URL:

https://www.mediafire.com/folder/n5pt0wxnn3lua/pass_2023

Full analysis: https://app.any.run/tasks/86739f83-c1f4-4fe6-865a-03cddc225cf8
Verdict: Malicious activity
Analysis date: April 29, 2024, 14:01:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

D9C6A382F89D9ECF17D0CF5F9A199772

SHA1:

5672D7DAB6AF8E282A44334E54D90A1485A442BF

SHA256:

B8548F23EF070C91FEA261610A96D18BF4115D85FB48F5C0096F8B342AB5F250

SSDEEP:

3:N8DSLw3eGUbKcoQD:2OLw3eG+v5D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2388)
      • wzsus53.exe (PID: 4648)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2516)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 4152)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1600)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 3136)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 4808)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2988)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2856)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1976)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2724)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2776)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2952)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 3112)
      • WinZipSmartMonitorSetup.exe (PID: 2436)
      • WinZip System Utilities Suite.exe (PID: 3080)

    • Registers / Runs the DLL via REGSVR32.EXE

      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1600)

    • Creates a writable file in the system directory

      • WinZip Smart Monitor Service.exe (PID: 1244)

    • Steals credentials from Web Browsers

      • WinZip System Utilities Suite.exe (PID: 3080)

    • Actions looks like stealing of personal data

      • WinZip System Utilities Suite.exe (PID: 3080)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 5656)
      • WinZip System Utilities Suite.exe (PID: 3080)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5736)
      • WinRAR.exe (PID: 5656)
      • WinZip System Utilities Suite.exe (PID: 3536)
      • WinZip System Utilities Suite.exe (PID: 3624)
      • WinZip System Utilities Suite.exe (PID: 2780)
      • WinZip System Utilities Suite.exe (PID: 2360)
      • WinZip System Utilities Suite.exe (PID: 3424)
      • Settings.exe (PID: 2960)
      • WinZip Smart Monitor Service.exe (PID: 2824)
      • WinZipSmartMonitor.exe (PID: 3092)
      • WinZip System Utilities Suite.exe (PID: 5152)
      • Settings.exe (PID: 2816)
      • WinZip System Utilities Suite.exe (PID: 3080)
      • WinZip System Utilities Suite.exe (PID: 112)
      • Settings.exe (PID: 5048)
      • WinZip System Utilities Suite.exe (PID: 2412)
      • Settings.exe (PID: 5232)
      • Settings.exe (PID: 5384)
      • Settings.exe (PID: 2984)
      • WinZip System Utilities Suite.exe (PID: 5836)
      • Settings.exe (PID: 5856)
      • Settings.exe (PID: 5888)
      • WinZip Smart Monitor Service.exe (PID: 1244)
      • WinZipSmartMonitor.exe (PID: 444)

    • Executable content was dropped or overwritten

      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1600)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2388)
      • wzsus53.exe (PID: 4648)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2516)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 4152)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 4808)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 3136)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2988)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2856)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1976)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 3112)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2776)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2952)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2724)
      • WinZipSmartMonitorSetup.exe (PID: 2436)
      • WinZip System Utilities Suite.exe (PID: 3080)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1600)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2388)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2516)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 4152)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 4808)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 3136)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2988)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2856)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1976)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2952)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2776)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 3112)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2724)
      • WinZipSmartMonitorSetup.exe (PID: 2436)

    • The process creates files with name similar to system file names

      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1600)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2388)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2516)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 4152)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 4808)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 3136)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2856)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2988)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1976)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2952)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2776)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2724)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 3112)
      • WinZipSmartMonitorSetup.exe (PID: 2436)

    • Searches for installed software

      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1600)
      • Settings.exe (PID: 2816)
      • WinZip System Utilities Suite.exe (PID: 5152)
      • Settings.exe (PID: 5048)
      • WinZip System Utilities Suite.exe (PID: 3080)
      • WinZip System Utilities Suite.exe (PID: 112)
      • Settings.exe (PID: 5384)
      • Settings.exe (PID: 5232)
      • Settings.exe (PID: 2984)
      • Settings.exe (PID: 5856)
      • Settings.exe (PID: 5888)
      • WinZip Smart Monitor Service.exe (PID: 1244)
      • WinZipSmartMonitor.exe (PID: 444)

    • The process drops C-runtime libraries

      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1600)

    • Checks Windows Trust Settings

      • WinZip System Utilities Suite.exe (PID: 3536)
      • WinZip System Utilities Suite.exe (PID: 3624)
      • WinZip System Utilities Suite.exe (PID: 3424)
      • WinZip System Utilities Suite.exe (PID: 2780)
      • WinZip System Utilities Suite.exe (PID: 2360)
      • Settings.exe (PID: 2960)
      • WinZip Smart Monitor Service.exe (PID: 2824)
      • WinZipSmartMonitor.exe (PID: 3092)
      • WinZip Smart Monitor Service.exe (PID: 1244)
      • WinZip System Utilities Suite.exe (PID: 5152)
      • Settings.exe (PID: 2816)
      • WinZip System Utilities Suite.exe (PID: 112)
      • Settings.exe (PID: 5048)
      • WinZip System Utilities Suite.exe (PID: 3080)
      • WinZip System Utilities Suite.exe (PID: 2412)
      • Settings.exe (PID: 5232)
      • Settings.exe (PID: 5384)
      • Settings.exe (PID: 2984)
      • WinZip System Utilities Suite.exe (PID: 5836)
      • Settings.exe (PID: 5856)
      • Settings.exe (PID: 5888)
      • WinZipSmartMonitor.exe (PID: 444)

    • Reads settings of System Certificates

      • WinZip System Utilities Suite.exe (PID: 3536)
      • WinZip System Utilities Suite.exe (PID: 3624)
      • WinZip System Utilities Suite.exe (PID: 3424)
      • WinZip System Utilities Suite.exe (PID: 2780)
      • WinZip System Utilities Suite.exe (PID: 2360)
      • Settings.exe (PID: 2960)
      • WinZip Smart Monitor Service.exe (PID: 2824)
      • WinZipSmartMonitor.exe (PID: 3092)
      • WinZip System Utilities Suite.exe (PID: 5152)
      • Settings.exe (PID: 2816)
      • Settings.exe (PID: 5048)
      • WinZip System Utilities Suite.exe (PID: 3080)
      • WinZip System Utilities Suite.exe (PID: 112)
      • WinZip System Utilities Suite.exe (PID: 2412)
      • Settings.exe (PID: 5232)
      • Settings.exe (PID: 5384)
      • Settings.exe (PID: 2984)
      • WinZip System Utilities Suite.exe (PID: 5836)
      • Settings.exe (PID: 5888)
      • Settings.exe (PID: 5856)
      • WinZipSmartMonitor.exe (PID: 444)

    • Process drops legitimate windows executable

      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1600)

    • Reads the Internet Settings

      • WinZip System Utilities Suite.exe (PID: 3624)
      • WinZip System Utilities Suite.exe (PID: 112)
      • WinZip System Utilities Suite.exe (PID: 3080)
      • WinZipSmartMonitor.exe (PID: 444)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 3048)

    • Starts SC.EXE for service management

      • WinZipSmartMonitorSetup.exe (PID: 2436)

    • Executes as Windows Service

      • WinZip Smart Monitor Service.exe (PID: 1244)
      • VSSVC.exe (PID: 368)

    • Creates a software uninstall entry

      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1600)
      • WinZip System Utilities Suite.exe (PID: 5152)

    • Changes Internet Explorer settings (feature browser emulation)

      • WinZip System Utilities Suite.exe (PID: 3080)

    • Drops 7-zip archiver for unpacking

      • WinZip System Utilities Suite.exe (PID: 3080)

    • Reads Microsoft Outlook installation path

      • WinZip System Utilities Suite.exe (PID: 3080)

    • Reads Internet Explorer settings

      • WinZip System Utilities Suite.exe (PID: 3080)

  • INFO

    • Checks supported languages

      • wmpnscfg.exe (PID: 2368)
      • setup.exe (PID: 5920)
      • setup.exe (PID: 4188)
      • wzsus53.exe (PID: 4656)
      • wzsus53.exe (PID: 4648)
      • wzsus53.exe (PID: 1212)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1600)
      • wzsus53.exe (PID: 2172)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2388)
      • wzsus53.exe (PID: 4148)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2516)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 4152)
      • wzsus53.exe (PID: 3192)
      • wzsus53.exe (PID: 3688)
      • wzsus53.exe (PID: 4056)
      • wzsus53.exe (PID: 4836)
      • wzsus53.exe (PID: 2304)
      • wzsus53.exe (PID: 4740)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 4808)
      • wzsus53.exe (PID: 4728)
      • wzsus53.exe (PID: 4804)
      • wzsus53.exe (PID: 3164)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1976)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 3136)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 3112)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2988)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2724)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2776)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2856)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2952)
      • WinZip System Utilities Suite.exe (PID: 3536)
      • WinZip System Utilities Suite.exe (PID: 3624)
      • WinZip System Utilities Suite.exe (PID: 2780)
      • WinZip System Utilities Suite.exe (PID: 3424)
      • WinZipSmartMonitorSetup.exe (PID: 2436)
      • WinZip System Utilities Suite.exe (PID: 2360)
      • WinZip Smart Monitor Service.exe (PID: 2824)
      • WinZipSmartMonitor.exe (PID: 3092)
      • Settings.exe (PID: 2960)
      • WinZip Smart Monitor Service.exe (PID: 1244)
      • WinZip System Utilities Suite.exe (PID: 5152)
      • Settings.exe (PID: 2816)
      • WinZip System Utilities Suite.exe (PID: 112)
      • WinZip System Utilities Suite.exe (PID: 3080)
      • Settings.exe (PID: 5048)
      • WinZip System Utilities Suite.exe (PID: 2412)
      • Settings.exe (PID: 5232)
      • Settings.exe (PID: 5384)
      • Settings.exe (PID: 2984)
      • WinZip System Utilities Suite.exe (PID: 5836)
      • Settings.exe (PID: 5856)
      • Settings.exe (PID: 5888)
      • WinZipSmartMonitor.exe (PID: 444)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2368)
      • wzsus53.exe (PID: 4648)
      • wzsus53.exe (PID: 1212)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1600)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2388)
      • wzsus53.exe (PID: 4656)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2516)
      • wzsus53.exe (PID: 2172)
      • wzsus53.exe (PID: 4148)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 4152)
      • wzsus53.exe (PID: 4740)
      • wzsus53.exe (PID: 3192)
      • wzsus53.exe (PID: 4836)
      • wzsus53.exe (PID: 3688)
      • wzsus53.exe (PID: 2304)
      • wzsus53.exe (PID: 4056)
      • wzsus53.exe (PID: 4728)
      • wzsus53.exe (PID: 4804)
      • wzsus53.exe (PID: 3164)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 3136)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2724)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 3112)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2856)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2952)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2776)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 4808)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1976)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2988)
      • WinZip System Utilities Suite.exe (PID: 3536)
      • WinZip System Utilities Suite.exe (PID: 3624)
      • WinZip System Utilities Suite.exe (PID: 3424)
      • WinZip System Utilities Suite.exe (PID: 2780)
      • WinZipSmartMonitorSetup.exe (PID: 2436)
      • WinZip System Utilities Suite.exe (PID: 2360)
      • Settings.exe (PID: 2960)
      • WinZip Smart Monitor Service.exe (PID: 2824)
      • WinZipSmartMonitor.exe (PID: 3092)
      • WinZip Smart Monitor Service.exe (PID: 1244)
      • WinZip System Utilities Suite.exe (PID: 5152)
      • Settings.exe (PID: 2816)
      • WinZip System Utilities Suite.exe (PID: 3080)
      • WinZip System Utilities Suite.exe (PID: 112)
      • Settings.exe (PID: 5048)
      • WinZip System Utilities Suite.exe (PID: 2412)
      • Settings.exe (PID: 5384)
      • Settings.exe (PID: 5232)
      • Settings.exe (PID: 2984)
      • WinZip System Utilities Suite.exe (PID: 5836)
      • Settings.exe (PID: 5856)
      • Settings.exe (PID: 5888)
      • WinZipSmartMonitor.exe (PID: 444)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2368)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 3968)
      • WinRAR.exe (PID: 5736)

    • The process uses the downloaded file

      • msedge.exe (PID: 5288)
      • WinRAR.exe (PID: 5656)
      • msedge.exe (PID: 4236)
      • msedge.exe (PID: 3968)
      • msedge.exe (PID: 2696)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 3968)
      • WinRAR.exe (PID: 5736)

