| File name: | MAGIX VEGAS Pro v21.0 patch.exe |
| Full analysis: | https://app.any.run/tasks/745c7c18-b9e2-4f6b-9eae-1da7080c35e5 |
| Verdict: | Malicious activity |
| Analysis date: | September 01, 2024, 17:00:27 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 4A027F5B895F161A0D0E26F8EC6F31A7 |
| SHA1: | 2D8AA07828C92D4D9D85FC62BA82F0FE0BB5A789 |
| SHA256: | 73F5EEE95F0D5250F5D2F7A29702700537EBE6C08861D4DDFEFC09D485F0F65E |
| SSDEEP: | 98304:0kLEAGg00ojGjm4EC/qQb4zldELsSqr7jkie3t:DEzg7AGUqqXHPjze3t |
| .exe | | | Inno Setup installer (67.7) |
|---|---|---|
| .exe | | | Win32 EXE PECompact compressed (generic) (25.6) |
| .exe | | | Win32 Executable (generic) (2.7) |
| .exe | | | Win16/32 Executable Delphi generic (1.2) |
| .exe | | | Generic Win/DOS Executable (1.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:02:15 14:54:16+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 741888 |
| InitializedDataSize: | 398848 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb5eec |
| OSVersion: | 6.1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 6.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 21.0.0.0 |
| ProductVersionNumber: | 21.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | MAGIX |
| FileDescription: | VEGAS Pro |
| FileVersion: | 21.0 |
| LegalCopyright: | © 2023 MAGIX Software GmbH. All rights reserved. |
| OriginalFileName: | |
| ProductName: | VEGAS Pro |
| ProductVersion: | 21.0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 232 | nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM" | C:\Users\admin\AppData\Local\Temp\is-438G4.tmp\nircmd.exe | — | cmd.exe | |||||||||||
User: admin Company: NirSoft Integrity Level: HIGH Description: NirCmd Exit code: 0 Version: 2.81 Modules
| |||||||||||||||
| 1656 | nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "Serial" "string" "P3-77020-98979-63411-51090-66867-08191" | C:\Users\admin\AppData\Local\Temp\is-438G4.tmp\nircmd.exe | — | cmd.exe | |||||||||||
User: admin Company: NirSoft Integrity Level: HIGH Description: NirCmd Exit code: 0 Version: 2.81 Modules
| |||||||||||||||
| 2068 | nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "DontShowNagBox" "1" | C:\Users\admin\AppData\Local\Temp\is-438G4.tmp\nircmd.exe | — | cmd.exe | |||||||||||
User: admin Company: NirSoft Integrity Level: HIGH Description: NirCmd Exit code: 0 Version: 2.81 Modules
| |||||||||||||||
| 2180 | "C:\Users\admin\Downloads\MAGIX VEGAS Pro v21.0 patch.exe" | C:\Users\admin\Downloads\MAGIX VEGAS Pro v21.0 patch.exe | — | explorer.exe | |||||||||||
User: admin Company: MAGIX Integrity Level: MEDIUM Description: VEGAS Pro Exit code: 3221226540 Version: 21.0 Modules
| |||||||||||||||
| 2268 | nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "NumberOfStarts" "0" | C:\Users\admin\AppData\Local\Temp\is-438G4.tmp\nircmd.exe | — | cmd.exe | |||||||||||
User: admin Company: NirSoft Integrity Level: HIGH Description: NirCmd Exit code: 0 Version: 2.81 Modules
| |||||||||||||||
| 3784 | "C:\Users\admin\AppData\Local\Temp\is-6B4P5.tmp\MAGIX VEGAS Pro v21.0 patch.tmp" /SL5="$9032A,4018567,1141760,C:\Users\admin\Downloads\MAGIX VEGAS Pro v21.0 patch.exe" | C:\Users\admin\AppData\Local\Temp\is-6B4P5.tmp\MAGIX VEGAS Pro v21.0 patch.tmp | MAGIX VEGAS Pro v21.0 patch.exe | ||||||||||||
User: admin Company: MAGIX Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 3812 | nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "IsRegisteredUser" "1" | C:\Users\admin\AppData\Local\Temp\is-438G4.tmp\nircmd.exe | — | cmd.exe | |||||||||||
User: admin Company: NirSoft Integrity Level: HIGH Description: NirCmd Exit code: 0 Version: 2.81 Modules
| |||||||||||||||
| 4540 | nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM" | C:\Users\admin\AppData\Local\Temp\is-438G4.tmp\nircmd.exe | — | cmd.exe | |||||||||||
User: admin Company: NirSoft Integrity Level: HIGH Description: NirCmd Exit code: 0 Version: 2.81 Modules
| |||||||||||||||
| 4644 | nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "VersionUnlock" "IsRegisteredUser" "1" | C:\Users\admin\AppData\Local\Temp\is-438G4.tmp\nircmd.exe | — | cmd.exe | |||||||||||
User: admin Company: NirSoft Integrity Level: HIGH Description: NirCmd Exit code: 0 Version: 2.81 Modules
| |||||||||||||||
| 4680 | "C:\WINDOWS\system32\cmd.exe" /C ""C:\Users\admin\AppData\Local\Temp\is-438G4.tmp\nircmd.cmd"" | C:\Windows\System32\cmd.exe | — | MAGIX VEGAS Pro v21.0 patch.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (3784) MAGIX VEGAS Pro v21.0 patch.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: C80E00009BC2CE7590FCDA01 | |||
