Overview

overview

6

Static

static

3

wzsus53.exe

windows10-2004-x64

6

wzsus53.exe

windows11-ltsc_2024-x64

6

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-ltsc_2024-x64

3

SystemInfo...mt.dll

windows10-2004-x64

1

SystemInfo...mt.dll

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 09:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    wzsus53.exe
  • Size 46.1MB
  • Sample261113-k48eaasy3m
  • SHA256 ea4978b4261cccc53702fd3c2cffc44e8e83aa1958874e57d7c89a6c8a5e56fb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 22 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 51 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\wzsus53.exe
    "C:\Users\Admin\AppData\Local\Temp\wzsus53.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3332
    • C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe
      "C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe" -helper -client_id "F26D5EB4-C20C-484A-B6BC-F2D6E8CF5AB9"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:1436
    • C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe
      "C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe" -install -client_id "F26D5EB4-C20C-484A-B6BC-F2D6E8CF5AB9"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2564
    • C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe
      "C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe" -language=English -client_id "F26D5EB4-C20C-484A-B6BC-F2D6E8CF5AB9"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:1032
    • C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe
      "C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe" -delete_apps_if_needed -client_id "F26D5EB4-C20C-484A-B6BC-F2D6E8CF5AB9"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:4140
    • C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe
      "C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe" -build_id "0" -client_id "F26D5EB4-C20C-484A-B6BC-F2D6E8CF5AB9"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:1088
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\WinZip System Utilities Suite\windowscontextmenuhandler-vc141-mt.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5712
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Program Files\WinZip System Utilities Suite\windowscontextmenuhandler-vc141-mt.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:5040
    • C:\Users\Admin\AppData\Local\Temp\nst32A1.tmp\WinZipSmartMonitorSetup.exe
      C:\Users\Admin\AppData\Local\Temp\nst32A1.tmp\WinZipSmartMonitorSetup.exe
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5432
      • C:\Program Files\WinZip Smart Monitor\Settings.exe
        "C:\Program Files\WinZip Smart Monitor\Settings.exe" /RegServer
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        PID:860
      • C:\Program Files\WinZip Smart Monitor\WinZip Smart Monitor Service.exe
        "C:\Program Files\WinZip Smart Monitor\WinZip Smart Monitor Service.exe" /Service
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        PID:2068
      • C:\Program Files\WinZip Smart Monitor\WinZipSmartMonitor.exe
        "C:\Program Files\WinZip Smart Monitor\WinZipSmartMonitor.exe" -install
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        PID:2992
      • C:\Windows\SysWOW64\sc.exe
        sc start "WinZip Smart Monitor Service"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1200
    • C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe
      "C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe" -osource ""
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3460
    • C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe
      "C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe" -no_update -first_run_after_install -client_id "F26D5EB4-C20C-484A-B6BC-F2D6E8CF5AB9"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:5584
    • C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe
      "C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe" -post_install -client_id "F26D5EB4-C20C-484A-B6BC-F2D6E8CF5AB9"
      2⤵
      • Enumerates connected drives
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2044
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://goto.winzip.com/action/?product=SUS&LinkType=Install&Language=en&BuildID=0&OSource=&t=&UID=a4aca275-b331abc4-ae1225b1-57adb2c8&version=4.1.0.12&license=&r=0&dsi=0
        3⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4968
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x344,0x7ff9a51ac188,0x7ff9a51ac194,0x7ff9a51ac1a0
          4⤵
            PID:5908
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,1732673539602428216,1483390484456400801,262144 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
            4⤵
              PID:2412
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,8107235734579441880,7416207106998708052,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:11
              4⤵
              • System Time Discovery
              PID:5768
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,6896649021737735086,8412291322286338021,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:13
              4⤵
                PID:2480
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,1649966458365787386,2998319094905007491,2097152 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
                4⤵
                  PID:6036
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,18234207669690825136,9284848566409182254,2097152 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
                  4⤵
                    PID:1508
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,6726904254902718051,16263992671190440759,2097152 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:9
                    4⤵
                      PID:3008
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,1404510052823444676,16471986004462911343,2097152 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
                      4⤵
                        PID:3508
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,4803818215862437495,8115031462515275730,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
                        4⤵
                          PID:2428
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5444,i,5528488340563963083,17401247408056643116,2097152 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
                          4⤵
                            PID:3316
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,5479076273099921489,18181858227651829986,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
                            4⤵
                              PID:5040
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,5479076273099921489,18181858227651829986,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
                              4⤵
                                PID:968
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,15415684568164407811,2003387136577748807,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
                                4⤵
                                  PID:5200
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,12996143295209531949,13221974074187118793,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
                                  4⤵
                                    PID:1600
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,445917178916133344,5973934471771151160,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
                                    4⤵
                                      PID:6028
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,11736966872385163543,12641265827065202228,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
                                      4⤵
                                        PID:1848
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,11296717373623052746,11803367696067247657,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
                                        4⤵
                                          PID:5252
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,2204221543156345526,5718024438312642899,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:14
                                          4⤵
                                            PID:2656
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,16829160500030309839,1952687587808068111,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
                                            4⤵
                                              PID:2484
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,16823960120209569,12691837586410300965,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
                                              4⤵
                                                PID:5808
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,14800245544580698467,15584366626841841565,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:14
                                                4⤵
                                                  PID:4700
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,6849554616226880094,10592350519968675109,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
                                                  4⤵
                                                    PID:2668
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,16342217848720143394,3470228851526836237,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
                                                    4⤵
                                                      PID:856
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,16552515829675652087,14171977043898520976,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:14
                                                      4⤵
                                                        PID:3928
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,10694068527925326969,13792924510561358134,524288 --field-trial-handle=2348,i,6940239821595063912,5843544275809001822,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
                                                        4⤵
                                                          PID:3092
                                                    • C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe
                                                      "C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe" -syncSMSettings
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Modifies system certificate store
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1728
                                                  • C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe
                                                    "C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe"
                                                    1⤵
                                                    • Enumerates connected drives
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Reads the TCP/IP host and domain name from the registry
                                                    • Modifies Internet Explorer settings
                                                    • Suspicious behavior: AddClipboardFormatListener
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    • Suspicious use of SetWindowsHookEx
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1340
                                                    • C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe
                                                      "C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe" -splash 1340
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Suspicious behavior: AddClipboardFormatListener
                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2484
                                                    • C:\Program Files\WinZip System Utilities Suite\SUSNotifier.exe
                                                      "C:\Program Files\WinZip System Utilities Suite\SUSNotifier.exe" -show -defaultFrameStyle=modern -license="" -dsi=0 -language=en -buildid=0 -checkType=start -version=4.1.0.12 -puid=c2785626-750ed35d-88b6fb68-bf845c4a -IPTNDelay=900 -parentHWND=401f0
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Reads the TCP/IP host and domain name from the registry
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:688
                                                      • C:\Program Files\WinZip System Utilities Suite\SUSNotifier.exe
                                                        "C:\Program Files\WinZip System Utilities Suite\SUSNotifier.exe" -showOnly -allowParallelExecution -productcode="SUS" -buildid="0" -version="4.1.0.12" -language="en" -uid="a4aca275-b331abc4-ae1225b1-57adb2c8" -defaultFrameStyle="modern" -checkType="start" -dsi="0" -msi="1" -apps="SUS" -IPTNDelay="900" -parentHWND="401f0" -puid="c2785626-750ed35d-88b6fb68-bf845c4a"
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • Reads the TCP/IP host and domain name from the registry
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        PID:1560
                                                  • C:\Program Files\WinZip Smart Monitor\WinZip Smart Monitor Service.exe
                                                    "C:\Program Files\WinZip Smart Monitor\WinZip Smart Monitor Service.exe"
                                                    1⤵
                                                    • Drops file in System32 directory
                                                    • Executes dropped EXE
                                                    • Reads the TCP/IP host and domain name from the registry
                                                    • Modifies data under HKEY_USERS
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1208
                                                  • C:\Program Files\WinZip Smart Monitor\Settings.exe
                                                    "C:\Program Files\WinZip Smart Monitor\Settings.exe" -Embedding
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:3644
                                                  • C:\Windows\system32\wbem\unsecapp.exe
                                                    C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                    1⤵
                                                      PID:4412
                                                    • C:\Program Files\WinZip Smart Monitor\Settings.exe
                                                      "C:\Program Files\WinZip Smart Monitor\Settings.exe" -Embedding
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:5344
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                      1⤵
                                                        PID:2152
                                                      • C:\Program Files\WinZip Smart Monitor\Settings.exe
                                                        "C:\Program Files\WinZip Smart Monitor\Settings.exe" -Embedding
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:5516
                                                      • C:\Program Files\WinZip Smart Monitor\Settings.exe
                                                        "C:\Program Files\WinZip Smart Monitor\Settings.exe" -Embedding
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:4736
                                                      • C:\Windows\System32\Conhost.exe
                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        1⤵
                                                          PID:6036
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                          1⤵
                                                            PID:1532
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                            1⤵
                                                              PID:1272

