Overview

overview

6

Static

static

1

winrar-x32-701b1.exe

windows10-2004-x64

6

winrar-x32-701b1.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/10/2026, 00:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    winrar-x32-701b1.exe
  • Size 3.4MB
  • Sample261017-arpfjayz2l
  • SHA256 ac90edad856130b787116e0218c9f2efe8a45cc038dbe6226b48d6cf7f70f69a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 42 IoCs
  • Executes dropped EXE 15 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\winrar-x32-701b1.exe
    "C:\Users\Admin\AppData\Local\Temp\winrar-x32-701b1.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Program Files (x86)\WinRAR\uninstall.exe
      "C:\Program Files (x86)\WinRAR\uninstall.exe" /setup
      2⤵
      • Checks computer location settings
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Modifies system executable filetype association
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\WinRAR\WhatsNew.txt
        3⤵
        • System Location Discovery: System Language Discovery
        PID:884
      • C:\Program Files (x86)\WinRAR\WinRAR.exe
        "C:\Program Files (x86)\WinRAR\WinRAR.exe"
        3⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:708
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.1 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=708.4828.2031360902255726062
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of WriteProcessMemory
          PID:4884
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffd3f44b078,0x7ffd3f44b084,0x7ffd3f44b090
            5⤵
              PID:2892
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1772,i,6875455636592895567,10255528230588965216,262144 --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:2
              5⤵
                PID:2100
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2084,i,6875455636592895567,10255528230588965216,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
                5⤵
                  PID:4200
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2088,i,6875455636592895567,10255528230588965216,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
                  5⤵
                    PID:1724
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3680,i,6875455636592895567,10255528230588965216,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
                    5⤵
                      PID:1416
                • C:\Program Files (x86)\WinRAR\WinRAR.exe
                  "C:\Program Files (x86)\WinRAR\WinRAR.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:1848
                • C:\Windows\SysWOW64\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\WinRAR\WhatsNew.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4544
                • C:\Program Files (x86)\WinRAR\WinRAR.exe
                  "C:\Program Files (x86)\WinRAR\WinRAR.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of SetWindowsHookEx
                  PID:2324
                • C:\Windows\SysWOW64\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\WinRAR\WhatsNew.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3712
                • C:\Windows\SysWOW64\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\WinRAR\WhatsNew.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2868
                • C:\Program Files (x86)\WinRAR\WinRAR.exe
                  "C:\Program Files (x86)\WinRAR\WinRAR.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of SetWindowsHookEx
                  PID:3776
                • C:\Program Files (x86)\WinRAR\WinRAR.exe
                  "C:\Program Files (x86)\WinRAR\WinRAR.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2748
                • C:\Windows\SysWOW64\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\WinRAR\WhatsNew.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1232
                • C:\Windows\SysWOW64\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\WinRAR\WhatsNew.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4880
                • C:\Program Files (x86)\WinRAR\WinRAR.exe
                  "C:\Program Files (x86)\WinRAR\WinRAR.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of SetWindowsHookEx
                  PID:4432
                • C:\Windows\SysWOW64\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\WinRAR\WhatsNew.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4136
                • C:\Program Files (x86)\WinRAR\WinRAR.exe
                  "C:\Program Files (x86)\WinRAR\WinRAR.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:4132
                • C:\Program Files (x86)\WinRAR\WinRAR.exe
                  "C:\Program Files (x86)\WinRAR\WinRAR.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of SetWindowsHookEx
                  PID:1916
                • C:\Windows\SysWOW64\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\WinRAR\WhatsNew.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4852
                • C:\Program Files (x86)\WinRAR\WinRAR.exe
                  "C:\Program Files (x86)\WinRAR\WinRAR.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of SetWindowsHookEx
                  PID:5060
                • C:\Windows\SysWOW64\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\WinRAR\WhatsNew.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2708
                • C:\Program Files (x86)\WinRAR\WinRAR.exe
                  "C:\Program Files (x86)\WinRAR\WinRAR.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of SetWindowsHookEx
                  PID:1836
                • C:\Windows\SysWOW64\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\WinRAR\WhatsNew.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:748
                • C:\Windows\SysWOW64\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\WinRAR\WhatsNew.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4892
                • C:\Program Files (x86)\WinRAR\WinRAR.exe
                  "C:\Program Files (x86)\WinRAR\WinRAR.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of SetWindowsHookEx
                  PID:1172
                • C:\Program Files (x86)\WinRAR\WinRAR.exe
                  "C:\Program Files (x86)\WinRAR\WinRAR.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3812
                • C:\Windows\SysWOW64\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\WinRAR\WhatsNew.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1904
                • C:\Windows\SysWOW64\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\WinRAR\WhatsNew.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1320
                • C:\Program Files (x86)\WinRAR\WinRAR.exe
                  "C:\Program Files (x86)\WinRAR\WinRAR.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1612
                • C:\Program Files (x86)\WinRAR\WinRAR.exe
                  "C:\Program Files (x86)\WinRAR\WinRAR.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of SetWindowsHookEx
                  PID:5008
                • C:\Windows\SysWOW64\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\WinRAR\WhatsNew.txt
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2908

