URL:

http://zoomtext2020.vfo.digital/2020.2008.19.400/1CDB6BAA-03D8-4CCB-B00C-DA79ACBC6231/ZT2020.2008.19.400.exe

Full analysis: https://app.any.run/tasks/52678c2c-56a2-40d2-a071-f066b55ae61c
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 01, 2020, 10:31:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

C9278589F639FE040A3E273C818E9019

SHA1:

5A3EBAD872E9DB6FF9C47F32C4F6B8AD1B9C6360

SHA256:

6DFBB03CEE8B3448DF3FBCDB77D3801FAAB77497DA22D7EE6B68D763613FD27E

SSDEEP:

3:N1KEuRATtFD3EsVjVJtPWrtI8LIAmnvvZJtkA:CEuRctrYlIDnHZkA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ZT2020.2008.19.400.exe (PID: 3848)
      • ZoomTextSetupPackage.exe (PID: 180)
      • vcredist_x86.exe (PID: 556)
      • vcredist_x86.exe (PID: 2644)
      • ZT2020.2008.19.400.exe (PID: 3272)
      • Sentinel System Driver Installer 7.5.0.exe (PID: 2584)
      • vregtool.exe (PID: 2948)
      • SentinelDrv32Support.exe (PID: 2940)
      • ZT2020.2008.19.400.exe (PID: 4060)
      • fsWow64Proxy.exe (PID: 4072)
      • MDDInstaller32.exe (PID: 3936)
      • InstAndStartNTParService.exe (PID: 3888)
      • InstParLauncher.exe (PID: 2748)
      • AhoiUtil.exe (PID: 2336)
      • Zt.exe (PID: 2648)
      • AiSquared.ZoomText.UI.exe (PID: 1888)
      • RemoteSupportUI.exe (PID: 3432)
      • Zt.exe (PID: 3036)

    • Loads dropped or rewritten executable

      • ZT2020.2008.19.400.exe (PID: 3272)
      • vcredist_x86.exe (PID: 2644)
      • rundll32.exe (PID: 3276)
      • rundll32.exe (PID: 3696)
      • rundll32.exe (PID: 3768)
      • regsvr32.exe (PID: 1248)
      • AhoiUtil.exe (PID: 2336)
      • rundll32.exe (PID: 1512)
      • rundll32.exe (PID: 860)
      • regsvr32.exe (PID: 1324)
      • rundll32.exe (PID: 2844)
      • rundll32.exe (PID: 3016)
      • regsvr32.exe (PID: 2992)
      • Zt.exe (PID: 3036)
      • AiSquared.ZoomText.UI.exe (PID: 1888)

    • Downloads executable files from the Internet

      • ZT2020.2008.19.400.exe (PID: 3272)
      • chrome.exe (PID: 2924)

    • Changes settings of System certificates

      • ZoomTextSetupPackage.exe (PID: 180)
      • MDDInstaller32.exe (PID: 3936)

    • Changes the autorun value in the registry

      • ZoomTextSetupPackage.exe (PID: 180)
      • vcredist_x86.exe (PID: 556)
      • ZT2020.2008.19.400.exe (PID: 3272)

    • Registers / Runs the DLL via REGSVR32.EXE

      • rundll32.exe (PID: 860)

  • SUSPICIOUS

    • Starts itself from another location

      • ZT2020.2008.19.400.exe (PID: 4060)
      • ZT2020.2008.19.400.exe (PID: 3272)

    • Creates a software uninstall entry

      • ZoomTextSetupPackage.exe (PID: 180)
      • vcredist_x86.exe (PID: 556)

    • Executable content was dropped or overwritten

      • ZoomTextSetupPackage.exe (PID: 180)
      • ZT2020.2008.19.400.exe (PID: 3272)
      • vcredist_x86.exe (PID: 2644)
      • Sentinel System Driver Installer 7.5.0.exe (PID: 2584)
      • MDDInstaller32.exe (PID: 3936)
      • chrome.exe (PID: 3172)
      • DrvInst.exe (PID: 2848)
      • DrvInst.exe (PID: 1820)
      • rundll32.exe (PID: 3768)
      • rundll32.exe (PID: 3696)
      • rundll32.exe (PID: 1512)
      • rundll32.exe (PID: 860)

    • Adds / modifies Windows certificates

      • ZoomTextSetupPackage.exe (PID: 180)

    • Creates files in the user directory

      • ZT2020.2008.19.400.exe (PID: 3272)

    • Reads Internet Cache Settings

      • ZT2020.2008.19.400.exe (PID: 3272)

    • Searches for installed software

      • ZoomTextSetupPackage.exe (PID: 180)
      • vcredist_x86.exe (PID: 556)

    • Creates files in the Windows directory

      • Sentinel System Driver Installer 7.5.0.exe (PID: 2584)
      • DrvInst.exe (PID: 956)
      • DrvInst.exe (PID: 1820)
      • DrvInst.exe (PID: 2848)
      • rundll32.exe (PID: 3768)

    • Starts Microsoft Installer

      • Sentinel System Driver Installer 7.5.0.exe (PID: 2584)

    • Creates files in the program directory

      • ZoomTextSetupPackage.exe (PID: 180)
      • rundll32.exe (PID: 3768)
      • AhoiUtil.exe (PID: 2336)

    • Executed via COM

      • DrvInst.exe (PID: 956)
      • DrvInst.exe (PID: 2848)
      • DrvInst.exe (PID: 1820)
      • RemoteSupportUI.exe (PID: 3432)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 956)
      • DrvInst.exe (PID: 1820)
      • DrvInst.exe (PID: 2848)

    • Application launched itself

      • vcredist_x86.exe (PID: 556)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 956)
      • DrvInst.exe (PID: 1820)
      • DrvInst.exe (PID: 2848)

    • Uses RUNDLL32.EXE to load library

      • MsiExec.exe (PID: 3608)

    • Changes IE settings (feature browser emulation)

      • rundll32.exe (PID: 3768)

    • Creates COM task schedule object

      • AhoiUtil.exe (PID: 2336)
      • regsvr32.exe (PID: 1248)
      • regsvr32.exe (PID: 1324)
      • regsvr32.exe (PID: 2992)
      • regsvr32.exe (PID: 2904)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 3172)
      • chrome.exe (PID: 2924)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 3172)

    • Dropped object may contain Bitcoin addresses

      • ZT2020.2008.19.400.exe (PID: 3272)

    • Application launched itself

      • chrome.exe (PID: 3172)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 1352)
      • MsiExec.exe (PID: 3860)
      • MsiExec.exe (PID: 3968)
      • MsiExec.exe (PID: 316)
      • MsiExec.exe (PID: 3608)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 956)

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 956)

    • Searches for installed software

      • DrvInst.exe (PID: 1820)

    • Manual execution by user

      • Zt.exe (PID: 2648)
      • Zt.exe (PID: 3036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
108
Monitored processes
50
Malicious processes
20
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs zt2020.2008.19.400.exe no specs zt2020.2008.19.400.exe zt2020.2008.19.400.exe chrome.exe no specs zoomtextsetuppackage.exe chrome.exe no specs vcredist_x86.exe vcredist_x86.exe vregtool.exe no specs sentinel system driver installer 7.5.0.exe msiexec.exe no specs msiexec.exe msiexec.exe no specs drvinst.exe no specs sentineldrv32support.exe no specs instparlauncher.exe no specs msiexec.exe no specs instandstartntparservice.exe no specs fswow64proxy.exe no specs mddinstaller32.exe drvinst.exe chrome.exe no specs drvinst.exe msiexec.exe msiexec.exe no specs rundll32.exe no specs rundll32.exe rundll32.exe rundll32.exe ahoiutil.exe no specs rundll32.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs rundll32.exe no specs rundll32.exe no specs zt.exe no specs zt.exe remotesupportui.exe no specs aisquared.zoomtext.ui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
180"C:\Users\admin\AppData\Local\Temp\{F60A61ED-AA56-414D-BDBF-A886FF3BB70D}\.be\ZoomTextSetupPackage.exe" -q -burn.elevated BurnPipe.{63F067B6-D224-4A32-B146-E7728DF2073E} {43AFECAF-880E-43EA-B798-CB3728E8645B} 3272C:\Users\admin\AppData\Local\Temp\{F60A61ED-AA56-414D-BDBF-A886FF3BB70D}\.be\ZoomTextSetupPackage.exe
ZT2020.2008.19.400.exe
User:
admin
Company:
Freedom Scientific
Integrity Level:
HIGH
Description:
Freedom Scientific ZoomText 2020
Exit code:
0
Version:
14.9.7.0
Modules
Images
c:\users\admin\appdata\local\temp\{f60a61ed-aa56-414d-bdbf-a886ff3bb70d}\.be\zoomtextsetuppackage.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
316C:\Windows\system32\MsiExec.exe -Embedding CD591B9B6F3015028F593CE57DB7DB0D M Global\MSI0000C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
556"C:\ProgramData\Package Cache\DF7F0A73BFA077E483E51BFB97F5E2ECEEDFB6A3\vcredist_x86.exe" /q /norestartC:\ProgramData\Package Cache\DF7F0A73BFA077E483E51BFB97F5E2ECEEDFB6A3\vcredist_x86.exe
ZoomTextSetupPackage.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501
Exit code:
0
Version:
12.0.30501.0
Modules
Images
c:\programdata\package cache\df7f0a73bfa077e483e51bfb97f5e2eceedfb6a3\vcredist_x86.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
776"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x717fa9d0,0x717fa9e0,0x717fa9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
860rundll32.exe "C:\Windows\Installer\MSIA016.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1875921 165 EvernixCustomActions!EvernixCustomActions.CustomActions.RegisterCOMC:\Windows\system32\rundll32.exe
MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imagehlp.dll
956DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{1ed7b7cd-90e2-69eb-a586-f556e3110974}\sntnlusb.inf" "0" "6dd04a27f" "00000274" "WinSta0\Default" "0000058C" "208" "C:\Program Files\Common Files\SafeNet Sentinel\Sentinel System Driver"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1012"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=960,17846854760000487691,17415750168138690022,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=16391995784805606667 --mojo-platform-channel-handle=3556 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1248"C:\Windows\System32\regsvr32.exe" /s AutomationManager.dllC:\Windows\System32\regsvr32.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1256"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=960,17846854760000487691,17415750168138690022,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16178833647773763552 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1264"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=960,17846854760000487691,17415750168138690022,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=2923470292620478024 --mojo-platform-channel-handle=500 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
3 703
Read events
2 187
Write events
1 492
Delete events
24

