icedid | c15c7e69d90fd076c43a89bb11cf2a642bf3e354566aeecfb9b58fee4e27372a

Analysis

max time kernel
543s
max time network
551s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
11-12-2022 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZoomInstallerFull.exe
Size

75.4MB
MD5

3d36e5c4caa98515b4cbede14c253676
SHA1

d2e1bd8ee0a2185557e5c01883cdccb53772f7bb
SHA256

c15c7e69d90fd076c43a89bb11cf2a642bf3e354566aeecfb9b58fee4e27372a
SHA512

b234812ba40bfee5dfacacf4d2198949d3636449e34a9f75c062d2bc20c6225edb1c4d25f737c5ecc0d31b1cbbf2960e3ba8ce97f006368871dda2a5cd2e6182
SSDEEP

1572864:upDrQefrQSB+gTC4GB3RA9MLhWG7VYlSGTbANByfGajuTgIrPJGs:cDLfrQQ/FA3RAicfUjByfFIDJ

Score

10^/10

icedid 1441853872 banker loader persistence trojan

Malware Config

Extracted

Family

icedid

Campaign

1441853872

ewgahskoot.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 12 IoCs

Processes:

rundll32.exemsiexec.exe

flow	pid	process
2	2756	rundll32.exe
4	3776	msiexec.exe
6	3776	msiexec.exe
18	2756	rundll32.exe
20	2756	rundll32.exe
21	2756	rundll32.exe
22	2756	rundll32.exe
24	2756	rundll32.exe
29	2756	rundll32.exe
32	2756	rundll32.exe
33	2756	rundll32.exe
34	2756	rundll32.exe

Executes dropped EXE 3 IoCs

Processes:

ZoomOutlookIMPlugin.exeCptInstall.exeCptService.exe

pid process

3932 ZoomOutlookIMPlugin.exe
3860 CptInstall.exe
2440 CptService.exe

pid	process
3932	ZoomOutlookIMPlugin.exe
3860	CptInstall.exe
2440	CptService.exe

Loads dropped DLL 13 IoCs

Processes:

rundll32.exeMsiExec.exeZoomOutlookIMPlugin.exe

pid	process
2756	rundll32.exe
4852	MsiExec.exe
3932	ZoomOutlookIMPlugin.exe
3932	ZoomOutlookIMPlugin.exe
3932	ZoomOutlookIMPlugin.exe
3932	ZoomOutlookIMPlugin.exe
3932	ZoomOutlookIMPlugin.exe
4852	MsiExec.exe
4852	MsiExec.exe
4852	MsiExec.exe
4852	MsiExec.exe
4852	MsiExec.exe
4852	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

MsiExec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zoommsirepair = "\"C:\\Program Files (x86)\\Zoom\\bin\\installer.exe\" /repair"	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

MsiExec.exemsiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f486-1f3ff.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f4ca.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f95a.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\bin\zCrashReport.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f468-1f3fc-1f393.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f469-1f469-1f467-1f467.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f470-1f3fb-2642.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f478-1f3fb.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f994.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\2744.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f1f5-1f1f0.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f325.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f3cb-2642.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f9d1-1f3ff-1f9bc.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f9dd-1f3fe-2640.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f44b-1f3fe.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f9d1-1f3fe-1f9b3.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1fa9e.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f6b5-1f3ff-2642.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f3c4-2642.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f433.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f630.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f938-1f3ff-2642.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f9d1-1f3fd-1f3a8.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f473-1f3fd.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f64d-1f3fd-2640.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f92e.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f468-1f3ff-1f33e.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f953.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f408-2b1b.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f468-1f3ff-1f692.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f9d1-1f91d-1f9d1.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f646-1f3fd-2642.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1fa82.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f469-1f3fe-2764-1f469-1f3fe.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f9eb.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1fa85.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f469-1f3ff-2764-1f48b-1f469-1f3fc.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f42c.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f469-1f3fd-1f52c.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f469-1f3fd-2764-1f468-1f3ff.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f41f.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f477-2640.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f485-1f3fb.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f9d1-1f3fd-2764-1f9d1-1f3fe.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f9d1-1f3fe-1f9af.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f1f1-1f1fe.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f468-1f3fd-2764-1f48b-1f468-1f3fe.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f469-1f3fc-1f37c.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f6e9.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f9f7.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f939-1f3ff.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f9d1-1f9af.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f1f2-1f1e8.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f44a-1f3fd.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f469-1f3ff-2764-1f469-1f3fc.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f937-1f3fc-2642.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\2699.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f600.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f926-1f3fc-2640.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f470.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f487-1f3fc.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f5bc.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f945.png	MsiExec.exe

