File name:

Zoom_cm_fo42mnktZ9vvrZo4_mIJg9E-rbc-F3VJvwPDKfXA0FTYmIFIt9iJyw@XGuujkn+R-Vzrby6_k317d1561d31f43d3_ 1.exe

Full analysis: https://app.any.run/tasks/7123514a-cd0a-4369-839f-b811251d2269
Verdict: Malicious activity
Analysis date: May 19, 2025, 02:46:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

D2C2F7974BCB8A531CC9F138A58BD70B

SHA1:

90164DE94F87BEDF84FA4DE45D12CFEF56FD6E29

SHA256:

1CE27D561F9ACD3C80EC78B439F6C44E03873C2E3B1AE9D5BDAE4E9D2C11D879

SSDEEP:

6144:/7WnDPPIUfR0x82Z/5tga9dkYQUFzqnt1qz:z0D/UZ/5ON8UI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 7123514a-cd0a-4369-839f-b811251d2269.exe (PID: 2092)
      • Installer.exe (PID: 6272)
      • Zoom.exe (PID: 5756)
      • Zoom.exe (PID: 4728)

    • Executable content was dropped or overwritten

      • 7123514a-cd0a-4369-839f-b811251d2269.exe (PID: 2092)
      • Zoom.exe (PID: 5756)
      • Installer.exe (PID: 6272)

    • Application launched itself

      • Installer.exe (PID: 6272)
      • Zoom.exe (PID: 5756)

    • Reads the date of Windows installation

      • Installer.exe (PID: 6272)
      • Zoom.exe (PID: 5756)

    • Creates a software uninstall entry

      • Installer.exe (PID: 6272)

    • The process checks if it is being run in the virtual environment

      • Zoom.exe (PID: 5756)
      • Zoom.exe (PID: 4728)

    • Starts itself from another location

      • 7123514a-cd0a-4369-839f-b811251d2269.exe (PID: 2092)

    • Starts application with an unusual extension

      • 7123514a-cd0a-4369-839f-b811251d2269.exe (PID: 2092)

    • The process creates files with name similar to system file names

      • Zoom.exe (PID: 5756)
      • Installer.exe (PID: 6272)

    • Process drops legitimate windows executable

      • Installer.exe (PID: 6272)

    • The process drops C-runtime libraries

      • Installer.exe (PID: 6272)

  • INFO

    • The sample compiled with english language support

      • 7123514a-cd0a-4369-839f-b811251d2269.exe (PID: 2092)
      • Zoom.exe (PID: 5756)
      • Installer.exe (PID: 6272)

    • Checks supported languages

      • 7123514a-cd0a-4369-839f-b811251d2269.exe (PID: 2092)
      • Installer.exe (PID: 6272)
      • Installer.exe (PID: 2268)
      • Zoom.exe (PID: 4728)
      • zm3FB5.tmp (PID: 1040)
      • Zoom.exe (PID: 5756)
      • Installer.exe (PID: 6676)

    • The sample compiled with chinese language support

      • Installer.exe (PID: 6272)
      • Zoom.exe (PID: 5756)

    • Checks proxy server information

      • 7123514a-cd0a-4369-839f-b811251d2269.exe (PID: 2092)
      • Zoom.exe (PID: 5756)
      • Zoom.exe (PID: 4728)

    • Reads the computer name

      • 7123514a-cd0a-4369-839f-b811251d2269.exe (PID: 2092)
      • Installer.exe (PID: 6272)
      • Installer.exe (PID: 2268)
      • Zoom.exe (PID: 5756)
      • Zoom.exe (PID: 4728)
      • Installer.exe (PID: 6676)

    • Reads the software policy settings

      • 7123514a-cd0a-4369-839f-b811251d2269.exe (PID: 2092)
      • Installer.exe (PID: 6272)
      • Zoom.exe (PID: 5756)
      • Zoom.exe (PID: 4728)

    • Reads the machine GUID from the registry

      • 7123514a-cd0a-4369-839f-b811251d2269.exe (PID: 2092)
      • Zoom.exe (PID: 5756)
      • Zoom.exe (PID: 4728)
      • Installer.exe (PID: 6272)

