Overview

overview

6

Static

static

1

winrar-x64-701b1.exe

windows10-2004-x64

6

winrar-x64-701b1.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/10/2026, 00:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    winrar-x64-701b1.exe
  • Size 3.7MB
  • Sample261017-arpfjayz2n
  • SHA256 8249444b8ec33512027cde2bd6edb51bea9e9b4f35c4b261319d7a52d3befffc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 60 IoCs
  • Executes dropped EXE 15 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\winrar-x64-701b1.exe
    "C:\Users\Admin\AppData\Local\Temp\winrar-x64-701b1.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4624
    • C:\Program Files\WinRAR\uninstall.exe
      "C:\Program Files\WinRAR\uninstall.exe" /setup
      2⤵
      • Checks computer location settings
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3460
      • C:\Program Files\WinRAR\WinRAR.exe
        "C:\Program Files\WinRAR\WinRAR.exe"
        3⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2556
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.1 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=2556.4916.13426233392188495884
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of WriteProcessMemory
          PID:1564
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x10c,0x188,0x7ffc5d81b078,0x7ffc5d81b084,0x7ffc5d81b090
            5⤵
              PID:876
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1748,i,5147437128717520453,5528004091075095330,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
              5⤵
                PID:4984
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2068,i,5147437128717520453,5528004091075095330,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:3
                5⤵
                  PID:4288
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2416,i,5147437128717520453,5528004091075095330,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
                  5⤵
                    PID:4764
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3692,i,5147437128717520453,5528004091075095330,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
                    5⤵
                      PID:3696
                • C:\Windows\system32\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                  3⤵
                    PID:3076
                  • C:\Program Files\WinRAR\WinRAR.exe
                    "C:\Program Files\WinRAR\WinRAR.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4676
                  • C:\Windows\system32\NOTEPAD.EXE
                    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                    3⤵
                      PID:4460
                    • C:\Windows\system32\NOTEPAD.EXE
                      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                      3⤵
                        PID:4636
                      • C:\Program Files\WinRAR\WinRAR.exe
                        "C:\Program Files\WinRAR\WinRAR.exe"
                        3⤵
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious behavior: GetForegroundWindowSpam
                        • Suspicious use of SetWindowsHookEx
                        PID:4172
                      • C:\Windows\system32\NOTEPAD.EXE
                        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                        3⤵
                          PID:3168
                        • C:\Program Files\WinRAR\WinRAR.exe
                          "C:\Program Files\WinRAR\WinRAR.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious behavior: GetForegroundWindowSpam
                          • Suspicious use of SetWindowsHookEx
                          PID:4492
                        • C:\Program Files\WinRAR\WinRAR.exe
                          "C:\Program Files\WinRAR\WinRAR.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious behavior: GetForegroundWindowSpam
                          • Suspicious use of SetWindowsHookEx
                          PID:1328
                        • C:\Windows\system32\NOTEPAD.EXE
                          "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                          3⤵
                            PID:3872
                          • C:\Windows\system32\NOTEPAD.EXE
                            "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                            3⤵
                              PID:2372
                            • C:\Program Files\WinRAR\WinRAR.exe
                              "C:\Program Files\WinRAR\WinRAR.exe"
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:4056
                            • C:\Windows\system32\NOTEPAD.EXE
                              "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                              3⤵
                                PID:4120
                              • C:\Program Files\WinRAR\WinRAR.exe
                                "C:\Program Files\WinRAR\WinRAR.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:2592
                              • C:\Program Files\WinRAR\WinRAR.exe
                                "C:\Program Files\WinRAR\WinRAR.exe"
                                3⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of SetWindowsHookEx
                                PID:3240
                              • C:\Windows\system32\NOTEPAD.EXE
                                "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                                3⤵
                                  PID:1144
                                • C:\Program Files\WinRAR\WinRAR.exe
                                  "C:\Program Files\WinRAR\WinRAR.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2780
                                • C:\Windows\system32\NOTEPAD.EXE
                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                                  3⤵
                                    PID:1168
                                  • C:\Windows\system32\NOTEPAD.EXE
                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                                    3⤵
                                      PID:2368
                                    • C:\Program Files\WinRAR\WinRAR.exe
                                      "C:\Program Files\WinRAR\WinRAR.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: GetForegroundWindowSpam
                                      • Suspicious use of SetWindowsHookEx
                                      PID:3376
                                    • C:\Windows\system32\NOTEPAD.EXE
                                      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                                      3⤵
                                        PID:4384
                                      • C:\Program Files\WinRAR\WinRAR.exe
                                        "C:\Program Files\WinRAR\WinRAR.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4232
                                      • C:\Windows\system32\NOTEPAD.EXE
                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                                        3⤵
                                          PID:5096
                                        • C:\Program Files\WinRAR\WinRAR.exe
                                          "C:\Program Files\WinRAR\WinRAR.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • Modifies registry class
                                          • Suspicious behavior: GetForegroundWindowSpam
                                          • Suspicious use of SetWindowsHookEx
                                          PID:212
                                        • C:\Windows\system32\NOTEPAD.EXE
                                          "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                                          3⤵
                                            PID:3220
                                          • C:\Program Files\WinRAR\WinRAR.exe
                                            "C:\Program Files\WinRAR\WinRAR.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious behavior: GetForegroundWindowSpam
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3492
                                          • C:\Program Files\WinRAR\WinRAR.exe
                                            "C:\Program Files\WinRAR\WinRAR.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Modifies registry class
                                            • Suspicious behavior: GetForegroundWindowSpam
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1840
                                          • C:\Windows\system32\NOTEPAD.EXE
                                            "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                                            3⤵
                                              PID:4992

