File name:

Zoom_cm_fo42anktZ9vvrZo4_mf3rukiajnh9KTUguLjjFsSq9pRkXm0WOo8cI@y-Kjf8MpIu+Rtmhe_k44a0416512cb29c4_ 1.exe

Full analysis: https://app.any.run/tasks/29e7c542-60b9-4253-a198-d8fbb4ae9ea4
Verdict: Malicious activity
Analysis date: May 16, 2025, 21:49:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

BC48CB98D8F2DACCA97A2EB72F4275CB

SHA1:

CD3DD263FC37C8C7BEB1393A654B400F2F531F1C

SHA256:

C18FB46AFA17AD8578D1EDD4AA6A89B42F381CA7998A4E5A096643E0F2721C49

SSDEEP:

3072:mUGN8U00oL0pMQPmcDgbt6RbMMlLDYthINgsVHRjb:mUS03wpfPm1b8RbMMRqI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe (PID: 4172)
      • Installer.exe (PID: 2432)
      • Zoom.exe (PID: 5400)
      • Zoom.exe (PID: 5200)

    • Executable content was dropped or overwritten

      • 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe (PID: 4172)
      • Installer.exe (PID: 2432)
      • Zoom.exe (PID: 5400)

    • The process drops C-runtime libraries

      • Installer.exe (PID: 2432)

    • The process creates files with name similar to system file names

      • Installer.exe (PID: 2432)
      • Zoom.exe (PID: 5400)

    • Process drops legitimate windows executable

      • Installer.exe (PID: 2432)

    • Creates a software uninstall entry

      • Installer.exe (PID: 2432)

    • Reads the date of Windows installation

      • Installer.exe (PID: 2432)
      • Zoom.exe (PID: 5400)

    • Application launched itself

      • Installer.exe (PID: 2432)
      • Zoom.exe (PID: 5400)

    • Starts itself from another location

      • 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe (PID: 4172)

    • Starts application with an unusual extension

      • 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe (PID: 4172)

    • The process checks if it is being run in the virtual environment

      • Zoom.exe (PID: 5400)
      • Zoom.exe (PID: 5200)

  • INFO

    • The sample compiled with english language support

      • 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe (PID: 4172)
      • Zoom.exe (PID: 5400)
      • Installer.exe (PID: 2432)

    • Reads the computer name

      • 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe (PID: 4172)
      • Installer.exe (PID: 6676)
      • Zoom.exe (PID: 5200)
      • Zoom.exe (PID: 5400)
      • Installer.exe (PID: 4488)
      • Installer.exe (PID: 2432)

    • Checks supported languages

      • 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe (PID: 4172)
      • Installer.exe (PID: 6676)
      • zm345B.tmp (PID: 1568)
      • Zoom.exe (PID: 5400)
      • Zoom.exe (PID: 5200)
      • Installer.exe (PID: 4488)
      • Installer.exe (PID: 2432)

    • Checks proxy server information

      • 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe (PID: 4172)
      • Zoom.exe (PID: 5400)
      • Zoom.exe (PID: 5200)

    • Reads the software policy settings

      • 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe (PID: 4172)
      • Installer.exe (PID: 2432)
      • Zoom.exe (PID: 5400)
      • Zoom.exe (PID: 5200)

    • Creates files or folders in the user directory

      • 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe (PID: 4172)
      • Zoom.exe (PID: 5400)
      • Zoom.exe (PID: 5200)
      • Installer.exe (PID: 2432)

    • Reads the machine GUID from the registry

      • 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe (PID: 4172)
      • Zoom.exe (PID: 5400)
      • Zoom.exe (PID: 5200)
      • Installer.exe (PID: 2432)

    • Create files in a temporary directory

      • 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe (PID: 4172)
      • Zoom.exe (PID: 5400)

    • Process checks computer location settings

      • 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe (PID: 4172)
      • Installer.exe (PID: 2432)
      • Zoom.exe (PID: 5400)
      • Zoom.exe (PID: 5200)

    • Reads Environment values

      • Zoom.exe (PID: 5400)

    • The sample compiled with chinese language support

      • Zoom.exe (PID: 5400)
      • Installer.exe (PID: 2432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:26 05:23:55+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 70656
InitializedDataSize: 44032
UninitializedDataSize: -
EntryPoint: 0x6be0
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 6.1.10.43
ProductVersionNumber: 6.1.10.43
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: Zoom Opener
CompanyName: Zoom Video Communications, Inc.
FileDescription: Zoom Opener
FileVersion: 6,1,10,43
InternalName: Zoom Opener
LegalCopyright: © Zoom Video Communications, Inc. All rights reserved.
LegalTrademarks: Zoom Opener
OriginalFileName: Zoom Opener
ProductName: Zoom Opener
ProductVersion: 6,1,10,43
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe sppextcomobj.exe no specs slui.exe no specs installer.exe installer.exe zoom.exe zm345b.tmp no specs zoom.exe no specs installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1568"C:\Users\admin\AppData\Local\Temp\zm345B.tmp" -DAF8C715436E44649F1312698287E6A5=C:\Users\admin\AppData\Local\Temp\29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exeC:\Users\admin\AppData\Local\Temp\zm345B.tmp—29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Opener
Exit code:
0
Version:
6,1,10,43
Modules
Images
c:\users\admin\appdata\local\temp\zm345b.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
2432"C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe" ZInstaller --conf.mode=silent --ipc_wnd=197456C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe
29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Installer
Exit code:
0
Version:
6,4,6,64360
Modules
Images
c:\users\admin\appdata\roaming\zoom\zoomdownload\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
3240C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4172"C:\Users\admin\AppData\Local\Temp\29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe" C:\Users\admin\AppData\Local\Temp\29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe
explorer.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Opener
Exit code:
0
Version:
6,1,10,43
Modules
Images
c:\users\admin\appdata\local\temp\29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
4488"C:\Users\admin\AppData\Roaming\Zoom\bin\Installer.exe" "C:\Users\admin\AppData\Roaming\Zoom\bin\Installer.exe" /tskschdC:\Users\admin\AppData\Roaming\Zoom\bin\Installer.exe—Zoom.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Installer
Exit code:
0
Version:
6,4,6,64360
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
5200"C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe" --action=joinbyno --runaszvideo=TRUE C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe—Zoom.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Meetings
Version:
6.4.6.64360
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\zoom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\users\admin\appdata\roaming\zoom\bin\cmmlib.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5400"C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe" "--url=zoommtg://win.launch?h.domain=zoom.us&h.path=join&action=join&confno="C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe
29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Meetings
Version:
6.4.6.64360
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\zoom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
6676"C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe" /addfwexception --bin_home="C:\Users\admin\AppData\Roaming\Zoom\bin"C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe
Installer.exe
User:
admin
Company:
Zoom Communications, Inc.
Integrity Level:
HIGH
Description:
Zoom Installer
Exit code:
0
Version:
6,4,6,64360
Modules
Images
c:\users\admin\appdata\roaming\zoom\zoomdownload\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
7084"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
20 924
Read events
20 820
Write events
78
Delete events
26

