File name:

winrar-x64-701.exe

Full analysis: https://app.any.run/tasks/2fc759f6-6b39-48fe-87e0-b2e7c0ef71a4
Verdict: Malicious activity
Analysis date: November 17, 2024, 14:11:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 8 sections
MD5:

3A2F16A044D8F6D2F9443DFF6BD1C7D4

SHA1:

48C6C0450AF803B72A0CAA7D5E3863C3F0240EF1

SHA256:

31F7BA37180F820313B2D32E76252344598409CB932109DD84A071CD58B64AA6

SSDEEP:

98304:7q69dX60Chz9WEoHgfIjZLanqlELE7FQYF98F3nLsOAnKn7D2XBNUf29hy6VbJ0C:KKN7ULOzua

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • winrar-x64-701.exe (PID: 6220)

    • Executable content was dropped or overwritten

      • winrar-x64-701.exe (PID: 6220)

    • Drops 7-zip archiver for unpacking

      • winrar-x64-701.exe (PID: 6220)

    • Reads Microsoft Outlook installation path

      • winrar-x64-701.exe (PID: 6220)

    • Reads Internet Explorer settings

      • winrar-x64-701.exe (PID: 6220)

  • INFO

    • Reads the computer name

      • winrar-x64-701.exe (PID: 6220)

    • Checks proxy server information

      • winrar-x64-701.exe (PID: 6220)

    • The process uses the downloaded file

      • winrar-x64-701.exe (PID: 6220)

    • Checks supported languages

      • winrar-x64-701.exe (PID: 6220)

    • Creates files or folders in the user directory

      • Uninstall.exe (PID: 4436)

    • Creates files in the program directory

      • Uninstall.exe (PID: 4436)
      • winrar-x64-701.exe (PID: 6220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:05:12 10:17:26+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.33
CodeSize: 270848
InitializedDataSize: 313344
UninitializedDataSize: -
EntryPoint: 0x29e90
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 7.1.0.0
ProductVersionNumber: 7.1.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
ProductName: WinRAR
CompanyName: Alexander Roshal
FileDescription: WinRAR
FileVersion: 7.1.0
ProductVersion: 7.1.0
InternalName: WinRAR
LegalCopyright: Copyright © Alexander Roshal 1993-2024
OriginalFileName: WinRAR.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar-x64-701.exe uninstall.exe no specs winrar-x64-701.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2808"C:\Users\admin\AppData\Local\Temp\winrar-x64-701.exe" C:\Users\admin\AppData\Local\Temp\winrar-x64-701.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR
Exit code:
3221226540
Version:
7.1.0
Modules
Images
c:\users\admin\appdata\local\temp\winrar-x64-701.exe
c:\windows\system32\ntdll.dll
4436"C:\Program Files\WinRAR\uninstall.exe" /setupC:\Program Files\WinRAR\Uninstall.exe—winrar-x64-701.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
HIGH
Description:
Uninstall WinRAR
Exit code:
0
Version:
7.1.0
Modules
Images
c:\program files\winrar\uninstall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6220"C:\Users\admin\AppData\Local\Temp\winrar-x64-701.exe" C:\Users\admin\AppData\Local\Temp\winrar-x64-701.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
HIGH
Description:
WinRAR
Exit code:
0
Version:
7.1.0
Modules
Images
c:\users\admin\appdata\local\temp\winrar-x64-701.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
1 111
Read events
1 025
Write events
82
Delete events
4

Modification events

(PID) Process:(6220) winrar-x64-701.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6220) winrar-x64-701.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6220) winrar-x64-701.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6220) winrar-x64-701.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR SFX
Operation:writeName:C%%Program Files%WinRAR
Value:
C:\Program Files\WinRAR
(PID) Process:(6220) winrar-x64-701.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFavoritesInitialSelection
Value:
(PID) Process:(6220) winrar-x64-701.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFeedsInitialSelection
Value:
(PID) Process:(4436) Uninstall.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.rar
Operation:writeName:Set
Value:
1
(PID) Process:(4436) Uninstall.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.zip
Operation:writeName:Set
Value:
1
(PID) Process:(4436) Uninstall.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.cab
Operation:writeName:Set
Value:
1
(PID) Process:(4436) Uninstall.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.arj
Operation:writeName:Set
Value:
1
Executable files
13
Suspicious files
10
Text files
11
Unknown types
1

