Overview
overview
8Static
static
3winrarx64-setup.exe
windows10-2004-x64
8winrarx64-setup.exe
windows11-ltsc_2024-x64
8$EXEDIR/wi...10.exe
windows10-2004-x64
6$EXEDIR/wi...10.exe
windows11-ltsc_2024-x64
6$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDIR/INetC.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
122s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 12:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
winrarx64-setup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
32 signatures
150 seconds
Behavioral task
behavioral2
Sample
winrarx64-setup.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
31 signatures
150 seconds
Behavioral task
behavioral3
Sample
$EXEDIR/winrar-x64-710.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral4
Sample
$EXEDIR/winrar-x64-710.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/INetC.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target winrarx64-setup.exe
- Size 3.6MB
- Sample261002-pgfg7shh29
- SHA256 0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616
- MD5 330122a06ff07116214ee6e544a4da67
- SHA1 ce5c450236bd4f20dfdae91884fd2ecff97ce3ff
- SHA512 b9f84cbb86c03a7aba325fc86e8a09754247fb211f073c02fc47f985262705c357bbf4d77dc5f9fa4c410fbc5459d6d748da8325e137bea5686cfff2d9775e71
- SSDEEP 98304:FHbqeBAq1toOr4onSgLKJCrJKL4fRxFiRy6xmPWS6+:F7qQ0onSwKJCrUL4Zx4TwPWm
- TLSH T182062315A3A858F5E2779334CC924217E6B27C254B31979F23E1079A3E373A0AE3D761
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5068 powershell.exe 1228 powershell.exe 4916 powershell.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 18 3708 winrarx64-setup.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 24 IoCs
pid Process 1852 winrar-x64-710.exe 2392 uninstall.exe 4716 RarExtInstaller.exe 3264 RarExtInstaller.exe 1252 WinRAR.exe 5572 RarExtInstaller.exe 2780 WinRAR.exe 6044 WinRAR.exe 4512 WinRAR.exe 4392 WinRAR.exe 5072 WinRAR.exe 1400 WinRAR.exe 3676 WinRAR.exe 2620 WinRAR.exe 2512 test.exe 1344 MicrosoftEdgeSecurity.exe 2000 MicrosoftEdgeSecurity.exe 1136 WinRAR.exe 4980 WinRAR.exe 5396 WinRAR.exe 5540 WinRAR.exe 1728 WinRAR.exe 4988 WinRAR.exe 2856 WinRAR.exe - Loads dropped DLL 5 IoCs
pid Process 3708 winrarx64-setup.exe 3708 winrarx64-setup.exe 3708 winrarx64-setup.exe 3708 winrarx64-setup.exe 3708 winrarx64-setup.exe - Modifies system executable filetype association 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WinRAR.exe - Drops desktop.ini file(s) 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\812257FAE4E90BDC70C3B52AECD6449F_FileGrabber\data\Desktop\desktop.ini MicrosoftEdgeSecurity.exe File created C:\Users\Admin\AppData\Local\Temp\812257FAE4E90BDC70C3B52AECD6449F_FileGrabber\data\Documents\desktop.ini MicrosoftEdgeSecurity.exe File created C:\Users\Admin\AppData\Local\Temp\812257FAE4E90BDC70C3B52AECD6449F_FileGrabber\data\Downloads\desktop.ini MicrosoftEdgeSecurity.exe - Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe - Drops file in Program Files directory 60 IoCs
description ioc Process File created C:\Program Files\WinRAR\ReadMe.txt winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\License.txt winrar-x64-710.exe File created C:\Program Files\WinRAR\UnRAR.exe winrar-x64-710.exe File created C:\Program Files\WinRAR\Zip32.SFX winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-710.exe File created C:\Program Files\WinRAR\Default.SFX winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\Rar.txt winrar-x64-710.exe File created C:\Program Files\WinRAR\RarFiles.lst winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst winrar-x64-710.exe File created C:\Program Files\WinRAR\Uninstall.exe winrar-x64-710.exe File created C:\Program Files\WinRAR\WinRAR.exe winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\Order.htm winrar-x64-710.exe File created C:\Program Files\WinRAR\7zxa.dll winrar-x64-710.exe File created C:\Program Files\WinRAR\WinRAR.chm winrar-x64-710.exe File created C:\Program Files\WinRAR\Default32.SFX winrar-x64-710.exe File created C:\Program Files\WinRAR\WinCon.SFX winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\Default.SFX winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll winrar-x64-710.exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File created C:\Program Files\WinRAR\Rar.txt winrar-x64-710.exe File created C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-710.exe File created C:\Program Files\WinRAR\Rar.exe winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\Default32.SFX winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\Zip32.SFX winrar-x64-710.exe File created C:\Program Files\WinRAR\Descript.ion winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\Descript.ion winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst winrar-x64-710.exe File created C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-710.exe File created C:\Program Files\WinRAR\WinCon32.SFX winrar-x64-710.exe File created C:\Program Files\WinRAR\RarExt32.dll winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-710.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-710.exe File created C:\Program Files\WinRAR\Zip.SFX winrar-x64-710.exe File created C:\Program Files\WinRAR\zipnew.dat uninstall.exe File created C:\Program Files\WinRAR\Order.htm winrar-x64-710.exe File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240732203 winrar-x64-710.exe File created C:\Program Files\WinRAR\License.txt winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\RarExt.dll winrar-x64-710.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\Rar.exe winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe winrar-x64-710.exe File created C:\Program Files\WinRAR\RarExt.dll winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\Resources.pri winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll winrar-x64-710.exe File created C:\Program Files\WinRAR\Uninstall.lst winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\WinCon32.SFX winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt winrar-x64-710.exe File created C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-710.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-710.exe File created C:\Program Files\WinRAR\Resources.pri winrar-x64-710.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX winrar-x64-710.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\EdgeUpdate\test.exe winrarx64-setup.exe File created C:\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exe test.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 200 cmd.exe 976 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 41 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname MicrosoftEdgeSecurity.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname winrarx64-setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname winrar-x64-710.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname uninstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain RarExtInstaller.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain winrar-x64-710.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain MicrosoftEdgeSecurity.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain uninstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname RarExtInstaller.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WinRAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WinRAR.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winrarx64-setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MicrosoftEdgeSecurity.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MicrosoftEdgeSecurity.exe - Delays execution with timeout.exe 1 IoCs