| (PID) Process: | (3784) MAGIX VEGAS Pro v21.0 patch.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: 27606052B3EE16C11A0B274F29731F5D5377A3E36633326F253114E542BAF2FD | |||
| (PID) Process: | (3784) MAGIX VEGAS Pro v21.0 patch.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (3784) MAGIX VEGAS Pro v21.0 patch.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | RegFiles0000 |
Value: C:\Program Files\VEGAS\VEGAS Pro 21.0\Protein\Protein_x64.4.2.dll | |||
| (PID) Process: | (3784) MAGIX VEGAS Pro v21.0 patch.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | RegFilesHash |
Value: DA1C0A4D3278D9E8DB6CEB3500C2903A5727B59882AB321C9DB5FA6ACD0185DD | |||
| (PID) Process: | (3784) MAGIX VEGAS Pro v21.0 patch.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options |
| Operation: | write | Name: | DevOverrideEnable |
Value: 1 | |||
| (PID) Process: | (3784) MAGIX VEGAS Pro v21.0 patch.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | RegFilesHash |
Value: ᳚䴊砲泛㗫숀㪐❗颵ꮂᰲ떝櫺Ǎ� | |||
| (PID) Process: | (3784) MAGIX VEGAS Pro v21.0 patch.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | RegFiles0000 |
Value: C:\Program Files\VEGAS\VEGAS Pro 21.0\Protein\Protein_x64.4.2.dll | |||
| (PID) Process: | (3784) MAGIX VEGAS Pro v21.0 patch.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | Sequence |
Value: | |||
| (PID) Process: | (3784) MAGIX VEGAS Pro v21.0 patch.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | SessionHash |
Value: 性剠섖ଚ伧猩崟睓㍦漲ㄥ멂ﷲ | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3784 | MAGIX VEGAS Pro v21.0 patch.tmp | C:\Users\admin\AppData\Local\Temp\is-438G4.tmp\nircmd.cmd | text | |
MD5:E153C13EA7E1EF949A96E82F8E8B8CD8 | SHA256:2589C520E0E088FB5813D187B46BE8A4E28FFBDF138FAA4FCAFFAA09D3C86268 | |||
| 3784 | MAGIX VEGAS Pro v21.0 patch.tmp | C:\Program Files\VEGAS\VEGAS Pro 21.0\Protein\Protein_x64.4.2.dll | executable | |
MD5:59A910407B648D297CD3A1804913399A | SHA256:A8A6BED5E2DF9E644E12B28E6F6B9E2B3CD2C6FB7D99A0A454E8177D219C90CC | |||
| 6988 | MAGIX VEGAS Pro v21.0 patch.exe | C:\Users\admin\AppData\Local\Temp\is-6B4P5.tmp\MAGIX VEGAS Pro v21.0 patch.tmp | executable | |
MD5:90F19922D1AC82552F5E95036EA90CCB | SHA256:FCA2FADA59C1A0D1CD30C2023933036AF4D3247B1BC0449D439BE2D53771FD94 | |||
| 3784 | MAGIX VEGAS Pro v21.0 patch.tmp | C:\Users\admin\AppData\Local\Temp\is-438G4.tmp\_isetup\_iscrypt.dll | executable | |
MD5:A69559718AB506675E907FE49DEB71E9 | SHA256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC | |||
| 3784 | MAGIX VEGAS Pro v21.0 patch.tmp | C:\Users\admin\AppData\Local\Temp\is-438G4.tmp\is-3STPN.tmp | text | |
MD5:E153C13EA7E1EF949A96E82F8E8B8CD8 | SHA256:2589C520E0E088FB5813D187B46BE8A4E28FFBDF138FAA4FCAFFAA09D3C86268 | |||
| 3784 | MAGIX VEGAS Pro v21.0 patch.tmp | C:\Program Files\VEGAS\VEGAS Pro 21.0\Protein\is-93KV4.tmp | executable | |
MD5:59A910407B648D297CD3A1804913399A | SHA256:A8A6BED5E2DF9E644E12B28E6F6B9E2B3CD2C6FB7D99A0A454E8177D219C90CC | |||
| 3784 | MAGIX VEGAS Pro v21.0 patch.tmp | C:\Program Files\VEGAS\VEGAS Pro 21.0\vegas210.exe.local\is-MHHCB.tmp | executable | |
MD5:B7A38368A52FF07D875E6465BD7EE26A | SHA256:8C6C791E8DB8728F9A610DEF238C61BE054BFA3DE487BF6AB037130A61A3EF19 | |||
| 3784 | MAGIX VEGAS Pro v21.0 patch.tmp | C:\Users\admin\AppData\Local\Temp\is-438G4.tmp\nircmd.exe | executable | |
MD5:B417238213EFB0D2A23562674406CDF9 | SHA256:5BFA034F7555A38E64C078AF71B4FF8C49511579FA826A87661940B7E9A6E333 | |||
| 3784 | MAGIX VEGAS Pro v21.0 patch.tmp | C:\Users\admin\AppData\Local\Temp\is-438G4.tmp\is-N6RKO.tmp | executable | |
MD5:B417238213EFB0D2A23562674406CDF9 | SHA256:5BFA034F7555A38E64C078AF71B4FF8C49511579FA826A87661940B7E9A6E333 | |||
| 3784 | MAGIX VEGAS Pro v21.0 patch.tmp | C:\Users\admin\AppData\Local\Temp\is-438G4.tmp\_isetup\_setup64.tmp | executable | |
MD5:E4211D6D009757C078A9FAC7FF4F03D4 | SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1492 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5796 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6244 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5796 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3260 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1492 | svchost.exe | 40.126.32.72:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1492 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |