File name:

Zoom_cm_fr55MivM5bZ9vvrZo4_moNF2GWB7etbZHa2a6ZNCzDqUXvQAJAJpmMXm@Sg-1BMYBpifMvcvP_k4f7ed7b45eab8e7a_.exe

Full analysis: https://app.any.run/tasks/34ebef48-dea3-4c24-9fb6-b43ce2e72926
Verdict: Malicious activity
Analysis date: May 19, 2025, 04:14:30
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

D2C2F7974BCB8A531CC9F138A58BD70B

SHA1:

90164DE94F87BEDF84FA4DE45D12CFEF56FD6E29

SHA256:

1CE27D561F9ACD3C80EC78B439F6C44E03873C2E3B1AE9D5BDAE4E9D2C11D879

SSDEEP:

6144:/7WnDPPIUfR0x82Z/5tga9dkYQUFzqnt1qz:z0D/UZ/5ON8UI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe (PID: 5960)
      • Installer.exe (PID: 6388)
      • Zoom.exe (PID: 6080)
      • Zoom.exe (PID: 1184)
      • Zoom.exe (PID: 4428)
      • Zoom.exe (PID: 2656)

    • Executable content was dropped or overwritten

      • 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe (PID: 5960)
      • Installer.exe (PID: 6388)
      • Zoom.exe (PID: 6080)

    • The process creates files with name similar to system file names

      • Installer.exe (PID: 6388)
      • Zoom.exe (PID: 6080)

    • The process drops C-runtime libraries

      • Installer.exe (PID: 6388)

    • Process drops legitimate windows executable

      • Installer.exe (PID: 6388)

    • Starts application with an unusual extension

      • 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe (PID: 5960)

    • Starts itself from another location

      • 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe (PID: 5960)

    • Application launched itself

      • Installer.exe (PID: 6388)
      • Zoom.exe (PID: 6080)

    • Reads the date of Windows installation

      • Installer.exe (PID: 6388)
      • Zoom.exe (PID: 6080)

    • Creates a software uninstall entry

      • Installer.exe (PID: 6388)

    • The process checks if it is being run in the virtual environment

      • Zoom.exe (PID: 6080)
      • Zoom.exe (PID: 1184)
      • Zoom.exe (PID: 4428)
      • Zoom.exe (PID: 2656)

  • INFO

    • Reads the computer name

      • 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe (PID: 5960)
      • Installer.exe (PID: 6388)
      • Installer.exe (PID: 2240)
      • Zoom.exe (PID: 6080)
      • Zoom.exe (PID: 1184)
      • Installer.exe (PID: 2152)
      • Zoom.exe (PID: 4428)
      • Zoom.exe (PID: 2656)

    • The sample compiled with english language support

      • 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe (PID: 5960)
      • Installer.exe (PID: 6388)
      • Zoom.exe (PID: 6080)

    • Create files in a temporary directory

      • 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe (PID: 5960)
      • Zoom.exe (PID: 6080)

    • Checks proxy server information

      • 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe (PID: 5960)
      • Zoom.exe (PID: 6080)
      • Zoom.exe (PID: 1184)
      • Zoom.exe (PID: 4428)
      • Zoom.exe (PID: 2656)

    • Reads the software policy settings

      • 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe (PID: 5960)
      • Installer.exe (PID: 6388)
      • Zoom.exe (PID: 6080)
      • Zoom.exe (PID: 1184)
      • Zoom.exe (PID: 4428)
      • Zoom.exe (PID: 2656)
      • slui.exe (PID: 6372)

    • Reads the machine GUID from the registry

      • 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe (PID: 5960)
      • Installer.exe (PID: 6388)
      • Zoom.exe (PID: 6080)
      • Zoom.exe (PID: 1184)
      • Zoom.exe (PID: 4428)
      • Zoom.exe (PID: 2656)

    • Creates files or folders in the user directory

      • 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe (PID: 5960)
      • Installer.exe (PID: 6388)
      • Zoom.exe (PID: 6080)
      • Zoom.exe (PID: 1184)
      • Zoom.exe (PID: 4428)
      • Zoom.exe (PID: 2656)