pid Process 5252 timeout.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.arj uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lzh uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ WinRAR.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2972 schtasks.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1228 powershell.exe 1228 powershell.exe 4916 powershell.exe 4916 powershell.exe 4916 powershell.exe 5068 powershell.exe 5068 powershell.exe 5068 powershell.exe 1344 MicrosoftEdgeSecurity.exe 1344 MicrosoftEdgeSecurity.exe 1344 MicrosoftEdgeSecurity.exe 1344 MicrosoftEdgeSecurity.exe 1344 MicrosoftEdgeSecurity.exe 1344 MicrosoftEdgeSecurity.exe 1344 MicrosoftEdgeSecurity.exe 1344 MicrosoftEdgeSecurity.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1252 WinRAR.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 2752 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1228 powershell.exe Token: SeIncreaseQuotaPrivilege 1228 powershell.exe Token: SeSecurityPrivilege 1228 powershell.exe Token: SeTakeOwnershipPrivilege 1228 powershell.exe Token: SeLoadDriverPrivilege 1228 powershell.exe Token: SeSystemProfilePrivilege 1228 powershell.exe Token: SeSystemtimePrivilege 1228 powershell.exe Token: SeProfSingleProcessPrivilege 1228 powershell.exe Token: SeIncBasePriorityPrivilege 1228 powershell.exe Token: SeCreatePagefilePrivilege 1228 powershell.exe Token: SeBackupPrivilege 1228 powershell.exe Token: SeRestorePrivilege 1228 powershell.exe Token: SeShutdownPrivilege 1228 powershell.exe Token: SeDebugPrivilege 1228 powershell.exe Token: SeSystemEnvironmentPrivilege 1228 powershell.exe Token: SeRemoteShutdownPrivilege 1228 powershell.exe Token: SeUndockPrivilege 1228 powershell.exe Token: SeManageVolumePrivilege 1228 powershell.exe Token: 33 1228 powershell.exe Token: 34 1228 powershell.exe Token: 35 1228 powershell.exe Token: 36 1228 powershell.exe Token: SeDebugPrivilege 4916 powershell.exe Token: SeIncreaseQuotaPrivilege 4916 powershell.exe Token: SeSecurityPrivilege 4916 powershell.exe Token: SeTakeOwnershipPrivilege 4916 powershell.exe Token: SeLoadDriverPrivilege 4916 powershell.exe Token: SeSystemProfilePrivilege 4916 powershell.exe Token: SeSystemtimePrivilege 4916 powershell.exe Token: SeProfSingleProcessPrivilege 4916 powershell.exe Token: SeIncBasePriorityPrivilege 4916 powershell.exe Token: SeCreatePagefilePrivilege 4916 powershell.exe Token: SeBackupPrivilege 4916 powershell.exe Token: SeRestorePrivilege 4916 powershell.exe Token: SeShutdownPrivilege 4916 powershell.exe Token: SeDebugPrivilege 4916 powershell.exe Token: SeSystemEnvironmentPrivilege 4916 powershell.exe Token: SeRemoteShutdownPrivilege 4916 powershell.exe Token: SeUndockPrivilege 4916 powershell.exe Token: SeManageVolumePrivilege 4916 powershell.exe Token: 33 4916 powershell.exe Token: 34 4916 powershell.exe Token: 35 4916 powershell.exe Token: 36 4916 powershell.exe Token: SeDebugPrivilege 5068 powershell.exe Token: SeIncreaseQuotaPrivilege 5068 powershell.exe Token: SeSecurityPrivilege 5068 powershell.exe Token: SeTakeOwnershipPrivilege 5068 powershell.exe Token: SeLoadDriverPrivilege 5068 powershell.exe Token: SeSystemProfilePrivilege 5068 powershell.exe Token: SeSystemtimePrivilege 5068 powershell.exe Token: SeProfSingleProcessPrivilege 5068 powershell.exe Token: SeIncBasePriorityPrivilege 5068 powershell.exe Token: SeCreatePagefilePrivilege 5068 powershell.exe Token: SeBackupPrivilege 5068 powershell.exe Token: SeRestorePrivilege 5068 powershell.exe Token: SeShutdownPrivilege 5068 powershell.exe Token: SeDebugPrivilege 5068 powershell.exe Token: SeSystemEnvironmentPrivilege 5068 powershell.exe Token: SeRemoteShutdownPrivilege 5068 powershell.exe Token: SeUndockPrivilege 5068 powershell.exe Token: SeManageVolumePrivilege 5068 powershell.exe Token: 33 5068 powershell.exe Token: 34 5068 powershell.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1852 winrar-x64-710.exe 1852 winrar-x64-710.exe - Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 3708 wrote to memory of 1228 3708 winrarx64-setup.exe 89 PID 3708 wrote to memory of 1852 3708 winrarx64-setup.exe 92 PID 1852 wrote to memory of 2392 1852 winrar-x64-710.exe 94 PID 2392 wrote to memory of 4716 2392 uninstall.exe 95 PID 2392 wrote to memory of 2756 2392 uninstall.exe 99 PID 2392 wrote to memory of 1252 2392 uninstall.exe 100 PID 1252 wrote to memory of 5572 1252 WinRAR.exe 101 PID 1252 wrote to memory of 2752 1252 WinRAR.exe 103 PID 2752 wrote to memory of 5088 2752 msedgewebview2.exe 104 PID 2752 wrote to memory of 2072 2752 msedgewebview2.exe 105 PID 2752 wrote to memory of 2072 2752 msedgewebview2.exe 105 PID 2752 wrote to memory of 2072 2752 msedgewebview2.exe 105 PID 2752 wrote to memory of 2072 