Analysis
- user interaction
yes - max time kernel
365s - max time network
356s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 01:37
General
- Target https://drive.usercontent.google.com/download?id=11jEPhB6_EfWa1Kn3khovnsGGMNmX7_yf
- Sample260910-b1spzscm2x
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 36 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 16 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in System32 directory 6 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies Internet Explorer settings 1 TTPs 45 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Opens file in notepad (likely ransom note) 4 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookAW 2 IoCs
- Suspicious use of SetWindowsHookEx 25 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.usercontent.google.com/download?id=11jEPhB6_EfWa1Kn3khovnsGGMNmX7_yf2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffcf9edc188,0x7ffcf9edc194,0x7ffcf9edc1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,6200237992657515455,5892112642431333494,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:33⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,11742936966983647070,9377289713338203218,262144 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,6336158600993929848,17209995834245919848,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,6595218575201262833,12010304984683903096,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,11932744779752589450,11165407913522840774,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,17056070494344644867,6606526906813041909,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,11838223439017367678,10816420731226984862,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,13256874038670252047,10196622092398612849,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,13650819246201746290,1093329764199567007,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,8485359147609454520,3954395380294400782,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5692,i,2917808216447632334,2988474457388828891,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,7415696934279688096,5330890279902710164,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,3184850325803910094,1312354309015963284,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,3184850325803910094,1312354309015963284,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:83⤵
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Get_Link.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Get_Link.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6520,i,17619883366617950262,13111735869106204172,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4644,i,2418192277486372562,13925515063661659016,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4156,i,11013171073741497290,8799045817954858749,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,7689872933124579722,13664305787851724205,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,14493840285056826424,9272846177609351724,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,3380410376756649628,13238680441349788448,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,5999795290326269827,15199211672001257046,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,11053434958598157938,15384165397477072121,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,10570160686124126943,5581807925659079915,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,4722977203735937683,16953211795683355614,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7720,i,7213692107464988157,6029308480627623489,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4784,i,14610213161433787300,14970312679319204680,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7720,i,13402928282363055625,8137190766216267752,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5276,i,8084853326606797620,10689283384830817890,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5436,i,9779920672932866696,16414788722901571308,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