71e9d4c711a188b0bc798b078eb8f052b11d479c9f4e4f1d746dccfefd4de984

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240215-es
resource tags

arch:x64arch:x86image:win7-20240215-eslocale:es-esos:windows7-x64systemwindows
submitted
04-06-2024 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

F0nts/DL/Winzip.exe
Size

3.2MB
MD5

b66dec691784f00061bc43e62030c343
SHA1

779d947d41efafc2995878e56e213411de8fb4cf
SHA256

26b40c79356453c60498772423f99384a3d24dd2d0662d215506768cb9c58370
SHA512

6a89bd581baf372f07e76a3378e6f6eb29cac2e4981a7f0affb4101153407cadfce9f1b6b28d5a003f7d4039577029b2ec6ebcfd58e55288e056614fb03f8ba3
SSDEEP

98304:lJXOBfK92HbAw0CNB3kJElzNsy8vGUvfCo3ABH43:lJ192HbAXCvDlzNsy8vGUyo3AB8

Score

4^/10

discovery persistence

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\WinRAR.exe	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	Winzip.exe
File created	C:\Program Files\WinRAR\ReadMe.rus.txt	Winzip.exe
File created	C:\Program Files\WinRAR\WinConEn.SFX	Winzip.exe
File created	C:\Program Files\WinRAR\ZipEn64.SFX	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\rarlng.dll	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	Winzip.exe
File created	C:\Program Files\WinRAR\RarExt.dll	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	Winzip.exe
File created	C:\Program Files\WinRAR\DefaultEn64.SFX	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\WinConEn64.SFX	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	Winzip.exe
File created	C:\Program Files\WinRAR\DefaultEn.SFX	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\Zip64.SFX	Winzip.exe
File opened for modification	C:\Program Files\WinRAR	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	Winzip.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\ZipEn64.SFX	Winzip.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_259426823	Winzip.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\DefaultEn64.SFX	Winzip.exe
File created	C:\Program Files\WinRAR\Zip.SFX	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	Winzip.exe
File created	C:\Program Files\WinRAR\WinCon64.SFX	Winzip.exe
File created	C:\Program Files\WinRAR\Zip64.SFX	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	Winzip.exe
File created	C:\Program Files\WinRAR\Order.htm	Winzip.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	Winzip.exe
File created	C:\Program Files\WinRAR\Rar.exe	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\DefaultEn.SFX	Winzip.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\Descript.ion	Winzip.exe
File created	C:\Program Files\WinRAR\Rar.txt	Winzip.exe
File created	C:\Program Files\WinRAR\7zxa.dll	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\Default64.SFX	Winzip.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	Winzip.exe
File created	C:\Program Files\WinRAR\WinConEn64.SFX	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	Winzip.exe
File created	C:\Program Files\WinRAR\ZipEn.SFX	Winzip.exe
File created	C:\Program Files\WinRAR\rarlng.dll	Winzip.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	Winzip.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	Winzip.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	Winzip.exe
File created	C:\Program Files\WinRAR\Default64.SFX	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\ZipEn.SFX	Winzip.exe
File created	C:\Program Files\WinRAR\License.txt	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\WinConEn.SFX	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.rus.txt	Winzip.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	Winzip.exe
File created	C:\Program Files\WinRAR\Default.SFX	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\WinCon64.SFX	Winzip.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	Winzip.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	Winzip.exe

Executes dropped EXE 1 IoCs

pid	Process
2796	uninstall.exe

Loads dropped DLL 9 IoCs

pid	Process
2240	Winzip.exe
1240	Process not Found
2796	uninstall.exe
2796	uninstall.exe
1240	Process not Found
1240	Process not Found
1240	Process not Found
1240	Process not Found
1240	Process not Found

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	Winzip.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r05	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r19	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r27	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r07	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r07\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r28\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "Архив ZIP - WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r11\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r16	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r12\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r21\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r11	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r13\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r17\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r19\ = "WinRAR"	uninstall.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2240	Winzip.exe
2240	Winzip.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2796	2240	Winzip.exe	28
PID 2240 wrote to memory of 2796	2240	Winzip.exe	28
PID 2240 wrote to memory of 2796	2240	Winzip.exe	28

