Analysis
-
max time kernel
390s -
max time network
334s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27-02-2023 22:16
Static task
static1
Behavioral task
behavioral1
Sample
winrar-611br.msi
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
winrar-611br.msi
Resource
win10v2004-20230221-en
General
-
Target
winrar-611br.msi
-
Size
4.5MB
-
MD5
68ba045e1427d63d03660ef2d88584d0
-
SHA1
a3e9bd9adddf1aaaaff03cd69a7128e6fc774977
-
SHA256
e06b212b0c26d4f385a3623c64820b3ea4bbd83065646a38d1f3e0cfdfbb0898
-
SHA512
d677806a4c4ed419995b0ead65db4081c3e4b002e400fafb8d042d6695e7e17cc476a0ccc8df9c1caed164254ba2536c73891f89f6f9f57aea7a5421a6d964e8
-
SSDEEP
98304:MYGKdAHTgvV1OsKnG5vgzfTVkdRTpRjbrvC7gEjT7A3:i81OsKG6zfTVkddpdTCRj
Malware Config
Extracted
C:\Program Files\WinRAR\Rar.txt
Extracted
C:\Program Files\WinRAR\WhatsNew.txt
https
http
http://weirdsgn.com
http://icondesignlab.com
https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar
https://technet.microsoft.com/en-us/library/security/ms14-064.aspx
http://rarlab.com/vuln_sfx_html2.htm
https://blake2.net
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 4 1568 powershell.exe -
Executes dropped EXE 5 IoCs
Processes:
Hw2confiança.exewinrar.exeuninstall.exeWinRAR.exeWinRAR.exepid process 1896 Hw2confiança.exe 2056 winrar.exe 2856 uninstall.exe 2196 WinRAR.exe 3000 WinRAR.exe -
Loads dropped DLL 20 IoCs
Processes:
MsiExec.exepowershell.exewinrar.exeuninstall.exepid process 1348 MsiExec.exe 1348 MsiExec.exe 1348 MsiExec.exe 1348 MsiExec.exe 1568 powershell.exe 1568 powershell.exe 1236 2056 winrar.exe 1236 2856 uninstall.exe 2856 uninstall.exe 2856 uninstall.exe 1236 1236 1236 1236 1236 1236 1236 1236 -
Modifies system executable filetype association 2 TTPs 8 IoCs
Processes:
uninstall.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
uninstall.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Hw2confiança.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run Hw2confiança.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\lxhoanat = "C:\\astuto\\escasso\\Hw2confiança.exe" Hw2confiança.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Program Files directory 60 IoCs
Processes:
winrar.exeuninstall.exedescription ioc process File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar.exe File created C:\Program Files\WinRAR\Uninstall.lst winrar.exe File created C:\Program Files\WinRAR\RarExt32.dll winrar.exe File created C:\Program Files\WinRAR\License.txt winrar.exe File created C:\Program Files\WinRAR\Order.htm winrar.exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix winrar.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar.exe File created C:\Program Files\WinRAR\WinCon.SFX winrar.exe File created C:\Program Files\WinRAR\WhatsNew.txt winrar.exe File created C:\Program Files\WinRAR\RarExtInstaller.exe winrar.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll winrar.exe File opened for modification C:\Program Files\WinRAR\Default.SFX winrar.exe File created C:\Program Files\WinRAR\zipnew.dat uninstall.exe File created C:\Program Files\WinRAR\Descript.ion winrar.exe File opened for modification C:\Program Files\WinRAR\Rar.exe winrar.exe File opened for modification C:\Program Files\WinRAR\RarExt.dll winrar.exe File created C:\Program Files\WinRAR\Default64.SFX winrar.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar.exe File opened for modification C:\Program Files\WinRAR winrar.exe File opened for modification C:\Program Files\WinRAR\Descript.ion winrar.exe File created C:\Program Files\WinRAR\RarFiles.lst winrar.exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe winrar.exe File created C:\Program Files\WinRAR\Resources.pri winrar.exe File opened for modification C:\Program Files\WinRAR\Zip64.SFX winrar.exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe winrar.exe File created C:\Program Files\WinRAR\WinCon64.SFX winrar.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar.exe File created C:\Program Files\WinRAR\WinRAR.chm winrar.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt winrar.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst winrar.exe File created C:\Program Files\WinRAR\Uninstall.exe winrar.exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe winrar.exe File created C:\Program Files\WinRAR\7zxa.dll winrar.exe File created C:\Program Files\WinRAR\RarExt.dll winrar.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll winrar.exe File created C:\Program Files\WinRAR\Default.SFX winrar.exe File created C:\Program Files\WinRAR\Zip.SFX winrar.