| File name: | Guitar+Pro+5.2+++Crack.rar |
| Full analysis: | https://app.any.run/tasks/aeaeadc5-2e0f-4f40-932a-f6d3c4603558 |
| Verdict: | Malicious activity |
| Analysis date: | June 13, 2024, 16:18:23 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v4, os: Win32 |
| MD5: | DB112CFF121D12BF6C05C9B5100F42F1 |
| SHA1: | 691A6E05936DAB758FA4511001FF7BC41C5F0C99 |
| SHA256: | 4BC90E188DCEA56FF061453BF3BF571D88C58CC00B36A943BCFAEA1FFD29C7D5 |
| SSDEEP: | 98304:tYh9fat4Sbym3R52DNxO0z60dDker3dJnZMoSe+wDgIgHC8cKAJncF9gwNGio1ut:YSA608TQvNRMptgk2UgeYekf1LK |
| .rar | | | RAR compressed archive (v-4.x) (58.3) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (41.6) |
| CompressedSize: | 11701570 |
|---|---|
| UncompressedSize: | 11701480 |
| OperatingSystem: | Win32 |
| ModifyDate: | 2007:01:27 01:51:52 |
| PackingMethod: | Stored |
| ArchivedFileName: | Guitarra\Guitar Pro 5.2 Sempre Download Full\Guitar Pro 5.2 Setup.exe |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 552 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument http://sempredownloadfull.blogspot.com/ | C:\Program Files\Microsoft\Edge\Application\msedge.exe | WinRAR.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
| 924 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3540 --field-trial-handle=1312,i,4083382282441711628,9670110918979675601,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1660 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6e05f598,0x6e05f5a8,0x6e05f5b4 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1676 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1268 --field-trial-handle=1312,i,4083382282441711628,9670110918979675601,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1696 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2208 --field-trial-handle=1312,i,4083382282441711628,9670110918979675601,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1820 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1412 --field-trial-handle=1312,i,4083382282441711628,9670110918979675601,131072 /prefetch:3 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2028 | "C:\Users\admin\AppData\Local\Temp\is-MOCF8.tmp\is-38UCM.tmp" /SL4 $9015C "C:\Users\admin\AppData\Local\Temp\Rar$EXa3972.38440\Guitarra\Guitar Pro 5.2 Sempre Download Full\Guitar Pro 5.2 Setup.exe" 11385370 52224 | C:\Users\admin\AppData\Local\Temp\is-MOCF8.tmp\is-38UCM.tmp | Guitar Pro 5.2 Setup.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.42.0.0 Modules
| |||||||||||||||
| 2040 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3972.38440\Guitarra\Guitar Pro 5.2 Sempre Download Full\Guitar Pro 5.2 Setup.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3972.38440\Guitarra\Guitar Pro 5.2 Sempre Download Full\Guitar Pro 5.2 Setup.exe | WinRAR.exe | ||||||||||||
User: admin Company: Arobas Music Integrity Level: HIGH Description: Guitar Pro 5 Setup Exit code: 0 Version: Modules
| |||||||||||||||
| 2088 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4568 --field-trial-handle=1312,i,4083382282441711628,9670110918979675601,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2300 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2232 --field-trial-handle=1312,i,4083382282441711628,9670110918979675601,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
| (PID) Process: | (3972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3972) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (3972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (3972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (3972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Guitar+Pro+5.2+++Crack.rar | |||
| (PID) Process: | (3972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3972 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3972.38440\Sempre Download Full.url | url | |