    • Application launched itself

      • msedge.exe (PID: 3968)
      • msedge.exe (PID: 4844)
      • msedge.exe (PID: 2388)

    • Create files in a temporary directory

      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2388)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1600)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2516)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 4152)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 4808)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 3136)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2988)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2856)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1976)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2724)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 3112)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2952)
      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 2776)
      • WinZipSmartMonitorSetup.exe (PID: 2436)

    • Reads the machine GUID from the registry

      • WinZip System Utilities Suite.exe (PID: 3536)
      • WinZip System Utilities Suite.exe (PID: 3624)
      • WinZip System Utilities Suite.exe (PID: 3424)
      • WinZip System Utilities Suite.exe (PID: 2780)
      • WinZip System Utilities Suite.exe (PID: 2360)
      • Settings.exe (PID: 2960)
      • WinZip Smart Monitor Service.exe (PID: 2824)
      • WinZip System Utilities Suite.exe (PID: 5152)
      • WinZip Smart Monitor Service.exe (PID: 1244)
      • WinZipSmartMonitor.exe (PID: 3092)
      • Settings.exe (PID: 2816)
      • WinZip System Utilities Suite.exe (PID: 112)
      • WinZip System Utilities Suite.exe (PID: 3080)
      • Settings.exe (PID: 5048)
      • WinZip System Utilities Suite.exe (PID: 2412)
      • Settings.exe (PID: 5232)
      • Settings.exe (PID: 5384)
      • Settings.exe (PID: 2984)
      • WinZip System Utilities Suite.exe (PID: 5836)
      • Settings.exe (PID: 5856)
      • Settings.exe (PID: 5888)
      • WinZipSmartMonitor.exe (PID: 444)

    • Reads the software policy settings

      • WinZip System Utilities Suite.exe (PID: 3536)
      • WinZip System Utilities Suite.exe (PID: 3624)
      • WinZip System Utilities Suite.exe (PID: 3424)
      • WinZip System Utilities Suite.exe (PID: 2360)
      • WinZip System Utilities Suite.exe (PID: 2780)
      • Settings.exe (PID: 2960)
      • WinZip Smart Monitor Service.exe (PID: 2824)
      • WinZip Smart Monitor Service.exe (PID: 1244)
      • WinZipSmartMonitor.exe (PID: 3092)
      • WinZip System Utilities Suite.exe (PID: 5152)
      • Settings.exe (PID: 2816)
      • Settings.exe (PID: 5048)
      • WinZip System Utilities Suite.exe (PID: 3080)
      • WinZip System Utilities Suite.exe (PID: 112)
      • WinZip System Utilities Suite.exe (PID: 2412)
      • Settings.exe (PID: 5384)
      • Settings.exe (PID: 5232)
      • Settings.exe (PID: 2984)
      • WinZip System Utilities Suite.exe (PID: 5836)
      • Settings.exe (PID: 5888)
      • Settings.exe (PID: 5856)
      • WinZipSmartMonitor.exe (PID: 444)

    • Creates files in the program directory

      • f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe (PID: 1600)
      • WinZip System Utilities Suite.exe (PID: 3424)
      • WinZip System Utilities Suite.exe (PID: 3624)
      • WinZip System Utilities Suite.exe (PID: 2360)
      • WinZipSmartMonitorSetup.exe (PID: 2436)
      • WinZipSmartMonitor.exe (PID: 3092)
      • Settings.exe (PID: 2816)
      • WinZip System Utilities Suite.exe (PID: 3080)
      • WinZip System Utilities Suite.exe (PID: 112)

    • Checks proxy server information

      • WinZip System Utilities Suite.exe (PID: 3624)
      • WinZip System Utilities Suite.exe (PID: 3080)
      • WinZip Smart Monitor Service.exe (PID: 1244)
      • WinZipSmartMonitor.exe (PID: 444)

    • Creates files or folders in the user directory

      • WinZip System Utilities Suite.exe (PID: 3624)
      • WinZip System Utilities Suite.exe (PID: 3080)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
212
Monitored processes
146
Malicious processes
26
Suspicious processes
12