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm winrar.exe File created C:\Program Files\WinRAR\Rar.txt winrar.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt winrar.exe File created C:\Program Files\WinRAR\UnRAR.exe winrar.exe File created C:\Program Files\WinRAR\Zip64.SFX winrar.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar.exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File opened for modification C:\Program Files\WinRAR\Order.htm winrar.exe File created C:\Program Files\WinRAR\Rar.exe winrar.exe File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_7270738 winrar.exe File opened for modification C:\Program Files\WinRAR\License.txt winrar.exe File opened for modification C:\Program Files\WinRAR\Rar.txt winrar.exe File created C:\Program Files\WinRAR\WinRAR.exe winrar.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe winrar.exe File opened for modification C:\Program Files\WinRAR\Resources.pri winrar.exe File opened for modification C:\Program Files\WinRAR\Default64.SFX winrar.exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX winrar.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX winrar.exe File created C:\Program Files\WinRAR\ReadMe.txt winrar.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst winrar.exe File created C:\Program Files\WinRAR\RarExtPackage.msix winrar.exe File opened for modification C:\Program Files\WinRAR\WinCon64.SFX winrar.exe -
Drops file in Windows directory 14 IoCs
Processes:
msiexec.exeDrvInst.exedescription ioc process File created C:\Windows\Installer\6c7e07.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7EF1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI81D0.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\6c7e0b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI86A3.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI8123.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\6c7e09.ipi msiexec.exe File opened for modification C:\Windows\Installer\6c7e07.msi msiexec.exe File created C:\Windows\Installer\6c7e09.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI8450.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
IEXPLORE.EXEiexplore.exeWinRAR.exewinrar.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\winrarbrasil.com.br\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "55" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.winrarbrasil.com.br\ = "8288" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70456aef014bd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\winrarbrasil.com.br IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" WinRAR.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8288" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch WinRAR.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D6A9931-B6F5-11ED-9CB8-C227D5A71BE4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.winrarbrasil.com.br\ = "87" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.winrarbrasil.com.br\ = "29" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "87" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\winrarbrasil.com.br\Total = "29" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\winrarbrasil.com.br\Total = "87" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main winrar.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.winrarbrasil.com.br\ = "55" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\winrarbrasil.com.br\Total = "55" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\winrarbrasil.com.br\Total = "8288" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "29" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.winrarbrasil.com.br\ = "47" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca000000000200000000001066000000010000200000002edd202de0d650bba3b2a578173cbbaf9231e2d3cf3723714c54f026fa4cef6c000000000e8000000002000020000000a36009a30baa640911fe3478e8fb7a72b6505b79335364dc0b5ba4db122851cc20000000c33dd509ba69136e2eb9af474d85d386fd001dcb9d0cf33b5be07b14e27fd87740000000825ccadceb6612024c515a67487de16705d3c48569d49475126cb2133160d8bf04794f4899f4e881e299aad037982fbfb16472932fb134a5d2358aa8b31b2be8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "384304893" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "47" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\winrarbrasil.com.br\Total = "47" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.winrarbrasil.com.br IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca00000000020000000000106600000001000020000000963bd405ff3af8ef67133a928e4a91a3957b0e1691fbe02e5066dde332564a5b000000000e8000000002000020000000acb3e2a9ad25d33519eb47746c24cc049f4da20326412250b24455a9febfacf090000000ec9b4a8fc0ad6354ea3387a423f51721a8a7a0fca0e55d14e82074785fafd9cab5fd6401bab34a395b872d64189b31d49efd6870a60e48924cbb2fe586cadbd801f90c08252b6be1d907792c9e53f3be0f2f528c34cff8031ffaa2fe975c6bccd4dfbb85c0c42b386f3ca7b943dd3acca52fcd50201eb0886ddfd2bb9b2601a536723e01b15389e015125ab44013005040000000aeb7ca1c3a2274735b4a171435d24afcc7900a8fef28115f625fca95edcbd2bde5fe101fa081ada3b4ceda85be770042f85c9c02f0ddbf704c63b49a5205b2b9 iexplore.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
DrvInst.exemsiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe -
Modifies registry class 64 IoCs
Processes:
uninstall.exemsiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r03 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r05\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BE04CB4DB6ECE7E4C8A99529959C6F31\MainFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR" uninstall.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cab uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rev uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r13\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r14\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r22\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lha uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell uninstall.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\SourceList\PackageName = "winrar-611br.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r12\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r16\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r10 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r13 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r21 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r26\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.z uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r27\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE04CB4DB6ECE7E4C8A99529959C6F31\ProductName = "Winrar" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r19 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r00 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r20\ = "WinRAR" uninstall.exe -
Processes:
WinRAR.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 WinRAR.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 WinRAR.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 WinRAR.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 WinRAR.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 7 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 9 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msiexec.exepowershell.exeHw2confiança.exepid process 1628 msiexec.exe 1628 msiexec.exe 1568 powershell.exe 1568 powershell.exe 1568 powershell.exe 1568 powershell.exe 1568 powershell.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Hw2confiança.exepid process 1896 Hw2confiança.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid process Token: SeShutdownPrivilege 1668 msiexec.exe Token: SeIncreaseQuotaPrivilege 1668 msiexec.exe Token: SeRestorePrivilege 1628 msiexec.exe Token: SeTakeOwnershipPrivilege 1628 msiexec.exe Token: SeSecurityPrivilege 1628 msiexec.exe Token: SeCreateTokenPrivilege 1668 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1668 msiexec.exe Token: SeLockMemoryPrivilege 1668 msiexec.exe Token: SeIncreaseQuotaPrivilege 1668 msiexec.exe Token: SeMachineAccountPrivilege 1668 msiexec.exe Token: SeTcbPrivilege 1668 msiexec.exe Token: SeSecurityPrivilege 1668 msiexec.exe Token: SeTakeOwnershipPrivilege 1668 msiexec.exe Token: SeLoadDriverPrivilege 1668 msiexec.exe Token: SeSystemProfilePrivilege 1668 msiexec.exe Token: SeSystemtimePrivilege 1668 msiexec.exe Token: SeProfSingleProcessPrivilege 1668 msiexec.exe Token: SeIncBasePriorityPrivilege 1668 msiexec.exe Token: SeCreatePagefilePrivilege 1668 msiexec.exe Token: SeCreatePermanentPrivilege 1668 msiexec.exe Token: SeBackupPrivilege 1668 msiexec.exe Token: SeRestorePrivilege 1668 msiexec.exe Token: SeShutdownPrivilege 1668 msiexec.exe Token: SeDebugPrivilege 1668 msiexec.exe Token: SeAuditPrivilege 1668 msiexec.exe Token: SeSystemEnvironmentPrivilege 1668 msiexec.exe Token: SeChangeNotifyPrivilege 1668 msiexec.exe Token: SeRemoteShutdownPrivilege 1668 msiexec.exe