5236,i,3584327440676764930,1714373961888604789,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7016,i,1202475882672684159,2049173330953775468,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7976,i,16749452279243979636,6911977815361169469,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7992,i,16165744112652992649,13402995180967345518,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5804,i,8533873190636927811,17722695753296982083,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8220,i,7404568452463709406,12455419724216721501,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=8288 /prefetch:83⤵
-
-
C:\Users\Admin\Downloads\winzip77-bing.exe"C:\Users\Admin\Downloads\winzip77-bing.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\e5a0b2d\winzip77-bing.exerun=1 shortcut="C:\Users\Admin\Downloads\winzip77-bing.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\Downloads\winzip77-bing.exe"C:\Users\Admin\Downloads\winzip77-bing.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\e5a0b3c\winzip77-bing.exerun=1 shortcut="C:\Users\Admin\Downloads\winzip77-bing.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8424,i,12412180684588370740,5705010889440152345,262144 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=8428 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8452,i,5311464265582168461,2926850557749554581,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8432,i,15157818208442857622,11794222726773863493,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7744,i,12292443987014644583,980707783083210532,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5600,i,16059625947635209536,3461799788467336292,2097152 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,7317388772351901831,12741202259109099148,524288 --field-trial-handle=2000,i,1346384286004154779,7701272375411658110,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:83⤵
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_ToolsUnlock.zip\Manual.txt2⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=winzip64.exe --webview-exe-version="77.1 (42)" --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=5676.5648.67563882747788353143⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffcc271b078,0x7ffcc271b084,0x7ffcc271b0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.1 (42)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1664,i,18432598416427665601,10414092722873270770,262144 --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.1 (42)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2084,i,18432598416427665601,10414092722873270770,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.1 (42)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2088,i,18432598416427665601,10414092722873270770,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.1 (42)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3704,i,18432598416427665601,10414092722873270770,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14⤵
-
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" /admincfg3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
-
-
C:\Program Files\WinZip\WzScan.exe"C:\Program Files\WinZip\WzScan.exe" -pinstall3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winzip.com/instcmplt.cgi?pid=WNZP&ver=77.1.17090.0&lang=en&osbits=64&vid=oemg&x-at=bing2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.winzip.com/instcmplt.cgi?pid=WNZP&ver=77.1.17090.0&lang=en&osbits=64&vid=oemg&x-at=bing3⤵
-
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" "C:\Users\Admin\Downloads\ToolsUnlock.zip"2⤵
- Executes dropped EXE
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ToolsUnlock\" -an -ai#7zMap8643:118:7zEvent96442⤵
-
-