    • Creates files or folders in the user directory

      • 7123514a-cd0a-4369-839f-b811251d2269.exe (PID: 2092)
      • Installer.exe (PID: 6272)
      • Zoom.exe (PID: 5756)
      • Zoom.exe (PID: 4728)

    • Process checks computer location settings

      • 7123514a-cd0a-4369-839f-b811251d2269.exe (PID: 2092)
      • Installer.exe (PID: 6272)
      • Zoom.exe (PID: 5756)
      • Zoom.exe (PID: 4728)

    • Create files in a temporary directory

      • 7123514a-cd0a-4369-839f-b811251d2269.exe (PID: 2092)
      • Zoom.exe (PID: 5756)

    • Reads Environment values

      • Zoom.exe (PID: 5756)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:27 08:33:58+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 103424
InitializedDataSize: 51712
UninitializedDataSize: -
EntryPoint: 0x6de0
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 6.4.5.69
ProductVersionNumber: 6.4.5.69
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: Zoom Opener
CompanyName: Zoom Communications, Inc.
FileDescription: Zoom Opener
FileVersion: 6,4,5,69
InternalName: Zoom Opener
LegalCopyright: © Zoom Communications, Inc. All rights reserved.
LegalTrademarks: Zoom Opener
OriginalFileName: Zoom Opener
ProductName: Zoom Opener
ProductVersion: 6,4,5,69
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 7123514a-cd0a-4369-839f-b811251d2269.exe sppextcomobj.exe no specs slui.exe no specs installer.exe installer.exe zoom.exe zm3fb5.tmp no specs zoom.exe no specs installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1040"C:\Users\admin\AppData\Local\Temp\zm3FB5.tmp" -DAF8C715436E44649F1312698287E6A5=C:\Users\admin\Downloads\7123514a-cd0a-4369-839f-b811251d2269.exeC:\Users\admin\AppData\Local\Temp\zm3FB5.tmp—7123514a-cd0a-4369-839f-b811251d2269.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Opener
Exit code:
0
Version:
6,4,5,69
Modules
Images
c:\users\admin\appdata\local\temp\zm3fb5.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
1272C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2092"C:\Users\admin\Downloads\7123514a-cd0a-4369-839f-b811251d2269.exe" C:\Users\admin\Downloads\7123514a-cd0a-4369-839f-b811251d2269.exe
explorer.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Opener
Exit code:
0
Version:
6,4,5,69
Modules
Images
c:\users\admin\downloads\7123514a-cd0a-4369-839f-b811251d2269.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
2268"C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe" /addfwexception --bin_home="C:\Users\admin\AppData\Roaming\Zoom\bin"C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe
Installer.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
HIGH
Description:
Zoom Installer
Exit code:
0
Version:
6,4,6,64360
Modules
Images
c:\users\admin\appdata\roaming\zoom\zoomdownload\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
4728"C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe" --action=joinbyno --runaszvideo=TRUE C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe—Zoom.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Meetings
Version:
6.4.6.64360
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\zoom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\users\admin\appdata\roaming\zoom\bin\cmmlib.dll
5332"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5756"C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe" "--url=zoommtg://win.launch?h.domain=zoom.us&h.path=join&action=join&confno="C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe
7123514a-cd0a-4369-839f-b811251d2269.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Meetings
Version:
6.4.6.64360
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\zoom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
6272"C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe" ZInstaller --conf.mode=silent --ipc_wnd=262918C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe
7123514a-cd0a-4369-839f-b811251d2269.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Installer
Exit code:
0
Version:
6,4,6,64360
Modules
Images
c:\users\admin\appdata\roaming\zoom\zoomdownload\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
6676"C:\Users\admin\AppData\Roaming\Zoom\bin\Installer.exe" "C:\Users\admin\AppData\Roaming\Zoom\bin\Installer.exe" /tskschdC:\Users\admin\AppData\Roaming\Zoom\bin\Installer.exe—Zoom.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Installer
Exit code:
0
Version:
6,4,6,64360
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
Total events
20 909
Read events
20 805
Write events
78
Delete events
26