MD5:A60F638F3C40B5C0016B6C95BA2F331C | SHA256:20D69611ECBFAA7FEEAB5E36FC048E37601455698EE7E07741AAFBBE85C64B1F | |||
| 3972 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3972.38440\Guitarra\Guitar Pro 5.2 Sempre Download Full\Guitar Pro 5.2 Setup.exe | executable | |
MD5:3878A0A8C2BCC02E564DA32B103694BF | SHA256:34C3980BA64DAF61A2B0EE485866563F14B8648601F177FAE062EBC275C72AED | |||
| 3972 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3972.38440\Leia!!!.txt | text | |
MD5:FA9D4CF56F7A835FAE8CD187535A5AB4 | SHA256:F93431CDC08735938ACE107DC91E4D6F5A45C88F7215483BFDCCCE0A9E74D37E | |||
| 3972 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3972.35329\Leia!!!.txt | text | |
MD5:FA9D4CF56F7A835FAE8CD187535A5AB4 | SHA256:F93431CDC08735938ACE107DC91E4D6F5A45C88F7215483BFDCCCE0A9E74D37E | |||
| 3972 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3972.35329\Guitarra\Guitar Pro 5.2 Sempre Download Full\Guitar Pro 5.2 Setup.exe | executable | |
MD5:3878A0A8C2BCC02E564DA32B103694BF | SHA256:34C3980BA64DAF61A2B0EE485866563F14B8648601F177FAE062EBC275C72AED | |||
| 3972 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa3972.34159\Leia!!!.txt | text | |
MD5:FA9D4CF56F7A835FAE8CD187535A5AB4 | SHA256:F93431CDC08735938ACE107DC91E4D6F5A45C88F7215483BFDCCCE0A9E74D37E | |||
| 3972 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3972.38440\Guitarra\Guitar Pro 5.2 Sempre Download Full\Keygen.exe | executable | |
MD5:8D9F60F35D7EF075A86E9BA076257402 | SHA256:DE1B2E9A21DAF03111E107CD58163529AAA406BF6000938AA819B54B0599A54A | |||
| 2040 | Guitar Pro 5.2 Setup.exe | C:\Users\admin\AppData\Local\Temp\is-MOCF8.tmp\is-38UCM.tmp | executable | |
MD5:036EF63E2F9B138A42D6ADB54EC0CD1E | SHA256:71B487F0523F213004766402B22BF86FA0EF9891E940D2A4CB12EBA6627E7CC6 | |||
| 3972 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3972.35329\Sempre Download Full.url | url | |
MD5:A60F638F3C40B5C0016B6C95BA2F331C | SHA256:20D69611ECBFAA7FEEAB5E36FC048E37601455698EE7E07741AAFBBE85C64B1F | |||
| 2028 | is-38UCM.tmp | C:\Users\admin\AppData\Local\Temp\is-K90ML.tmp\_isetup\_shfoldr.dll | executable | |
MD5:92DC6EF532FBB4A5C3201469A5B5EB63 | SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1820 | msedge.exe | GET | 200 | 172.217.16.129:80 | http://sempredownloadfull.blogspot.com/js/cookienotice.js | unknown | — | — | unknown |
1820 | msedge.exe | GET | 200 | 172.217.16.129:80 | http://sempredownloadfull.blogspot.com/ | unknown | — | — | unknown |
1820 | msedge.exe | GET | 200 | 172.217.16.129:80 | http://sempredownloadfull.blogspot.com/favicon.ico | unknown | — | — | unknown |
1820 | msedge.exe | GET | 200 | 142.250.181.233:80 | http://www.blogger.com/img/logo-16.png | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
552 | msedge.exe | 239.255.255.250:1900 | — | — | — | unknown |
1820 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1820 | msedge.exe | 172.217.16.129:80 | sempredownloadfull.blogspot.com | GOOGLE | US | whitelisted |
1820 | msedge.exe | 13.107.21.239:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
1820 | msedge.exe | 142.250.185.238:443 | apis.google.com | GOOGLE | US | whitelisted |
1820 | msedge.exe | 142.250.181.233:443 | www.blogger.com | GOOGLE | US | unknown |
1820 | msedge.exe | 142.250.181.233:80 | www.blogger.com | GOOGLE | US | unknown |
Domain | IP | Reputation |
|---|---|---|
config.edge.skype.com |
| whitelisted |
sempredownloadfull.blogspot.com |
| unknown |
edge.microsoft.com |
| whitelisted |
www.blogger.com |
| shared |
apis.google.com |
| whitelisted |
pagead2.googlesyndication.com |
| whitelisted |
www.bing.com |
| whitelisted |
accounts.google.com |
| shared |
resources.blogblog.com |
| whitelisted |
lh3.googleusercontent.com |
| whitelisted |