2aa9f15810e2c55dbc8522e386d76d1a8fb3a63a712b33e17bd2139a7b45c76b

Target

ZoomInfoContactContributor.exe
Size

259KB
MD5

0b5719e9fd40b85d4d95e475e9431cd0
SHA1

132151d26e61d2fda4e4b31eb376a41ea0d56e6d
SHA256

2aa9f15810e2c55dbc8522e386d76d1a8fb3a63a712b33e17bd2139a7b45c76b
SHA512

ed17497df8e53eb9a49ff3d6ed5bf8d84f17a045947a4b474204a8bf06254f8a801be1243599e526123ccc5e88af389f718021409567ac86ed28d988afd3d1cf

Score

8^/10

discovery persistence pyinstaller

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

coordinator.exe

pid process

1120 coordinator.exe

pid	process
1120	coordinator.exe

Loads dropped DLL 16 IoCs

Processes:

ZoomInfoContactContributor.execmd.exe

pid	process
1892	ZoomInfoContactContributor.exe
1892	ZoomInfoContactContributor.exe
1892	ZoomInfoContactContributor.exe
1892	ZoomInfoContactContributor.exe
1892	ZoomInfoContactContributor.exe
1892	ZoomInfoContactContributor.exe
1892	ZoomInfoContactContributor.exe
1892	ZoomInfoContactContributor.exe
1892	ZoomInfoContactContributor.exe
1892	ZoomInfoContactContributor.exe
1892	ZoomInfoContactContributor.exe
1892	ZoomInfoContactContributor.exe
1892	ZoomInfoContactContributor.exe
1892	ZoomInfoContactContributor.exe
1892	ZoomInfoContactContributor.exe
268	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ZoomInfoContactContributor.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run	ZoomInfoContactContributor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZoomInfo Contact Contributor = "C:\\Users\\Admin\\AppData\\Local\\ZoomInfoCEUtility\\launch.bat"	ZoomInfoContactContributor.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Detects Pyinstaller 3 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\ZoomInfoCEUtility\2214\coordinator.exe	pyinstaller
C:\Users\Admin\AppData\Local\ZoomInfoCEUtility\2214\coordinator.exe	pyinstaller
\Users\Admin\AppData\Local\ZoomInfoCEUtility\2214\coordinator.exe	pyinstaller

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\ZoomInfoCEUtility\uninstall.exe	nsis_installer_1
\Users\Admin\AppData\Local\ZoomInfoCEUtility\uninstall.exe	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 62 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "128"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "68"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\zoominfo.com\Total = "17"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\zoominfo.com\Total = "128"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b803eca0bed601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\zoominfo.com\Total = "68"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a60000000000200000000001066000000010000200000005d7bde3afdaf443b716fd3154d0e07e4d663bac806734135d7b92d429fb5e672000000000e8000000002000020000000be27ca5ba8974867f7725bf38305d7ee7328589c2f262de59f79d3908a9b698a900000003abc5c687e17dad578a7119eeecb280773337ecc29076b84bce9cc7cf45b5abeff5021d5e9264f714db5d7a818ad340be11916318d359475f1029e95b15aba35a789adbc284ce1f5370bbc2cef206649d31fb89e0a6d1e83458d0d24e70942a764cb7c694c27724bb86e573e4c1bf16f98e2b78e2143e0c99bbfe4ab37da05ca790733e96f062c5e8c0bbaa8fe08b20b400000003544eedbdd258ef2eb26a35e0685ded70e76c59b478ff2f013540f1ac1d74fc176a525a5939fe6aa4a2fb9b4ff30d1239e52f4b20981dec86699acc99b7bff23	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.zoominfo.com\ = "68"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.zoominfo.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\zoominfo.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.zoominfo.com\ = "141"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\zoominfo.com\Total = "1007"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{118A5B51-2A94-11EB-8332-F65A7312C48E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1007"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.zoominfo.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\zoominfo.com\Total = "32"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "141"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\zoominfo.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "32"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\zoominfo.com\Total = "141"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.zoominfo.com\ = "1007"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\zoominfo.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.zoominfo.com\ = "17"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "312575076"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.zoominfo.com\ = "32"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "17"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a60000000000200000000001066000000010000200000004038824e546d03af8ca7b8f06f96d718debe1b543bf686d1037610896b11fe42000000000e8000000002000020000000b7a92f98b8cc4e61964428c1904621fefe5c5a2c27212fd6edc45256c711f4dd2000000070b0fc10bcf043a1676a2fde495b1134dff174fa73fb4794a4736a2e7a1db05240000000f26cb94903ac4a7872daa4819ea119ae7d80c06ae35717391a5216a6e65c2ad5b54993f4cc4c6f2e094e71884510e62124952cdb55ec0ce387d2627c66cc9fae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.zoominfo.com\ = "128"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ZoomInfoContactContributor.exe

pid process

1892 ZoomInfoContactContributor.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1192 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1192 iexplore.exe
1192 iexplore.exe
1020 IEXPLORE.EXE
1020 IEXPLORE.EXE
1020 IEXPLORE.EXE
1020 IEXPLORE.EXE

pid	process
1192	iexplore.exe

pid	process
1192	iexplore.exe
1192	iexplore.exe
1020	IEXPLORE.EXE
1020	IEXPLORE.EXE
1020	IEXPLORE.EXE
1020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