2752 msedgewebview2.exe 105 PID 2752 wrote to memory of 4128 2752 msedgewebview2.exe 106 PID 2752 wrote to memory of 700 2752 msedgewebview2.exe 107 PID 2752 wrote to memory of 700 2752 msedgewebview2.exe 107 PID 2752 wrote to memory of 700 2752 msedgewebview2.exe 107 PID 2752 wrote to memory of 480 2752 msedgewebview2.exe 108 PID 2752 wrote to memory of 480 2752 msedgewebview2.exe 108 PID 2752 wrote to memory of 480 2752 msedgewebview2.exe 108 PID 2752 wrote to memory of 480 2752 msedgewebview2.exe 108 PID 2752 wrote to memory of 480 2752 msedgewebview2.exe 108 PID 2392 wrote to memory of 2780 2392 uninstall.exe 109 PID 2392 wrote to memory of 3120 2392 uninstall.exe 110 PID 2392 wrote to memory of 6044 2392 uninstall.exe 112 PID 2392 wrote to memory of 5428 2392 uninstall.exe 113 PID 2392 wrote to memory of 4512 2392 uninstall.exe 114 PID 2392 wrote to memory of 5696 2392 uninstall.exe 115 PID 2392 wrote to memory of 4392 2392 uninstall.exe 116 PID 2392 wrote to memory of 4696 2392 uninstall.exe 117 PID 2392 wrote to memory of 5072 2392 uninstall.exe 118 PID 2392 wrote to memory of 4700 2392 uninstall.exe 119 PID 2392 wrote to memory of 5124 2392 uninstall.exe 120 PID 2392 wrote to memory of 1400 2392 uninstall.exe 121 PID 2392 wrote to memory of 3676 2392 uninstall.exe 122 PID 2392 wrote to memory of 1668 2392 uninstall.exe 123 PID 3708 wrote to memory of 4916 3708 winrarx64-setup.exe 142 PID 3708 wrote to memory of 5068 3708 winrarx64-setup.exe 127 PID 2392 wrote to memory of 4832 2392 uninstall.exe 129 PID 2392 wrote to memory of 2620 2392 uninstall.exe 130 PID 3708 wrote to memory of 2512 3708 winrarx64-setup.exe 131 PID 2512 wrote to memory of 200 2512 test.exe 132 PID 200 wrote to memory of 2972 200 cmd.exe 134 PID 2512 wrote to memory of 1344 2512 test.exe 135 PID 2512 wrote to memory of 976 2512 test.exe 136 PID 976 wrote to memory of 5252 976 cmd.exe 138 PID 2392 wrote to memory of 1136 2392 uninstall.exe 141 PID 2392 wrote to memory of 4916 2392 uninstall.exe 142 PID 2392 wrote to memory of 4980 2392 uninstall.exe 143 PID 2392 wrote to memory of 2912 2392 uninstall.exe 144 PID 2392 wrote to memory of 5396 2392 uninstall.exe 146 PID 2392 wrote to memory of 4344 2392 uninstall.exe 147 PID 2392 wrote to memory of 4996 2392 uninstall.exe 148 PID 2392 wrote to memory of 5540 2392 uninstall.exe 149 PID 2392 wrote to memory of 1728 2392 uninstall.exe 150 PID 2392 wrote to memory of 4716 2392 uninstall.exe 151 PID 2392 wrote to memory of 4988 2392 uninstall.exe 152 PID 2392 wrote to memory of 5064 2392 uninstall.exe 153 PID 2392 wrote to memory of 2856 2392 uninstall.exe 154 PID 2392 wrote to memory of 5480 2392 uninstall.exe 155 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\winrarx64-setup.exe"C:\Users\Admin\AppData\Local\Temp\winrarx64-setup.exe"1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
-
C:\Users\Admin\AppData\Local\Temp\winrar-x64-710.exeC:\Users\Admin\AppData\Local\Temp\winrar-x64-710.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4716
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt4⤵PID:2756
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install5⤵
- Executes dropped EXE
PID:5572
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WinRAR.exe --webview-exe-version=7.10.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1252.5956.5843208525345717661 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc55⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView /prefetch:4 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x12c,0x194,0x7ffb310e5fd8,0x7ffb310e5fe4,0x7ffb310e5ff06⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.10.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,10998311446609613159,12443500789355057000,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc56⤵PID:2072
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.10.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2088 --field-trial-handle=1776,i,10998311446609613159,12443500789355057000,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc56⤵PID:4128