                                                            Network

                                                                  MITRE ATT&CK Enterprise v16

                                                                  Reconnaissance

                                                                  Resource Development

                                                                  Initial Access

                                                                  Execution

                                                                  Persistence

                                                                  Event Triggered Execution

                                                                  1
                                                                  T1546

                                                                  Component Object Model Hijacking

                                                                  1
                                                                  T1546.015

                                                                  Privilege Escalation

                                                                  Event Triggered Execution

                                                                  1
                                                                  T1546

                                                                  Component Object Model Hijacking

                                                                  1
                                                                  T1546.015

                                                                  Defense Evasion

                                                                  Modify Registry

                                                                  2
                                                                  T1112

                                                                  Subvert Trust Controls

                                                                  1
                                                                  T1553

                                                                  Install Root Certificate

                                                                  1
                                                                  T1553.004

                                                                  Credential Access

                                                                  Credentials from Password Stores

                                                                  1
                                                                  T1555

                                                                  Credentials from Web Browsers

                                                                  1
                                                                  T1555.003

                                                                  Unsecured Credentials

                                                                  1
                                                                  T1552

                                                                  Credentials In Files

                                                                  1
                                                                  T1552.001

                                                                  Discovery

                                                                  Browser Information Discovery

                                                                  1
                                                                  T1217

                                                                  Peripheral Device Discovery

                                                                  1
                                                                  T1120

                                                                  Query Registry

                                                                  4
                                                                  T1012

                                                                  System Information Discovery

                                                                  3
                                                                  T1082

                                                                  System Location Discovery

                                                                  1
                                                                  T1614

                                                                  System Language Discovery

                                                                  1
                                                                  T1614.001

                                                                  System Network Configuration Discovery

                                                                  1
                                                                  T1016

                                                                  System Time Discovery

                                                                  1
                                                                  T1124

                                                                  Lateral Movement

                                                                  Collection

                                                                  Data from Local System

                                                                  1
                                                                  T1005

                                                                  Command and Control

                                                                  Exfiltration

                                                                  Impact

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  MSVCP140.dll
                                                                  • Path C:\Program Files\WinZip System Utilities Suite\MSVCP140.dll
                                                                  • Size 618KB
                                                                  • SHA256 517cd3aac2177a357cca6032f07ad7360ee8ca212a02dd6e1301bf6cfade2094
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Qt5Core.dll
                                                                  • Path C:\Program Files\WinZip System Utilities Suite\Qt5Core.dll
                                                                  • Size 5.4MB
                                                                  • SHA256 dbe9fe1eeaea36d080a6d4a037e00352ca04700c919252af04e7888b78bafd4e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Qt5Gui.dll
                                                                  • Path C:\Program Files\WinZip System Utilities Suite\Qt5Gui.dll
                                                                  • Size 5.6MB
                                                                  • SHA256 3f1373bb1f11d91bccd64798271c0402e4b9e965f0095b0317d7c0bdc9c8e575
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Qt5Svg.dll
                                                                  • Path C:\Program Files\WinZip System Utilities Suite\Qt5Svg.dll
                                                                  • Size 319KB
                                                                  • SHA256 26df53779e77e9c20513a63c1aa1c03aeba20d964d280bf79dbde46a2a8f6f3e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Qt5Widgets.dll
                                                                  • Path C:\Program Files\WinZip System Utilities Suite\Qt5Widgets.dll
                                                                  • Size 5.3MB
                                                                  • SHA256 8897b9192cd8243a1d26f705ef0a5d401b25dfe41ce70fba4531cb0af92f7b3b
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Qt5WinExtras.dll
                                                                  • Path C:\Program Files\WinZip System Utilities Suite\Qt5WinExtras.dll
                                                                  • Size 286KB
                                                                  • SHA256 695807ab71c12f81dd0d18244528d6eb716c4655a13ee8295a583bfe79843de7
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  SystemInfo-vc141-mt.dll
                                                                  • Path C:\Program Files\WinZip System Utilities Suite\SystemInfo-vc141-mt.dll
                                                                  • Size 2.4MB
                                                                  • SHA256 934607ca23f6e80e961ba21101c949ef7e90250ebfa832a776bebeae658d935c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  WinZip System Utilities Suite.exe
                                                                  • Path C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe
                                                                  • Size 10.5MB
                                                                  • SHA256 0af63a896f688ff84cbb6b6763d2a41adf0f44654a3c3a697822be673c3d3ed4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  English.xml
                                                                  • Path C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite\English.xml
                                                                  • Size 33KB
                                                                  • SHA256 efbcf57c3e2899d6629c13e6a61d3d78e6cc60fbfba8cba700f483dce335c3b8
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  uninst.exe
                                                                  • Path C:\Program Files\WinZip System Utilities Suite\uninst.exe
                                                                  • Size 289KB
                                                                  • SHA256 577d6efb2408990c6ddc19b993c9085e407c2bdfcf35bd3cfd5690aab6a1958e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  vcruntime140.dll
                                                                  • Path C:\Program Files\WinZip System Utilities Suite\vcruntime140.dll
                                                                  • Size 85KB
                                                                  • SHA256 d89c7b863fc1ac3a179d45d5fe1b9fd35fb6fbd45171ca68d0d68ab1c1ad04fb
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  smsettings
                                                                  • Path C:\ProgramData\WinZip\WinZip Smart Monitor\S-1-5-21-650287814-2715975232-1279715623-1000\smsettings
                                                                  • Size 44B
                                                                  • SHA256 79b18978637868aa31f346c5c628fa95e21a3442a1896aa627c5e4fd21533d04
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  scanStatisticInfo.lock
                                                                  • Path C:\ProgramData\WinZip\WinZip System Utilities Suite\S-1-5-21-650287814-2715975232-1279715623-1000\Driver Updater\scanStatisticInfo.lock
                                                                  • Size 44B
                                                                  • SHA256 1fcd00774db3d2843056b816a2f97ce4c5968549f53dca1415481759dd2a61cf
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  scanStatisticInfo.lock
                                                                  • Path C:\ProgramData\WinZip\WinZip System Utilities Suite\S-1-5-21-650287814-2715975232-1279715623-1000\Driver Updater\scanStatisticInfo.lock
