intercepting application that reads encrypted zip

[Mem5]

- Read from memory (RAM) the process space
or/and
- hook all API used by the process. You will be able to see for example the params given to function, so maybe the password.