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.10.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2240 --field-trial-handle=1776,i,10998311446609613159,12443500789355057000,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc56⤵PID:700
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.10.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3424 --field-trial-handle=1776,i,10998311446609613159,12443500789355057000,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:16⤵PID:480
-
-
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
PID:2780
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt4⤵PID:3120
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
PID:6044
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt4⤵PID:5428
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
PID:4512
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt4⤵PID:5696
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
PID:4392
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt4⤵PID:4696
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5072
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt4⤵PID:4700
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt4⤵PID:5124
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
PID:1400
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
PID:3676
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt4⤵PID:1668
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt4⤵PID:4832
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2620
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
PID:1136
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt4⤵PID:4916
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
PID:4980
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt4⤵PID:2912
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
PID:5396
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt4⤵PID:4344
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt4⤵PID:4996
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
PID:5540
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
PID:1728
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt4⤵PID:4716
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
PID:4988
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt4⤵PID:5064
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
PID:2856
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt4⤵PID:5480
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\EdgeUpdate\'"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\EdgeUpdate\\test.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5068
-
-
C:\Windows\EdgeUpdate\test.exeC:\Windows\EdgeUpdate\\test.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c schtasks /create /tn "EdgeUpdate" /tr "C:\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exe" /sc minute /mo 5 /f /rl highest3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Windows\system32\schtasks.exeschtasks /create /tn "EdgeUpdate" /tr "C:\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exe" /sc minute /mo 5 /f /rl highest4⤵
- Scheduled Task/Job: Scheduled Task
PID:2972
-
-
-
C:\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exe"C:\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exe"3⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c timeout /t 3 /nobreak > nul & del /f /q "C:\Windows\EdgeUpdate\test.exe" & rmdir "C:\Windows\EdgeUpdate"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\system32\timeout.exetimeout /t 3 /nobreak4⤵
- Delays execution with timeout.exe
PID:5252
-
-
-
-
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" /install /local1⤵
- Executes dropped EXE
PID:3264
-
C:\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exeC:\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exe1⤵
- Executes dropped EXE
PID:2000
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\WinRAR\Rar.exe
- Size 793KB
- SHA256 4b5e9b4ca11942b3bccf0a6f9e1f6d2662155b8ec1e07b87eb2a1722e292956c
- MD5 c861ad70174fa8ddcaae02df6c98e76c
- SHA1 e9f35e687a1f5ff4b17bbbfcd6bd250a0d5f1e9b
- SHA512 a41b1ebf7f3ad911752a673b59d1a208a38c5166e09f9c1c7949e1bf15567f3027db6cf032a8c552370ddbdb6b3ef0144a8cc008658b6b31622724ad2a9a9194