                                        Network

                                              MITRE ATT&CK Enterprise v16

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              Rar.exe
                                              • Path C:\Program Files\WinRAR\Rar.exe
                                              • Size 744KB
                                              • SHA256 208613236687804f6343178c4e1e2a7b6a1280b8292e4d4732a72fd266898843
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Rar.txt
                                              • Path C:\Program Files\WinRAR\Rar.txt
                                              • Size 105KB
                                              • SHA256 59e40b34b09be2654b793576035639c459ad6e962f9f9cd000d556fa21b1c7cd
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              RarExtInstaller.exe
                                              • Path C:\Program Files\WinRAR\RarExtInstaller.exe
                                              • Size 181KB
                                              • SHA256 fbc99c83873157dc43348a7a93da7ac13f3b67d2a6bcb87b3eb4589c74980d4e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              UnRAR.exe
                                              • Path C:\Program Files\WinRAR\UnRAR.exe
                                              • Size 494KB
                                              • SHA256 53f89f7166525413cda9c420fbb8ace83e7451e1728c6bd0397c20b24a8f607c
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Uninstall.exe
                                              • Path C:\Program Files\WinRAR\Uninstall.exe
                                              • Size 477KB
                                              • SHA256 33710e85281cca1fb2affec27e2e865daba06d09902e13e737062c74dc06be91
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              WhatsNew.txt
                                              • Path C:\Program Files\WinRAR\WhatsNew.txt
                                              • Size 45KB
                                              • SHA256 a536a510d54804b5b673192d83aab6e80475bbb524eac6741b56640b1f7015d0
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              WinRAR.chm
                                              • Path C:\Program Files\WinRAR\WinRAR.chm
                                              • Size 316KB
                                              • SHA256 3f4e0f977534a18e2b75da514b462f8892af16a85bde6d9f15cb1645b5d4e821
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              WinRAR.exe
                                              • Path C:\Program Files\WinRAR\WinRAR.exe
                                              • Size 3.1MB
                                              • SHA256 f066e5a325f0c743bdf9153ba4d7b8dcf3db85bc0521ec5608ebbe96485ca0a2
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              46fc9406-f44f-483e-be3a-95a983b56dac.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\46fc9406-f44f-483e-be3a-95a983b56dac.tmp
                                              • Size 4KB
                                              • SHA256 ed109ec353fa3232fa40c3c3743c68d0f061c226d3c0f8c6b226fa0b73d81e3f
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              63eae02c-5128-46c5-8215-2ab83b85cbc8.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\63eae02c-5128-46c5-8215-2ab83b85cbc8.tmp
                                              • Size 3KB
                                              • SHA256 c12b5468382a936385ffee88e27ae97f04519c1285f7a1e453855ecd54eeaf3e
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              6b789eda-a0e9-4222-b8ad-be1d907a46b5.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\6b789eda-a0e9-4222-b8ad-be1d907a46b5.tmp
                                              • Size 1KB
                                              • SHA256 3d44af1ba26b266ff3b37a57b1d39adbce9103684dd48a5a595966377298e5f5
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              settings.dat
                                              • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
                                              • Size 280B
                                              • SHA256 1de6651aeb7aa22e0a74f1d2c3f5011ecaa34615abf946ddf63f2b00801ff262
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              settings.dat
                                              • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
                                              • Size 280B
                                              • SHA256 fa7bb308f9a678fc36ae65bc4fe23337bb3273a8d7e5285bfbc42778b996cd60
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              throttle_store.dat
                                              • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
                                              • Size 20B
                                              • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              data_0
                                              • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\GPUCache\data_0
                                              • Size 8KB
                                              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                              • MD5 SHA1 SHA512 SSDEEP
                                              Submit Download

                                              data_1
                                              • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\GPUCache\data_1
                                              • Size 264KB
                                              • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                              • MD5 SHA1 SHA512 SSDEEP
                                              Submit Download

                                              data_2
                                              • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\GPUCache\data_2
                                              • Size 8KB
                                              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                              • MD5 SHA1 SHA512 SSDEEP
                                              Submit Download

                                              data_3
                                              • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\GPUCache\data_3
                                              • Size 8KB
                                              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                              • MD5 SHA1 SHA512 SSDEEP
                                              Submit Download

                                              SCT Auditing Pending Reports
                                              • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
                                              • Size 2B
                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              CURRENT
                                              • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
                                              • Size 16B
                                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              MANIFEST-000001
                                              • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
                                              • Size 41B
                                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              Local State
                                              • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                              • Size 1KB
                                              • SHA256 84b153747a11f4d316d91e142d8b20e3ddbf4008641d1d98e535e895ee8eb33d
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              df7b4cd4-200d-45bf-97db-54a1498d329f.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\df7b4cd4-200d-45bf-97db-54a1498d329f.tmp
                                              • Size 2KB
                                              • SHA256 24935467f30aa2b56b0925f86607ce288cf06d0d8fed76d8930eb65633791263
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              version.dat
                                              • Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
                                              • Size 12B
                                              • SHA256 4767b7994104a2a95d0de86a2242f4aed76bdf7963478cac2ec312c9b18679aa
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              memory/3696-231-0x00007FFC79EE0000-0x00007FFC79EE1000-memory.dmp
                                              Download

                                              memory/4764-178-0x00007FFC7A090000-0x00007FFC7A091000-memory.dmp
                                              Download

                                              memory/4764-179-0x00007FFC7AD30000-0x00007FFC7AD31000-memory.dmp
                                              Download

                                              memory/4984-113-0x00007FFC79EE0000-0x00007FFC79EE1000-memory.dmp
                                              Download

                                              memory/4984-408-0x00000200EC980000-0x00000200ECB21000-memory.dmp
                                              Download