Overview
overview
10Static
static
3F0nts/DL/Winzip.exe
windows7-x64
4F0nts/DL/Winzip.exe
windows10-2004-x64
1F0nts/Lang...ip.exe
windows7-x64
1F0nts/Lang...ip.exe
windows10-2004-x64
1F0nts/Nita/Winzip.exe
windows7-x64
1F0nts/Nita/Winzip.exe
windows10-2004-x64
1F0nts/Rupo/Winzip.exe
windows7-x64
1F0nts/Rupo/Winzip.exe
windows10-2004-x64
1F0nts/Tire/Winzip.exe
windows7-x64
1F0nts/Tire/Winzip.exe
windows10-2004-x64
1F0nts/erro...ip.exe
windows7-x64
1F0nts/erro...ip.exe
windows10-2004-x64
1LaNgz/Winzip.exe
windows7-x64
1LaNgz/Winzip.exe
windows10-2004-x64
1Setup.exe
windows7-x64
10Setup.exe
windows10-2004-x64
10Analysis
- max time kernel
120s - max time network
125s - platform
windows7_x64 - resource
win7-20240215-es - resource tags
arch:x64arch:x86image:win7-20240215-eslocale:es-esos:windows7-x64systemwindows - submitted
04/06/2024, 01:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
F0nts/DL/Winzip.exe
Resource
win7-20240215-es
windows7-x64
11 signatures
1200 seconds
Behavioral task
behavioral2
Sample
F0nts/DL/Winzip.exe
Resource
win10v2004-20240508-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral3
Sample
F0nts/LangZ/Winzip.exe
Resource
win7-20240215-es
windows7-x64
3 signatures
1200 seconds
Behavioral task
behavioral4
Sample
F0nts/LangZ/Winzip.exe
Resource
win10v2004-20240426-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral5
Sample
F0nts/Nita/Winzip.exe
Resource
win7-20240508-es
windows7-x64
3 signatures
1200 seconds
Behavioral task
behavioral6
Sample
F0nts/Nita/Winzip.exe
Resource
win10v2004-20240508-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral7
Sample
F0nts/Rupo/Winzip.exe
Resource
win7-20231129-es
windows7-x64
3 signatures
1200 seconds
Behavioral task
behavioral8
Sample
F0nts/Rupo/Winzip.exe
Resource
win10v2004-20240508-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral9
Sample
F0nts/Tire/Winzip.exe
Resource
win7-20240215-es
windows7-x64
3 signatures
1200 seconds
Behavioral task
behavioral10
Sample
F0nts/Tire/Winzip.exe
Resource
win10v2004-20240426-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral11
Sample
F0nts/error/Winzip.exe
Resource
win7-20240221-es
windows7-x64
3 signatures
1200 seconds
Behavioral task
behavioral12
Sample
F0nts/error/Winzip.exe
Resource
win10v2004-20240508-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral13
Sample
LaNgz/Winzip.exe
Resource
win7-20240221-es
windows7-x64
3 signatures
1200 seconds
Behavioral task
behavioral14
Sample
LaNgz/Winzip.exe
Resource
win10v2004-20240426-es
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral15
Sample
Setup.exe
Resource
win7-20240221-es
windows7-x64
4 signatures
1200 seconds
Behavioral task
behavioral16
Sample
Setup.exe
Resource
win10v2004-20240426-es
windows10-2004-x64
4 signatures
1200 seconds
General
- Target F0nts/DL/Winzip.exe
- Size 3.2MB
- Sample240604-bj9beagg28
- SHA256 26b40c79356453c60498772423f99384a3d24dd2d0662d215506768cb9c58370
- MD5 b66dec691784f00061bc43e62030c343
- SHA1 779d947d41efafc2995878e56e213411de8fb4cf
- SHA512 6a89bd581baf372f07e76a3378e6f6eb29cac2e4981a7f0affb4101153407cadfce9f1b6b28d5a003f7d4039577029b2ec6ebcfd58e55288e056614fb03f8ba3
- SSDEEP 98304:lJXOBfK92HbAw0CNB3kJElzNsy8vGUvfCo3ABH43:lJ192HbAXCvDlzNsy8vGUyo3AB8
- MD5 SHA1 SHA512 SSDEEP
Score
4/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WinRAR\WinRAR.exe Winzip.exe File opened for modification C:\Program Files\WinRAR\RarExt.dll Winzip.exe File created C:\Program Files\WinRAR\ReadMe.rus.txt Winzip.exe File created C:\Program Files\WinRAR\WinConEn.SFX Winzip.exe File created C:\Program Files\WinRAR\ZipEn64.SFX Winzip.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe Winzip.exe File opened for modification C:\Program Files\WinRAR\rarlng.dll Winzip.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm Winzip.exe File opened for modification C:\Program Files\WinRAR\Order.htm Winzip.exe File opened for modification C:\Program Files\WinRAR\Rar.exe Winzip.exe File created C:\Program Files\WinRAR\RarExt.dll Winzip.exe File opened for modification C:\Program Files\WinRAR\Default.SFX Winzip.exe File created C:\Program Files\WinRAR\DefaultEn64.SFX Winzip.exe File opened for modification C:\Program Files\WinRAR\WinConEn64.SFX Winzip.