Token: SeUndockPrivilege 1668 msiexec.exe Token: SeSyncAgentPrivilege 1668 msiexec.exe Token: SeEnableDelegationPrivilege 1668 msiexec.exe Token: SeManageVolumePrivilege 1668 msiexec.exe Token: SeImpersonatePrivilege 1668 msiexec.exe Token: SeCreateGlobalPrivilege 1668 msiexec.exe Token: SeBackupPrivilege 560 vssvc.exe Token: SeRestorePrivilege 560 vssvc.exe Token: SeAuditPrivilege 560 vssvc.exe Token: SeBackupPrivilege 1628 msiexec.exe Token: SeRestorePrivilege 1628 msiexec.exe Token: SeRestorePrivilege 1956 DrvInst.exe Token: SeRestorePrivilege 1956 DrvInst.exe Token: SeRestorePrivilege 1956 DrvInst.exe Token: SeRestorePrivilege 1956 DrvInst.exe Token: SeRestorePrivilege 1956 DrvInst.exe Token: SeRestorePrivilege 1956 DrvInst.exe Token: SeRestorePrivilege 1956 DrvInst.exe Token: SeLoadDriverPrivilege 1956 DrvInst.exe Token: SeLoadDriverPrivilege 1956 DrvInst.exe Token: SeLoadDriverPrivilege 1956 DrvInst.exe Token: SeRestorePrivilege 1628 msiexec.exe Token: SeTakeOwnershipPrivilege 1628 msiexec.exe Token: SeRestorePrivilege 1628 msiexec.exe Token: SeTakeOwnershipPrivilege 1628 msiexec.exe Token: SeRestorePrivilege 1628 msiexec.exe Token: SeTakeOwnershipPrivilege 1628 msiexec.exe Token: SeRestorePrivilege 1628 msiexec.exe Token: SeTakeOwnershipPrivilege 1628 msiexec.exe Token: SeRestorePrivilege 1628 msiexec.exe Token: SeTakeOwnershipPrivilege 1628 msiexec.exe Token: SeRestorePrivilege 1628 msiexec.exe Token: SeTakeOwnershipPrivilege 1628 msiexec.exe Token: SeRestorePrivilege 1628 msiexec.exe Token: SeTakeOwnershipPrivilege 1628 msiexec.exe Token: SeRestorePrivilege 1628 msiexec.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
msiexec.exepowershell.exeiexplore.exepid process 1668 msiexec.exe 1568 powershell.exe 1568 powershell.exe 1956 iexplore.exe 1668 msiexec.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
iexplore.exewinrar.exeHw2confiança.exeWinRAR.exepid process 1956 iexplore.exe 1956 iexplore.exe 2056 winrar.exe 2056 winrar.exe 1896 Hw2confiança.exe 1896 Hw2confiança.exe 2196 WinRAR.exe 2196 WinRAR.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
msiexec.exeMsiExec.exepowershell.exeiexplore.exewinrar.exedescription pid process target process PID 1628 wrote to memory of 1348 1628 msiexec.exe MsiExec.exe PID 1628 wrote to memory of 1348 1628 msiexec.exe MsiExec.exe PID 1628 wrote to memory of 1348 1628 msiexec.exe MsiExec.exe PID 1628 wrote to memory of 1348 1628 msiexec.exe MsiExec.exe PID 1628 wrote to memory of 1348 1628 msiexec.exe MsiExec.exe PID 1628 wrote to memory of 1348 1628 msiexec.exe MsiExec.exe PID 1628 wrote to memory of 1348 1628 msiexec.exe MsiExec.exe PID 1348 wrote to memory of 1568 1348 MsiExec.exe powershell.exe PID 1348 wrote to memory of 1568 1348 MsiExec.exe powershell.exe PID 1348 wrote to memory of 1568 1348 MsiExec.exe powershell.exe PID 1348 wrote to memory of 1568 1348 MsiExec.exe powershell.exe PID 1568 wrote to memory of 1896 1568 powershell.exe Hw2confiança.exe PID 1568 wrote to memory of 1896 1568 powershell.exe Hw2confiança.exe PID 1568 wrote to memory of 1896 1568 powershell.exe Hw2confiança.exe PID 1568 wrote to memory of 1896 1568 powershell.exe Hw2confiança.exe PID 1568 wrote to memory of 1896 1568 powershell.exe Hw2confiança.exe PID 1568 wrote to memory of 1896 1568 powershell.exe Hw2confiança.exe PID 1568 wrote to memory of 1896 1568 powershell.exe Hw2confiança.exe PID 1956 wrote to memory of 1704 1956 iexplore.exe IEXPLORE.EXE PID 1956 wrote to memory of 1704 1956 iexplore.exe IEXPLORE.EXE PID 1956 wrote to memory of 1704 1956 iexplore.exe IEXPLORE.EXE PID 1956 wrote to memory of 1704 1956 iexplore.exe IEXPLORE.EXE PID 1568 wrote to memory of 2056 1568 powershell.exe winrar.exe PID 1568 wrote to memory of 2056 1568 powershell.exe winrar.exe PID 1568 wrote to memory of 2056 1568 powershell.exe winrar.exe PID 1568 wrote to memory of 2056 1568 powershell.exe winrar.exe PID 2056 wrote to memory of 2856 2056 winrar.exe uninstall.exe PID 2056 wrote to memory of 2856 2056 winrar.exe uninstall.exe PID 2056 wrote to memory of 2856 2056 winrar.exe uninstall.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\winrar-611br.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 34AD5615DBE97D54DC27291571FD18B62⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss8D36.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi8D04.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr8D15.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr8D16.txt" -propSep " :<->: " -testPrefix "_testValue."3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\astuto\escasso\Hw2confiança.exe"C:\astuto\escasso\Hw2confiança.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Public\Documents\AnyDesk\winrar.exe"C:\Users\Public\Documents\AnyDesk\winrar.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004A0" "00000000000003A8"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\6c7e0a.rbsFilesize
