URL:

https://us02web.zoom.us/j/81823503678?pwd=YTNWL2RnM0dHU1FsUE1uaHhXcGR6QT09

Full analysis: https://app.any.run/tasks/048f016b-49a9-4793-a2bb-aba0268c24bd
Verdict: Malicious activity
Analysis date: April 05, 2023, 12:12:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

418264F719C57CDFAA7866F9EDBB0AA1

SHA1:

F00C087CB15B28E97ACD58BD3939D3AD4257456C

SHA256:

AA1E88D05862FB446B3350481C78559D870C7AF9EB6BC2A6495FA0E0639A5B7F

SSDEEP:

3:N8eoiKILQN7d1WedTXrypcrCUUJEtN913TB:2eop9ZbTXkUUJE93TB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe (PID: 2660)
      • Installer.exe (PID: 2040)
      • Installer.exe (PID: 3560)
      • Zoom.exe (PID: 3916)
      • zmC5AD.tmp (PID: 1736)
      • Zoom.exe (PID: 3888)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe (PID: 2660)
      • Installer.exe (PID: 2040)

    • Reads the Internet Settings

      • Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe (PID: 2660)

    • Reads security settings of Internet Explorer

      • Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe (PID: 2660)
      • Installer.exe (PID: 2040)

    • Checks Windows Trust Settings

      • Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe (PID: 2660)
      • Installer.exe (PID: 2040)

    • Adds/modifies Windows certificates

      • iexplore.exe (PID: 2668)

    • Executable content was dropped or overwritten

      • Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe (PID: 2660)
      • Installer.exe (PID: 2040)

    • Application launched itself

      • Installer.exe (PID: 2040)
      • Zoom.exe (PID: 3916)

    • The process creates files with name similar to system file names

      • Installer.exe (PID: 2040)

    • Starts application with an unusual extension

      • Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe (PID: 2660)

    • Starts itself from another location

      • Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe (PID: 2660)

  • INFO

    • Create files in a temporary directory

      • iexplore.exe (PID: 2668)

    • Application launched itself

      • iexplore.exe (PID: 2668)

    • Reads the computer name

      • Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe (PID: 2660)
      • Installer.exe (PID: 2040)

    • Checks proxy server information

      • Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe (PID: 2660)

    • The process checks LSA protection

      • Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe (PID: 2660)
      • Installer.exe (PID: 2040)

    • Checks supported languages

      • Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe (PID: 2660)
      • Installer.exe (PID: 2040)

    • Reads the machine GUID from the registry

      • Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe (PID: 2660)
      • Installer.exe (PID: 2040)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2668)
      • iexplore.exe (PID: 3052)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2668)

    • Creates files or folders in the user directory

      • Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe (PID: 2660)
      • Installer.exe (PID: 2040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start iexplore.exe iexplore.exe zoom_cm_fo42anktz9vvrzo4_mp7xsso9mzkpwiwduvpovmrpsntzolyvgr5+8@0fpm1mcvzvmkkklw_k23cdf043e2f52616_.exe installer.exe installer.exe zoom.exe no specs zmc5ad.tmp no specs zoom.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1736"C:\Users\admin\AppData\Local\Temp\zmC5AD.tmp" -DAF8C715436E44649F1312698287E6A5=C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exeC:\Users\admin\AppData\Local\Temp\zmC5AD.tmp—Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Opener
Exit code:
0
Version:
5,10,3,4851
2040"C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe" ZInstaller --conf.mode=silent --ipc_wnd=66034C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe
Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Installer
Exit code:
0
Version:
5,14,2,14578
Modules
Images
c:\users\admin\appdata\roaming\zoom\zoomdownload\installer.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\lpk.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2660"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe
iexplore.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Opener
Exit code:
0
Version:
5,10,3,4851
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\zoom_cm_fo42anktz9vvrzo4_mp7xsso9mzkpwiwduvpovmrpsntzolyvgr5+8@0fpm1mcvzvmkkklw_k23cdf043e2f52616_.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2668"C:\Program Files\Internet Explorer\iexplore.exe" "https://us02web.zoom.us/j/81823503678?pwd=YTNWL2RnM0dHU1FsUE1uaHhXcGR6QT09"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\ntdll.dll
3052"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2668 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3560"C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe" /addfwexception --bin_home="C:\Users\admin\AppData\Roaming\Zoom\bin"C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe
Installer.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
HIGH
Description:
Zoom Installer
Exit code:
0
Version:
5,14,2,14578
3888"C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe" --action=join --runaszvideo=TRUE C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe—Zoom.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Meetings
Exit code:
0
Version:
5,14,2,14578
3916"C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe" "--url=zoommtg://win.launch?h.domain=us02web.zoom.us&h.path=join&confid=dXNzPWptbHZnX3QwMW50Ri1DSldTeVJUei1lVXBHT2JBVG05X2pQY285aS1ld3k5V3lrdEJDb3h4dm5DamRmWWlYamNEb0syRTJuV3U4YzNOVEp4RUo5MnFqS3JIdjM1LkplZmhabnRVWEdibWVkNnImdGlkPTc3YWY0Y2JmZjQ3ZDQyZTdhNDRmZmMzZDk3N2YwZmFk&mcv=0.92.11227.0929&stype=0&zc=0&browser=msie&action=join&confno=81823503678&pwd=YTNWL2RnM0dHU1FsUE1uaHhXcGR6QT09"C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe—Zoom_cm_fo42anktZ9vvrZo4_mP7xSsO9mzkpWiwDUvpOVmrpSNtZOlyVgR5+8@0fpM1McVzVMKKkLw_k23cdf043e2f52616_.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Meetings
Exit code:
0
Version:
5,14,2,14578
Total events
62 872
Read events
62 570
Write events
290
Delete events
12

