My best guesses: a) Your machine was already compromised when you made the rar b) The attacker logged your password, either when you entered the archive or in

My best guesses: a) Your machine was already compromised when you made the rar b) The attacker logged your password, either when you entered the archive or into another service which shares the same password c) perhaps WinRAR encrypted archives have a cyptographic flaw making them easily broken by software d) perhaps the attacker has been bruteforcing for a while