606KB
MD573100c6a21c5fc2561666cd83ede2c83
SHA1ebc7746251a12659da2091bd377cf9b6ab634061
SHA256546c0bfcae1da091f1335cf26e2e0662a0f9914edbf431750920bcac0e4b5436
SHA512e323e2e69d3a686883a73a042946627cdc1253ef1775fb165a0fdd6814ad96edb955f070e49410a682cc96beeab1b9fa450eb4e946de5bf8a03f5adec2cccf88
-
C:\Program Files\WinRAR\Rar.txtFilesize
107KB
MD58933d6e810668af29d7ba8f1c3b2b9ff
SHA1760cbb236c4ca6e0003582aaefd72ff8b1c872aa
SHA256cd3ba458c88bdf8924ebb404c8505d627e6ac7aadc6e351562c1894019604fc7
SHA512344d737228483add83d5f2b31ae9582ca78013dc4be967f2cdafca24145970e3cb46d75373996150a3c9119ebc81ce9ac50e16696c17a4dea65c9571ef8e745e
-
C:\Program Files\WinRAR\Uninstall.exeFilesize
412KB
MD592667e28583a9489e3cf4f1a7fd6636e
SHA1faa09990ba4daae970038ed44e3841151d6e7f28
SHA2569147293554ad43920bcf763ffd6e1183c36b9f8156dc220548426a187a5f2959
SHA51263555a15f153df59b2ca2ab56cd20d71420eb5c9977bcf774723d8484157172b027f71fb2f7a4692aecc6e471f50beec2e0f7a43e57449714caede1e9684c0b8
-
C:\Program Files\WinRAR\Uninstall.exeFilesize
412KB
MD592667e28583a9489e3cf4f1a7fd6636e
SHA1faa09990ba4daae970038ed44e3841151d6e7f28
SHA2569147293554ad43920bcf763ffd6e1183c36b9f8156dc220548426a187a5f2959
SHA51263555a15f153df59b2ca2ab56cd20d71420eb5c9977bcf774723d8484157172b027f71fb2f7a4692aecc6e471f50beec2e0f7a43e57449714caede1e9684c0b8
-
C:\Program Files\WinRAR\WhatsNew.txtFilesize
95KB
MD5d4c768c52ee077eb09bac094f4af8310
SHA1c56ae6b4464799fcdc87c5ff5a49ac1ad43482b1
SHA2568089dfbebdf2142c7f60f5c12098859417b3c997f0b24b696ccaa78a50f3726c
SHA5125b794b19b5ff10f7356a46f02204d0df3183037bc89d32e3f2c2978ea8f90ac6367fcb225b476cb7c8a3035d82ca1e328791271d3a58b40b9759d4b65e83f847
-
C:\Program Files\WinRAR\WinRAR.chmFilesize
314KB
MD581b236ef16aaa6a3936fd449b12b82a2
SHA1698acb3c862c7f3ecf94971e4276e531914e67bc
SHA256d37819e64ecb61709fcf3435eb9bed790f75163057e36fb94a3465ca353ccc5e
SHA512968fe20d6fe6879939297b8683da1520a1e0d2b9a5107451fca70b91802492e243976f56090c85eb9f38fca8f74134b8b6aa133ba2e2806d763c9f8516ace769
-
C:\Program Files\WinRAR\WinRAR.exeFilesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
C:\Program Files\WinRAR\WinRAR.exeFilesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
C:\Program Files\WinRAR\WinRAR.exeFilesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD52838d0dec8f164f67045d764142cbf62
SHA1c4fc2558b11ee21be1b72f343dec9275a6939a45
SHA2560bbc285d19c099bfb4393fa13c7b4b961c69748d3a3dfc6682ee050d0a1982d6
SHA5120fd3929d799c0fcf44a2bfa4d5fcde5b9b8eb524bb8399a36034a426864ff14ce88c42a7a559b3d9c17e06d439c3553c1606df9c0cfcb6a5a0c3d18939ce94f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5919f0508b43b0aabafbc0b29675fa6e7
SHA15a64350a34dc88d20f83fb3ac8434924a98b3cce
SHA256a8988edb08dc57b82a20cf0b65398175eb6655f9473faaf79de896d68c7485ba
SHA512da8350ec0c4958ee4658b7fa1ccfd35cc10b3fa6d19c2c373a9204fd770a89da79f7d67859f2fb9b21a83bb2777eb7a0875338d8145ca4ddd0ba95ef1a890ebb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5bdbfe83c9bf0ca7e4b4215f1d2b84cd5
SHA137ad823b48e7593b19dec1d57e4893d2e2936522
SHA2562e7db20af27021073c7827240e846ddba8858904a508dee112a638d89cd3f4dc
SHA512217b2808ec58fc20ee1eaf1eae101ad0e1653e989a2fcda010eff6a0d3428e54ed2054a8fcd440e1beedd5f30eee97c01b24cb66d4cc73c4afc8372e1fe4ed6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD53df2d4a4f3afaa96c6eefa1fd31e7aed
SHA168fc85807592b394ab540c1a33fec95a64bf3b51
SHA2569dd64a8a65a1c20bb72d8c1ead2877c827217eaad08883a264aeb0b04c1cd870
SHA5127bfbd8eb73589f00f3542556f4ef26d9105151080002a6bd625c7403a841ba82d9eeee59c552dab03b49081bceb718ac7f571953368ff31d900e76b6e17e5c02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5f35f87277080c85b2ad4c225481ced39
SHA14cf3e70a0abac54e8ce0f63b02202fa225305612
SHA2565792a9a8eb30388106c287c8d61718dc5f9375cbf2dfee7a6c20746560dfd7a5
SHA5128012531bc733ee358647a21f17ab3b8cc9d175efcb68f3748062f0cb15d41d07bacf3f9c1337a07c5c97004e92962eca37185f179b2b4829979d4e5adc7ba34c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5138075b45b8d6c73ab963894741c1b8b
SHA1a8f85cfd0f9f824eae209b7ad70277bfe11ae442
SHA256013e4fd7916bcb615ca10e9bfb2a7bc5ff8e8959f2de6675152bf79b7e83c0d1