C:\Users\Admin\Downloads\ToolsUnlock\ToolsUnlock_v14.9.exe"C:\Users\Admin\Downloads\ToolsUnlock\ToolsUnlock_v14.9.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\ToolsUnlock\ToolsUnlock_v14.9.exe"C:\Users\Admin\Downloads\ToolsUnlock\ToolsUnlock_v14.9.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\ToolsUnlock\ToolsUnlock_v14.9.exe"C:\Users\Admin\Downloads\ToolsUnlock\ToolsUnlock_v14.9.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\ToolsUnlock\ToolsUnlock_v14.9.exe"C:\Users\Admin\Downloads\ToolsUnlock\ToolsUnlock_v14.9.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\ToolsUnlock\ToolsUnlock_v14.9.exe"C:\Users\Admin\Downloads\ToolsUnlock\ToolsUnlock_v14.9.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\ToolsUnlock\Readme.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Users\Admin\Downloads\ToolsUnlock\ToolsUnlock_v14.9.exe"C:\Users\Admin\Downloads\ToolsUnlock\ToolsUnlock_v14.9.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C6308711BB852845FB83C639EA2A24932⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 82662BB2AE948D721B1A53049F7AB0A02⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 1" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_9AM\" -show" /ST 09:06 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 2" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_12PM\" -show" /ST 12:06 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 3" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_3PM\" -show" /ST 15:06 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding F9E7551503F85707F91A35C578654D93 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\WinZip\FAHConsole.exe"C:\Program Files\WinZip\FAHConsole.exe"3⤵
- Executes dropped EXE
-
C:\Program Files\WinZip\FAHWindow64.exe"C:\Program Files\WinZip\FAHWindow64.exe" register4⤵
- Executes dropped EXE
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFCMBPDF.dll" /codebase /tlb3⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFRMPD.dll" /codebase /tlb3⤵
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFSGNPDFWINCERTSTORE.dll" /codebase /tlb3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFP2D.dll" /codebase /tlb3⤵
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFSGNPDF.dll" /codebase /tlb3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFD2P.dll" /codebase /tlb3⤵
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFWMRK.dll" /codebase /tlb3⤵
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFCNVP.dll" /codebase /tlb3⤵
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
-
C:\Program Files\WinZip\WzPreviewer64.exe"C:\Program Files\WinZip\WzPreviewer64.exe" -regserver winzip642⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files\WinZip\WzPreloader.exe"C:\Program Files\WinZip\WzPreloader.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" /noqp /nodesktop /nostartmenu /nomenugroup /autoinstall /lang 10332⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookAW
-
C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" /precreatehkcu2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\WzUpdater.exe"C:\Program Files\WinZip\WzUpdater.exe" /schedule2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\WZUpdateNotifier.exe"C:\Program Files\WinZip\WZUpdateNotifier.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\WzBGTComServer64.exe"C:\Program Files\WinZip\WzBGTComServer64.exe" /REGSERVER2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\WzBGTools64.exe"C:\Program Files\WinZip\WzBGTools64.exe" /s2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\ZipSendService.exe"C:\Program Files\WinZip\ZipSendService.exe" /REGAPP Outlook2⤵
- Executes dropped EXE
-
C:\Program Files\WinZip\ZipSendService.exe"C:\Program Files\WinZip\ZipSendService.exe" /REGSERVER3⤵
- Executes dropped EXE
- Modifies registry class
-
-
-
C:\Program Files\WinZip\adxregistrator.exe"C:\Program Files\WinZip\adxregistrator.exe" /install="WZOffice.dll" /privileges=admin /generateLogFile=false /CLRVersion="4.0"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Program Files\WinZip\adxregistrator.exe"C:\Program Files\WinZip\adxregistrator.exe" /install="WZOutlok.dll" /privileges=admin /generateLogFile=false /CLRVersion="4.0"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\WinZip\FAHConsole.exe"C:\Program Files\WinZip\FAHConsole.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\WinZip\FAHWindow64.exe"C:\Program Files\WinZip\FAHWindow64.exe" register2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\WinZip\WZUpdateNotifier.exe"C:\Program Files\WinZip\WZUpdateNotifier.exe" -show1⤵