                                                                  • Size 44B
                                                                  • SHA256 9c076298906f9e87111ef1e43d0d620f40253908bbe6b56fdf2be941e6c1f427
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  Settings.ini
                                                                  • Path C:\ProgramData\WinZip\WinZip System Utilities Suite\S-1-5-21-650287814-2715975232-1279715623-1000\Registry Cleaner\Settings.ini
                                                                  • Size 52B
                                                                  • SHA256 c8a9b425919a8cb528fbbeb1f692dcab4c31505478f44382f0ef0578a53c751b
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  scan.ini
                                                                  • Path C:\ProgramData\WinZip\WinZip System Utilities Suite\S-1-5-21-650287814-2715975232-1279715623-1000\Registry Cleaner\scan.ini
                                                                  • Size 120B
                                                                  • SHA256 53272014703845c52a542527a7bb17f93bdf4c243a321292b788a5f14d6779fe
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  WinZip.ini
                                                                  • Path C:\ProgramData\WinZip\WinZip System Utilities Suite\S-1-5-21-650287814-2715975232-1279715623-1000\WinZip.ini
                                                                  • Size 619B
                                                                  • SHA256 7e2c6c9f97ce390b926a7a8f423e54bd84d1c19393388aba6fae4492d450c9da
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  WinZip.ini.gq1088
                                                                  • Path C:\ProgramData\WinZip\WinZip System Utilities Suite\S-1-5-21-650287814-2715975232-1279715623-1000\WinZip.ini.gq1088
                                                                  • Size 623B
                                                                  • SHA256 a7f1996e758ca51e09e7d2e1fc2732f0382febd846b8eec43048f3586e1789c1
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  WinZip.ini.lock
                                                                  • Path C:\ProgramData\WinZip\WinZip System Utilities Suite\S-1-5-21-650287814-2715975232-1279715623-1000\WinZip.ini.lock
                                                                  • Size 15B
                                                                  • SHA256 a692b806d7beec8329c3eadadb0b48dfcbe738c45a7b81af1708a337e8848ebe
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  WinZip.ini
                                                                  • Path C:\ProgramData\WinZip\WinZip System Utilities Suite\WinZip.ini
                                                                  • Size 75B
                                                                  • SHA256 d584d7232efe15c2221eda81bc7e114b94bee4ca33627098c8bbfa7a36c2f255
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  8EC9B1D0ABBD7F98B401D425828828CE_1A8301B6674CB174AF4EF58214CF4E1F
                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1A8301B6674CB174AF4EF58214CF4E1F
                                                                  • Size 727B
                                                                  • SHA256 a6d9d7a20f942836e49cc91c4909ba35db15ae2c4b8be223fbbb1570f8b02f61
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                  • Size 727B
                                                                  • SHA256 1e416c31c090fe83a8eae7588a7301d1d9b7f8d1a9878ec5aeb23bf2028a2bbf
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  8EC9B1D0ABBD7F98B401D425828828CE_1A8301B6674CB174AF4EF58214CF4E1F
                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1A8301B6674CB174AF4EF58214CF4E1F
                                                                  • Size 416B
                                                                  • SHA256 3841b7d0452d653b86aae68d3c192d4186f947d2e2eaa250198050b06a812ff8
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                  • Size 412B
                                                                  • SHA256 781dff45a7f86eae2dd5651f83621aaa66671f7382e31f87d0fff4960189c7e6
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  11b7bfd2-2d89-4642-a7ff-918e7e41fa86.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\11b7bfd2-2d89-4642-a7ff-918e7e41fa86.tmp
                                                                  • Size 34KB
                                                                  • SHA256 c7cb7a22038458ea7bd31003bb8b087ecbbd5f2700136da118913cbf7a4d628d
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  70bd9224-4a82-424b-9ec8-0dbbbe9697ab.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\70bd9224-4a82-424b-9ec8-0dbbbe9697ab.tmp
                                                                  • Size 38KB
                                                                  • SHA256 11c3a1eb1c8c6027dcc4e6f5010d94e7ddde9d8f5dfc5e903c1cd83c6d0976b0
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
                                                                  • Size 135B
                                                                  • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  249eecdf-b105-4929-901a-08d6f6237312.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\249eecdf-b105-4929-901a-08d6f6237312.tmp
                                                                  • Size 70KB
                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2a6d6217-ef10-49e1-b65e-916b31769808.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2a6d6217-ef10-49e1-b65e-916b31769808.tmp
                                                                  • Size 12KB
