privateloader | c2d6bbfa360de2737edaf24386bd732a32176849c24de7a967e55bdc30e06491

Analysis

max time kernel
612s
max time network
614s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2023 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

File_pass1234.7z
Size

4.5MB
MD5

e8e6cefe6cfff9d51b0df39fccf9403d
SHA1

2ce448433f94f00c7a50539e871a207af7d5fa19
SHA256

53b3d8422628b4820e0b49da4af8d7a0d44d3f5284c2fbcc01c5309cb51d4d2a
SHA512

cfd47ddcbe84e5a8a012dbfbf26d6d5bbca43d1e4d843d647c7a8d580c3eed087dcd6b4df8b821f46c81c0e9a450406fca36956f47878a098b48de6f9b099c57
SSDEEP

98304:NLl0uYbdyUJ4X2X6O99Ts4N24fET/71p3YOaXGea:NLlyb5J4X26qzN2gEDYQ9

Score

10^/10

privateloader discovery loader persistence spyware stealer

Malware Config

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

winrar-x64-621.exeWinRAR.exeFile.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	winrar-x64-621.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	WinRAR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	File.exe

Executes dropped EXE 4 IoCs

Processes:

winrar-x64-621.exeuninstall.exeWinRAR.exeFile.exe

pid process

3152 winrar-x64-621.exe
5388 uninstall.exe
4352 WinRAR.exe
3764 File.exe
Loads dropped DLL 2 IoCs

Processes:

WinRAR.exe

pid process

4352 WinRAR.exe
4352 WinRAR.exe

pid	process
3152	winrar-x64-621.exe
5388	uninstall.exe
4352	WinRAR.exe
3764	File.exe

pid	process
4352	WinRAR.exe
4352	WinRAR.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

uninstall.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

uninstall.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

171 ipinfo.io
172 ipinfo.io

flow	ioc
171	ipinfo.io
172	ipinfo.io

Drops file in System32 directory 4 IoCs

Processes:

File.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	File.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	File.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	File.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	File.exe

Drops file in Program Files directory 60 IoCs

Processes:

winrar-x64-621.exeuninstall.exe

description	ioc	process
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WinCon64.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Default64.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240583765	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Zip64.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Zip64.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Default64.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WinCon64.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-621.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

WinRAR.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	WinRAR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\IESettingSync	WinRAR.exe

Modifies registry class 64 IoCs

Processes:

uninstall.exeOpenWith.execmd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.001	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r10	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Applications\WinRAR.exe\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r14\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r28\ = "WinRAR"	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r02	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r23	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r03\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r07\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r13\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r29\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r06	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r26\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c0031000000000054565bb0110050524f4752417e310000740009000400efbe874fdb4954565bb02e0000003f0000000000010000000000000000004a0000000000226c4400500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR"	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r03	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r01\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r07	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r15	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r02\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r27\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r06\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\winrar-x64-621.exe:Zone.Identifier firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\winrar-x64-621.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

File.exe

pid	process
3764	File.exe
3764	File.exe
3764	File.exe
3764	File.exe
3764	File.exe
3764	File.exe
3764	File.exe
3764	File.exe
3764	File.exe
3764	File.exe
3764	File.exe
3764	File.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

2444 OpenWith.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

firefox.exeuninstall.exe

description	pid	process
Token: SeDebugPrivilege	2116	firefox.exe
Token: SeDebugPrivilege	2116	firefox.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe
Token: SeDebugPrivilege	5388	uninstall.exe

Suspicious use of FindShellTrayWindow 17 IoCs

Processes:

firefox.exeWinRAR.exe

pid	process
2116	firefox.exe
2116	firefox.exe
2116	firefox.exe
2116	firefox.exe
4352	WinRAR.exe
4352	WinRAR.exe
4352	WinRAR.exe
4352	WinRAR.exe
4352	WinRAR.exe
4352	WinRAR.exe
4352	WinRAR.exe
4352	WinRAR.exe
4352	WinRAR.exe
4352	WinRAR.exe
4352	WinRAR.exe
4352	WinRAR.exe
4352	WinRAR.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

2116 firefox.exe
2116 firefox.exe
2116 firefox.exe

Suspicious use of SetWindowsHookEx 29 IoCs

Processes:

OpenWith.exefirefox.exewinrar-x64-621.exeuninstall.exeWinRAR.exe

pid	process
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2116	firefox.exe
2116	firefox.exe
2116	firefox.exe
2116	firefox.exe
3152	winrar-x64-621.exe
3152	winrar-x64-621.exe
3152	winrar-x64-621.exe
5388	uninstall.exe
2444	OpenWith.exe
4352	WinRAR.exe
4352	WinRAR.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 3588 wrote to memory of 2116	3588	firefox.exe	firefox.exe
PID 3588 wrote to memory of 2116	3588	firefox.exe	firefox.exe
PID 3588 wrote to memory of 2116	3588	firefox.exe	firefox.exe
PID 3588 wrote to memory of 2116	3588	firefox.exe	firefox.exe
PID 3588 wrote to memory of 2116	3588	firefox.exe	firefox.exe
PID 3588 wrote to memory of 2116	3588	firefox.exe	firefox.exe
PID 3588 wrote to memory of 2116	3588	firefox.exe	firefox.exe
PID 3588 wrote to memory of 2116	3588	firefox.exe	firefox.exe
PID 3588 wrote to memory of 2116	3588	firefox.exe	firefox.exe
PID 3588 wrote to memory of 2116	3588	firefox.exe	firefox.exe
PID 3588 wrote to memory of 2116	3588	firefox.exe	firefox.exe
PID 2116 wrote to memory of 2720	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 2720	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 3076	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 2020	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 2020	2116	firefox.exe	firefox.exe
PID 2116 wrote to memory of 2020	2116	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\File_pass1234.7z
1⤵
- Modifies registry class
PID:2224

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2444

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\AppData\Local\Temp\File_pass1234.7z"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4352

C:\Users\Admin\AppData\Local\Temp\Rar$EXb4352.34409\File.exe
"C:\Users\Admin\AppData\Local\Temp\Rar$EXb4352.34409\File.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3588

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2116.0.1819323807\58262718" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82a2105b-fd25-4c08-b5ed-202f2607ab9e} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 1916 12c436e1558 gpu
3⤵
PID:2720

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2116.1.1104712105\229290385" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {daf0952a-0e8c-4cb6-b150-7a8185e22c72} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 2316 12c36670a58 socket
3⤵
- Checks processor information in registry
PID:3076

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2116.2.1040156358\1113603221" -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 3144 -prefsLen 21009 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca9dea95-8a58-4671-9b6b-1b0bc9589140} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 1484 12c473f6658 tab
3⤵
PID:2020

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2116.3.19460287\361076310" -childID 2 -isForBrowser -prefsHandle 1280 -prefMapHandle 1276 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3f861d2-e154-454c-8ede-923ccb58d2ca} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 3440 12c36667b58 tab
3⤵
PID:4240

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2116.4.726187251\1278020535" -childID 3 -isForBrowser -prefsHandle 3900 -prefMapHandle 3896 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0163e60b-3dd6-4357-aa2e-8cd444712e7e} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 3912 12c3665b258 tab
3⤵
PID:2036

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2116.7.1355317820\1275007318" -childID 6 -isForBrowser -prefsHandle 5268 -prefMapHandle 5272 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e50414a8-cf1d-4988-a293-5b6419adee2d} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 5260 12c49ac7a58 tab
3⤵
PID:3516

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2116.6.364767342\906443864" -childID 5 -isForBrowser -prefsHandle 5072 -prefMapHandle 5076 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a746c0d-2438-4f10-a114-db1d3e89db0d} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 5064 12c49ac6b58 tab
3⤵
PID:3480

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2116.5.2072767014\2097417713" -childID 4 -isForBrowser -prefsHandle 5028 -prefMapHandle 5024 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {be8415ca-4455-4d87-85dd-3ebd76b894e7} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 5040 12c49a16b58 tab
3⤵
PID:3964

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2116.8.1081650437\997701538" -childID 7 -isForBrowser -prefsHandle 3448 -prefMapHandle 1452 -prefsLen 26753 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b37b0389-a5d9-4bdb-83c8-1c5e13d98256} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 3532 12c3665fe58 tab
3⤵
PID:5960