- Executes dropped EXE
-
C:\Program Files\WinZip\WZUpdateNotifier.exe"C:\Program Files\WinZip\WZUpdateNotifier.exe" -showOnly -allowParallelExecution2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\WzUpdater.exe"C:\Program Files\WinZip\WzUpdater.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\WinZip\WzBGTToolsManager64.exe"C:\Program Files\WinZip\WzBGTToolsManager64.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
e5a8bd9.rbs
SbkupStub.exe.config
WinZipCourierConfig.exe
WinZip Duplicate File Finder.lnk
WinZip Duplicate File Finder.lnk~RFe5adcd4.TMP
WinZip Image Manager.lnk
WinZip Image Manager.lnk~RFe5add03.TMP
WinZip PDF Express.lnk
WinZip PDF Express.lnk~RFe5add23.TMP
WinZip SafeShare.lnk
WinZip SafeShare.lnk~RFe5add51.TMP
WinZip Secure Backup.lnk
WinZip Secure Backup.lnk~RFe5add51.TMP
WinZip Tool Settings.lnk
WinZip Tool Settings.lnk
WinZip Tool Settings.lnk~RFe5adcb5.TMP
WinZip.lnk
WinZip.lnk~RFe5adca6.TMP
WinZip.lnk
WinZip.lnk~RFe5adc86.TMP
winzip.77.xml
WinZip.addon
3C42BC945025A34066DAB76EF3F80A05
FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
3C42BC945025A34066DAB76EF3F80A05
FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
blocklist
settings.dat
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
f_000092
f_000093
f_000094
f_000096
f_000098
f_0000a1
f_0000a3
f_0000a4
f_0000b6
f_0000b7
f_0000f2
f_0000f3
f_0000f4
f_0000f5
f_0000f6
f_00010d
f_000111
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe590ae3.TMP
SiteList-Enterprise.json
Edge Profile.ico
CURRENT
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries~RFe59b04b.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe59b702.TMP
the-real-index
the-real-index
the-real-index
the-real-index~RFe58f97e.TMP
the-real-index
the-real-index
the-real-index~RFe587df5.TMP
index.txt
index.txt
index.txt
index.txt
the-real-index
the-real-index~RFe58d0b9.TMP
sync_diagnostic.log
OperationConfig
OperationConfig~RFe592ca4.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe59984e.TMP
metadata.json
ipm.corel[1].xml
ipm.corel[1].xml
ipm.corel[1].xml
ipm.corel[1].xml
ipm.corel[1].xml
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
iconcache_idx.db
gtm[1].js
IPP_GMT_1789004395.html
log_20260910013926.txt
installer_log_20260910013909.txt
Load.html
common.css
button-normal.png
centerImg.png
close-normal.png
footerImg.png
headerImg.png
header_logo.png
common.js
external.js
jquery-3.7.1.min.js
jquery-ui-1.14.2.min.js
config.js
installerlist.js
installparams.js
stubparams.js
features.js
page.html
page.js
features.js
page.html
page.js
features.js
page.html
page.js
features.js
page.html
page.js
features.js
page.html
page.js
page.js
features.js
page.html
page.js
settings.dat
the-real-index
the-real-index~RFe5b510a.TMP
data_1
data_0
data_2
data_3
index
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State~RFe5b2f1b.TMP
WzRecipientsCache.db
db53b23fd1edbd46.customDestinations-ms
db53b23fd1edbd46.customDestinations-ms
Get_Link.txt
winzip77-bing.exe.crdownload
WinZip Duplicate File Finder.lnk
WinZip Duplicate File Finder.lnk~RFe5adcc5.TMP
WinZip Image Manager.lnk
WinZip Image Manager.lnk~RFe5adce4.TMP
WinZip PDF Express.lnk
WinZip PDF Express.lnk~RFe5add13.TMP
WinZip SafeShare.lnk
WinZip SafeShare.lnk~RFe5add42.TMP
WinZip Secure Backup.lnk
WinZip Secure Backup.lnk~RFe5add61.TMP
WinZip.lnk
WinZip.lnk~RFe5adc77.TMP
MSI8E86.tmp
MSI8F61.tmp
MSI9447.tmp
DupFFStub64_Shortcut_Desktop.ico
ImgUtilStub64_Shortcut_Desktop.ico
PdfUtilStub64_Shortcut_Desktop.ico
SafeShareStub64_Shortcut_Desktop.ico
SbkupStub64_ShortCut_StartMenu.ico
WinZip64_Shortcut_MenuGroup.ico
memory/760-3163-0x0000023457C30000-0x0000023457C5E000-memory.dmp
memory/760-3161-0x00000234577B0000-0x0000023457820000-memory.dmp
memory/760-4334-0x000001AA41D00000-0x000001AA41D95000-memory.dmp
memory/760-3167-0x0000023471CE0000-0x0000023471D34000-memory.dmp