Modification events

(PID) Process:(2668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
364
Suspicious files
284
Text files
96
Unknown types
18

Dropped files

PID
Process
Filename
Type
3052iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\VU6OFNYK.txttext
MD5:—
SHA256:—
3052iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97Cder
MD5:—
SHA256:—
3052iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\J67HIHOY.txttext
MD5:—
SHA256:—
3052iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04der
MD5:—
SHA256:—
3052iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:—
SHA256:—
3052iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\TWG6DB0O.txttext
MD5:—
SHA256:—
3052iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\CT1RMUDF.txttext
MD5:—
SHA256:—
3052iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
3052iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\81823503678[1].htmhtml
MD5:—
SHA256:—
3052iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97Cbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
39
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3052
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
3052
iexplore.exe
GET
200
192.229.221.95:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.78 Kb
whitelisted
2668
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3052
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAbCsehAv%2FkAxBfkV5KvfLI%3D
US
der
471 b
whitelisted
2668
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3052
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
3052
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAhflMAthXvozBT%2FU%2B2iPio%3D
US
der
471 b
whitelisted
3052
iexplore.exe
GET
200
178.79.242.11:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?df1fbb81b096ea25
DE
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3052
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3052
iexplore.exe
178.79.242.11:80
ctldl.windowsupdate.com
LLNW
DE
suspicious
3052
iexplore.exe
18.66.147.95:443
static.ada.support
AMAZON-02
US
suspicious
3052
iexplore.exe
34.98.108.207:443
cdn.solvvy.com
GOOGLE
US
unknown
3052
iexplore.exe
170.114.52.3:443
us02web.zoom.us
—
US
suspicious
3052
iexplore.exe
13.224.199.249:443
us02st3.zoom.us
AMAZON-02
US
unknown
3052
iexplore.exe
18.66.130.242:443
st1.zoom.us
AMAZON-02
US
unknown
3052
iexplore.exe
54.227.249.145:443
log-gateway.zoom.us
AMAZON-AES
US
unknown
3052
iexplore.exe
104.19.188.97:443
cdn.cookielaw.org
CLOUDFLARENET
—
whitelisted
2668
iexplore.exe
184.86.251.19:443
www.bing.com
Akamai International B.V.
DE
suspicious

DNS requests

Domain
IP
Reputation
us02web.zoom.us
  • 170.114.52.3
whitelisted
ctldl.windowsupdate.com
  • 178.79.242.11
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
static.ada.support
  • 18.66.147.95
  • 18.66.147.113
  • 18.66.147.60
  • 18.66.147.121
whitelisted
cdn.solvvy.com
  • 34.98.108.207
shared
us02st3.zoom.us
  • 13.224.199.249
shared
st1.zoom.us
  • 18.66.130.242
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 184.86.251.19
  • 184.86.251.27
  • 184.86.251.7
  • 184.86.251.20
  • 184.86.251.13
  • 184.86.251.9
  • 184.86.251.21
  • 184.86.251.17
whitelisted
log-gateway.zoom.us
  • 54.227.249.145
  • 54.235.192.240
unknown

Threats

No threats detected
Process
Message
Installer.exe
[ProductPathHelper::RecursiveRemoveDirA] Path is:
Installer.exe
C:\Users\admin\AppData\Roaming\Zoom\zoom_install_src
Installer.exe
Installer.exe
C:\Users\admin\AppData\Roaming\Zoom\zoom_install_src
Installer.exe
Installer.exe
[ProductPathHelper::RecursiveRemoveDirA] Path is:
Installer.exe
[ProductPathHelper::RecursiveRemoveDirA] Path is:
Installer.exe
Installer.exe
Installer.exe
[ProductPathHelper::RecursiveRemoveDirA] Path is:
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://us02web.zoom.us/j/81823503678?pwd=YTNWL2RnM0dHU1FsUE1uaHhXcGR6QT09