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2116.9.1425879055\556078629" -childID 8 -isForBrowser -prefsHandle 5952 -prefMapHandle 3472 -prefsLen 26770 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ee6998b-c673-4fe7-a8bd-9a8c5fb58704} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 5012 12c49c1f558 tab
3⤵
PID:5468

C:\Users\Admin\Downloads\winrar-x64-621.exe
"C:\Users\Admin\Downloads\winrar-x64-621.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3152

C:\Program Files\WinRAR\uninstall.exe
"C:\Program Files\WinRAR\uninstall.exe" /setup
4⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WinRAR\7zxa.dll
Filesize
211KB

MD5
bc3754b7c77dfb6aed1722ef7f53b414

SHA1
06863238ddbe03e409559c26d85d975deaf989a6

SHA256
b54cac90e649ebbf7c27cf1772f5c1644f4600db88f0d51419a3529a5a5f95fc

SHA512
489157d07a7ea7c95de1576350400c357ccec091ea5ba81bea3437fe05bc873e0305fd950e7a663d3d7ceebc2581cf5669d2f1e83aa850f9f6882a5728685c24

Download Submit
C:\Program Files\WinRAR\7zxa.dll
Filesize
211KB

MD5
bc3754b7c77dfb6aed1722ef7f53b414

SHA1
06863238ddbe03e409559c26d85d975deaf989a6

SHA256
b54cac90e649ebbf7c27cf1772f5c1644f4600db88f0d51419a3529a5a5f95fc

SHA512
489157d07a7ea7c95de1576350400c357ccec091ea5ba81bea3437fe05bc873e0305fd950e7a663d3d7ceebc2581cf5669d2f1e83aa850f9f6882a5728685c24

Download Submit
C:\Program Files\WinRAR\7zxa.dll
Filesize
211KB

MD5
bc3754b7c77dfb6aed1722ef7f53b414

SHA1
06863238ddbe03e409559c26d85d975deaf989a6

SHA256
b54cac90e649ebbf7c27cf1772f5c1644f4600db88f0d51419a3529a5a5f95fc

SHA512
489157d07a7ea7c95de1576350400c357ccec091ea5ba81bea3437fe05bc873e0305fd950e7a663d3d7ceebc2581cf5669d2f1e83aa850f9f6882a5728685c24

Download Submit
C:\Program Files\WinRAR\Rar.txt
Filesize
109KB

MD5
e51d9ff73c65b76ccd7cd09aeea99c3c

SHA1
d4789310e9b7a4628154f21af9803e88e89e9b1b

SHA256
7456f489100ec876062d68d152081167ac00d45194b17af4a8dd53680acfc9bd

SHA512
57ab82d4a95d3b5d181c0ec1a1a1de56a4d6c83af5644032ff3af71e9bd8e13051ae274609bda8b336d70a99f2fba17331773694d7e98d4a7635f7b59651b77c

Download Submit
C:\Program Files\WinRAR\Uninstall.exe
Filesize
437KB

MD5
cac9723066062383778f37e9d64fd94e

SHA1
1cd78fc041d733f7eacdd447371c9dec25c7ef2c

SHA256
e187e1119350caa3aec9d531989f60452d0198368f19cf65ffd2194a8a4003ad

SHA512
2b3dc50fb5006f1f3beec1774d0927a0533b49d20122e49a0b4b41840f83c494376c8e61da735aa58d27453c44450203d5c2bb4f03fdd37b648ee0f51f925c59

Download Submit
C:\Program Files\WinRAR\Uninstall.exe
Filesize
437KB

MD5
cac9723066062383778f37e9d64fd94e

SHA1
1cd78fc041d733f7eacdd447371c9dec25c7ef2c

SHA256
e187e1119350caa3aec9d531989f60452d0198368f19cf65ffd2194a8a4003ad

SHA512
2b3dc50fb5006f1f3beec1774d0927a0533b49d20122e49a0b4b41840f83c494376c8e61da735aa58d27453c44450203d5c2bb4f03fdd37b648ee0f51f925c59

Download Submit
C:\Program Files\WinRAR\WhatsNew.txt
Filesize
103KB

MD5
4c88a040b31c4d144b44b0dc68fb2cc8

SHA1
bf473f5a5d3d8be6e5870a398212450580f8b37b

SHA256
6f1a005a0e5c765fcc68fe15f7ccd18667a6e583980e001ba7181aaaeed442b8

SHA512
e7f224a21d7c111b83775c778e6d9fa447e53809e0efd4f3ba99c7d6206036aa3dde9484248b244fb26789467559a40516c8e163d379e84dcf31ac84b4c5d2a8