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  Rar.exe
                  • Path C:\Program Files (x86)\WinRAR\Rar.exe
                  • Size 764KB
                  • SHA256 a3f14b382daed078d64ae6f06a8dec0add2a0702efa4561feca950523572fccf
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Rar.txt
                  • Path C:\Program Files (x86)\WinRAR\Rar.txt
                  • Size 105KB
                  • SHA256 59e40b34b09be2654b793576035639c459ad6e962f9f9cd000d556fa21b1c7cd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  UnRAR.exe
                  • Path C:\Program Files (x86)\WinRAR\UnRAR.exe
                  • Size 488KB
                  • SHA256 ec7ffaa3f8b5c2f060d6042a10f50f17b4404da0712d98084a89db445922dab8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Uninstall.exe
                  • Path C:\Program Files (x86)\WinRAR\Uninstall.exe
                  • Size 427KB
                  • SHA256 8b6bbfbe72c16d06e2c59d5dbff28161a4da1a73f69432a2ee910ba1e2d09a1a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  WhatsNew.txt
                  • Path C:\Program Files (x86)\WinRAR\WhatsNew.txt
                  • Size 45KB
                  • SHA256 a536a510d54804b5b673192d83aab6e80475bbb524eac6741b56640b1f7015d0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  WinRAR.chm
                  • Path C:\Program Files (x86)\WinRAR\WinRAR.chm
                  • Size 316KB
                  • SHA256 3f4e0f977534a18e2b75da514b462f8892af16a85bde6d9f15cb1645b5d4e821
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  WinRAR.exe
                  • Path C:\Program Files (x86)\WinRAR\WinRAR.exe
                  • Size 3.2MB
                  • SHA256 583169f06e2b0cb1e56da558605eb43aec842892ddeee39274859b157203f0b5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  0103c511-43e3-482e-9557-a4fc27fbedb5.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\0103c511-43e3-482e-9557-a4fc27fbedb5.tmp
                  • Size 4KB
                  • SHA256 287e2fbe9e9c107594bdcf75426fc3ebb8ed153c57016da343ec5756929f8f1b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 7e8c0a34f3609c5db466c8f0f59d899454029d4495b7eb7e65cf1321e3abf250
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 9d7379fc6b492fac687f555f643126a42528ba207c95e1f164e9198d37e54c9d
                  • MD5 SHA1 SHA512
                  Submit Download

                  throttle_store.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
                  • Size 20B
                  • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                  • MD5 SHA1 SHA512
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
                  • Size 264KB
                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  index
                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\index
                  • Size 256KB
                  • SHA256 fd767bc142616d61810d65aa142000ee185c27d424996d2cac4e895eb799caae
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\GPUCache\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\GPUCache\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\GPUCache\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  SCT Auditing Pending Reports
                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
                  • Size 2B
                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                  • MD5 SHA1 SHA512
                  Submit Download

                  MANIFEST-000001
                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
                  • Size 41B
                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                  • MD5 SHA1 SHA512
                  Submit Download

                  CURRENT
                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                  • Size 1KB
                  • SHA256 073a2848c4d49f130b8ed9de72f8c624eaaa96fce5a6388e4ca7717b4a49578a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ce42445a-53b5-42d9-ab81-fc8f250702ce.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\ce42445a-53b5-42d9-ab81-fc8f250702ce.tmp
                  • Size 3KB
                  • SHA256 180469094febdff280aedebf6ee2c595e400d2b41a3c292c68051124aeefd751
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  eb4a792b-7324-4800-baeb-bbc284204786.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\eb4a792b-7324-4800-baeb-bbc284204786.tmp
                  • Size 2KB
                  • SHA256 b6f5e2d564ad25e5818fdce9866d3482f6337b951ad604a8a98696dc23b14e66
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  fb06f364-e762-466a-806d-7cc51fcde8fd.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\fb06f364-e762-466a-806d-7cc51fcde8fd.tmp
                  • Size 1KB
                  • SHA256 b22fe9816a5f80b8dfcb33d369f2f0842e26f697cbc8b0ab33a82f3006931ac4
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  version.dat
                  • Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
                  • Size 12B
                  • SHA256 5a432483dd5b56464a6a125a8664fee9c1053b0ea5dbe6067a66a466451b1a14
                  • MD5 SHA1 SHA512
                  Submit Download

                  memory/1416-217-0x00007FFD5C3F0000-0x00007FFD5C3F1000-memory.dmp
                  Download

                  memory/1724-150-0x00007FFD5C430000-0x00007FFD5C431000-memory.dmp
                  Download

                  memory/1724-149-0x00007FFD5AE90000-0x00007FFD5AE91000-memory.dmp
                  Download

                  memory/1724-385-0x000001A9539C0000-0x000001A9539F0000-memory.dmp
                  Download

                  memory/2100-93-0x00007FFD5C3F0000-0x00007FFD5C3F1000-memory.dmp
                  Download