File name:

winzip76.exe

Full analysis: https://app.any.run/tasks/1f486627-5870-43ab-8c51-053cd8acd5cb
Verdict: Malicious activity
Analysis date: November 20, 2024, 06:52:57
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

7C05D8FAEB45C410E965F3AC98D31300

SHA1:

9847D9C73951C78DABC74AE5E21C2E6AB90327F1

SHA256:

B9C54457A260A168FA0EB60F2AE1A5C7A5B7072A8120E37E9561FAD6F914E298

SSDEEP:

98304:ADKrqzlJuLRqSYZresjGihx0Rp9dqNuzHl/A1v5KaKt:ExS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • winzip76.exe (PID: 2280)
      • winzip76.exe (PID: 3620)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4208)

    • Starts itself from another location

      • winzip76.exe (PID: 2280)

    • Reads security settings of Internet Explorer

      • winzip76.exe (PID: 3620)

    • Reads Internet Explorer settings

      • winzip76.exe (PID: 3620)

    • Reads Microsoft Outlook installation path

      • winzip76.exe (PID: 3620)

    • Checks Windows Trust Settings

      • winzip76.exe (PID: 3620)

    • Process drops legitimate windows executable

      • winzip76.exe (PID: 3620)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4208)
      • MicrosoftEdgeUpdate.exe (PID: 5912)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 5912)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4208)

  • INFO

    • Checks supported languages

      • winzip76.exe (PID: 2280)
      • winzip76.exe (PID: 3620)

    • Creates files in the program directory

      • winzip76.exe (PID: 3620)

    • Reads the computer name

      • winzip76.exe (PID: 3620)

    • Create files in a temporary directory

      • winzip76.exe (PID: 2280)
      • winzip76.exe (PID: 3620)

    • Process checks computer location settings

      • winzip76.exe (PID: 3620)

    • The process uses the downloaded file

      • winzip76.exe (PID: 3620)

    • Reads the software policy settings

      • winzip76.exe (PID: 3620)

    • Reads the machine GUID from the registry

      • winzip76.exe (PID: 3620)

    • Checks proxy server information

      • winzip76.exe (PID: 3620)

    • Creates files or folders in the user directory

      • winzip76.exe (PID: 3620)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (18)
.exe | Win32 Executable (generic) (2.9)
.exe | Generic Win/DOS Executable (1.3)
.exe | DOS Executable Generic (1.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:09:06 17:56:30+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 2104320
InitializedDataSize: 703488
UninitializedDataSize: -
EntryPoint: 0x18ac30
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 76.9.16251.0
ProductVersionNumber: 76.9.16251.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: WinZip Computing
FileDescription: WinZipStub Installer
FileVersion: 76.9.16251.0
InternalName: WinZipStubInstaller.exe
LegalCopyright: (c) 2015-2024 Corel Corporation All rights reserved.
ProductName: WinZipStub
ProductVersion: 76.9.16251.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winzip76.exe winzip76.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe winzip76.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
488"C:\Users\admin\AppData\Local\Temp\winzip76.exe" C:\Users\admin\AppData\Local\Temp\winzip76.exe—explorer.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
MEDIUM
Description:
WinZipStub Installer
Exit code:
3221226540
Version:
76.9.16251.0
Modules
Images
c:\users\admin\appdata\local\temp\winzip76.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2280"C:\Users\admin\AppData\Local\Temp\winzip76.exe" C:\Users\admin\AppData\Local\Temp\winzip76.exe
explorer.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
HIGH
Description:
WinZipStub Installer
Exit code:
0
Version:
76.9.16251.0
Modules
Images
c:\users\admin\appdata\local\temp\winzip76.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3620 run=1 shortcut="C:\Users\admin\AppData\Local\Temp\winzip76.exe"C:\Users\admin\AppData\Local\Temp\e95c3\winzip76.exe
winzip76.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
HIGH
Description:
WinZipStub Installer
Exit code:
0
Version:
76.9.16251.0
Modules
Images
c:\users\admin\appdata\local\temp\e95c3\winzip76.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4208"C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /installC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
winzip76.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
2147747592
Version:
1.3.195.31
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5912"C:\Program Files (x86)\Microsoft\Temp\EUA3BD.tmp\MicrosoftEdgeUpdate.exe" /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Program Files (x86)\Microsoft\Temp\EUA3BD.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
2147747592
Version:
1.3.195.31
Modules
Images
c:\program files (x86)\microsoft\temp\eua3bd.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
6292"C:\WINDOWS\system32\wermgr.exe" "-outproc" "0" "5912" "760" "664" "2032" "0" "0" "0" "0" "0" "0" "0" "0" C:\Windows\SysWOW64\wermgr.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wermgr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
5 425
Read events
5 368
Write events
53
Delete events
4

