File name:

WinRAR 6.10 Final [32bit 64bit] Crack [Coder].zip

Full analysis: https://app.any.run/tasks/50c21458-0a2c-48ed-bc1b-a5601398ea03
Verdict: Malicious activity
Analysis date: January 26, 2022, 10:02:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

8FB2EC5B7C7D25A0E74FD02582402702

SHA1:

8571D709C02E0404E624466ED0BE2C93BF3CAD85

SHA256:

E3432CE45E84491676EB2ADDEA9D64A3BF22AB72EAF9B454D4BC0A554D0FBF54

SSDEEP:

196608:hwDF5+kmfOJbSXOMVON7xvlogeSOatlUhD:ez+kmfqbSXSl7rtlU9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • winrar-x32-610.exe (PID: 2332)

  • SUSPICIOUS

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3880)
      • winrar-x32-610.exe (PID: 2332)

    • Checks supported languages

      • WinRAR.exe (PID: 3880)
      • winrar-x32-610.exe (PID: 2332)

    • Reads Microsoft Outlook installation path

      • winrar-x32-610.exe (PID: 2332)

    • Drops a file that was compiled in debug mode

      • winrar-x32-610.exe (PID: 2332)
      • WinRAR.exe (PID: 3880)

    • Creates files in the program directory

      • winrar-x32-610.exe (PID: 2332)

    • Executable content was dropped or overwritten

      • winrar-x32-610.exe (PID: 2332)
      • WinRAR.exe (PID: 3880)

    • Reads the computer name

      • winrar-x32-610.exe (PID: 2332)
      • WinRAR.exe (PID: 3880)

    • Reads internet explorer settings

      • winrar-x32-610.exe (PID: 2332)

  • INFO

    • Reads the computer name

      • rundll32.exe (PID: 3508)

    • Manual execution by user

      • winrar-x32-610.exe (PID: 2332)

    • Changes default file association

      • rundll32.exe (PID: 3508)

    • Checks supported languages

      • rundll32.exe (PID: 3508)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipFileName: WinRAR 6.10 Final [32bit 64bit] Crack [Coder]/Coder.txt
ZipUncompressedSize: 191
ZipCompressedSize: 191
ZipCRC: 0xaf45f319
ZipModifyDate: 2022:01:26 09:37:13
ZipCompression: None
ZipBitFlag: 0x0800
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
3
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start rundll32.exe no specs winrar.exe winrar-x32-610.exe

Process information

PID
CMD
Path
Indicators
Parent process
2332"C:\Users\admin\Desktop\WinRAR 6.10 Final [32bit 64bit] Crack [Coder]\Setup file for 32bit\winrar-x32-610.exe" C:\Users\admin\Desktop\WinRAR 6.10 Final [32bit 64bit] Crack [Coder]\Setup file for 32bit\winrar-x32-610.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
HIGH
Description:
WinRAR archiver
Exit code:
9
Version:
6.10.0
Modules
Images
c:\users\admin\desktop\winrar 6.10 final [32bit 64bit] crack [coder]\setup file for 32bit\winrar-x32-610.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\usp10.dll
3508"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL "C:\Users\admin\AppData\Local\Temp\WinRAR 6.10 Final [32bit 64bit] Crack [Coder].zip.xpi"C:\Windows\system32\rundll32.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imagehlp.dll
3880"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\WinRAR 6.10 Final [32bit 64bit] Crack [Coder].zip.xpi"C:\Program Files\WinRAR\WinRAR.exe
rundll32.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
6 316
Read events
6 196
Write events
119
Delete events
1

Modification events

(PID) Process:(3508) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\eHome\ehshell.exe
Value:
Windows Media Center
(PID) Process:(3508) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
Firefox
(PID) Process:(3508) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\mspaint.exe
Value:
Paint
(PID) Process:(3508) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\NOTEPAD.EXE
Value:
Notepad
(PID) Process:(3508) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\PROGRA~1\MICROS~1\Office14\OIS.EXE
Value:
Microsoft Office 2010
(PID) Process:(3508) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Opera\Opera.exe
Value:
Opera Internet Browser
(PID) Process:(3508) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Windows Photo Viewer\PhotoViewer.dll
Value:
Windows Photo Viewer
(PID) Process:(3508) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\VideoLAN\VLC\vlc.exe
Value:
VLC media player
(PID) Process:(3508) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Value:
Microsoft Word
(PID) Process:(3508) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
12
Suspicious files
0
Text files
10
Unknown types
1

Dropped files

PID
Process
Filename
Type
3880WinRAR.exeC:\Users\admin\Desktop\WinRAR 6.10 Final [32bit 64bit] Crack [Coder]\Coder.txttext
MD5:—
SHA256:—
3880WinRAR.exeC:\Users\admin\Desktop\WinRAR 6.10 Final [32bit 64bit] Crack [Coder]\Setup file for 32bit\winrar-x32-610.exeexecutable
MD5:—
SHA256:—
3880WinRAR.exeC:\Users\admin\Desktop\WinRAR 6.10 Final [32bit 64bit] Crack [Coder]\Crack file\rarreg.keytext
MD5:—
SHA256:—
3880WinRAR.exeC:\Users\admin\Desktop\WinRAR 6.10 Final [32bit 64bit] Crack [Coder]\Setup file for 64bit\winrar-x64-610.exeexecutable
MD5:—
SHA256:—
2332winrar-x32-610.exeC:\Program Files\WinRAR\License.txttext
MD5:672064CF19DB0B083B981CF0BE7662B0
SHA256:9FC8AA33CCAFA04C1CE4C0A61047B341297D720ADAB1B77F67B5FE59F43BB59F
2332winrar-x32-610.exeC:\Program Files\WinRAR\Rar.txttext
MD5:AA94798C46F4B375AB50752552B93CA4
SHA256:AA982C2813A0CA7B8B2461B8500FE72A5B275B4376162D904ED4EC1F86A88423
2332winrar-x32-610.exeC:\Program Files\WinRAR\7zxa.dllexecutable
MD5:CB6C821F3849C2146C7DBBE5C676C01F
SHA256:1679A59A3D5428CC6A3EA2DAD6670057E263BC3F7F723C0F83F08A859E5A3A09
2332winrar-x32-610.exeC:\Program Files\WinRAR\Default.SFXexecutable
MD5:EEE3A229DA26073CB80240F32EBE70D3
SHA256:E1F5ADC2FBE9C783DCB68D3DF79DA423FBE450AB21A18E9985E64EC1CEFF1AD3
2332winrar-x32-610.exeC:\Program Files\WinRAR\ReadMe.txttext
MD5:00D0A57A6D64EE3DE8F4D5529D6C6447
SHA256:FCD13E1B97AF47B8B923BA97AE15E9731C66093609667C3171D5DD24A6F7F2E6
2332winrar-x32-610.exeC:\Program Files\WinRAR\Descript.iontext
MD5:3FB658E292A09D2303B6D84FAF079E0C
SHA256:FA7BFC756E502CA814F927130574CBB472FC8B9C608F98B470409E7D8D1AD30D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WinRAR 6.10 Final [32bit 64bit] Crack [Coder].zip