                                                                  • SHA256 f587c37132b52980cee5c9492700fb87f8bf3f78bc9a1005f35d19c5c667f707
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  4870030d-0a3d-4e6c-836c-424e7e2eb354.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4870030d-0a3d-4e6c-836c-424e7e2eb354.tmp
                                                                  • Size 12KB
                                                                  • SHA256 0d808eafbf04136a16384dabbdd7edfbb844c6b72b62f72eb32992765d9c714f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  5bbb38f8-1061-4b6e-94b8-851c9d6916ff.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5bbb38f8-1061-4b6e-94b8-851c9d6916ff.tmp
                                                                  • Size 12KB
                                                                  • SHA256 301e840907aebbb8f0c0e1f0d59e44183c6d5879fa12fd55af2593fefb3af2bd
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  869932e3-8067-46e0-8061-6b1f4326bc0d.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\869932e3-8067-46e0-8061-6b1f4326bc0d.tmp
                                                                  • Size 29KB
                                                                  • SHA256 73d7abe63b3e3b39dd06197684b085b6b336225cf9b19896e3fd7b4f645face3
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  LOG.old
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                  • Size 334B
                                                                  • SHA256 3e9d65ec6a047c9f46fcfc6008a20f241b3664eadd1cadded8a42af7833e4872
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  temp-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                  • Size 3KB
                                                                  • SHA256 cb2d44704ed8f33239824ba47315e40646ea2df77ce9bcf368e0b15232f4f1c1
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                  • Size 3KB
                                                                  • SHA256 6496b9754ad5bdeccd6c924e0411ebc2186683649fc2cf7323f6f71ca7106273
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  73c3c4a2-0a19-4552-91d1-8818d8fd8473.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\73c3c4a2-0a19-4552-91d1-8818d8fd8473.tmp
                                                                  • Size 2B
                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  dasherSettingSchema.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                                  • Size 854B
                                                                  • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  1ec9b407-ca2b-43a1-8d47-c1e6826ec779.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1ec9b407-ca2b-43a1-8d47-c1e6826ec779.tmp
                                                                  • Size 40B
                                                                  • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  62118d98-6785-4ffd-bd39-064a07f60650.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\62118d98-6785-4ffd-bd39-064a07f60650.tmp
                                                                  • Size 2B
                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  67f2ecb4-156e-46ab-8d12-f563ebdd7dde.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\67f2ecb4-156e-46ab-8d12-f563ebdd7dde.tmp
                                                                  • Size 6KB
                                                                  • SHA256 61b62947dd1b4cc8c378af0b91d708268a86629fb28e038b856dfd9b89cdb47d
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  8104f8f8-be32-4f88-944b-f8b64f262195.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8104f8f8-be32-4f88-944b-f8b64f262195.tmp
                                                                  • Size 22KB
                                                                  • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
                                                                  • Size 43B
                                                                  • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  b182e0b2-6fb6-4ec9-b3d7-8fd9a2988e4f.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b182e0b2-6fb6-4ec9-b3d7-8fd9a2988e4f.tmp
                                                                  • Size 37KB
                                                                  • SHA256 ad51dc0fd9da09ee12aa95867fe07648ad3a077ff059219cf28fc2333707fcde
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  b1d3ae7f-34c4-4252-b0bc-357484da8622.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b1d3ae7f-34c4-4252-b0bc-357484da8622.tmp
                                                                  • Size 42KB
                                                                  • SHA256 97a3fbdd614ced50fad321133eecac4535d38cb774bcf8e3c4a9e5c4b0d80818
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  bfd28158-93cf-4fa4-b36b-b422e7cdc011.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bfd28158-93cf-4fa4-b36b-b422e7cdc011.tmp
                                                                  • Size 39KB
                                                                  • SHA256 a4315f33ae602843061540ac91a8ed305919221b1b34f567801cdbc11c80d1c6
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ba947f13-b850-44e0-b430-13b5fbb9291b.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ba947f13-b850-44e0-b430-13b5fbb9291b.tmp
                                                                  • Size 132B
                                                                  • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  eb44a2b6-6a84-4228-8e5c-f052e710f997.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\eb44a2b6-6a84-4228-8e5c-f052e710f997.tmp
                                                                  • Size 252B