C:\Users\Admin\AppData\Local\Temp\F0nts\DL\Winzip.exe
"C:\Users\Admin\AppData\Local\Temp\F0nts\DL\Winzip.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files\WinRAR\uninstall.exe
  "C:\Program Files\WinRAR\uninstall.exe" /setup
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Registers COM server for autorun
  - Modifies registry class
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WinRAR\Rar.txt

Filesize
118KB

MD5
5684ea7cee254c5d8cab7a9d74974be1

SHA1
fb375d94eced40b1c26f6cfe5298c526bc80cff4

SHA256
8fe2e2987889f5f1c4ccc3ba6bf069ae35e5abf3c6a50d14e0e8b50dcff5108a

SHA512
0ec8b03ff6dcf53bf23ae439939385427064247537f11c11818f0710ccc15f6a248bf97c3c2e893645cf00652b08d1e1d54814482fe21dd127c1c5cf44ddc293

Download Submit
C:\Program Files\WinRAR\WhatsNew.txt

Filesize
129KB

MD5
974e21550629d23011b110fd10b2950f

SHA1
64bc579196cbed3b8670e5c357b8b4a6c482ce17

SHA256
d573f277b0f1c92e96f5df7b1864dd1167b4ed4d32229822b6ff2b07ba78f062

SHA512
2e88716846290172d02b22c2b2ea67d9f67b785d0ce88f4eb63233312250b24d455b785d7b494760120ee52903682769f30b90520153d95026b15cceb35c9a10

Download Submit
C:\Program Files\WinRAR\WinRAR.chm

Filesize
378KB

MD5
02b9b0d56402e39eb2f7cb1923b7eca3

SHA1
3b4ac6d8424c437da86ae78258f950e64b65d8a6

SHA256
f8cb67292cc4bde1cedd9cb5cd27e6dec21fd6a23e1c32a02f047ff55eff3823

SHA512
7f3b6a96b13022d7d6d4c629e0cef4f3e6686f00877ff0b10a75ccd980c5fae2c76de79221215c9b930faeaf302d30f87fa684e501bbdafe70bbcd3b221264e1

Download Submit
C:\Program Files\WinRAR\WinRAR.exe

Filesize
2.2MB

MD5
1e3a2a966f593ad33125f26916267008

SHA1
38b1a547ddee671edeee7385cac138458a6a6858

SHA256
b18c9b9200e354f81882b29dc8143ec5d6f2b731cf4c7da3800e339ffb3c8827

SHA512
928540f5d087fd2099b642f8e5b23c9f4b3924e57be95552f4f719d29644d8fbbd75d30a3d359aca895434617f087ca251657cb2871d5fc1bf840f961375301b

Download Submit
C:\Program Files\WinRAR\rarlng.dll

Filesize
955KB

MD5
1380c57e28c63098c683cb15d8af1523

SHA1
9b66bf5741aa6485097f7a82b45e5eefbac717cd

SHA256
8c2a093eb8f7907ea928accbbbeb1531925b8f76adbd176364e4dcaff32d0ab2

SHA512
299143e7ad7266136f77362156c2990269660986a2ec67be0addef288803bedf85a6e47b4342381042395775becc0f4d2dfdb75e7dc8670e9272f2ac92d039cc

Download Submit
\Program Files\WinRAR\Uninstall.exe

Filesize
383KB

MD5
94239a4bd897e66cdfc298fe5ce6e160

SHA1
3d91edacfe7307506df2368909fe5e6d01ef18b4

SHA256
c382b2af0e85b090333df7b7395d0022b9c5a4c026cf7761052128ed3ada5e0f

SHA512
9c6c9fcff255aad7363040ee82df390cef43a6a03c0f0eb13ba5f3bfb0ce8d811d296d25ee13242adb51a17f0326d3c6b385495bd04bf9116f0e1a3633a0c7d4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads