File name:

ZoomInfoContactContributor-57-3.exe

Full analysis: https://app.any.run/tasks/9d75db2d-1526-4322-8be0-c6e606fdcec6
Verdict: Malicious activity
Analysis date: October 31, 2023, 03:05:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

0C4CBC3957BD9651AF06F76AD32B1FA2

SHA1:

A0C2D8CDFC71545623EA01D143F213AD66499F35

SHA256:

C5CCC464818ECCA316D98C67A79FC51192835CBC1EBA3060A22537D0382EEB41

SSDEEP:

3072:FHonJ5U5TPVobeaOETMsfKnFgem6Nh2/Qz1Kz+Rd4CYM:FHoPUlPeDOETMXiYQB8d4CY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • ZoomInfoContactContributor-57-3.exe (PID: 3820)
      • coordinator.exe (PID: 1648)

    • Application was dropped or rewritten from another process

      • coordinator.exe (PID: 1648)
      • ZoomInfoContactContributor-57-3.exe (PID: 3820)

    • Drops the executable file immediately after the start

      • ZoomInfoContactContributor-57-3.exe (PID: 3820)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • ZoomInfoContactContributor-57-3.exe (PID: 3820)

    • The process creates files with name similar to system file names

      • ZoomInfoContactContributor-57-3.exe (PID: 3820)

    • Reads Microsoft Outlook installation path

      • ZoomInfoContactContributor-57-3.exe (PID: 3820)

    • Reads the Internet Settings

      • ZoomInfoContactContributor-57-3.exe (PID: 3820)
      • coordinator.exe (PID: 1648)

    • Process drops legitimate windows executable

      • ZoomInfoContactContributor-57-3.exe (PID: 3820)

    • The process drops C-runtime libraries

      • ZoomInfoContactContributor-57-3.exe (PID: 3820)

    • Executing commands from a ".bat" file

      • ZoomInfoContactContributor-57-3.exe (PID: 3820)

    • Starts CMD.EXE for commands execution

      • ZoomInfoContactContributor-57-3.exe (PID: 3820)

    • Powershell version downgrade attack

      • powershell.exe (PID: 2296)

    • Loads Python modules

      • coordinator.exe (PID: 1648)

  • INFO

    • Reads the computer name

      • ZoomInfoContactContributor-57-3.exe (PID: 3820)
      • coordinator.exe (PID: 1648)

    • Checks supported languages

      • ZoomInfoContactContributor-57-3.exe (PID: 3820)
      • coordinator.exe (PID: 1648)

    • Reads Microsoft Office registry keys

      • ZoomInfoContactContributor-57-3.exe (PID: 3820)
      • coordinator.exe (PID: 1648)

    • Manual execution by a user

      • OUTLOOK.EXE (PID: 4076)
      • powershell.exe (PID: 2296)

    • Create files in a temporary directory

      • ZoomInfoContactContributor-57-3.exe (PID: 3820)
      • coordinator.exe (PID: 1648)

    • Checks proxy server information

      • ZoomInfoContactContributor-57-3.exe (PID: 3820)
      • coordinator.exe (PID: 1648)

    • Creates files or folders in the user directory

      • ZoomInfoContactContributor-57-3.exe (PID: 3820)
      • coordinator.exe (PID: 1648)

    • Reads Internet Explorer settings

      • OUTLOOK.EXE (PID: 4076)

    • The executable file from the user directory is run by the CMD process

      • coordinator.exe (PID: 1648)

    • Reads the machine GUID from the registry

      • coordinator.exe (PID: 1648)

    • Application launched itself

      • msedge.exe (PID: 3520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:12:05 23:50:52+01:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 164864
UninitializedDataSize: 1024
EntryPoint: 0x30fa
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.57
ProductVersionNumber: 2.0.0.57
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: ASCII
FileDescription: -
FileVersion: 57
LegalCopyright: (c) Zoom Information, Inc.
ProductName: ZoomInfo Contact Contributor
ProductVersion: 57
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
67
Monitored processes
24
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start zoominfocontactcontributor-57-3.exe outlook.exe outlook.exe no specs cmd.exe no specs coordinator.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs powershell.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\ZoomInfoCEUtility\launch.bat""C:\Windows\System32\cmd.exe—ZoomInfoContactContributor-57-3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1032"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2252 --field-trial-handle=1264,i,17191271930167694979,2564428226484504911,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
1244"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1244 --field-trial-handle=1264,i,17191271930167694979,2564428226484504911,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\cryptbase.dll
1244"C:\Windows\system32\notepad.exe" C:\Users\admin\AppData\Local\ZoomInfoCEUtility\launch.batC:\Windows\System32\notepad.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1620"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3956 --field-trial-handle=1264,i,17191271930167694979,2564428226484504911,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
1648"C:\Users\admin\AppData\Local\ZoomInfoCEUtility\2258\coordinator.exe" C:\Users\admin\AppData\Local\ZoomInfoCEUtility\2258\coordinator.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\zoominfoceutility\2258\coordinator.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\usp10.dll
2128"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1460 --field-trial-handle=1264,i,17191271930167694979,2564428226484504911,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2296"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2812"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3220 --field-trial-handle=1264,i,17191271930167694979,2564428226484504911,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
2860"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=1264,i,17191271930167694979,2564428226484504911,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
Total events
18 450
Read events
18 203
Write events
218
Delete events
29