Modification events

(PID) Process:(2092) 7123514a-cd0a-4369-839f-b811251d2269.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2092) 7123514a-cd0a-4369-839f-b811251d2269.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2092) 7123514a-cd0a-4369-839f-b811251d2269.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6272) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:DisplayIcon
Value:
C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe
(PID) Process:(6272) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:DisplayName
Value:
Zoom Workplace
(PID) Process:(6272) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:DisplayVersion
Value:
6.4.6 (64360)
(PID) Process:(6272) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:HelpLink
Value:
https://support.zoom.us/home
(PID) Process:(6272) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:URLInfoAbout
Value:
https://zoom.us
(PID) Process:(6272) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:URLUpdateInfo
Value:
https://zoom.us
(PID) Process:(6272) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:Publisher
Value:
Zoom Communications, Inc.
Executable files
261
Suspicious files
220
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
20927123514a-cd0a-4369-839f-b811251d2269.exeC:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Zoom.msi —
MD5:—
SHA256:—
20927123514a-cd0a-4369-839f-b811251d2269.exeC:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exeexecutable
MD5:DD4BE0CCEAC8CDF87534D8A2D40A92FA
SHA256:B5584C146A96506D2C1BB05BBB162CC5E54E1AA2B0259CA7D42F417B4D7662B2
6272Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\archival.pcmbinary
MD5:2DA32E501E9720B40D438FF7352A5573
SHA256:5E7D1491E7D6969EB67646F87AB2DBF0FF1D1CB4F5CF631128A305E2B67D4A1B
6272Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\crashrpt_lang.initext
MD5:FCF61AED8F093BFCF571CDD8F8162A05
SHA256:1F5B45A5411F7FC71B9DA789D6D1EAD8AD30551FBEA7BBB40FC7EA576D581ABB
6272Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\dingdong1.pcmbinary
MD5:8FE86D9E8AA5C709BB0563243172E580
SHA256:2FBBB9AE6A463B360E1459BEE558DAFA8D864DB2423F0FE4D2C56D22C3F3A5A2
6272Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\clap-high.pcmbinary
MD5:C32F95839557340B4B4197A68847CA1D
SHA256:0A16435CB3F7B8B1787476575AD646361E6FB4C07587DF874940413DE004DD08
6272Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\dingdong.pcmbinary
MD5:54511224E61E71D2915FF67E57DCB268
SHA256:7AADF0E317831D287B51E41992B43F0F381AE48A312CB77A426EEB3B6129D6D7
20927123514a-cd0a-4369-839f-b811251d2269.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97Cbinary
MD5:8EF25AFD04E11EA489387A8D773935B6
SHA256:8E471C8C458B736465161ECB416E6742653819EB3C344218D8CD6135E09AA9C7
20927123514a-cd0a-4369-839f-b811251d2269.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97Cbinary
MD5:3A7A9E3FC6A23FFF27D882A07DCAA695
SHA256:D72A77F1C027126056F9A60EEBA1274C13F96D4473D8D5A1124BDC799D38C0FE
6272Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\pcm\dtmf_0.pcmbinary
MD5:285974390C5114E6A8E91A2D63266A38
SHA256:394C441E19F6D34B46BAEB7820726F279BC71D21E6911070DBB58E67568ECB9C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
34
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2092
7123514a-cd0a-4369-839f-b811251d2269.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAhflMAthXvozBT%2FU%2B2iPio%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5640
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5640
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2092
7123514a-cd0a-4369-839f-b811251d2269.exe
170.114.52.2:443
zoom.us
—
US
whitelisted
2092
7123514a-cd0a-4369-839f-b811251d2269.exe
170.114.46.1:443
cdn.zoom.us
Cloudflare London, LLC
US
whitelisted
2092
7123514a-cd0a-4369-839f-b811251d2269.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.142
whitelisted
zoom.us
  • 170.114.52.2
whitelisted
cdn.zoom.us
  • 170.114.46.1
  • 170.114.45.1
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.3
  • 20.190.160.132
  • 20.190.160.65
  • 20.190.160.20
  • 20.190.160.66
  • 40.126.32.133
  • 20.190.160.128
  • 20.190.160.2
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Zoom_cm_fo42mnktZ9vvrZo4_mIJg9E-rbc-F3VJvwPDKfXA0FTYmIFIt9iJyw@XGuujkn+R-Vzrby6_k317d1561d31f43d3_ 1.exe