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\{D2D52E89-6EC4-456C-ACDB-874925BDE05A}\_6FEFF9B68218417F98F549.exe	msiexec.exe
File created	C:\Windows\Installer\e5772d1.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D2D52E89-6EC4-456C-ACDB-874925BDE05A}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5772ce.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D8C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{D2D52E89-6EC4-456C-ACDB-874925BDE05A}\_6FEFF9B68218417F98F549.exe	msiexec.exe
File created	C:\Windows\Installer\e5772ce.msi	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

Processes:

MsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}\AppName = "Zoom.exe"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}\AppPath = "C:\\Program Files (x86)\\Zoom\\bin"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}\Policy = "3"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Zoom.exe = "11000"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\zoommtg	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\zoommtg\WarnOnOpen = "0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}	MsiExec.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

MsiExec.exeZoomOutlookIMPlugin.exeCptInstall.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	CptInstall.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	CptInstall.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ZoomOutlookIMPlugin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	CptInstall.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	ZoomOutlookIMPlugin.exe

Modifies registry class 64 IoCs

Processes:

MsiExec.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\ZoomPhoneCall\URL Protocol	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\ZoomPhoneCall\DefaultIcon\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\",1"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\ZoomPbx.zoomphonecall\ = "URL:ZoomPhoneCall Protocol"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\tel	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zoommtg\Content Type = "application/x-zoommtg-launcher"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg\shell\open\command	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zoom	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\ZoomPbx.zoomphonecall\URL Protocol	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPhoneCall	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\PackageCode = "B166BEAD21AFBC446AF5E8A7E12A5F27"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\497B918CC54A72F48906C06894A225CC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg\DefaultIcon\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\",1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomRecording\shell\open	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\SourceList\PackageName = "ikm.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomRecording\shell	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\Language = "1033"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\ZoomPhoneCall\shell\open	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPhoneCall\URL Protocol	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomLauncher\shell	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomLauncher\shell\open\command	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg\URL Protocol	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomRecording	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomRecording\DefaultIcon\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\",0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomLauncher\shell\open	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomLauncher\shell\open\command\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\" \"--url=%1\""	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg\DefaultIcon	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPbx.zoomphonecall\shell	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg\shell	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\ZoomPbx.zoomphonecall\shell\open	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPhoneCall\shell	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPbx.zoomphonecall\DefaultIcon	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPhoneCall\DefaultIcon\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\",1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPbx.zoomphonecall	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPbx.zoomphonecall\shell\open	MsiExec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\ZoomPbx.im	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\IM	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg\shell\open\command\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\" \"--url=%1\""	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\ZoomPhoneCall\ = "URL:ZoomPhoneCall Protocol"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\ZoomPhoneCall\shell\open\command\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\" --url=\"%l\""	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\ProductName = "Zoom(32bit)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\Version = "84683162"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\ZoomPbx.zoomphonecall	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg\ = "URL:Zoom Launcher"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPhoneCall\shell\open\command	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPbx.zoomphonecall\DefaultIcon\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\",1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\497B918CC54A72F48906C06894A225CC\98E25D2D4CE6C654CABD789452DB0EA5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg\UseOriginalUrlEncoding = "1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\ZoomPhoneCall	MsiExec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\ZoomPbx.callto	MsiExec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\ZoomPbx.tel	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zoommtg\ = "ZoomLauncher"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomLauncher\ = "Zoom Launcher - 3.0.1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPbx.zoomphonecall\shell\open\command	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\98E25D2D4CE6C654CABD789452DB0EA5\DefaultFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zoommtg	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-zoommtg-launcher\Extension = ".zoommtg"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomRecording\shell\open\command	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exemsiexec.exeMsiExec.exeZoomOutlookIMPlugin.exeCptInstall.exe

pid	process
2756	rundll32.exe
2756	rundll32.exe
4144	msiexec.exe
4144	msiexec.exe
4852	MsiExec.exe
4852	MsiExec.exe
4852	MsiExec.exe
4852	MsiExec.exe
4852	MsiExec.exe
4852	MsiExec.exe
3932	ZoomOutlookIMPlugin.exe
3932	ZoomOutlookIMPlugin.exe
3860	CptInstall.exe
3860	CptInstall.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exeMsiExec.exe

