File name: | 6.rar |
Full analysis: | https://app.any.run/tasks/ac341635-c08c-4efb-bd7b-f4dd8eda6c74 |
Verdict: | Malicious activity |
Analysis date: | January 17, 2020, 20:48:36 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | 62562350D6F1E4614D3490E7CE85D1FE |
SHA1: | 1C3E38AB470371571C2645F986CE6276D8E45E2D |
SHA256: | 6F0E47D3CFCBBEF05D1185701326C20AB2D6A1C89CAA27A67773C55E846CE22D |
SSDEEP: | 196608:Ds5zyyQmt1Ib9MjveixFXjPWxXUhJmuAlf/bxb7sE1CuWDUJ6ITYMV0XR1RHGXq:o5zEmqinjOyWpbVszJDQjEMGpSq |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2120 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\6.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3424 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\32Bit\webbuilder15.zip" C:\Users\admin\Desktop\32Bit\webbuilder15\ | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
1532 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\32Bit\Keygen.zip" C:\Users\admin\Desktop\32Bit\Keygen\ | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3260 | "C:\Users\admin\Desktop\32Bit\Keygen\Keygen.exe" | C:\Users\admin\Desktop\32Bit\Keygen\Keygen.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM | ||||
2820 | "C:\Users\admin\Desktop\32Bit\webbuilder15\setup.exe" | C:\Users\admin\Desktop\32Bit\webbuilder15\setup.exe | explorer.exe | |
User: admin Company: Pablo Software Solutions Integrity Level: MEDIUM Description: WYSIWYG Web Builder 15 Setup Version: | ||||
3328 | "C:\Users\admin\AppData\Local\Temp\is-4R5Q0.tmp\setup.tmp" /SL5="$40204,14128487,751104,C:\Users\admin\Desktop\32Bit\webbuilder15\setup.exe" | C:\Users\admin\AppData\Local\Temp\is-4R5Q0.tmp\setup.tmp | — | setup.exe |
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Version: 51.1052.0.0 | ||||
1212 | "C:\Users\admin\Desktop\32Bit\webbuilder15\setup.exe" /SPAWNWND=$601CE /NOTIFYWND=$40204 | C:\Users\admin\Desktop\32Bit\webbuilder15\setup.exe | setup.tmp | |
User: admin Company: Pablo Software Solutions Integrity Level: HIGH Description: WYSIWYG Web Builder 15 Setup Version: | ||||
2796 | "C:\Users\admin\AppData\Local\Temp\is-12NLV.tmp\setup.tmp" /SL5="$B018E,14128487,751104,C:\Users\admin\Desktop\32Bit\webbuilder15\setup.exe" /SPAWNWND=$601CE /NOTIFYWND=$40204 | C:\Users\admin\AppData\Local\Temp\is-12NLV.tmp\setup.tmp | setup.exe | |
User: admin Integrity Level: HIGH Description: Setup/Uninstall Version: 51.1052.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2120 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2120.17287\32Bit\Keygen.zip | — | |
MD5:— | SHA256:— | |||
2120 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2120.17287\32Bit\Startcrack.com.url | — | |
MD5:— | SHA256:— | |||
2120 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2120.17287\32Bit\webbuilder15.zip | — | |
MD5:— | SHA256:— | |||
2796 | setup.tmp | C:\Program Files\WYSIWYG Web Builder 15\is-M6SMU.tmp | — | |
MD5:— | SHA256:— | |||
2796 | setup.tmp | C:\Program Files\WYSIWYG Web Builder 15\is-GEOQC.tmp | — | |
MD5:— | SHA256:— | |||
2796 | setup.tmp | C:\Program Files\WYSIWYG Web Builder 15\is-776IQ.tmp | — | |
MD5:— | SHA256:— | |||
2796 | setup.tmp | C:\Program Files\WYSIWYG Web Builder 15\is-N5PH7.tmp | — | |
MD5:— | SHA256:— | |||
2796 | setup.tmp | C:\Program Files\WYSIWYG Web Builder 15\is-K16UI.tmp | — | |
MD5:— | SHA256:— | |||
2796 | setup.tmp | C:\Program Files\WYSIWYG Web Builder 15\is-TJRBI.tmp | — | |
MD5:— | SHA256:— | |||
2796 | setup.tmp | C:\Program Files\WYSIWYG Web Builder 15\is-BIVVM.tmp | — | |
MD5:— | SHA256:— |