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst Winzip.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt Winzip.exe File created C:\Program Files\WinRAR\DefaultEn.SFX Winzip.exe File opened for modification C:\Program Files\WinRAR\Zip64.SFX Winzip.exe File opened for modification C:\Program Files\WinRAR Winzip.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt Winzip.exe File created C:\Program Files\WinRAR\WhatsNew.txt Winzip.exe File opened for modification C:\Program Files\WinRAR\ZipEn64.SFX Winzip.exe File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_259426823 Winzip.exe File created C:\Program Files\WinRAR\RarExt32.dll Winzip.exe File opened for modification C:\Program Files\WinRAR\DefaultEn64.SFX Winzip.exe File created C:\Program Files\WinRAR\Zip.SFX Winzip.exe File opened for modification C:\Program Files\WinRAR\License.txt Winzip.exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX Winzip.exe File created C:\Program Files\WinRAR\WinCon64.SFX Winzip.exe File created C:\Program Files\WinRAR\Zip64.SFX Winzip.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst Winzip.exe File created C:\Program Files\WinRAR\Order.htm Winzip.exe File created C:\Program Files\WinRAR\RarFiles.lst Winzip.exe File created C:\Program Files\WinRAR\Rar.exe Winzip.exe File opened for modification C:\Program Files\WinRAR\DefaultEn.SFX Winzip.exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File created C:\Program Files\WinRAR\Descript.ion Winzip.exe File created C:\Program Files\WinRAR\Rar.txt Winzip.exe File created C:\Program Files\WinRAR\7zxa.dll Winzip.exe File opened for modification C:\Program Files\WinRAR\Default64.SFX Winzip.exe File created C:\Program Files\WinRAR\WinCon.SFX Winzip.exe File created C:\Program Files\WinRAR\WinConEn64.SFX Winzip.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX Winzip.exe File created C:\Program Files\WinRAR\ZipEn.SFX Winzip.exe File created C:\Program Files\WinRAR\rarlng.dll Winzip.exe File created C:\Program Files\WinRAR\UnRAR.exe Winzip.exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe Winzip.exe File created C:\Program Files\WinRAR\zipnew.dat uninstall.exe File created C:\Program Files\WinRAR\ReadMe.txt Winzip.exe File opened for modification C:\Program Files\WinRAR\Rar.txt Winzip.exe File created C:\Program Files\WinRAR\Uninstall.exe Winzip.exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe Winzip.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll Winzip.exe File created C:\Program Files\WinRAR\Default64.SFX Winzip.exe File opened for modification C:\Program Files\WinRAR\ZipEn.SFX Winzip.exe File created C:\Program Files\WinRAR\License.txt Winzip.exe File opened for modification C:\Program Files\WinRAR\WinConEn.SFX Winzip.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll Winzip.exe File opened for modification C:\Program Files\WinRAR\ReadMe.rus.txt Winzip.exe File created C:\Program Files\WinRAR\Uninstall.lst Winzip.exe File created C:\Program Files\WinRAR\Default.SFX Winzip.exe File opened for modification C:\Program Files\WinRAR\WinCon64.SFX Winzip.exe File created C:\Program Files\WinRAR\WinRAR.chm Winzip.exe File opened for modification C:\Program Files\WinRAR\Descript.ion Winzip.exe - Executes dropped EXE 1 IoCs
pid Process 2796 uninstall.exe - Loads dropped DLL 9 IoCs