SHA512879568cdba5955c0fb3852f0017bbabc93b5649bc4968839b2afd0fa3fa6400df41fba7c71afcc7c669b1d467f00fb973c61c21678b8d42c14e31c1b0695fc0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD53e2d03c73069a8cbec7e89eacb2874d8
SHA13c43d8604906c2ecef6052977732e7119c881627
SHA2567bae8ce717b2c580eb2794037a89f775e17846a1498bee10aadfe0a698319581
SHA51255aaeef11afa6907bc391955445cf363ced76fa09364cbf4131d7c226efffc025c28e461b34f71f4daa4aede9cae11eaee90163d3b0662d0cbe88417b527ceda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD506442fa8be24ab0958a86d061cc66b34
SHA106f1297ecdd02044d5700f010e5e7436ffaa2995
SHA2568cec945e4f6faf868b1b61241c24efe3e74914555a1ff12f6de3b5dfc615a3a8
SHA512a80b62fe8df4427203d31eacf26041d65fefb75a1bec78884cf1c6481413cf692d11e2687200b84e820b8244c13278f38bd169dd5ac9d5deca6bb84acc0944ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5570fca05b2cad1d3c77b250e7b10419c
SHA1d9d40819d0bffa8acab84555fcdc524aebacaddd
SHA25652e76fb094d39e529882785c469fd51e26109c5af86188589670a2dac588a17e
SHA512a123a971558adc595053bd7df4156d46e8163362a9ee3680e9c50db1da33226522668167d38fe205dc624339991d067c6f771c8c54b5ce51fbd4e1d2195194ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5571473f7d4b62323c1438f6a3a7967fe
SHA1f69177de8f9bc737cb75ee1db102053322a39d85
SHA256dea0af57e804c1008c530d5be4ffcfc267c993e1b75b4e37c6985dc1d5a413aa
SHA512392df132626c0f49404ca0bc11a50709281e677a0f019b988f0c0a7d5bb00e059242c2689548bbf0e01962f8675e1f65390beb5b4ad5228419369ba7e9cdc9f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD588688e4335a653160b7e1e66d0af0dd1
SHA16d85f88b28830e4616761c5ee1792df1dfd12f76
SHA256151bcb3a228cea597452e6884522804ccf20a184fa25fa94b4bccdb649999584
SHA512d7d81645ac859a0dac2195d343de98e9c97a2a5a1d5010b5023fed39100bd4419cf4cb9138d078e82c72594fa6c71ba8d3addfc46b4f4d7e730aefa55879bba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD568554924146580870e9f5923fa94ad81
SHA184af98e00f350ce86ab00b3ea8183bad9555ea1c
SHA2567b43dad68bc11646483d4824642a6c4ef1a6a774855fd2644a5e4d50301a00de
SHA5120a14d183040159015c94f5d6c1adbdf7ca1029cf05cd094a460e0018a26c60bde389408396149e07bb423408737a3d6807d976f7797f1db89b5ab2d6a6ecbe19
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4D33E1QE\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\Cab96C7.tmpFilesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\Local\Temp\Tar9728.tmpFilesize
161KB
MD573b4b714b42fc9a6aaefd0ae59adb009
SHA1efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA51273af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd
-
C:\Users\Admin\AppData\Local\Temp\pss8D36.ps1Filesize
5KB
MD5fc1bb6c87fd1f08b534e52546561c53c
SHA1db402c5c1025cf8d3e79df7b868fd186243aa9d1
SHA256a04750ed5f05b82b90f6b8ea3748ba246af969757a5a4b74a0e25b186add520b
SHA5125495f4ac3c8f42394a82540449526bb8ddd91adf0a1a852a9e1f2d32a63858b966648b4099d9947d8ac68ee43824dacda24c337c5b97733905e36c4921280e86
-
C:\Users\Admin\AppData\Local\Temp\scr8D15.ps1Filesize
17KB
MD5d815da347cf3c1a260840649beb56ff7
SHA14da95ffed10e7369b685a390fe4e99a6a1e1f416
SHA256d6f001aeb36cdb8e6bbcb0d35ffe55c86ad5f942f9d0d15a089706801fdad931
SHA512ca2cd68cf615db854c7ccc6cc5c84da4a8b5f6913229c856fc343ba3e7af8563b0afcd29e9d14ca75eb4cf833102a2ea8b802629f284819bfb2630a82d61b170
-
C:\Users\Admin\AppData\Roaming\WinRAR\version.datFilesize
12B
MD5cb7e235f444d5ac109ab9c25dd7f35cf
SHA187ee28f2e63bb04ded5350baa66f2ecadd0d4a9d
SHA25652a7504015656dbe42f76b01b6b0f4da57627f5811d15434842b12e11bdd25db
SHA5129d6b73fe7d61771aeed00d6c1b4c77b2f4ed4c179b0ee94fc1c75e84bbd51c002a78b472e82986e160dd55f1a762f5dd4858b586318b14855118cda83a1403b0
-
C:\Users\Public\Documents\AnyDesk\winrar.exeFilesize
3.3MB
MD58a6217d94e1bcbabdd1dfcdcaa83d1b3
SHA199b81b01f277540f38ea3e96c9c6dc2a57dfeb92
SHA2563023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684
SHA512a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54
-
C:\Users\Public\Documents\AnyDesk\winrar.exeFilesize
3.3MB
MD58a6217d94e1bcbabdd1dfcdcaa83d1b3
SHA199b81b01f277540f38ea3e96c9c6dc2a57dfeb92
SHA2563023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684
SHA512a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54
-
C:\Windows\Installer\6c7e07.msiFilesize
4.5MB
MD568ba045e1427d63d03660ef2d88584d0
SHA1a3e9bd9adddf1aaaaff03cd69a7128e6fc774977
SHA256e06b212b0c26d4f385a3623c64820b3ea4bbd83065646a38d1f3e0cfdfbb0898
SHA512d677806a4c4ed419995b0ead65db4081c3e4b002e400fafb8d042d6695e7e17cc476a0ccc8df9c1caed164254ba2536c73891f89f6f9f57aea7a5421a6d964e8
-