Modification events

(PID) Process:(4172) 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4172) 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4172) 29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2432) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:DisplayIcon
Value:
C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe
(PID) Process:(2432) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:DisplayName
Value:
Zoom Workplace
(PID) Process:(2432) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:DisplayVersion
Value:
6.4.6 (64360)
(PID) Process:(2432) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:HelpLink
Value:
https://support.zoom.us/home
(PID) Process:(2432) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:URLInfoAbout
Value:
https://zoom.us
(PID) Process:(2432) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:URLUpdateInfo
Value:
https://zoom.us
(PID) Process:(2432) Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX
Operation:writeName:Publisher
Value:
Zoom Communications, Inc.
Executable files
261
Suspicious files
220
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
417229e7c542-60b9-4253-a198-d8fbb4ae9ea4.exeC:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Zoom.msi —
MD5:—
SHA256:—
2432Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\directui_license.txttext
MD5:AB54B14548A4CC76DD7C27414D971111
SHA256:6033476BE3D1D41166B65984E2BE94C87AC98DCE55BFEC887E932B696E859295
2432Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\duilib_license.txttext
MD5:7FAEC2006BB231D14B794A9F31769448
SHA256:7ED2ACCA31A243BA107D8C12FDDECD52462FD326D3D2C73B04D4CF10C76765FF
2432Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\clap-high.pcmbinary
MD5:C32F95839557340B4B4197A68847CA1D
SHA256:0A16435CB3F7B8B1787476575AD646361E6FB4C07587DF874940413DE004DD08
2432Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\archival.pcmbinary
MD5:2DA32E501E9720B40D438FF7352A5573
SHA256:5E7D1491E7D6969EB67646F87AB2DBF0FF1D1CB4F5CF631128A305E2B67D4A1B
2432Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\dingdong1.pcmbinary
MD5:8FE86D9E8AA5C709BB0563243172E580
SHA256:2FBBB9AE6A463B360E1459BEE558DAFA8D864DB2423F0FE4D2C56D22C3F3A5A2
2432Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\crashrpt_lang.initext
MD5:FCF61AED8F093BFCF571CDD8F8162A05
SHA256:1F5B45A5411F7FC71B9DA789D6D1EAD8AD30551FBEA7BBB40FC7EA576D581ABB
417229e7c542-60b9-4253-a198-d8fbb4ae9ea4.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97Cbinary
MD5:A81D0B0A99ABA0CACB0D8FB5804C9666
SHA256:55432E29D303248EC2DC7B42F71A13675B1CC828170491890EF82624AEEC43FB
2432Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\meeting_raisehand_chime.pcmbinary
MD5:CD7D41D5204013CE176C99C225016D6D
SHA256:CD9B81D47633FE9AA3F1020D895161DE8C31797B365F93DFB22A60D920CC2EB3
2432Installer.exeC:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\pcm\beep_intercom.pcmbinary
MD5:618A307EF3EFAD70399A6107CB1CE9E3
SHA256:32567197286CBB2DFFC282F7CAE8D46D13AF9D5E83BC98773A836904D244326F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
35
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4172
29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAhflMAthXvozBT%2FU%2B2iPio%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1056
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1056
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4172
29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe
170.114.52.2:443
zoom.us
—
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4172
29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe
170.114.46.1:443
cdn.zoom.us
Cloudflare London, LLC
US
whitelisted
4172
29e7c542-60b9-4253-a198-d8fbb4ae9ea4.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.155
  • 23.48.23.147
  • 23.48.23.158
  • 23.48.23.159
  • 23.48.23.134
  • 23.48.23.194
  • 23.48.23.157
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.110
whitelisted
zoom.us
  • 170.114.52.2
whitelisted
cdn.zoom.us
  • 170.114.46.1
  • 170.114.45.1
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.128
  • 40.126.31.1
  • 40.126.31.2
  • 20.190.159.4
  • 40.126.31.129
  • 20.190.159.128
  • 40.126.31.67
  • 40.126.31.0
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Zoom_cm_fo42anktZ9vvrZo4_mf3rukiajnh9KTUguLjjFsSq9pRkXm0WOo8cI@y-Kjf8MpIu+Rtmhe_k44a0416512cb29c4_ 1.exe