- SSDEEP 12288:UctJOKPajKGDxhMTwaySQQ843KvWJPcQEj2Tcl9Ioz/zd3e/65Wo+7wv:7OKPajzDHjSllJPcZqTcPIihH5Q7wv
- TLSH T104057E1A9BF801FCE0FBE17889965917E7B7780603719B8F03E445AA1F673609E39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\Rar.txt
- Size 109KB
- SHA256 96095f21a8d96a332ac2b5e786f96bf9a3d3739540c00c673d775496d755bdbb
- MD5 afe729346b1da93b5718bdbf3ec131ab
- SHA1 9c0ff1466130086dd28b18b94f0eb648b0dfd31c
- SHA512 6f4304b35132419ed71ea4970bbb8f2cff069911224e26ed6cc09e38d6078daf83147f47c62ee4c5d7cb5af58a1bc9870b5d0d4b2a3f35aba2842ded7cbf5674
- SSDEEP 768:/oxQukh1SIfjcjKVbRZHqT9ExyYiHSzoOKyIMiN618e5xCwVxD+zb+WkOPMYuQ:/oxQuOKKV9Z69hS7KyIF61ZbFmiWBXh
- TLSH T16BB3C8277E8F1371257201965F19A199E31090EF371F169538ED838C7F3A8A292F66EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\RarExtInstaller.exe
- Size 206KB
- SHA256 9ba66ba2c0726b2ceab6c311ce825ad1b7a54aa468c2d2a1701c3ea643b8ee25
- MD5 264f0e447ecedd017434a4d93a5da9fb
- SHA1 ddee482cc55c61ccc0883fc392f68aad3ed36360
- SHA512 63a0f2ca36062ff8b599b777c36d4dcbc708888a607fdc95a30a41993ccb7fb64d6a94754cb94f035abd8244d8a2ee9af84d199ff36dfe5dbb0f93bedba719f7
- SSDEEP 3072:JRW0EXiMfSAQ818EHWarmU5cRKPPY6R3EX44kAtVkTrKlasDtFNS:UiySBw3WaCU5coHNULkZKXxXS
- TLSH T16E247B46B3F400E4E577D13588564212FB32782517249BDF27A0437A9F33BA2EE3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\RarExtPackage.msix
- Size 23KB
- SHA256 3b90e67a0e67800c2f7cd6afa6f80af12ec74aebb0e125a14138e4bf3813db5c
- MD5 308f1be82dd00c4a45bce5be83889d47
- SHA1 3ae1dba242fa08c3dc148e8d46e45a7dc8259228
- SHA512 1e252e052bd9f3c6dab4d211fc6ca21d2ca81333c8de4e9df9235453c851edc74e464803fde09356e57dce007fe21ca378b0facc14ba2df2ba10a5563f28d953
- SSDEEP 384:tyR015ziBz4oqvhFv+qkD7m0fxPZA7SxEDHV6sZd3NsRDXjSvVl5gEBp+LmnSZhN:KYzMzHshFvbkDaoZ76MsZd3SzSv5gMU/
- TLSH T1B5B2CFF1B24E28A7D73D8975C7020D606A34EEA0205BCE553BD6342492E4F35039BBAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\UnRAR.exe
- Size 531KB
- SHA256 9db04f7564a40335c3302a927f604288cd6082d8a0eefd01038d9d5cc9808fa4
- MD5 0a3e5786cdc992f867f4227d8ca72879
- SHA1 f9f400a685be8411f511c8f73caef2fd9873b359
- SHA512 9c049c54b23e5dd530e049972cc38285398b08f7d6ca58f63af911fd84740858850354765bd848d14ac0aaf36ffe6f653f4ff112f879f15e42a59e4872079ab6
- SSDEEP 12288:zxSaM90m6BXIupStE+nPaEeGTX0QNgFR8v9887wH:zrM90myXi7PteG70qv9887wH
- TLSH T1A9C47C9597E801F8F0F7A67889A20902FB7B784506B19B4F03E4857B2F673519E3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\Uninstall.exe
- Size 383KB
- SHA256 1347fb8a07082920c357cbcbdd95d0f95d24b13903edc955e62738e952d8c9a1
- MD5 87cac2dd7f8bd59952e448c18b64f423
- SHA1 7551c56b9e63f4a3667a0bd8294a6a79c8fd5e6a
- SHA512 e1a0f849b6bcb4870a563e42ba4202d94009f3f2731b10e425238aec42f4d626916107bc01ee1d2da94ffcb05b31d860afde0409780afd02e48ed9c8fb6d052a
- SSDEEP 6144:4JzGGFTYROoY+oy1o6bVKxGfLGvgOUxPNmYeD7pdIII+Sn5HBK7jcDw0:4wwoY6o2VKxGfLgQNL+dIIvS5ejcDJ
- TLSH T140848C1DA3E409F9E9BBD23DC5924607E2723C558F71D38F03A5065A2E23690DD3EB62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WhatsNew.txt
- Size 52KB
- SHA256 96885512e883c8bca77c82e059fda6b060086146270c7b41ad94970d6adc878b
- MD5 6a10a5b06624c96e858ef2106047a6a8
- SHA1 505f4b59730907fd3aa4938fa650e076722b12a4
- SHA512 edb1a8bd21eb69ad984c7f4cb51f79e00c50d785c36799a90caefa850b19404a7dfb5ac4c58cd52a561d249ff7ae38910e27e361f18fe5b9d28d37ab79cbff05
- SSDEEP 768:qkJimpZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:qkJ/pl41kVxwXicDYb3fXxuqoR
- TLSH T1DC33A6237D9A127129B242856E166295F31861BF370B42C4796C838C3F369A7D3F72F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WinRAR.chm
- Size 324KB
- SHA256 abf0d987456f907fd4fca9b0427b575d143b5b4506f1f55d5f42ad4ace728db0
- MD5 bc5cef210f388e582d0b5d8cf4c28824
- SHA1 f4592d693c0400d4087b8263db62f3489af204b7
- SHA512 ffe652c3cc38b7557d58ae9399a405aea39756c5de77cc5e90c5fc7a5e103c54a90d9e423ecefcc1d8344be5d50cb2e9a9f59a67568562d508809f7da88497f8
- SSDEEP 6144:UxkGOFunZoMOCaUqBeNvBoJnaaBCOA4+JpOyOwEyHES4hPa:QNOGfVq0JobBkTOyOwyk
- TLSH T1146412692CFD4431D9A13E3ACDCE23DD171825FAAAD53B196E1F103468D0FCDA818B56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WinRAR.exe
- Size 3.2MB
- SHA256 f0eeddb2efeee20f1e94d55fa2012c38db6409502537acd72f1f446ec2525495
- MD5 b92d17bd2752dfbbb25eb5172d26b32e
- SHA1 2b34c345aa4e7e07a9ffb879455844be46cd586b
- SHA512 c45b2c8c969a4922224c74c62a8e48f0d410f0b566efc70a547578abaaacc18a011de1f6a8ed34f7a1d6e2fb1e9347a937eda506fe85943383fed1ab91671964
- SSDEEP 49152:/Jq/x+m/Pu6THsMpKhi2CyDOe8HOz97uIgUQ/kUejuOXk0jdEKBH4i4:/JvPMpv/35KuO00j9BH4i4
- TLSH T1A7E58E06A7F805ACE0FBE2789D568603D77BB8090371974F039099A62F673A1DE7D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
- Size 727B
- SHA256 e4b71667d0e8c70afc6cced7282fd3ee21e184b01940248fc7b493dd04b604e5
- MD5 5a60b30abb064380ad54a0149a5183d8
- SHA1 60a5bfdd2431b5968478da967d6753a40a7d34bc
- SHA512 0eca6d9899d69b797ffc3d37f18480a35fb580162072d24d75b572a9a52a2e34ce128900b7b47a21e4f57329256086b0fd2ceeb696f6beaa2728ac44734008ea
- TLSH T12001650A992DE7F0D9108D388E158E76F1926226613AD88D02A756606ADA3011EF0F21
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 307db0fb56225eedd300dafb363d7b91db4e02c6c5d308c0b36c7bcb06d67d90
- MD5 a945b09f6acdc44d1ea34f30071119d7
- SHA1 32b494f5767b7a00ae716f5b62889f8fcd05e4da
- SHA512 bb37807220b24bdd5200664b69c4f9bd808e9879d3dd65e309c43dd9ba3856d0a315088e56c8179d069f14008abf6148ce10ad24ed25fa57ce148d59135d2f22
- TLSH T1FE0115430962BF007D514C46B7ADD9F472B1018E10C007B3B679104656DA2F6A6404B9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
- Size 404B
- SHA256 cdc47005ff964bf62c8133286e624b0945110272b0152db35e75e0b2542403e2
- MD5 e454bf5e2743bbddbf2eb8155f0ecd54
- SHA1 5fa6f836fbb5f84dd7d125681e740057ab7df64b
- SHA512 5dc15371bf6ab6e4183f408cd59e5a0761a55a432e800e565a163a80d15b4885bfd35db07cb5f17352f06aec7ac30745250feff7258e6091ca21588a36f71560
- TLSH T1EFE0C07431F9410DF0F49D3403F698214A89F1060505825D05409617DD19F004CD2924
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 7fa1bf84bfe8f8551ac1e372b26e47bb5acff68bf54b1ea955c97429cb5b634a
- MD5 1c557006baaf83d5eacb88c4450d7d4f
- SHA1 3ed6a2ea108eeba3cc5d9b21ba724f3bb3b7b702
- SHA512 6af93929b91cd5ef3d4dbf8dde21602f97d7dd213d6c44c27c1a5e5e9119a2d081c7ffd76582ced5b7f3c8c8afbe70c965c2c5081317863dcb783ef014745e44
- TLSH T1F7E0683C27AB650EF050893482FAA0710D49E2091040937906800308BB0AF009C219B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 21KB
- SHA256 c1288fef0548e802e59fedeb082e402f2251f8e29d314ac8d032b06265a96016
- MD5 6ef8e5cfff18292d0caadac9b2969839
- SHA1 63f64b9fefaf2014d33fa7569da752ade93370c5
- SHA512 873b34fea94c9e760baa70ba131035fb4e7262e669234516eedac8d7cd9f61564847f9bbc2828b15ae568813c8ed9550fc08346eadc36629993d32dacb4cc19a
- SSDEEP 384:H1eBaoT1iBGXGW14bAE+ffwm1TlFu0zCjr2Pn5IAkF4hiVWdu8PKl8vYbhNzPMlb:VexZ6GWWiv+Xwm1TW16RIAkOiTdzbhNg
- TLSH T121A2C478213F6DC7D8D226B010D50AE7FBE4D489DAB611D4BF1BDE2F4C90EB64A60524
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 21KB
- SHA256 ffe73df1c5bf9f8d6b18f3b364f7326b843cd2acab57d833c080710ca3cef661
- MD5 e30cb3094b286825f9a3cfef02a2a78f
- SHA1 2f067f523a34eecd4b98f2c2e1ee125ca514db79
- SHA512 f866baccc9c88cb069b4359060611a2ec97378b8f8a9588aa0b09b7be83a2eaa81ced0373c8f149ab488f4704cd121bc522a43daf8d5ad6cbed1379cfd86e3d6
- SSDEEP 384:O2b1eBaoT1iBGqGlblXhe4WziCZnCk22PtWOEPiUDzdC0MIAWLF45WGlvoDqRKFq:O2ZexZ6GxlhXhLWziOUN6UFC0MIAkCfJ
- TLSH T1FAA21928226F9DCBE88161B800920396FBF4D159E9E552DBEF0FC92F2C4197E5E501F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\6c898bf0-2a6a-4984-91b8-12bad3faeb23.tmp
- Size 3KB
- SHA256 2a60308d45a4878fc8939cb781af3433cd04bfce29b39b50b474b8a93fcb6275
- MD5 615efa2f6c90b6675391ec7896fb829b
- SHA1 fffb306697162edb0c625d2959e552521e57868a
- SHA512 4bea3d7bcf58c0b75a1d8c647a55eda31e3673edccbe099d4198cb8d57d4c6b6e040c87a52b196cef6745c56e71bb32d26edcbafe46c4324b144a9f2cc4632c9
- TLSH T1836194336934BA2B5EF3990579863B1AA7A06123E4C57F94D6ED0F1C01C32882342C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\851996ab-7c36-4f25-8270-0086257d019a.tmp
- Size 2KB
- SHA256 377fd09de29cfa4ee38c640f4e4f78692eba9ab55d93d9e59db81fd2059ca8b8
- MD5 b74efe2b905a795f808deba60e891470
- SHA1 272e9a8d0791989e576f5808d1edff9ff9a76db4
- SHA512 aed4f65c9426a43d6a65adf04d2bd407cec2cd305c68553b7109f331b640a1c2fbcd7f1fefbf29c64ce87d359499f4021a7d921e3d3666e89c9aac9837535ca4