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmpnscfg.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs winrar.exe setup.exe no specs setup.exe setup.exe no specs setup.exe msedge.exe no specs wzsus53.exe no specs wzsus53.exe no specs wzsus53.exe wzsus53.exe wzsus53.exe no specs f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe wzsus53.exe f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe wzsus53.exe no specs wzsus53.exe f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe wzsus53.exe no specs wzsus53.exe f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe wzsus53.exe no specs wzsus53.exe no specs wzsus53.exe no specs wzsus53.exe no specs wzsus53.exe wzsus53.exe wzsus53.exe no specs wzsus53.exe no specs wzsus53.exe no specs wzsus53.exe no specs wzsus53.exe no specs wzsus53.exe wzsus53.exe wzsus53.exe wzsus53.exe wzsus53.exe wzsus53.exe wzsus53.exe f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe msedge.exe no specs winzip system utilities suite.exe no specs winzip system utilities suite.exe winzip system utilities suite.exe no specs winzip system utilities suite.exe no specs winzip system utilities suite.exe no specs regsvr32.exe no specs winzipsmartmonitorsetup.exe settings.exe no specs winzip smart monitor service.exe no specs winzipsmartmonitor.exe no specs sc.exe no specs winzip smart monitor service.exe winzip system utilities suite.exe no specs settings.exe no specs winzip system utilities suite.exe no specs winzip system utilities suite.exe settings.exe no specs unsecapp.exe no specs winzip system utilities suite.exe no specs settings.exe no specs settings.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs settings.exe no specs winzip system utilities suite.exe no specs settings.exe no specs settings.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs winzipsmartmonitor.exe msedge.exe no specs SPPSurrogate no specs vssvc.exe no specs SPPSurrogate no specs SPPSurrogate no specs

Process information

PID
CMD
Path
Indicators
Parent process
112"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1264 --field-trial-handle=1344,i,5675037518379154068,1311549252598336498,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
112"C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe" -post_install -client_id "3A7D0D9A-3D1B-49DF-A4D6-9224D83FAA55"C:\Program Files\WinZip System Utilities Suite\WinZip System Utilities Suite.exe—f4ccee8d-04e9-4fd1-97fb-9bfec8def2c7.exe
User:
admin
Company:
Corel Corporation
Integrity Level:
HIGH
Description:
WinZip System Utilities Suite
Exit code:
0
Version:
4,0,3,4
Modules
Images
c:\program files\winzip system utilities suite\winzip system utilities suite.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
368C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
444"C:\Program Files\WinZip Smart Monitor\WinZipSmartMonitor.exe" -runC:\Program Files\WinZip Smart Monitor\WinZipSmartMonitor.exe
WinZip Smart Monitor Service.exe
User:
admin
Company:
Corel Corporation
Integrity Level:
HIGH
Description:
WinZip Smart Monitor
Version:
2,12,3,2
Modules
Images
c:\program files\winzip smart monitor\winzipsmartmonitor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
660"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2232 --field-trial-handle=1344,i,5675037518379154068,1311549252598336498,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
660C:\Windows\system32\wbem\unsecapp.exe -EmbeddingC:\Windows\System32\wbem\unsecapp.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Sink to receive asynchronous callbacks for WMI client application
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
728"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2248 --field-trial-handle=1344,i,5675037518379154068,1311549252598336498,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1012"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=7172 --field-trial-handle=1344,i,5675037518379154068,1311549252598336498,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1212"C:\Users\admin\Downloads\wzsus53.exe" C:\Users\admin\Downloads\wzsus53.exe
msedge.exe
User:
admin
Company:
Corel Corporation
Integrity Level:
HIGH
Description:
WinZip System Utilities Suite
Exit code:
0
Version:
4.0.3.4
Modules
Images
c:\users\admin\downloads\wzsus53.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1240"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4964 --field-trial-handle=1344,i,5675037518379154068,1311549252598336498,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
193 647
Read events
192 719
Write events
831
Delete events
97

Modification events

(PID) Process:(3968) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3968) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3968) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3968) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3968) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3968) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(3968) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(3968) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1302019708-1500728564-335382590-1000
Value:
B35180F8D2752F00
(PID) Process:(3968) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\FirstNotDefault
Operation:delete valueName:S-1-5-21-1302019708-1500728564-335382590-1000
Value:
(PID) Process:(3968) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge
Operation:writeName:UsageStatsInSample
Value:
1
Executable files
159
Suspicious files
310
Text files
561
Unknown types
252