Download Submit
C:\Program Files\WinRAR\WinRAR.chm
Filesize
317KB

MD5
381eae01a2241b8a4738b3c64649fbc0

SHA1
cc5944fde68ed622ebee2da9412534e5a44a7c9a

SHA256
ad58f39f5d429b5a3726c4a8ee5ccada86d24273eebf2f6072ad1fb61ea82d6e

SHA512
f7a8903ea38f2b62d6fa2cc755e0d972a14d00a2e1047e6e983902eff1d3a6bca98327c2b8ed47e46435d1156816e4b0d494726fce87b6cbe7722f5249889b88

Download Submit
C:\Program Files\WinRAR\WinRAR.exe
Filesize
2.4MB

MD5
46d15a70619d5e68415c8f22d5c81555

SHA1
12ec96e89b0fd38c469546042e30452b070e337f

SHA256
2e503ad5a9c800f2dac2fed2b3e8698d96d25b219ed86ed1a54896232cbe4781

SHA512
09446dc9d0c768844213f7f71ba65ee4e86b61d7a61610b63892d1b142952bdd346d14d27d878c026362e012e22fcb49c6746912d5e02db6b40223cafa6d01fb

Download Submit
C:\Program Files\WinRAR\WinRAR.exe
Filesize
2.4MB

MD5
46d15a70619d5e68415c8f22d5c81555

SHA1
12ec96e89b0fd38c469546042e30452b070e337f

SHA256
2e503ad5a9c800f2dac2fed2b3e8698d96d25b219ed86ed1a54896232cbe4781

SHA512
09446dc9d0c768844213f7f71ba65ee4e86b61d7a61610b63892d1b142952bdd346d14d27d878c026362e012e22fcb49c6746912d5e02db6b40223cafa6d01fb

Download Submit
C:\Program Files\WinRAR\uninstall.exe
Filesize
437KB

MD5
cac9723066062383778f37e9d64fd94e

SHA1
1cd78fc041d733f7eacdd447371c9dec25c7ef2c

SHA256
e187e1119350caa3aec9d531989f60452d0198368f19cf65ffd2194a8a4003ad

SHA512
2b3dc50fb5006f1f3beec1774d0927a0533b49d20122e49a0b4b41840f83c494376c8e61da735aa58d27453c44450203d5c2bb4f03fdd37b648ee0f51f925c59

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk
Filesize
1KB

MD5
1c14ba2c3949c35de89f9025f363b97e

SHA1
8f8749fc76ccbed5c43facdfa02b42485793e609

SHA256
c06a5bc4aece84611f6e3dfc1dda507cfa6852c9c7d92aa54bdeadd4edb1c3ea

SHA512
87aad9051397751e83875b5a8f02bad10446ba1ebae188721bc1b4085ee89c342209dd8e8f3d38f8f01396846d84dd030dbc148cabf1971417ea5382d82409b2

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk
Filesize
1KB

MD5
a5949a134cd0b79b5938b2d1e2eef0e2

SHA1
4ea21bad839b664354cf20c6fd909ca2c2fc8db3

SHA256
e9d790b6c6297c62be0b14c4bc071dedbf3ace06f5d8966b0d3bc3cc39a7dfb3

SHA512
2fcd96c01ecdba7eafee367564f63fab6e0a2e31b1d99d58c519ad37f8b15e58cc65c44e815048199456a07924df5ca40c06d2ae14bb74de64cd75cdebcc8fbe

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk
Filesize
1KB

MD5
24aac34c966bde964c9b447b892f5637

SHA1
83e0adcb648827ab4a12bc7ccd7c434e93384975

SHA256
5659c982f23f96ec287dc2e393585bc394fc4dc6d96f51b8bac6d062019f71c2

SHA512
0729d2efd0c2b747b014e11bc4e5ee727f2226397800de262918c3e32c12ff71d622d2d09379bf6c9af6086d8a709e53fb9c8d70f06431c6348a405bdae34081

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
Filesize
1KB

MD5
44be1a25437e5c5c6d742911885c9bc8

SHA1
e29c03973698e894ef012d42a7691af3f4f3b140

SHA256
448c2b0152366e7c96200501bd4c5d8c27dd6f8574587c9e4303a4f9f2358d2a

SHA512
3e92708a7a041c193a5f014deb730ac603513a69036a50b09c2fcf008e4706c1bc23fa6b7b3af8a696add5b2779f47beb27280af56dbecf29aa49a77e9af572a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Filesize
28KB

MD5
d78939bd2f5c8c33661781088d540ece

SHA1
e3d5ace1c4ae777f3b4b0442b9e6868fd14b90f1

SHA256
cf1d410324b68e5fca413af588a9257a26353856d970a4043e0847546ac00b55

SHA512
893e381f98010e8950e608370346174f681f939f9c14d90d0df8628b0b617ac0bc2510cdec8bca8a8f7e768fcc097115e51a77750beed0ec2f6e4bd064cb8679

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\activity-stream.discovery_stream.json.tmp
Filesize
148KB

MD5
c46346a58e069c6282b404ae5ce271ea

SHA1
bc3c479632b119b7d0178f10c7f142afe027ef1e

SHA256
8e31da503b0cae2cedfc86a3a012d8137e25c0ca9ccb409afa4aeda0fb321c46

SHA512
feb9b47fac52b3728791b050e4d2ac451ad790b3ae99f104b12e2a386a15cea810728c23b6385922f8c5323dd45a9941edd4201e1b50d537b6c6798748db1087

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EXb4352.34409\File.exe
Filesize
666.0MB

MD5
dfe614d5ea5019dfe90fbbc597a6347e

SHA1
ec8be683e0f53db9993347402e284133ae48b335

SHA256
09b7f55020638c72189bf0fb828953410f110f6b5b0aa6b1af669cc2451581e6

SHA512
159b1c0a8fb1a530e486e36a5b7cab9ad4044808f129e3408d0d5bc1c24dd732e5ac137d5a7a72b62f133bbb3b3e46e6864e6c5f507a96b6930314c7a0754e6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EXb4352.34409\File.exe
Filesize
666.0MB

MD5
dfe614d5ea5019dfe90fbbc597a6347e

SHA1
ec8be683e0f53db9993347402e284133ae48b335

SHA256
09b7f55020638c72189bf0fb828953410f110f6b5b0aa6b1af669cc2451581e6

SHA512
159b1c0a8fb1a530e486e36a5b7cab9ad4044808f129e3408d0d5bc1c24dd732e5ac137d5a7a72b62f133bbb3b3e46e6864e6c5f507a96b6930314c7a0754e6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EXb4352.34409\File.exe
Filesize
666.0MB

MD5
dfe614d5ea5019dfe90fbbc597a6347e

SHA1
ec8be683e0f53db9993347402e284133ae48b335

SHA256
09b7f55020638c72189bf0fb828953410f110f6b5b0aa6b1af669cc2451581e6

SHA512
159b1c0a8fb1a530e486e36a5b7cab9ad4044808f129e3408d0d5bc1c24dd732e5ac137d5a7a72b62f133bbb3b3e46e6864e6c5f507a96b6930314c7a0754e6a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js
Filesize
6KB

MD5
a7bf3f99b03910c2206c673b4c7f048a

SHA1
92f3700934944f7758bdd9498010e961ef53f6c8

SHA256
5186d06dce1b470e2deb4444ce2d0335855018475d64b7e592ddf8f07ae96508

SHA512
76017e5cdf56176da85c6a3ee273b6b88d7d60f6729ab0e0837f9711ab7f402985cb6b921296247522614d93d93bcbe58effbc09f33e0423df66d2f550d3a284

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js
Filesize
6KB

MD5
41d3de78dd64aa63a30266e7b079d7fa

SHA1
18fe6c2ec9b5301103b020a86956114a5d380b60

SHA256
038738515dc7e97002f7d7f259819b394cbc5c9b5f393b114e7c57accea5082f

SHA512
80b492211e56f02c622a9b9824fee5772ca099c795c8db94de51b09183fec749033caa5230a9adc1a2245eddeb6f964cbe9e23ecfb18cb0a9f34c40ddffabce0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js
Filesize
6KB