- TLSH T1DE5194736D247B3B9EA355083A4A7E2B8EA47152AA926F50A6DE4B1C01C355D2343C3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 960eabb6f36162aac58cf5b0e3dbffc21d62512e8a14c5ee5c5b973af7ec4a48
- MD5 c811e3a77748eacbcb79d350e56bddf8
- SHA1 c7d90fa89445aff3ef839a064c140061d935aec6
- SHA512 9335ee852de2ce0718ef5b5a5e0197a1904172f8aff58bfeb37557c5bef7bedbf31ab7f0b72b9daffe52d3d9b4a82a2888b7f0f60930e389b270afd447ae9550
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 6e18ba1003c1bdac3dc689dcced61244fcfcd0ba54e6025741470d20c5367734
- MD5 aa10d5b116fbbb4025419544a71d21a6
- SHA1 58ce995c7a44e664aecb1939e5b42bfc67aff0a4
- SHA512 e0fa026013d70cd5ae9ff1196f88f21699cce7fe69e3b5e60fb02a9cf3b053aaf0a7c525a54bb89db70dd98fd1c1fcd4e4692457f0eeead7449f1909cd76e7c4
- TLSH T18FD01223B3020234C0103033041376080440C22F41054140A828859E1A040A11E1EC45
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Cache\Cache_Data\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Cache\Cache_Data\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GrShaderCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GrShaderCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
- Size 1KB
- SHA256 58f9b9115f043aa2c21a66938e5dff14c90bd522b5f5c2e9281a5fb9e24f86d9
- MD5 7d5dc42278743b00d394b38c09bee894
- SHA1 1a0a5a9e188959611031cb74406bef19b8670bd3
- SHA512 deed29e4b755fc3fc81d387769fe85911e1ddff402c1c76e6d44a5aef1cc80de7bd8bf8396fd986db20963a0d9974c3b6897c1a0eacb15498ad4aca738bfc511
- TLSH T1272140B3E9347B376D92250A2646BA6F1E6030679190DF00B1DECB2C02D308EE21AD36
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\d4502823-f202-41c1-b0d7-4fd9048f223e.tmp
- Size 3KB
- SHA256 3f87c4615c7e2aa06df82122e76012257be9f2f9389a12b31a957016f008820b
- MD5 24210068cc660eec7f5f602a3fcf9d3b
- SHA1 eee05f73d02c8bf22d4846def1f65c7d1f563346
- SHA512 5508a1a9d993263e8d18b137204e81054c5f6015aeca52e99d679837452230f30c20b923840520d665521959399e89e58e0b624afc325f26d724e58ac273f469
- TLSH T19A71D6236974B92B5EF3D90579863B0BA7A46123E4C57F98DAED0F1D01D72891343C23
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vhbnhsy4.s4z.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsd24F4.tmp\INetC.dll
- Size 25KB
- SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
- MD5 40d7eca32b2f4d29db98715dd45bfac5
- SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
- SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
- SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
- TLSH T1F0B2F99257EA179AF7BAAB3478B9E762497FBC211821CCCF5533068D1872241ED30727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsd24F4.tmp\nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winrar-x64-710.exe
- Size 3.6MB
- SHA256 fd635707f7b8f122efff39da595541627bcde249eb31596cc09d757f476b9523
- MD5 468b0488243d15750b3cdecfa265093e
- SHA1 4735ce24fb34e9100effe00dbe514f604accbf07
- SHA512 0b1f516cea22df2c36c96dc97ab0b0ae1832c1feb20c8cbbf0c5c1c289c5941fbcef25e054bc78f09b9c9cb54d0bc22d5ea028810326824e1f91fb6ef73b4c96
- SSDEEP 98304:hbqeBAq1toOr4onSgLKJCrJKL4fRxFiRy6xmPWS6V:JqQ0onSwKJCrUL4Zx4TwPWN
- TLSH T1E2062319E7A858F5E1779278CC920207E6B27C254731979F22E1079B2F373A0AE3D761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
- Size 12B
- SHA256 bd158836e4c967ba625a386cef754774eeb7c8b2f5a4cb46c5f0a8c26f4a2d31
- MD5 511ca4e6f81ef06faa6a3d4fb08d6f62
- SHA1 b9b83dc1942a2a44d92e9afbe0134b57228af185
- SHA512 9885b861345895d1a6ee89094e5f57c44a5d6cd5e8d15541e662438ab85e8e9f5f44bab163750ba220fc6d45db5bc4d952cb82c978071f86b3e7cdb14fa13fa5
- MD5 SHA1 SHA512
- Path C:\Windows\EdgeUpdate\test.exe
- Size 3.1MB
- SHA256 f6e71c379e3c0b25b7be83b78f19e2950c8ee1dcc3829ca44b42099e4c9e194b
- MD5 b507f957d814d58e9a9290e12a1b8dc4
- SHA1 e684e742b6c3bf1f44ee9659bf6e1bfa4f2cddef
- SHA512 6c1ce6fabd00a655be50508ba4d9b3fa4c727b97c60f6fcabd09439edbab1e820cdc0d4877526939604564bd9d50e0a898f80532393a8d23c70698d48ed76a20
- SSDEEP 49152:x2JzNh2hpnzsQcooItwqqnSie8n8tCRIfgRTua+teofGDCZv3zuaN1ZHiHhPyQUl:xmIscdYUDkNg
- TLSH T1D8E58D09A3A900E9E027C17CCA578617EB72B40513359AFB5A928D573F23BF1673E721
- MD5 SHA1 SHA512 SSDEEP TLSH