Dropped files

PID
Process
Filename
Type
3968msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10450a.TMP —
MD5:—
SHA256:—
3968msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
3968msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF104548.TMP —
MD5:—
SHA256:—
3968msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
3968msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF104558.TMP —
MD5:—
SHA256:—
3968msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF104604.TMP —
MD5:—
SHA256:—
3968msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
3992msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pmabinary
MD5:C612E96CBFAC63232FC2062E15600FB1
SHA256:DB3C05D5EC0B6719A73E7F0BE84BCE9342772DA70567E7CE08CF6573480B38FF
3968msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datbinary
MD5:A6EBC0D32A7B9304824D19DB63B4E37A
SHA256:E991057C2B1718A151C5FD06E1C153F57130D195454A1F94C8C4C20971697093
3992msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pma~RF103b07.TMPbinary
MD5:886E82F2CA62ECCCE64601B30592078A
SHA256:E5E13D53601100FF3D6BB71514CBCCC4C73FE9B7EF5E930100E644187B42948E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
445
DNS requests
521
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3624
WinZip System Utilities Suite.exe
GET
304
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8e4f28f801d207ae
unknown
—
—
unknown
3624
WinZip System Utilities Suite.exe
GET
200
142.250.186.35:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
unknown
3624
WinZip System Utilities Suite.exe
GET
200
142.250.186.35:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCNbnFNjxLCZRKVsCHt2Y3B
unknown
—
—
unknown
1244
WinZip Smart Monitor Service.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
unknown
—
—
unknown
3624
WinZip System Utilities Suite.exe
GET
200
142.250.186.35:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
—
—
unknown
1244
WinZip Smart Monitor Service.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAmUgGmPKICqXmy6znLwJnc%3D
unknown
—
—
unknown
3080
WinZip System Utilities Suite.exe
GET
200
108.138.2.173:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
unknown
—
—
unknown
3080
WinZip System Utilities Suite.exe
GET
200
18.245.39.64:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
unknown
—
—
unknown
2032
msedge.exe
GET
301
95.101.54.120:80
http://www.winzipsystemtools.com/sus/install.html?lang=en&buildid=53
unknown
—
—
unknown
3080
WinZip System Utilities Suite.exe
GET
200
18.245.39.64:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkzUBtJnwJkc3SmanzgxeYU%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2032
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2032
msedge.exe
104.16.113.74:443
www.mediafire.com
CLOUDFLARENET
—
unknown
2032
msedge.exe
13.107.22.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3968
msedge.exe
239.255.255.250:1900
—
—
—
unknown
2032
msedge.exe
216.58.206.68:443
www.google.com
GOOGLE
US
whitelisted
2032
msedge.exe
104.16.114.74:443
www.mediafire.com
—
—
unknown

DNS requests

Domain
IP
Reputation
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.mediafire.com
  • 104.16.113.74
  • 104.16.114.74
shared
edge.microsoft.com
  • 13.107.22.239
  • 131.253.33.239
whitelisted
static.mediafire.com
  • 104.16.114.74
  • 104.16.113.74
shared
fonts.googleapis.com
  • 142.250.185.74
  • 142.250.186.106
whitelisted
www.google.com
  • 216.58.206.68
  • 216.58.206.36
whitelisted
ajax.googleapis.com
  • 216.58.212.138
whitelisted
fonts.gstatic.com
  • 172.217.16.131
  • 216.58.206.67
  • 172.217.18.99
whitelisted
www.googletagmanager.com
  • 142.250.186.168
whitelisted
www.gstatic.com
  • 142.250.186.163
  • 142.250.185.227
whitelisted

Threats

PID
Process
Class
Message
2032
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
2032
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
2032
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
2032
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
2032
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
2032
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
2032
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code.jquery .com)
2032
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Global content delivery network (unpkg .com)
Process
Message
msedge.exe
[0429/150415.644:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
msedge.exe
[0429/150448.248:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.mediafire.com/folder/n5pt0wxnn3lua/pass_2023