                                                                  • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  e808a76b-c00b-49be-a092-7836fd38a4b9.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e808a76b-c00b-49be-a092-7836fd38a4b9.tmp
                                                                  • Size 34KB
                                                                  • SHA256 3e68f64a2fafc18b0ec23cccf091640395b7dd85e1f097c078e5b9b8f73f8650
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                  • Size 158KB
                                                                  • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  9bbb8256-5c82-441b-9757-042e96a8f4a2.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9bbb8256-5c82-441b-9757-042e96a8f4a2.tmp
                                                                  • Size 13B
                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                  • Size 132B
                                                                  • SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  a773c99c-5210-4273-afbf-6a4dea482104.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\a773c99c-5210-4273-afbf-6a4dea482104.tmp
                                                                  • Size 1B
                                                                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  InstallOptions.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nst32A1.tmp\InstallOptions.dll
                                                                  • Size 15KB
                                                                  • SHA256 fa8de036b1d9bb06be383a82041966c73473fc8382d041fb5c1758f991afeae7
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  System.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nst32A1.tmp\System.dll
                                                                  • Size 11KB
                                                                  • SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ioSpecial.ini
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nst32A1.tmp\ioSpecial.ini
                                                                  • Size 2KB
                                                                  • SHA256 61fd20fdcb394e05b6ff6f94bcc8c029642db9c3baea70790b00aaf1429d416e
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  ioSpecial.ini
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nst32A1.tmp\ioSpecial.ini
                                                                  • Size 1KB
                                                                  • SHA256 b92057a21b24dd65e771699187bd2eca4d44622ae566ac1a163ec6996a1f0687
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  linker.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nst32A1.tmp\linker.dll
                                                                  • Size 7KB
                                                                  • SHA256 02ee7e90b9379827cb186df48db5b412aaf800196d6967762fb513b9143cd1ef
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  nsEnvVariables.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nst32A1.tmp\nsEnvVariables.dll
                                                                  • Size 41KB
                                                                  • SHA256 083cbb8fdd692134bb80b6d12c0fcd71ede5444064d226b6d747e3227995e045
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  nsProcess.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nst32A1.tmp\nsProcess.dll
                                                                  • Size 7KB
                                                                  • SHA256 102c22f492c3d31f99e43143218ca64592a2f3bb6933f743d8826075ab9b7ad2
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  System.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsy967C.tmp\System.dll
                                                                  • Size 11KB
                                                                  • SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  execDos.dll
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsy967C.tmp\execDos.dll
                                                                  • Size 5KB
                                                                  • SHA256 720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  messages.json
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4968_1361248074\CRX_INSTALL\_locales\en_CA\messages.json
                                                                  • Size 711B
                                                                  • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  content.js
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4968_1925129797\CRX_INSTALL\content.js
                                                                  • Size 9KB
                                                                  • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  bb8f8be2-48e5-49f3-8d16-7f34325ff225.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4968_1925129797\bb8f8be2-48e5-49f3-8d16-7f34325ff225.tmp
                                                                  • Size 10KB
                                                                  • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  protocols.json
                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4968_1373337769\protocols.json
                                                                  • Size 3KB
                                                                  • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  memory/1032-609-0x000000005BC60000-0x000000005C1A6000-memory.dmp
                                                                  Download