memory/852-3442-0x000002B42CAF0000-0x000002B42CB00000-memory.dmp
memory/852-3443-0x000002B447220000-0x000002B4472B6000-memory.dmp
memory/940-3463-0x000001E1ADAC0000-0x000001E1ADACE000-memory.dmp
memory/1020-3471-0x00000237C0800000-0x00000237C080E000-memory.dmp
memory/1196-3051-0x00000204537B0000-0x00000204537D2000-memory.dmp
memory/2976-3728-0x000001DFB7A10000-0x000001DFB84D1000-memory.dmp
memory/2976-3649-0x00007FFCEAB00000-0x00007FFCEAB22000-memory.dmp
memory/3208-3650-0x00000000035B0000-0x00000000035B1000-memory.dmp
memory/3208-3093-0x00007FFD08740000-0x00007FFD08742000-memory.dmp
memory/3208-3094-0x00007FFD08110000-0x00007FFD08120000-memory.dmp
memory/3208-3410-0x0000000009760000-0x0000000009761000-memory.dmp
memory/3492-3767-0x00007FFD08740000-0x00007FFD08741000-memory.dmp
memory/3804-3484-0x00000252E2E60000-0x00000252E2E9C000-memory.dmp
memory/3804-3485-0x00000252FD4E0000-0x00000252FD718000-memory.dmp
memory/3936-3447-0x000002A9CA8A0000-0x000002A9CA8B0000-memory.dmp
memory/4052-3515-0x0000000004EC0000-0x0000000004F52000-memory.dmp
memory/4052-3503-0x0000000004FD0000-0x00000000053FA000-memory.dmp
memory/4052-3514-0x00000000059B0000-0x0000000005F54000-memory.dmp
memory/4052-3516-0x0000000004E50000-0x0000000004E5A000-memory.dmp
memory/4052-3518-0x0000000005630000-0x0000000005666000-memory.dmp
memory/4052-3519-0x0000000005690000-0x00000000056AE000-memory.dmp
memory/5276-2660-0x00000264D62F0000-0x00000264D6DB1000-memory.dmp
memory/5280-3455-0x0000022D64490000-0x0000022D644DE000-memory.dmp
memory/5468-3074-0x00000267735A0000-0x00000267735C0000-memory.dmp
memory/5468-3075-0x00007FFCEA100000-0x00007FFCEA120000-memory.dmp
memory/5468-3077-0x0000026F74770000-0x0000026F74960000-memory.dmp
memory/5468-3089-0x0000026773750000-0x0000026773788000-memory.dmp
memory/5468-3088-0x0000026773700000-0x000002677370E000-memory.dmp
memory/5468-3101-0x00000267737A0000-0x00000267737A8000-memory.dmp
memory/5468-3157-0x0000026759B30000-0x000002675A5F1000-memory.dmp
memory/5468-3057-0x0000026772B20000-0x0000026772BB2000-memory.dmp
memory/5468-3055-0x00000267594D0000-0x00000267594DC000-memory.dmp
memory/5468-3056-0x0000026759570000-0x0000026759584000-memory.dmp
memory/5468-3053-0x0000026759520000-0x0000026759569000-memory.dmp
memory/5468-3054-0x00007FFCEAD30000-0x00007FFCEAD79000-memory.dmp
memory/5676-3631-0x0000024B1C830000-0x0000024B1C875000-memory.dmp
memory/5676-4291-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5676-3119-0x0000014673190000-0x00000146731DF000-memory.dmp
memory/5676-3120-0x00007FFCE64F0000-0x00007FFCE653F000-memory.dmp
memory/5676-4528-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5676-3121-0x0000014673280000-0x0000014673312000-memory.dmp
memory/5676-3128-0x0000014673370000-0x00000146733BF000-memory.dmp
memory/5676-3122-0x00007FFCDD160000-0x00007FFCDD1F2000-memory.dmp
memory/5676-4526-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5676-4524-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5676-3127-0x00000146733F0000-0x0000014673461000-memory.dmp
memory/5676-4513-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5676-3155-0x0000014671040000-0x0000014671B01000-memory.dmp
memory/5676-4495-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5676-3124-0x00000146731E0000-0x000001467324E000-memory.dmp
memory/5676-3125-0x0000014673320000-0x0000014673370000-memory.dmp
memory/5676-3123-0x00000146736F0000-0x0000014673AB8000-memory.dmp
memory/5676-3118-0x0000014673110000-0x0000014673181000-memory.dmp
memory/5676-3108-0x0000014672FC0000-0x0000014673025000-memory.dmp
memory/5676-3111-0x00000146730A0000-0x0000014673105000-memory.dmp
memory/5676-3110-0x0000014673030000-0x0000014673095000-memory.dmp
memory/5676-3607-0x00007FFCEAC50000-0x00007FFCEAC99000-memory.dmp
memory/5676-3606-0x0000024B024A0000-0x0000024B024E9000-memory.dmp
memory/5676-3611-0x0000024B1B530000-0x0000024B1B67B000-memory.dmp
memory/5676-3612-0x00007FFCEA350000-0x00007FFCEA49B000-memory.dmp
memory/5676-3107-0x0000014672F50000-0x0000014672FB5000-memory.dmp
memory/5676-3624-0x00007FFCEAB00000-0x00007FFCEAB22000-memory.dmp