ZoomInfoContactContributor.execmd.exeiexplore.exe

description	pid	process	target process
PID 1892 wrote to memory of 268	1892	ZoomInfoContactContributor.exe	cmd.exe
PID 1892 wrote to memory of 268	1892	ZoomInfoContactContributor.exe	cmd.exe
PID 1892 wrote to memory of 268	1892	ZoomInfoContactContributor.exe	cmd.exe
PID 1892 wrote to memory of 268	1892	ZoomInfoContactContributor.exe	cmd.exe
PID 268 wrote to memory of 1120	268	cmd.exe	coordinator.exe
PID 268 wrote to memory of 1120	268	cmd.exe	coordinator.exe
PID 268 wrote to memory of 1120	268	cmd.exe	coordinator.exe
PID 268 wrote to memory of 1120	268	cmd.exe	coordinator.exe
PID 1892 wrote to memory of 1192	1892	ZoomInfoContactContributor.exe	iexplore.exe
PID 1892 wrote to memory of 1192	1892	ZoomInfoContactContributor.exe	iexplore.exe
PID 1892 wrote to memory of 1192	1892	ZoomInfoContactContributor.exe	iexplore.exe
PID 1892 wrote to memory of 1192	1892	ZoomInfoContactContributor.exe	iexplore.exe
PID 1192 wrote to memory of 1020	1192	iexplore.exe	IEXPLORE.EXE
PID 1192 wrote to memory of 1020	1192	iexplore.exe	IEXPLORE.EXE
PID 1192 wrote to memory of 1020	1192	iexplore.exe	IEXPLORE.EXE
PID 1192 wrote to memory of 1020	1192	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\ZoomInfoContactContributor.exe
"C:\Users\Admin\AppData\Local\Temp\ZoomInfoContactContributor.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\ZoomInfoCEUtility\launch.bat""
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:268

C:\Users\Admin\AppData\Local\ZoomInfoCEUtility\2214\coordinator.exe
"C:\Users\Admin\AppData\Local\ZoomInfoCEUtility\2214\coordinator.exe"
3⤵
- Executes dropped EXE
PID:1120

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://cswapper.freshcontacts.com/client/installsuccess?client_version=62&os_version=Windows 6.1 Service Pack 1 7601 64 [ ]&outlook_version=14&outlook_bitness=32&autostart=1&client_id={89B9688A-4725-499E-B881-4DA1B8781EDB}&reachout=true&appid=3
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1192 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
23edc59e629116724102a74841d55dae

SHA1
56d8ab3d65363cab87cc9644add878ffc7ed3cb6

SHA256
0da9cadb0224a3e5021befb1156396f69aeb0af519a27975a1eb33d7599dec80

SHA512
fa034ef1c38a6a9fad8b41de5f94f75a6350b4826632b32603fb49aa95af31481e582b9e54742d0c1dc861d4fd50688cbd30ec0ed5e60d86784bdd16700343a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.dat
MD5
597e65782836eb1c372db2c8b61749e7

SHA1
629d9e7d557221548a22b001f491e25a166258eb

SHA256
2f3dc71b130fdd120eafc564ac0f58b33c5cc0060895cfb9ca9e7d5ca390dda9

SHA512
7bd78f744d6ab613f994c2b15bca7cf9e693c84952e8d34e7def956edfe418b3a98666ba836156e0126dc2f10c2045e2701dc7c1f6bf4cbbe6872c7b970a7310

Download Submit
C:\Users\Admin\AppData\Local\ZoomInfoCEUtility\2214\coordinator.exe
MD5
d4ead13be3274f2b42fb3b53ff142cd9

SHA1
d7cb84bcb2c3e4f57171462000c125f35e63f7e8

SHA256
554f8fea1460df263070edd9f0b5cf2905fa677e744b53734ffc0b321ca311b2

SHA512
6aada02815a75297f57c81cb8ac3db54b8cfd4888d586445f23b6f7296c9a9a167bafe5a3f581bd795e4f18e7a0cde660c9552612d706dbd88e3121477111233

Download Submit
C:\Users\Admin\AppData\Local\ZoomInfoCEUtility\2214\coordinator.exe
MD5
d4ead13be3274f2b42fb3b53ff142cd9

SHA1
d7cb84bcb2c3e4f57171462000c125f35e63f7e8

SHA256
554f8fea1460df263070edd9f0b5cf2905fa677e744b53734ffc0b321ca311b2

SHA512
6aada02815a75297f57c81cb8ac3db54b8cfd4888d586445f23b6f7296c9a9a167bafe5a3f581bd795e4f18e7a0cde660c9552612d706dbd88e3121477111233

Download Submit
C:\Users\Admin\AppData\Local\ZoomInfoCEUtility\launch.bat
MD5
fd4594751cb4a3b23e54ae582c4dd0e8

SHA1
13218cd2470e14221f6fce227a056ca489c98fa7

SHA256
5d7a9c239af404e403f16dd2f1383aee58721c5cfd66e4e1a40e41aec2da057e

SHA512
34af0afd31ad70d21f642c56d1d14491a82213c2f524c9c24037173109ce88267257a33ee0a03cc8ce430697823833c4567b5fa457c9e8ab29ca638dff85131e

Download Submit
C:\Users\Admin\AppData\Local\ZoomInfoCEUtility\version.dat
MD5
f3d9de86462c28781cbe5c47ef22c3e5

SHA1
5ec475005d2a5e68419080231b038c154aefaeed

SHA256
4ff57f0bce33b3f1663fb61a77e73fa4a65692726efb43b547ce6ceaa37145f6

SHA512
b47286c41cab48b98af5facde13b16de6873b1f0708ec173c9a8a087c9b6c54e8be836aca17d5b0cfb4fc6d963787a8d995b85bf2c8b90249edb91eb005799e3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\J2JZME5G.txt
MD5
cc089d13bd915475e2d43a9858221188

SHA1
088fa304e9aa88358e97989e490030b948175318

SHA256
298be12fd0466e143fc2ed9a5d4832c7b077badcfe63463b3074877997ec90b1

SHA512
60b1c497e4e68b506e7c1903517a96f8f8b479c205375b2ebeee719eac5f12af28d4334a012b67202b2153e0450555aef1a3729dcecc551b7185874b8307b53e

Download Submit
\Users\Admin\AppData\Local\Temp\nsn36B.tmp\FindProcDLL.dll
MD5
83cd62eab980e3d64c131799608c8371

SHA1
5b57a6842a154997e31fab573c5754b358f5dd1c

SHA256
a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294

SHA512
91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9

Download Submit
\Users\Admin\AppData\Local\Temp\nsn36B.tmp\GetVersion.dll
MD5
2e2412281a205ed8d53aafb3ef770a2d

SHA1
3cae4138e8226866236cf34f8fb00dafb0954d97

SHA256
db09adb6e17b6a0b31823802431ff5209018ee8c77a193ac8077e42e5f15fb00

SHA512
6d57249b7e02e1dfed2e297ec35fb375ecf3abc893d68694f4fa5f2e82ec68c129af9cc5ce3dd4025147309c0832a2847b69334138f3d29c5572ff4e1b16f219

Download Submit
\Users\Admin\AppData\Local\Temp\nsn36B.tmp\GetVersion.dll
MD5
2e2412281a205ed8d53aafb3ef770a2d

SHA1
3cae4138e8226866236cf34f8fb00dafb0954d97

SHA256
db09adb6e17b6a0b31823802431ff5209018ee8c77a193ac8077e42e5f15fb00

SHA512
6d57249b7e02e1dfed2e297ec35fb375ecf3abc893d68694f4fa5f2e82ec68c129af9cc5ce3dd4025147309c0832a2847b69334138f3d29c5572ff4e1b16f219

Download Submit
\Users\Admin\AppData\Local\Temp\nsn36B.tmp\GetVersion.dll
MD5
2e2412281a205ed8d53aafb3ef770a2d

SHA1
3cae4138e8226866236cf34f8fb00dafb0954d97

SHA256
db09adb6e17b6a0b31823802431ff5209018ee8c77a193ac8077e42e5f15fb00

SHA512
6d57249b7e02e1dfed2e297ec35fb375ecf3abc893d68694f4fa5f2e82ec68c129af9cc5ce3dd4025147309c0832a2847b69334138f3d29c5572ff4e1b16f219

Download Submit
\Users\Admin\AppData\Local\Temp\nsn36B.tmp\GetVersion.dll
MD5
2e2412281a205ed8d53aafb3ef770a2d

SHA1
3cae4138e8226866236cf34f8fb00dafb0954d97

SHA256
db09adb6e17b6a0b31823802431ff5209018ee8c77a193ac8077e42e5f15fb00

SHA512
6d57249b7e02e1dfed2e297ec35fb375ecf3abc893d68694f4fa5f2e82ec68c129af9cc5ce3dd4025147309c0832a2847b69334138f3d29c5572ff4e1b16f219

Download Submit
\Users\Admin\AppData\Local\Temp\nsn36B.tmp\GetVersion.dll
MD5
2e2412281a205ed8d53aafb3ef770a2d

SHA1
3cae4138e8226866236cf34f8fb00dafb0954d97

SHA256
db09adb6e17b6a0b31823802431ff5209018ee8c77a193ac8077e42e5f15fb00

SHA512
6d57249b7e02e1dfed2e297ec35fb375ecf3abc893d68694f4fa5f2e82ec68c129af9cc5ce3dd4025147309c0832a2847b69334138f3d29c5572ff4e1b16f219

Download Submit
\Users\Admin\AppData\Local\Temp\nsn36B.tmp\GetVersion.dll
MD5
2e2412281a205ed8d53aafb3ef770a2d

SHA1
3cae4138e8226866236cf34f8fb00dafb0954d97

SHA256
db09adb6e17b6a0b31823802431ff5209018ee8c77a193ac8077e42e5f15fb00

SHA512
6d57249b7e02e1dfed2e297ec35fb375ecf3abc893d68694f4fa5f2e82ec68c129af9cc5ce3dd4025147309c0832a2847b69334138f3d29c5572ff4e1b16f219

Download Submit
\Users\Admin\AppData\Local\Temp\nsn36B.tmp\GetVersion.dll
MD5
2e2412281a205ed8d53aafb3ef770a2d

SHA1
3cae4138e8226866236cf34f8fb00dafb0954d97

SHA256
db09adb6e17b6a0b31823802431ff5209018ee8c77a193ac8077e42e5f15fb00

SHA512
6d57249b7e02e1dfed2e297ec35fb375ecf3abc893d68694f4fa5f2e82ec68c129af9cc5ce3dd4025147309c0832a2847b69334138f3d29c5572ff4e1b16f219

Download Submit
\Users\Admin\AppData\Local\Temp\nsn36B.tmp\GetVersion.dll
MD5
2e2412281a205ed8d53aafb3ef770a2d

SHA1
3cae4138e8226866236cf34f8fb00dafb0954d97

SHA256
db09adb6e17b6a0b31823802431ff5209018ee8c77a193ac8077e42e5f15fb00

SHA512
6d57249b7e02e1dfed2e297ec35fb375ecf3abc893d68694f4fa5f2e82ec68c129af9cc5ce3dd4025147309c0832a2847b69334138f3d29c5572ff4e1b16f219

Download Submit
\Users\Admin\AppData\Local\Temp\nsn36B.tmp\NSISdl.dll
MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsn36B.tmp\NSISdl.dll
MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsn36B.tmp\System.dll
MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsn36B.tmp\nsDialogs.dll
MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
\Users\Admin\AppData\Local\Temp\nsn36B.tmp\nsisunz.dll
MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit
\Users\Admin\AppData\Local\ZoomInfoCEUtility\2214\coordinator.exe
MD5
d4ead13be3274f2b42fb3b53ff142cd9

SHA1
d7cb84bcb2c3e4f57171462000c125f35e63f7e8

SHA256
554f8fea1460df263070edd9f0b5cf2905fa677e744b53734ffc0b321ca311b2

SHA512
6aada02815a75297f57c81cb8ac3db54b8cfd4888d586445f23b6f7296c9a9a167bafe5a3f581bd795e4f18e7a0cde660c9552612d706dbd88e3121477111233

Download Submit
\Users\Admin\AppData\Local\ZoomInfoCEUtility\uninstall.exe
MD5
80c52c4e77d49a21c61cd1f2809e82c2

SHA1
ffc2bdc4c18c60340c04b65e19b19479e3447f52

SHA256
4e12c7c834cc57263432dd0925de522a4aab07a0532a4693ea5d90aca6aaaa38

SHA512
1a96e0978f9837f870fb95e9922b54263852a814a444a9dd692d41671f2e711080940734327eba32cdd12e71048fbe250b3ea7b4033ff834f4beff26b0939fea

Download Submit
memory/268-15-0x0000000000000000-mapping.dmp

Download
memory/848-25-0x000007FEF63D0000-0x000007FEF664A000-memory.dmp

Filesize
2.5MB

Download
memory/1020-40-0x000000007EF20000-0x000000007EF30000-memory.dmp

Filesize
64KB

Download
memory/1020-26-0x0000000000000000-mapping.dmp

Download
memory/1020-44-0x000000007EF10000-0x000000007EF20000-memory.dmp

Filesize
64KB

Download
memory/1120-22-0x0000000000000000-mapping.dmp

Download
memory/1120-21-0x0000000000000000-mapping.dmp

Download
memory/1192-24-0x0000000000000000-mapping.dmp

Download
memory/1892-14-0x00000000034B0000-0x00000000035B1000-memory.dmp

Filesize
1.0MB

Download