    • Process checks computer location settings

      • 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe (PID: 5960)
      • Installer.exe (PID: 6388)
      • Zoom.exe (PID: 6080)
      • Zoom.exe (PID: 1184)
      • Zoom.exe (PID: 4428)

    • Checks supported languages

      • 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe (PID: 5960)
      • Installer.exe (PID: 6388)
      • Zoom.exe (PID: 6080)
      • Installer.exe (PID: 2240)
      • zm46CA.tmp (PID: 4188)
      • Zoom.exe (PID: 1184)
      • Installer.exe (PID: 2152)
      • Zoom.exe (PID: 2656)
      • Zoom.exe (PID: 4428)

    • The sample compiled with chinese language support

      • Installer.exe (PID: 6388)
      • Zoom.exe (PID: 6080)

    • Reads Environment values

      • Zoom.exe (PID: 6080)
      • Zoom.exe (PID: 2656)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:27 08:33:58+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 103424
InitializedDataSize: 51712
UninitializedDataSize: -
EntryPoint: 0x6de0
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 6.4.5.69
ProductVersionNumber: 6.4.5.69
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: Zoom Opener
CompanyName: Zoom Communications, Inc.
FileDescription: Zoom Opener
FileVersion: 6,4,5,69
InternalName: Zoom Opener
LegalCopyright: © Zoom Communications, Inc. All rights reserved.
LegalTrademarks: Zoom Opener
OriginalFileName: Zoom Opener
ProductName: Zoom Opener
ProductVersion: 6,4,5,69
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
12
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe sppextcomobj.exe no specs slui.exe installer.exe installer.exe zoom.exe zm46ca.tmp no specs zoom.exe no specs installer.exe no specs zoom.exe no specs zoom.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1128C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1184"C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe" --action=joinbyno --runaszvideo=TRUE C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe—Zoom.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Meetings
Exit code:
0
Version:
6.4.6.64360
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\zoom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
2152"C:\Users\admin\AppData\Roaming\Zoom\bin\Installer.exe" "C:\Users\admin\AppData\Roaming\Zoom\bin\Installer.exe" /tskschdC:\Users\admin\AppData\Roaming\Zoom\bin\Installer.exe—Zoom.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Installer
Exit code:
0
Version:
6,4,6,64360
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
2240"C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe" /addfwexception --bin_home="C:\Users\admin\AppData\Roaming\Zoom\bin"C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe
Installer.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
HIGH
Description:
Zoom Installer
Exit code:
0
Version:
6,4,6,64360
Modules
Images
c:\users\admin\appdata\roaming\zoom\zoomdownload\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
2392C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2656Zoom.exe --action=cleanTmpFile --data=dataC:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe—Zoom.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Meetings
Exit code:
0
Version:
6.4.6.64360
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\zoom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\users\admin\appdata\roaming\zoom\bin\cmmlib.dll
4188"C:\Users\admin\AppData\Local\Temp\zm46CA.tmp" -DAF8C715436E44649F1312698287E6A5=C:\Users\admin\AppData\Local\Temp\34ebef48-dea3-4c24-9fb6-b43ce2e72926.exeC:\Users\admin\AppData\Local\Temp\zm46CA.tmp—34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Opener
Exit code:
0
Version:
6,4,5,69
Modules
Images
c:\users\admin\appdata\local\temp\zm46ca.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
4428"C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe" --action=preload --runaszvideo=TRUE C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe—Zoom.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Meetings
Exit code:
0
Version:
6.4.6.64360
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\zoom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
5960"C:\Users\admin\AppData\Local\Temp\34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe" C:\Users\admin\AppData\Local\Temp\34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe
explorer.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Opener
Exit code:
0
Version:
6,4,5,69
Modules
Images
c:\users\admin\appdata\local\temp\34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6080"C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe" "--url=zoommtg://win.launch?h.domain=zoom.us&h.path=join&action=join&confno="C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe
34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Meetings
Exit code:
0
Version:
6.4.6.64360
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\zoom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
Total events
32 454
Read events
32 274
Write events
120
Delete events
60