Modification events

(PID) Process:(3620) winzip76.exeKey:HKEY_CURRENT_USER\SOFTWARE\Corel\stubframework\WNZP\76
Operation:writeName:install_language
Value:
English
(PID) Process:(3620) winzip76.exeKey:HKEY_CURRENT_USER\SOFTWARE\Corel\PCU
Operation:writeName:7
Value:
726620524153
(PID) Process:(3620) winzip76.exeKey:HKEY_CURRENT_USER\SOFTWARE\Corel\PCU
Operation:writeName:HFNCv2
Value:
726620524153
(PID) Process:(3620) winzip76.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3620) winzip76.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3620) winzip76.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5912) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe
Operation:writeName:DisableExceptionChainValidation
Value:
0
(PID) Process:(5912) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{7969DBCF-43A4-4C30-AAF6-343B75630FBB}
Operation:writeName:PersistedPingString
Value:
<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" updater="Omaha" updaterversion="1.3.195.31" shell_version="1.3.147.37" ismachine="1" sessionid="{08973AB4-CF33-4A0D-9D64-8F98D6D7B60E}" userid="{FD984739-A122-4DB0-BE5B-46E3E09D84E4}" installsource="otherinstallcmd" requestid="{7969DBCF-43A4-4C30-AAF6-343B75630FBB}" dedup="cr" domainjoined="0"><hw logical_cpus="4" physmemory="4" disk_type="2" sse="1" sse2="1" sse3="1" ssse3="1" sse41="1" sse42="1" avx="1"/><os platform="win" version="10.0.19045.4046" sp="" arch="x64" product_type="48" is_wip="0" is_in_lockdown_mode="0"/><oem product_manufacturer="DELL" product_name="DELL"/><exp etag="&quot;r452t1+k2Tgq/HXzjvFNBRhopBWR9sbjXxqeUDH9uX0=&quot;"/><app appid="{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" version="1.3.185.17" nextversion="1.3.195.31" lang="" brand="" client=""><event eventtype="2" eventresult="1" errorcode="0" extracode1="0" system_uptime_ticks="9609695687" install_time_ms="360"/></app></request>
(PID) Process:(5912) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{7969DBCF-43A4-4C30-AAF6-343B75630FBB}
Operation:writeName:PersistedPingTime
Value:
133765591876310740
(PID) Process:(5912) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\proxy
Operation:writeName:source
Value:
auto
Executable files
203
Suspicious files
27
Text files
54
Unknown types
1

Dropped files

PID
Process
Filename
Type
2280winzip76.exeC:\Users\admin\AppData\Local\Temp\e95c3\winzip76.exeexecutable
MD5:7C05D8FAEB45C410E965F3AC98D31300
SHA256:B9C54457A260A168FA0EB60F2AE1A5C7A5B7072A8120E37E9561FAD6F914E298
3620winzip76.exeC:\Users\admin\AppData\Local\Temp\e97c7\common\img\close-normal.pngimage
MD5:C9F970B77486B6C60F583DE55B82EBB2
SHA256:DD727B90F3C6B053FA5B4C8401440E5D120DAC6B93305573CAAEFECEDC5F0C5E
3620winzip76.exeC:\Users\admin\AppData\Local\Temp\e97c7\common\img\close-hover.pngimage
MD5:DC25F8EBE54644F4C207F83711EE04AC
SHA256:0B0DF46552E1B95349C2F9D65DBB7379A7535E1A8A3C18C3B27958D0D8308E9B
3620winzip76.exeC:\Users\admin\AppData\Local\Temp\e97c7\common\css\jquery-ui.csstext
MD5:57E596746D7AEC182ABD22CCE3E21F48
SHA256:20F5E9ACBA9499E86914DDD950AEB1A33B94142D9C59E61510A91D884BA2BD6F
3620winzip76.exeC:\Users\admin\AppData\Local\Temp\e97c7\common\img\progress_value.pngimage
MD5:37FFEA558CCD74932778CFFD5BBAB974
SHA256:E9B73D55379ABB474E251A44386D4B28922F30C3D135C92996A6310AF59BFDFE
3620winzip76.exeC:\Users\admin\AppData\Local\Temp\e97c7\common\img\footerImg.pngimage
MD5:59068C9A357B259A32C5ACF1EAE1B6CA
SHA256:EA52A6F973100CBDD3217A609EF3737DAE42597DD112165FC8A0C42FBD37A517
3620winzip76.exeC:\Users\admin\AppData\Local\Temp\e97c7\common\img\arrow.pngimage
MD5:2A9E7E3FDD66157922465CE189D69AF3
SHA256:FE20166694A729AF85BAF6547ACA4E3A5297888091CA69CD5588EF1E48616E2F
3620winzip76.exeC:\Users\admin\AppData\Local\Temp\e97c7\common\img\progress_background.pngimage
MD5:17D7B3B6595A0D6860AF793BC8916F30
SHA256:74BFC424E331DF2961B4DF57D65FBFFC116594333DC1DDE0CD1277C351FA9C69
3620winzip76.exeC:\Users\admin\AppData\Local\Temp\e97c7\common\img\headerImg.pngimage
MD5:79F3461A48F669EF914EEFBD83925820
SHA256:A9B420A106ADB6B09E5DD39A864DD00519AADE91CE6F500C179E9E6652B0FC51
3620winzip76.exeC:\Users\admin\AppData\Local\Temp\e97c7\common\js\external.jstext
MD5:140918FEDED87FE0A5563A4080071258
SHA256:25DF7AB9509D4E8760F1FDC99684E0E72AAC6E885CBDD3396FEBC405EA77E7F6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
45
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6988
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6988
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6472
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3620
winzip76.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
4932
svchost.exe
GET
200
23.216.77.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4932
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6292
wermgr.exe
GET
200
23.216.77.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6292
wermgr.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
4536
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4932
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
104.126.37.123:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3620
winzip76.exe
34.215.199.186:443
www.installportal.com
AMAZON-02
US
unknown
3620
winzip76.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
3620
winzip76.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.142
whitelisted
www.bing.com
  • 104.126.37.123
  • 104.126.37.186
  • 104.126.37.131
  • 104.126.37.139
  • 104.126.37.137
  • 104.126.37.130
  • 104.126.37.144
  • 104.126.37.136
  • 104.126.37.128
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.installportal.com
  • 34.215.199.186
  • 35.165.40.155
unknown
go.microsoft.com
  • 23.35.238.131
whitelisted
msedge.sf.dl.delivery.mp.microsoft.com
  • 23.50.131.88
  • 23.50.131.87
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
crl.microsoft.com
  • 23.216.77.10
  • 23.216.77.21
  • 23.216.77.23
  • 23.216.77.16
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
winzip76.exe