Dropped files

PID
Process
Filename
Type
6220winrar-x64-701.exe —
MD5:—
SHA256:—
6220winrar-x64-701.exeC:\Program Files\WinRAR\RarFiles.lsttext
MD5:E70E22D45ECB35217D66A4CE30F081FA
SHA256:9EB1099D7231CD24D8740609D3AC6985139F2334730356DF983AB01D7896AD6F
6220winrar-x64-701.exeC:\Program Files\WinRAR\Rar.txttext
MD5:B954981A253F5E1EE25585037A0C5FEE
SHA256:59E40B34B09BE2654B793576035639C459AD6E962F9F9CD000D556FA21B1C7CD
6220winrar-x64-701.exeC:\Program Files\WinRAR\RarExtPackage.msixcompressed
MD5:4EBEB72C7DA644A296A0026C061DB51D
SHA256:DE451E233072B0D34ACECF04DDC38BCAD61B56A1E0218041CA0A80AD752BACCF
6220winrar-x64-701.exeC:\Program Files\WinRAR\Order.htmhtml
MD5:1310B652E7362A994650EE9278424101
SHA256:0365AAC5C65889C7533DCD3F239E8491FEDFA9EF01B9EA1C91A5EF535172589F
6220winrar-x64-701.exeC:\Program Files\WinRAR\Uninstall.lsttext
MD5:6EEEFCB85673C14201D024B6E6AC6258
SHA256:B75FDEE208D2834AB147DACB51F4E7D70E44457C8B639048FE67B252B8D61F1F
6220winrar-x64-701.exeC:\Program Files\WinRAR\Uninstall.exeexecutable
MD5:D36BE447F422ABC82276AF9CB2F2741B
SHA256:82A495858708B726F26CB86E2FBAB8DF86B9008A671BE4C1F6C4F24ED3013735
6220winrar-x64-701.exeC:\Program Files\WinRAR\7zxa.dllexecutable
MD5:04D3E794624A82228A7E683FDF22E182
SHA256:DB3D0484228ED14AD8D3763F4880D36024FB27B189C91720FF147B92D46BCB5A
6220winrar-x64-701.exeC:\Program Files\WinRAR\WinCon32.SFXexecutable
MD5:E5F0C2C4F60BD298855DFE0019C63043
SHA256:A339A384B1B69D58BBAAD230C2648944B08030F823E1EF2C41E870053188F878
6220winrar-x64-701.exeC:\Program Files\WinRAR\UnRAR.exeexecutable
MD5:98CCD44353F7BC5BAD1BC6BA9AE0CD68
SHA256:E51021F6CB20EFBD2169F2A2DA10CE1ABCA58B4F5F30FBF4BAE931E4ECAAC99B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
41
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2076
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7048
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3156
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7048
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3000
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
6944
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4360
SearchApp.exe
2.23.209.176:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5488
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 2.16.164.106
  • 2.16.164.114
  • 2.16.164.43
  • 2.16.164.32
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 184.30.21.171
whitelisted
www.bing.com
  • 2.23.209.176
  • 2.23.209.150
  • 2.23.209.185
  • 2.23.209.189
  • 2.23.209.130
  • 2.23.209.182
  • 2.23.209.179
  • 2.23.209.158
  • 2.23.209.187
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.74
  • 20.190.160.22
  • 40.126.32.136
  • 40.126.32.72
  • 40.126.32.140
  • 40.126.32.133
  • 20.190.160.14
whitelisted
th.bing.com
  • 23.212.110.154
  • 23.212.110.146
  • 23.212.110.155
  • 23.212.110.163
  • 23.212.110.147
  • 23.212.110.145
  • 23.212.110.161
  • 23.212.110.170
  • 23.212.110.162
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
winrar-x64-701.exe