MD5
516eb7a530ab3a95b7908a18c2ec4638

SHA1
170395f311b720c3bf447583bf59390e6d07a8c6

SHA256
dad2a5d370e10d35e586e68582e8763836b44ca99e73dde9ae1eb3f2bd160632

SHA512
a3952aea47dc4e5fb938c9873b6de58c31ff3746e53349fd53cc31cc20b5b667b6a569897ac05110e695af87e36704d2993d89433a13cf521d3df2e999c44376

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs.js
Filesize
6KB

MD5
1984b45f201f1fd79d2154406648433b

SHA1
42f082dc6d4d43333688690bf4dfa7c7f8b618ab

SHA256
000a408519010d12b94281710f9a987f822093a1efb5293bbb50ca2e4a6a9df9

SHA512
e73a00cc8994d4023168e93ff5f5b6e6b13ffeb740872b64f565787cbb57e49e64eb03e4de1d8068a6f303f0615749fb27cb47bdbc4cef3fef1290bd3a3a17cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionCheckpoints.json.tmp
Filesize
259B

MD5
700fe59d2eb10b8cd28525fcc46bc0cc

SHA1
339badf0e1eba5332bff317d7cf8a41d5860390d

SHA256
4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea

SHA512
3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
002629b428db450b6e60fb0410f4620f

SHA1
4e67f9d050c65db4e8bdf6efa6b4cb926e29377e

SHA256
4ab5bec90a6f907a3b6c231323d2de47ea964022973afda8c9c5d3eb2af5c10a

SHA512
35d2dd701a98b367551daaa19df03b8d02d40d577992c4630a3a5ee591ea99b073a7860b1d3a7fae3d346c544d33bcd610bc803cde1620fb25e85f50d3b6031c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore.jsonlz4
Filesize
4KB

MD5
3476432e34abc85a6901b6b8affbaacd

SHA1
4dd64e29b3e55edec0351696cf3da2ece5d0c762

SHA256
0e81928e40570f5ece3979c0f14ea608eda2d67d6d896e24bfca6298f6dd5cf6

SHA512
445538ade187d439d0e9d50c489dbad145d091bdaaadab5ab7f9e25a36466f3e3d98c5f5e8908c1ff897ad5bc55653adb19245e0687c4fd7d7b709c79c40166e

Download Submit
C:\Users\Admin\Downloads\winrar-x64-621.Hqa8Vs6T.exe.part
Filesize
223KB

MD5
bf9f47acaca6b36f7bae9e438187147a

SHA1
7fb328a110004d2b02a138bb0033775be3827bfa

SHA256
2dcec4a41225363ceae1a7ff97e924f94484b6bba649d96c0da4d6204a3cdace

SHA512
f177b6ccfa572f39d4eeb1592ee9fc01257b9dccd8e736f8d10054336df906c5c53a54335a131c3d58b5029c781f45a72ec2d286f54822e4880a17665abd3ae5

Download Submit
C:\Users\Admin\Downloads\winrar-x64-621.exe
Filesize
3.4MB

MD5
766ac70b840c029689d3c065712cf46e

SHA1
e54f4628076d81b36de97b01c098a2e7ba123663

SHA256
06d6ecc5f9d88636b0bac62218c296bfa1b2222f734c9cbed5575bd9f634e219

SHA512
49064dc2c30eecd7320a6431abfee49d250ea7cda5e8ae630d2c55325f5bdf338355ae8d7a3246b4036afce5c100b8b30599baf19ab64d20190392d2d9a28608

Download Submit
C:\Users\Admin\Downloads\winrar-x64-621.exe
Filesize
3.4MB

MD5
766ac70b840c029689d3c065712cf46e

SHA1
e54f4628076d81b36de97b01c098a2e7ba123663

SHA256
06d6ecc5f9d88636b0bac62218c296bfa1b2222f734c9cbed5575bd9f634e219

SHA512
49064dc2c30eecd7320a6431abfee49d250ea7cda5e8ae630d2c55325f5bdf338355ae8d7a3246b4036afce5c100b8b30599baf19ab64d20190392d2d9a28608

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini
Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/3764-870-0x00007FF667220000-0x00007FF667D45000-memory.dmp

Filesize
11.1MB

Download