Modification events

(PID) Process:(3220) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:3172-13243429898630375
Value:
259
(PID) Process:(3172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:2832-13239195546717773
Value:
0
(PID) Process:(3172) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
116
Suspicious files
110
Text files
257
Unknown types
168

Dropped files

PID
Process
Filename
Type
3172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\455f9b28-a44d-4374-a77c-5646bf50aaf4.tmp —
MD5:—
SHA256:—
3172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000032.dbtmp —
MD5:—
SHA256:—
3172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old —
MD5:—
SHA256:—
3172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
3172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:—
SHA256:—
3172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF1931a5.TMPtext
MD5:—
SHA256:—
3172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old~RF19328f.TMPtext
MD5:—
SHA256:—
3172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
3172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF1933c8.TMP —
MD5:—
SHA256:—
3172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old~RF1932ce.TMPtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
45
TCP/UDP connections
29
DNS requests
26
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3272
ZT2020.2008.19.400.exe
HEAD
200
2.16.186.58:80
http://components.vfo.digital/vcredist2013_x86/{464E1B3D-11E1-43CA-8D35-4DC136D80792}/vcredist2013_x86.exe
unknown
—
—
whitelisted
3272
ZT2020.2008.19.400.exe
HEAD
200
2.16.186.82:80
http://zoomtext2020.vfo.digital/2020.2008.19.400/1CDB6BAA-03D8-4CCB-B00C-DA79ACBC6231/enu/x86/fsElevation.msi
unknown
—
—
suspicious
180
ZoomTextSetupPackage.exe
GET
200
2.16.186.74:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
der
781 b
whitelisted
180
ZoomTextSetupPackage.exe
GET
200
23.37.43.27:80
http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEBdSvVOf1M8T%2BYFeDw2YHzk%3D
NL
der
1.57 Kb
shared
180
ZoomTextSetupPackage.exe
GET
200
23.37.43.27:80
http://ts-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRi82PVYYKWGJWdgVNyePy5kYTdqQQUX5r1blzMzHSa1N197z%2Fb7EyALt0CEA7P9DjI%2Fr81bgTYapgbGlA%3D
NL
der
1.43 Kb
whitelisted
3272
ZT2020.2008.19.400.exe
HEAD
200
2.16.186.82:80
http://zoomtext2020.vfo.digital/2020.2008.19.400/1CDB6BAA-03D8-4CCB-B00C-DA79ACBC6231/enu/x86/KeyboardManager.msi
unknown
executable
9.02 Mb
suspicious
180
ZoomTextSetupPackage.exe
GET
200
23.37.43.27:80
http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQJ1TBLBrQ9OnPHXPVaWb87MxkNlgQUwu79F9f%2Btw%2FGciJ7fvbA4gIz7D4CEH6T6%2Ft8xk5Z6kuad9QG%2FDs%3D
NL
der
1.30 Kb
whitelisted
3272
ZT2020.2008.19.400.exe
GET
200
2.16.186.82:80
http://zoomtext2020.vfo.digital/2020.2008.19.400/1CDB6BAA-03D8-4CCB-B00C-DA79ACBC6231/enu/x86/fsElevation.msi
unknown
executable
116 Kb
suspicious
180
ZoomTextSetupPackage.exe
GET
200
23.37.43.27:80
http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D
NL
der
1.71 Kb
whitelisted
3272
ZT2020.2008.19.400.exe
GET
200
2.16.186.82:80