pid Process 2240 Winzip.exe 1240 Process not Found 2796 uninstall.exe 2796 uninstall.exe 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found - Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe - Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main Winzip.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r05 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r19 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r27 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r07 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r07\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r28\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "Архив ZIP - WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r11\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r16 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7z uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r12\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.z uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r21\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r11 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r13\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r17\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r19\ = "WinRAR" uninstall.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2240 Winzip.exe 2240 Winzip.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2796 2240 Winzip.exe 28 PID 2240 wrote to memory of 2796 2240 Winzip.exe 28 PID 2240 wrote to memory of 2796 2240 Winzip.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\F0nts\DL\Winzip.exe"C:\Users\Admin\AppData\Local\Temp\F0nts\DL\Winzip.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Registers COM server for autorun
- Modifies registry class
PID:2796
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\WinRAR\Rar.txt
- Size 118KB
- SHA256 8fe2e2987889f5f1c4ccc3ba6bf069ae35e5abf3c6a50d14e0e8b50dcff5108a
- MD5 5684ea7cee254c5d8cab7a9d74974be1
- SHA1 fb375d94eced40b1c26f6cfe5298c526bc80cff4
- SHA512 0ec8b03ff6dcf53bf23ae439939385427064247537f11c11818f0710ccc15f6a248bf97c3c2e893645cf00652b08d1e1d54814482fe21dd127c1c5cf44ddc293
- SSDEEP 3072:0ur1FVJGk/ugEqnrTj2AZxjNCPdWTezkOahkU8vv:0mRGkzEKpEdaezkOa5k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\WinRAR\WhatsNew.txt
- Size 129KB
- SHA256 d573f277b0f1c92e96f5df7b1864dd1167b4ed4d32229822b6ff2b07ba78f062
- MD5 974e21550629d23011b110fd10b2950f
- SHA1 64bc579196cbed3b8670e5c357b8b4a6c482ce17
- SHA512 2e88716846290172d02b22c2b2ea67d9f67b785d0ce88f4eb63233312250b24d455b785d7b494760120ee52903682769f30b90520153d95026b15cceb35c9a10
- SSDEEP 3072:TtULGRgdZo+9HGdt6b0ggGhbzrMYwC8868yryp:BAvdZo+9mdtvfMrquEyp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\WinRAR\WinRAR.chm
- Size 378KB
- SHA256 f8cb67292cc4bde1cedd9cb5cd27e6dec21fd6a23e1c32a02f047ff55eff3823
- MD5 02b9b0d56402e39eb2f7cb1923b7eca3
- SHA1 3b4ac6d8424c437da86ae78258f950e64b65d8a6
- SHA512 7f3b6a96b13022d7d6d4c629e0cef4f3e6686f00877ff0b10a75ccd980c5fae2c76de79221215c9b930faeaf302d30f87fa684e501bbdafe70bbcd3b221264e1
- SSDEEP 6144:g48CD65y56em+x8cHdDmrel+Lv/2OVjN0thooGzRXbhEfhW7ghJVeSoN5N:xD6qm921ALv/fqt7GzRLhEZWiVeSM5N
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\WinRAR\WinRAR.exe
- Size 2.2MB
- SHA256 b18c9b9200e354f81882b29dc8143ec5d6f2b731cf4c7da3800e339ffb3c8827
- MD5 1e3a2a966f593ad33125f26916267008
- SHA1 38b1a547ddee671edeee7385cac138458a6a6858
- SHA512 928540f5d087fd2099b642f8e5b23c9f4b3924e57be95552f4f719d29644d8fbbd75d30a3d359aca895434617f087ca251657cb2871d5fc1bf840f961375301b
- SSDEEP 49152:m2IoCBtJnxlyU/mWhRcQYhie6/UIdjjQuctXnFDu3nAzNjteyUHBdH3y2:xrCBrtcy/lfkD0nANte9BpC2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\WinRAR\rarlng.dll
- Size 955KB
- SHA256 8c2a093eb8f7907ea928accbbbeb1531925b8f76adbd176364e4dcaff32d0ab2
- MD5 1380c57e28c63098c683cb15d8af1523
- SHA1 9b66bf5741aa6485097f7a82b45e5eefbac717cd
- SHA512 299143e7ad7266136f77362156c2990269660986a2ec67be0addef288803bedf85a6e47b4342381042395775becc0f4d2dfdb75e7dc8670e9272f2ac92d039cc
- SSDEEP 24576:AzNSCnq10I50tQPO0q0RpBd3X3B+iabPz:AzNDNui0LBdH3Lw
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files\WinRAR\Uninstall.exe
- Size 383KB
- SHA256 c382b2af0e85b090333df7b7395d0022b9c5a4c026cf7761052128ed3ada5e0f
- MD5 94239a4bd897e66cdfc298fe5ce6e160
- SHA1 3d91edacfe7307506df2368909fe5e6d01ef18b4
- SHA512 9c6c9fcff255aad7363040ee82df390cef43a6a03c0f0eb13ba5f3bfb0ce8d811d296d25ee13242adb51a17f0326d3c6b385495bd04bf9116f0e1a3633a0c7d4
- SSDEEP 6144:hX4HIPQIIpAonab5oA7Lp489Y76O+pShiwBhvZXQ+/3OKyvnIII9YB5hd67GO8:cIKAonab5X/qf7T4wBhvBJ/+7IISY1Ao
- MD5 SHA1 SHA512 SSDEEP