C:\Windows\Installer\MSI7EF1.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
C:\Windows\Installer\MSI8123.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
C:\Windows\Installer\MSI81D0.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
C:\Windows\Installer\MSI81D0.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
C:\Windows\Installer\MSI86A3.tmpFilesize
574KB
MD57b7d9e2c9b8236e7155f2f97254cb40e
SHA199621fc9d14511428d62d91c31865fb2c4625663
SHA256df58faba241328b9645dcb5dec387ec5edd56e2d878384a4783f2c0a66f85897
SHA512fbaa1560f03255f73be3e846959e4b7cbb1c24165d014ed01245639add6cc463975e5558567ab5704e18c9078a8a071c9e38dc1e499ba6e3dc507d4275b4a228
-
C:\astuto\escasso\Hw2confiança.exeFilesize
9.7MB
MD52e47fc5675f96d63b11821b8f0395f17
SHA11dccc123e58d2802491602345433dcb1e723f192
SHA25674b6bdee25a3dbb1a89e8e4170094c21ce60e782ff58e1123a99dae415ffe9d4
SHA5122ab1ce6c8ff45286411b95ddf8afba44e2fb8fd30d7d0feefe08b286a686bc415df2be890afc67d4513dac70ee2512f79854b5c265a4a0e9e7e86f6ab2d89273
-
C:\astuto\escasso\Hw2confiança.exeFilesize
9.7MB
MD52e47fc5675f96d63b11821b8f0395f17
SHA11dccc123e58d2802491602345433dcb1e723f192
SHA25674b6bdee25a3dbb1a89e8e4170094c21ce60e782ff58e1123a99dae415ffe9d4
SHA5122ab1ce6c8ff45286411b95ddf8afba44e2fb8fd30d7d0feefe08b286a686bc415df2be890afc67d4513dac70ee2512f79854b5c265a4a0e9e7e86f6ab2d89273
-
C:\astuto\escasso\Hw2confiança.exeFilesize
9.7MB
MD52e47fc5675f96d63b11821b8f0395f17
SHA11dccc123e58d2802491602345433dcb1e723f192
SHA25674b6bdee25a3dbb1a89e8e4170094c21ce60e782ff58e1123a99dae415ffe9d4
SHA5122ab1ce6c8ff45286411b95ddf8afba44e2fb8fd30d7d0feefe08b286a686bc415df2be890afc67d4513dac70ee2512f79854b5c265a4a0e9e7e86f6ab2d89273
-
C:\astuto\escasso\Update.zipFilesize
32.9MB
MD5d546eff329671383fb1f934e80ea7435
SHA1c8e7ce1bff5870397cc6a636b73d79c4a1804da7
SHA2568a188dc28b67770cef25f9ea7312ca84f674c60c9f418eab0fedbbbffde9695c
SHA512fb2a5851b10b3d72f3f4be90d85c0b8aab4c3fb02b99802134c0618608c9a8c17df51521c28c85f7ebd6aa032a9602a44061c06fb0eb557e34557d73f8a4098b
-
C:\astuto\escasso\windowsdumpFilesize
89.4MB
MD541aa2f4db1989e641169e9ccdf38a347
SHA1ced16950ca2e1c5d08ea87bb3034c21e6c6dd1df
SHA256573e582a98e8190dcf3b0dbe5ed86fe6e56044e948b5d5221b18052b584d5dc0
SHA5123423b722e89e4086f9ffd155b8039acd698775bf56181c23621269ca512e24e4a83c091c4ecbbf008edca0306b943c6e5b70170b51a17bf3f450c4d58d63f358
-
\Program Files\WinRAR\RarExt.dllFilesize
632KB
MD5650a771d005941c7a23926011d75ad8f
SHA184b346acd006f21d7ffb8d5ea5937ec0ee3daa4f
SHA256b28d116dd3066e7a3c9f0cc2f63d34a7189c9d78e869d1255c9dec59172a9d5f
SHA5124724bd81c26716f0ad59187c78fbb920fd8b251540e76c28d93e0afcce3ebe0e3e2b4605e9d444bbbc3e828ce11f2b73489404318ab11403eff94b42ef2c9bad
-
\Program Files\WinRAR\Uninstall.exeFilesize
412KB
MD592667e28583a9489e3cf4f1a7fd6636e
SHA1faa09990ba4daae970038ed44e3841151d6e7f28
SHA2569147293554ad43920bcf763ffd6e1183c36b9f8156dc220548426a187a5f2959
SHA51263555a15f153df59b2ca2ab56cd20d71420eb5c9977bcf774723d8484157172b027f71fb2f7a4692aecc6e471f50beec2e0f7a43e57449714caede1e9684c0b8
-
\Program Files\WinRAR\Uninstall.exeFilesize
412KB
MD592667e28583a9489e3cf4f1a7fd6636e
SHA1faa09990ba4daae970038ed44e3841151d6e7f28
SHA2569147293554ad43920bcf763ffd6e1183c36b9f8156dc220548426a187a5f2959
SHA51263555a15f153df59b2ca2ab56cd20d71420eb5c9977bcf774723d8484157172b027f71fb2f7a4692aecc6e471f50beec2e0f7a43e57449714caede1e9684c0b8
-
\Program Files\WinRAR\Uninstall.exeFilesize
412KB
MD592667e28583a9489e3cf4f1a7fd6636e
SHA1faa09990ba4daae970038ed44e3841151d6e7f28
SHA2569147293554ad43920bcf763ffd6e1183c36b9f8156dc220548426a187a5f2959
SHA51263555a15f153df59b2ca2ab56cd20d71420eb5c9977bcf774723d8484157172b027f71fb2f7a4692aecc6e471f50beec2e0f7a43e57449714caede1e9684c0b8
-
\Program Files\WinRAR\WinRAR.exeFilesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
\Program Files\WinRAR\WinRAR.exeFilesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
\Program Files\WinRAR\WinRAR.exeFilesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
\Program Files\WinRAR\WinRAR.exeFilesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
\Program Files\WinRAR\WinRAR.exeFilesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
\Program Files\WinRAR\WinRAR.exeFilesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
\Program Files\WinRAR\WinRAR.exeFilesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
\Program Files\WinRAR\WinRAR.exeFilesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
\Program Files\WinRAR\WinRAR.exeFilesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