http://zoomtext2020.vfo.digital/2020.2008.19.400/1CDB6BAA-03D8-4CCB-B00C-DA79ACBC6231/enu/x86/Authorization.msi
unknown
executable
9.02 Mb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2924
chrome.exe
216.58.205.228:443
www.google.com
Google Inc.
US
whitelisted
2924
chrome.exe
216.58.205.227:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2924
chrome.exe
216.58.212.131:443
www.gstatic.com
Google Inc.
US
whitelisted
2924
chrome.exe
216.58.212.173:443
accounts.google.com
Google Inc.
US
whitelisted
2924
chrome.exe
172.217.23.99:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
180
ZoomTextSetupPackage.exe
2.16.186.74:80
crl.microsoft.com
Akamai International B.V.
—
whitelisted
2924
chrome.exe
2.16.186.82:80
zoomtext2020.vfo.digital
Akamai International B.V.
—
whitelisted
180
ZoomTextSetupPackage.exe
93.184.220.29:80
crl.verisign.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3936
MDDInstaller32.exe
93.184.220.29:80
crl.verisign.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3936
MDDInstaller32.exe
23.37.43.27:80
s2.symcb.com
Akamai Technologies, Inc.
NL
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 172.217.23.99
whitelisted
zoomtext2020.vfo.digital
  • 2.16.186.82
  • 2.16.186.58
suspicious
accounts.google.com
  • 216.58.212.173
shared
www.google.com
  • 216.58.205.228
malicious
ssl.gstatic.com
  • 216.58.205.227
whitelisted
sb-ssl.google.com
  • 216.58.206.14
whitelisted
www.gstatic.com
  • 216.58.212.131
whitelisted
components.vfo.digital
  • 2.16.186.58
  • 2.16.186.82
whitelisted
crl.microsoft.com
  • 2.16.186.74
  • 2.16.186.120
whitelisted
s2.symcb.com
  • 23.37.43.27
whitelisted

Threats

PID
Process
Class
Message
2924
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3272
ZT2020.2008.19.400.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3272
ZT2020.2008.19.400.exe
Misc activity
ET INFO Packed Executable Download
2924
chrome.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
Process
Message
MsiExec.exe
AddInboundFirewallRule: Entered.
MsiExec.exe
AddInboundFirewallRule: Entered AddInboundFirewallRule helper.
MsiExec.exe
AddInboundFirewallRule: AppFriendlyName: Client Activator.
MsiExec.exe
AddInboundFirewallRule: ExeFullPath: C:\Program Files\Freedom Scientific\Shared\Authorization Tools\6.0\fsClientActivator.exe.
MsiExec.exe
AddInboundFirewallRule: CoInitializeEx succeeded.
MsiExec.exe
AddInboundFirewallRule: WindowsFirewallInitialize succeeded
MsiExec.exe
AddInboundFirewallRule: Authorized application C:\Program Files\Freedom Scientific\Shared\Authorization Tools\6.0\fsClientActivator.exe is disabled in the firewall.
MsiExec.exe
AddInboundFirewallRule: Authorized application C:\Program Files\Freedom Scientific\Shared\Authorization Tools\6.0\fsClientActivator.exe is now enabled in the firewall.
MsiExec.exe
AddInboundFirewallRule: WindowsFirewallAddApp succeeded
MsiExec.exe
AddInboundFirewallRule: WindowsFirewallCleanup returned.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://zoomtext2020.vfo.digital/2020.2008.19.400/1CDB6BAA-03D8-4CCB-B00C-DA79ACBC6231/ZT2020.2008.19.400.exe