memory/5676-3623-0x0000024B1BEC0000-0x0000024B1BEE2000-memory.dmp
memory/5676-3626-0x0000024B1C0B0000-0x0000024B1C121000-memory.dmp
memory/5676-3635-0x000002537F900000-0x000002537F958000-memory.dmp
memory/5676-3106-0x0000014672EE0000-0x0000014672F45000-memory.dmp
memory/5676-3634-0x00007FFCEA320000-0x00007FFCEA342000-memory.dmp
memory/5676-3633-0x0000024B1C880000-0x0000024B1C8A2000-memory.dmp
memory/5676-3632-0x00007FFCEA510000-0x00007FFCEA555000-memory.dmp
memory/5676-3126-0x0000014672D70000-0x0000014672D82000-memory.dmp
memory/5676-3102-0x0000014672E70000-0x0000014672ED8000-memory.dmp
memory/5676-3132-0x00007FFCDA570000-0x00007FFCDA5E0000-memory.dmp
memory/5676-3630-0x00007FFCEAAD0000-0x00007FFCEAAF2000-memory.dmp
memory/5676-3629-0x0000024B1C7A0000-0x0000024B1C7C2000-memory.dmp
memory/5676-3091-0x0000014672CF0000-0x0000014672D61000-memory.dmp
memory/5676-3092-0x0000014672DF0000-0x0000014672E61000-memory.dmp
memory/5676-3090-0x0000014672C70000-0x0000014672CE1000-memory.dmp
memory/5676-3086-0x00000146742C0000-0x0000014675A0C000-memory.dmp
memory/5676-3131-0x0000014673570000-0x00000146735E0000-memory.dmp
memory/5676-4480-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5676-3140-0x00000146733C0000-0x00000146733E6000-memory.dmp
memory/5676-3130-0x00000146734F0000-0x0000014673561000-memory.dmp
memory/5676-3087-0x00000146728D0000-0x0000014672941000-memory.dmp
memory/5676-3079-0x0000014672780000-0x00000146727C5000-memory.dmp
memory/5676-3080-0x00007FFCEA0B0000-0x00007FFCEA0F5000-memory.dmp
memory/5676-3081-0x0000014672730000-0x0000014672752000-memory.dmp
memory/5676-3085-0x0000014672850000-0x00000146728C1000-memory.dmp
memory/5676-3084-0x00000146729A0000-0x0000014672B62000-memory.dmp
memory/5676-4467-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5676-3083-0x00007FFCE9F50000-0x00007FFCE9F72000-memory.dmp
memory/5676-3134-0x00007FFCDA4C0000-0x00007FFCDA56F000-memory.dmp
memory/5676-3135-0x00000146735E0000-0x0000014673655000-memory.dmp
memory/5676-3133-0x0000014673AC0000-0x0000014673B6F000-memory.dmp
memory/5676-3982-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5676-3070-0x0000014672700000-0x0000014672722000-memory.dmp
memory/5676-3072-0x00007FFCEA500000-0x00007FFCEA522000-memory.dmp
memory/5676-3067-0x0000014671C70000-0x0000014671CCA000-memory.dmp
memory/5676-3063-0x0000014670E30000-0x0000014670E52000-memory.dmp
memory/5676-3064-0x00007FFCEA530000-0x00007FFCEA552000-memory.dmp
memory/5676-4391-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5676-3065-0x00000146723C0000-0x00000146724C8000-memory.dmp
memory/5676-3137-0x00007FFCEAAD0000-0x00007FFCEAAED000-memory.dmp
memory/5676-4389-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5676-3129-0x00007FFCDD090000-0x00007FFCDD0DF000-memory.dmp
memory/5676-4293-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5676-3138-0x0000014673660000-0x00000146736CA000-memory.dmp
memory/5676-4304-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5676-4306-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5676-3136-0x0000014673250000-0x000001467326D000-memory.dmp
memory/5676-3139-0x0000014673CB0000-0x0000014673CEA000-memory.dmp
memory/5676-4357-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5676-4385-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5676-4387-0x0000024B017F0000-0x0000024B022B1000-memory.dmp
memory/5688-3451-0x0000019FABDA0000-0x0000019FABDB6000-memory.dmp
memory/5756-4264-0x00000175EA620000-0x00000175EB0E1000-memory.dmp
memory/5872-3524-0x0000000005B10000-0x0000000005B24000-memory.dmp
memory/5872-3523-0x00000000064E0000-0x00000000066F2000-memory.dmp
memory/5872-3522-0x00000000062F0000-0x00000000064D8000-memory.dmp
memory/5964-3467-0x000002395E650000-0x000002395E662000-memory.dmp
memory/5968-4221-0x000001F502D30000-0x000001F502D60000-memory.dmp
memory/5968-3771-0x00007FFD08C60000-0x00007FFD08C61000-memory.dmp
memory/5968-3772-0x00007FFD07E70000-0x00007FFD07E71000-memory.dmp
memory/6136-3459-0x00000214D0350000-0x00000214D039E000-memory.dmp
memory/6392-3868-0x00007FFD08740000-0x00007FFD08741000-memory.dmp