Modification events

(PID) Process:(5960) 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5960) 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5960) 34ebef48-dea3-4c24-9fb6-b43ce2e72926.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6388) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\ZoomUMX\PerInstall
Operation:writeName:from
Value:
(PID) Process:(6388) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:DisplayIcon
Value:
C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe
(PID) Process:(6388) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:DisplayName
Value:
Zoom Workplace
(PID) Process:(6388) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:DisplayVersion
Value:
6.4.6 (64360)
(PID) Process:(6388) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:HelpLink
Value:
https://support.zoom.us/home
(PID) Process:(6388) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:URLInfoAbout
Value:
https://zoom.us
(PID) Process:(6388) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:URLUpdateInfo
Value:
https://zoom.us
Executable files
261
Suspicious files
235
Text files
18
Unknown types
0

Dropped files

PID
Process
Filename
Type
596034ebef48-dea3-4c24-9fb6-b43ce2e72926.exeC:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Zoom.msi —
MD5:—
SHA256:—
596034ebef48-dea3-4c24-9fb6-b43ce2e72926.exeC:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exeexecutable
MD5:DD4BE0CCEAC8CDF87534D8A2D40A92FA
SHA256:B5584C146A96506D2C1BB05BBB162CC5E54E1AA2B0259CA7D42F417B4D7662B2
596034ebef48-dea3-4c24-9fb6-b43ce2e72926.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97Cbinary
MD5:3A7A9E3FC6A23FFF27D882A07DCAA695
SHA256:D72A77F1C027126056F9A60EEBA1274C13F96D4473D8D5A1124BDC799D38C0FE
6388Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\archival.pcmbinary
MD5:2DA32E501E9720B40D438FF7352A5573
SHA256:5E7D1491E7D6969EB67646F87AB2DBF0FF1D1CB4F5CF631128A305E2B67D4A1B
6388Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\mute.pcmbinary
MD5:0C36D3EE8B0780BF848BFF08FCCE51F4
SHA256:B778592A0D29FC31875474A84ADCBB9A5BAD1FC095E7CD2D408B3DA219424A1E
6388Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\pcm\dtmf_0.pcmbinary
MD5:285974390C5114E6A8E91A2D63266A38
SHA256:394C441E19F6D34B46BAEB7820726F279BC71D21E6911070DBB58E67568ECB9C
6388Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\clap-medium.pcmbinary
MD5:AA93AB138EC89CF7CFB8B4B0EA8990A6
SHA256:D754FC9D9378772B7A17A53E6598C9CFE4A0F3EC492F0ED30241020562F58509
6388Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\clap-high.pcmbinary
MD5:C32F95839557340B4B4197A68847CA1D
SHA256:0A16435CB3F7B8B1787476575AD646361E6FB4C07587DF874940413DE004DD08
6388Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\meeting_chat_chime.pcmbinary
MD5:B30A997B4A9DF68D8796EEF6F457F4AA
SHA256:F2FF5D73EE2A89135094ECB5165B30E351BB24EE4EEEE95508F311EECDC9811F
6388Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\crashrpt_lang.initext
MD5:FCF61AED8F093BFCF571CDD8F8162A05
SHA256:1F5B45A5411F7FC71B9DA789D6D1EAD8AD30551FBEA7BBB40FC7EA576D581ABB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
38
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.20:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5960
34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAhflMAthXvozBT%2FU%2B2iPio%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1660
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1660
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.20:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5960
34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe
170.114.52.2:443
zoom.us
—
US
whitelisted
5960
34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe
170.114.46.1:443
cdn.zoom.us
Cloudflare London, LLC
US
whitelisted
5960
34ebef48-dea3-4c24-9fb6-b43ce2e72926.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.20
  • 23.216.77.42
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
google.com
  • 142.250.185.174
whitelisted
zoom.us
  • 170.114.52.2
whitelisted
cdn.zoom.us
  • 170.114.46.1
  • 170.114.45.1
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.132
  • 20.190.160.17
  • 20.190.160.65
  • 20.190.160.3
  • 20.190.160.64
  • 40.126.32.133
  • 40.126.32.136
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Zoom_cm_fr55MivM5bZ9vvrZo4_moNF2GWB7etbZHa2a6ZNCzDqUXvQAJAJpmMXm@Sg-1BMYBpifMvcvP_k4f7ed7b45eab8e7a_.exe