Modification events

(PID) Process:(4076) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(4076) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(4076) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(4076) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(4076) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(4076) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(4076) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(4076) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(4076) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(4076) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
231
Suspicious files
680
Text files
1 045
Unknown types
28

Dropped files

PID
Process
Filename
Type
4076OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR45FB.tmp.cvr —
MD5:—
SHA256:—
4076OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
3328OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR66F0.tmp.cvr —
MD5:—
SHA256:—
3820ZoomInfoContactContributor-57-3.exeC:\Users\admin\AppData\Local\ZoomInfoCEUtility\ZoomInfo_Grow.zip —
MD5:—
SHA256:—
3820ZoomInfoContactContributor-57-3.exeC:\Users\admin\AppData\Local\Temp\nsoB053.tmp\nsDialogs.dllexecutable
MD5:C10E04DD4AD4277D5ADC951BB331C777
SHA256:E31AD6C6E82E603378CB6B80E67D0E0DCD9CF384E1199AC5A65CB4935680021A
3820ZoomInfoContactContributor-57-3.exeC:\Users\admin\AppData\Local\Temp\nsoB053.tmp\GetVersion.dllexecutable
MD5:2E2412281A205ED8D53AAFB3EF770A2D
SHA256:DB09ADB6E17B6A0B31823802431FF5209018EE8C77A193AC8077E42E5F15FB00
3820ZoomInfoContactContributor-57-3.exeC:\Users\admin\AppData\Local\Temp\fccoordinator.tmptext
MD5:11FA8A81C1DE99D4C03F433A9C1C6505
SHA256:CA77688E75B0088ECEE17258959ECF7FAD24C77BCA9DB0183671144B383E6FE1
3820ZoomInfoContactContributor-57-3.exeC:\Users\admin\AppData\Local\Temp\nsoB053.tmp\FindProcDLL.dllexecutable
MD5:83CD62EAB980E3D64C131799608C8371
SHA256:A6122E80F1C51DC72770B4F56C7C482F7A9571143FBF83B19C4D141D0CB19294
4076OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\mso480F.tmphtml
MD5:A8934077843220A8E31367C7BBE15E6C
SHA256:A2DB0201D36F07F3F99D1ADF8B8EAFB9CF9BB803D024FCC9327B77AF56346861
4076OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{6B7F08BB-0D35-42F8-8996-E4B265053B78}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:4C61C12EDBC453D7AE184976E95258E1
SHA256:296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
25
DNS requests
28
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3820
ZoomInfoContactContributor-57-3.exe
GET
302
216.58.213.115:80
http://cswapper.freshcontacts.com/client/download2?client_version=57&client_id={A1CF6C7A-BFA7-4AE5-AAB9-0B3E769D0A79}&outlook_bitness=32&reachout=true&appid=3
unknown
—
—
unknown
3912
msedge.exe
GET
302
142.250.187.147:80
http://cswapper.freshcontacts.com/client/installsuccess?client_version=57&os_version=Windows%206.1%20Service%20Pack%201%207601%2032%20[%20]&outlook_version=14&outlook_bitness=32&autostart=1&client_id={A1CF6C7A-BFA7-4AE5-AAB9-0B3E769D0A79}&reachout=true&appid=3
unknown
—
—
unknown
3820
ZoomInfoContactContributor-57-3.exe
GET
200
142.251.140.91:80
http://storage.googleapis.com/coordinator-packages-public/swapper-2258.zip
unknown
compressed
89.7 Mb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4076
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3820
ZoomInfoContactContributor-57-3.exe
216.58.213.115:80
cswapper.freshcontacts.com
GOOGLE
US
unknown
3820
ZoomInfoContactContributor-57-3.exe
142.251.140.91:80
storage.googleapis.com
GOOGLE
US
unknown
3912
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3520
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
3912
msedge.exe
142.250.187.147:80
cswapper.freshcontacts.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
cswapper.freshcontacts.com
  • 216.58.213.115
  • 142.250.187.147
whitelisted
storage.googleapis.com
  • 142.251.140.91
  • 172.217.169.155
  • 172.217.169.219
  • 216.58.214.155
  • 142.250.184.155
  • 142.250.187.123
  • 142.250.187.155
  • 142.250.187.187
  • 172.217.17.123
  • 172.217.17.155
  • 172.217.20.91
  • 216.58.212.27
  • 216.58.212.59
  • 216.58.213.123
  • 142.251.140.27
  • 142.251.140.59
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
nav-edge.smartscreen.microsoft.com
  • 20.105.95.163
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
data-edge.smartscreen.microsoft.com
  • 20.105.95.163
whitelisted
www.zoominfo.com
  • 104.16.137.15
  • 104.16.136.15
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
login.zoominfo.com
  • 104.16.137.15
  • 104.16.136.15
unknown

Threats

Found threats are available for the paid subscriptions
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ZoomInfoContactContributor-57-3.exe