                                                                  memory/1032-608-0x00007FF66FFB0000-0x00007FF670A33000-memory.dmp
                                                                  Download

                                                                  memory/1088-626-0x00007FF66FFB0000-0x00007FF670A33000-memory.dmp
                                                                  Download

                                                                  memory/1088-627-0x000000005BC60000-0x000000005C1A6000-memory.dmp
                                                                  Download

                                                                  memory/1340-591-0x00007FF66FFB0000-0x00007FF670A33000-memory.dmp
                                                                  Download

                                                                  memory/1340-1063-0x000001D0E58B0000-0x000001D0E58C6000-memory.dmp
                                                                  Download

                                                                  memory/1340-1476-0x000001D0E5DE0000-0x000001D0E5F12000-memory.dmp
                                                                  Download

                                                                  memory/1340-590-0x000000005BC60000-0x000000005C1A6000-memory.dmp
                                                                  Download

                                                                  memory/1340-1064-0x00007FF9BE320000-0x00007FF9BE336000-memory.dmp
                                                                  Download

                                                                  memory/1340-1065-0x000001D0E5D50000-0x000001D0E5D96000-memory.dmp
                                                                  Download

                                                                  memory/1436-539-0x00007FF66FFB0000-0x00007FF670A33000-memory.dmp
                                                                  Download

                                                                  memory/1436-538-0x000000005BC60000-0x000000005C1A6000-memory.dmp
                                                                  Download

                                                                  memory/1728-1197-0x000000005BC60000-0x000000005C1A6000-memory.dmp
                                                                  Download

                                                                  memory/1728-1196-0x00007FF66FFB0000-0x00007FF670A33000-memory.dmp
                                                                  Download

                                                                  memory/2044-1077-0x00007FF9BE320000-0x00007FF9BE336000-memory.dmp
                                                                  Download

                                                                  memory/2044-1183-0x00000292D7960000-0x00000292D7A92000-memory.dmp
                                                                  Download

                                                                  memory/2044-1051-0x00007FF66FFB0000-0x00007FF670A33000-memory.dmp
                                                                  Download

                                                                  memory/2044-1049-0x000000005BC60000-0x000000005C1A6000-memory.dmp
                                                                  Download

                                                                  memory/2484-720-0x000000005BC60000-0x000000005C1A6000-memory.dmp
                                                                  Download

                                                                  memory/2484-719-0x00007FF66FFB0000-0x00007FF670A33000-memory.dmp
                                                                  Download

                                                                  memory/2564-560-0x000000005BC60000-0x000000005C1A6000-memory.dmp
                                                                  Download

                                                                  memory/2564-559-0x00007FF66FFB0000-0x00007FF670A33000-memory.dmp
                                                                  Download

                                                                  memory/3332-14-0x0000000002560000-0x000000000256E000-memory.dmp
                                                                  Download

                                                                  memory/3460-694-0x000000005BC60000-0x000000005C1A6000-memory.dmp
                                                                  Download

                                                                  memory/3460-693-0x00007FF66FFB0000-0x00007FF670A33000-memory.dmp
                                                                  Download

                                                                  memory/4140-622-0x000000005BC60000-0x000000005C1A6000-memory.dmp
                                                                  Download

                                                                  memory/4140-623-0x00007FF66FFB0000-0x00007FF670A33000-memory.dmp
                                                                  Download

                                                                  memory/5040-636-0x0000000003050000-0x000000000321A000-memory.dmp
                                                                  Download

                                                                  memory/5584-1050-0x000000005BC60000-0x000000005C1A6000-memory.dmp
                                                                  Download

                                                                  memory/5584-1048-0x00007FF66FFB0000-0x00007FF670A33000-memory.dmp
                                                                  Download