File name:

Dork Searcher EZ by VoidPrince.rar

Full analysis: https://app.any.run/tasks/c3c0e30c-8d63-46ba-a7ce-07d4c3ecfcf9
Verdict: Suspicious activity
Analysis date: January 14, 2020, 12:55:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

D6B94CAEB36B37010765ED878F834863

SHA1:

79AF739BFDE5F1930470DADC5DE28C97193E2278

SHA256:

7CDB5FDE86E5C12BEF81C54005C078DFEBDD19483D56031BC7DA5E9FC019652A

SSDEEP:

98304:7Rcr5A6I7SZrCA9aIv3oL7zd6KekcMs3eceAhZtgxoij+rVDFqe09bbPBMQ6f0BK:ir5t3Da6udSRmAhvesEbbn6f0zIfaLmb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Searcher.exe (PID: 3960)

    • Loads dropped or rewritten executable

      • Searcher.exe (PID: 3960)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1948)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start winrar.exe searcher.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1948"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Dork Searcher EZ by VoidPrince.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3960"C:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\Searcher.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\Searcher.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Searcher
Exit code:
0
Version:
4.2.2.1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1948.8267\dork searcher ez by voidprince\searcher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
493
Read events
477
Write events
16
Delete events
0

Modification events

(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1948) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Dork Searcher EZ by VoidPrince.rar
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
13
Suspicious files
2
Text files
6
Unknown types
4

Dropped files

PID
Process
Filename
Type
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\EntityFramework.dllexecutable
MD5:470BE89A6DB2444175461B54AD00EC72
SHA256:A963696A7C3C3424A566644900FEC5528D0CF1BD66033A0E2D36B6E4882A7D3A
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\Searcher.exeexecutable
MD5:D4B43B2CE490D8786CCDE6DEBCAD2251
SHA256:3AAD4931BC76E1D654E5FE3FC6A1A10277B0D66190A8547782A3D7FA117CCC27
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\AntiPublic\link.dbsqlite
MD5:AECECEE2C7B44FA2EEE601469AA374AB
SHA256:2AFF4F903986614C4E535D8D38BFC93EFC353DC4A9846D386EFC9521C95BFA68
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\System.Data.SQLite.dllexecutable
MD5:7C680B024E667410C463AE38A92F8621
SHA256:ED8A3599BE994C4BA948932332610F59069996DF47478B569790984871E0A4F5
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\Interop.WMPLib.dllbinary
MD5:B9F1241E02B83A443BAFCCF4839E4724
SHA256:16C18A3E6A5F2DD5EA7431E103F3FA76467B2B66D8166ABAB28D567F08584254
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\Newtonsoft.Json.dllexecutable
MD5:C53737821B861D454D5248034C3C097C
SHA256:575E30F98E4EA42C9E516EDC8BBB29AD8B50B173A3E6B36B5BA39E133CCE9406
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\Setting.dattext
MD5:4E67A003766F07388A7023EAE7AD4952
SHA256:A70DD83772D968CF0BDD5F14FAE030EDDCF2C46731CC41BAF4B85B172422AE71
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\System.Data.SQLite.EF6.dllexecutable
MD5:B02B80D5F34A4F66B647643A89B29D01
SHA256:F5369CE6E06AFDAAAB36C38661FB63F844BCBDC6DC32379F05776B3F4B041B63
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\blacktext
MD5:8F161398F61DCEE24D2F3284F4DB1D0C
SHA256:0DFAE6BF57B4F5DD68896C3DF7E7110B380DBBC8BA69D8372455027E15AFBD9A
3960Searcher.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\Key.txttext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Dork Searcher EZ by VoidPrince.rar