Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ

TLDR: I can't say for 100% sure, but there are multiple reasons to believe that this is malware.

Long version: I'm seeing multiple suspicious things here.

• The IPs being connected to are part of some hoster and have some abuse reports: https://www.abuseipdb.com/check-block/217.20.58.98/29

• The domain being resolved is qcloud[.]com, which belongs to Tencent Cloud and definitely not Microsoft.

• Other domains in memory like counter-strike[.]com[.]ua are very new and definitely sound fishy.

• A standalone version of 7zip is being run and extracts the created rar file with the password "infected". Real alarm bells here.

• A lot of the registry actions look like anti-debugging, which does not sound like something an Illustrator Plugin would do.

Malware or not, remember to update WinRAR

https://arstechnica.com/security/2025/08/high-severity-winrar-0-day-exploited-for-weeks-by-2-groups/

There are some suspicious things going on like the qcloud and counter-strike domains, as well as the 7zip extract being run.

I would probably get rid of it.

Unlikely for the rar file itself. The exe seems a little suspicious, so I would scan that file individually. Hard to say without unpacking and examining it.