\Users\Public\Documents\AnyDesk\winrar.exeFilesize
3.3MB
MD58a6217d94e1bcbabdd1dfcdcaa83d1b3
SHA199b81b01f277540f38ea3e96c9c6dc2a57dfeb92
SHA2563023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684
SHA512a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54
-
\Users\Public\Documents\AnyDesk\winrar.exeFilesize
3.3MB
MD58a6217d94e1bcbabdd1dfcdcaa83d1b3
SHA199b81b01f277540f38ea3e96c9c6dc2a57dfeb92
SHA2563023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684
SHA512a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54
-
\Windows\Installer\MSI7EF1.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
\Windows\Installer\MSI8123.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
\Windows\Installer\MSI81D0.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
\Windows\Installer\MSI86A3.tmpFilesize
574KB
MD57b7d9e2c9b8236e7155f2f97254cb40e
SHA199621fc9d14511428d62d91c31865fb2c4625663
SHA256df58faba241328b9645dcb5dec387ec5edd56e2d878384a4783f2c0a66f85897
SHA512fbaa1560f03255f73be3e846959e4b7cbb1c24165d014ed01245639add6cc463975e5558567ab5704e18c9078a8a071c9e38dc1e499ba6e3dc507d4275b4a228
-
\astuto\escasso\Hw2confiança.exeFilesize
9.7MB
MD52e47fc5675f96d63b11821b8f0395f17
SHA11dccc123e58d2802491602345433dcb1e723f192
SHA25674b6bdee25a3dbb1a89e8e4170094c21ce60e782ff58e1123a99dae415ffe9d4
SHA5122ab1ce6c8ff45286411b95ddf8afba44e2fb8fd30d7d0feefe08b286a686bc415df2be890afc67d4513dac70ee2512f79854b5c265a4a0e9e7e86f6ab2d89273
-
memory/1568-97-0x0000000002640000-0x0000000002680000-memory.dmpFilesize
256KB
-
memory/1568-92-0x0000000002640000-0x0000000002680000-memory.dmpFilesize
256KB
-
memory/1568-91-0x0000000002640000-0x0000000002680000-memory.dmpFilesize
256KB
-
memory/1568-90-0x0000000002640000-0x0000000002680000-memory.dmpFilesize
256KB
-
memory/1568-96-0x0000000002640000-0x0000000002680000-memory.dmpFilesize
256KB
-
memory/1568-95-0x0000000002640000-0x0000000002680000-memory.dmpFilesize
256KB
-
memory/1568-166-0x0000000005AB0000-0x0000000005AB1000-memory.dmpFilesize
4KB
-
memory/1568-119-0x0000000005AB0000-0x0000000005AB1000-memory.dmpFilesize
4KB
-
memory/1896-149-0x0000000000E20000-0x0000000000E2D000-memory.dmpFilesize
52KB
-
memory/1896-164-0x000000000FE50000-0x000000000FE7B000-memory.dmpFilesize
172KB
-
memory/1896-191-0x0000000011730000-0x00000000121EA000-memory.dmpFilesize
10.7MB
-
memory/1896-180-0x0000000011300000-0x0000000011316000-memory.dmpFilesize
88KB
-
memory/1896-632-0x0000000000400000-0x0000000000DC3000-memory.dmpFilesize
9.8MB
-
memory/1896-176-0x0000000011280000-0x00000000112BD000-memory.dmpFilesize
244KB
-
memory/1896-175-0x00000000111F0000-0x0000000011207000-memory.dmpFilesize
92KB
-
memory/1896-174-0x00000000111B0000-0x00000000111E8000-memory.dmpFilesize
224KB
-
memory/1896-173-0x0000000011130000-0x000000001116A000-memory.dmpFilesize
232KB
-
memory/1896-170-0x0000000011030000-0x0000000011068000-memory.dmpFilesize
224KB
-
memory/1896-171-0x000000000EF20000-0x000000000EF21000-memory.dmpFilesize
4KB
-
memory/1896-169-0x0000000000400000-0x0000000000DC3000-memory.dmpFilesize
9.8MB
-
memory/1896-168-0x0000000009240000-0x000000000EBB7000-memory.dmpFilesize
89.5MB
-
memory/1896-167-0x0000000010E50000-0x0000000010E69000-memory.dmpFilesize
100KB
-
memory/1896-165-0x0000000010DD0000-0x0000000010E46000-memory.dmpFilesize
472KB
-
memory/1896-202-0x000000000EF20000-0x000000000EF21000-memory.dmpFilesize
4KB
-
memory/1896-163-0x000000000FDC0000-0x000000000FE4E000-memory.dmpFilesize
568KB
-
memory/1896-162-0x000000000FD10000-0x000000000FDB3000-memory.dmpFilesize
652KB
-
memory/1896-161-0x000000000F7B0000-0x000000000FBBB000-memory.dmpFilesize
4.0MB
-
memory/1896-160-0x000000000F770000-0x000000000F7A1000-memory.dmpFilesize
196KB
-
memory/1896-159-0x000000000F3B0000-0x000000000F4E0000-memory.dmpFilesize
1.2MB
-
memory/1896-158-0x000000000F170000-0x000000000F1B6000-memory.dmpFilesize
280KB
-
memory/1896-157-0x000000000F1A0000-0x000000000F219000-memory.dmpFilesize
484KB
-
memory/1896-156-0x000000000F100000-0x000000000F197000-memory.dmpFilesize
604KB
-
memory/1896-155-0x000000000EF70000-0x000000000EF8C000-memory.dmpFilesize
112KB
-
memory/1896-152-0x000000000ED50000-0x000000000EF13000-memory.dmpFilesize
1.8MB
-
memory/1896-153-0x0000000000E10000-0x0000000000E11000-memory.dmpFilesize
4KB
-
memory/1896-151-0x000000000EBC0000-0x000000000ED50000-memory.dmpFilesize
1.6MB
-
memory/1896-148-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/1956-150-0x0000000002170000-0x0000000002180000-memory.dmpFilesize
64KB