description	pid	process
Token: SeShutdownPrivilege	3776	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3776	msiexec.exe
Token: SeSecurityPrivilege	4144	msiexec.exe
Token: SeCreateTokenPrivilege	3776	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3776	msiexec.exe
Token: SeLockMemoryPrivilege	3776	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3776	msiexec.exe
Token: SeMachineAccountPrivilege	3776	msiexec.exe
Token: SeTcbPrivilege	3776	msiexec.exe
Token: SeSecurityPrivilege	3776	msiexec.exe
Token: SeTakeOwnershipPrivilege	3776	msiexec.exe
Token: SeLoadDriverPrivilege	3776	msiexec.exe
Token: SeSystemProfilePrivilege	3776	msiexec.exe
Token: SeSystemtimePrivilege	3776	msiexec.exe
Token: SeProfSingleProcessPrivilege	3776	msiexec.exe
Token: SeIncBasePriorityPrivilege	3776	msiexec.exe
Token: SeCreatePagefilePrivilege	3776	msiexec.exe
Token: SeCreatePermanentPrivilege	3776	msiexec.exe
Token: SeBackupPrivilege	3776	msiexec.exe
Token: SeRestorePrivilege	3776	msiexec.exe
Token: SeShutdownPrivilege	3776	msiexec.exe
Token: SeDebugPrivilege	3776	msiexec.exe
Token: SeAuditPrivilege	3776	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3776	msiexec.exe
Token: SeChangeNotifyPrivilege	3776	msiexec.exe
Token: SeRemoteShutdownPrivilege	3776	msiexec.exe
Token: SeUndockPrivilege	3776	msiexec.exe
Token: SeSyncAgentPrivilege	3776	msiexec.exe
Token: SeEnableDelegationPrivilege	3776	msiexec.exe
Token: SeManageVolumePrivilege	3776	msiexec.exe
Token: SeImpersonatePrivilege	3776	msiexec.exe
Token: SeCreateGlobalPrivilege	3776	msiexec.exe
Token: SeBackupPrivilege	4696	vssvc.exe
Token: SeRestorePrivilege	4696	vssvc.exe
Token: SeAuditPrivilege	4696	vssvc.exe
Token: SeBackupPrivilege	4144	msiexec.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeBackupPrivilege	4836	srtasks.exe
Token: SeRestorePrivilege	4836	srtasks.exe
Token: SeSecurityPrivilege	4836	srtasks.exe
Token: SeTakeOwnershipPrivilege	4836	srtasks.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeBackupPrivilege	4836	srtasks.exe
Token: SeRestorePrivilege	4836	srtasks.exe
Token: SeSecurityPrivilege	4836	srtasks.exe
Token: SeTakeOwnershipPrivilege	4836	srtasks.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeDebugPrivilege	4852	MsiExec.exe
Token: SeRestorePrivilege	4852	MsiExec.exe
Token: SeBackupPrivilege	4852	MsiExec.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe
Token: SeRestorePrivilege	4144	msiexec.exe
Token: SeTakeOwnershipPrivilege	4144	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

3776 msiexec.exe
3776 msiexec.exe

pid	process
3776	msiexec.exe
3776	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

ZoomInstallerFull.exemsiexec.exeMsiExec.exe

description	pid	process	target process
PID 2344 wrote to memory of 2756	2344	ZoomInstallerFull.exe	rundll32.exe
PID 2344 wrote to memory of 2756	2344	ZoomInstallerFull.exe	rundll32.exe
PID 2344 wrote to memory of 3776	2344	ZoomInstallerFull.exe	msiexec.exe
PID 2344 wrote to memory of 3776	2344	ZoomInstallerFull.exe	msiexec.exe
PID 4144 wrote to memory of 4836	4144	msiexec.exe	srtasks.exe
PID 4144 wrote to memory of 4836	4144	msiexec.exe	srtasks.exe
PID 4144 wrote to memory of 4852	4144	msiexec.exe	MsiExec.exe
PID 4144 wrote to memory of 4852	4144	msiexec.exe	MsiExec.exe
PID 4144 wrote to memory of 4852	4144	msiexec.exe	MsiExec.exe
PID 4852 wrote to memory of 3932	4852	MsiExec.exe	ZoomOutlookIMPlugin.exe
PID 4852 wrote to memory of 3932	4852	MsiExec.exe	ZoomOutlookIMPlugin.exe
PID 4852 wrote to memory of 3932	4852	MsiExec.exe	ZoomOutlookIMPlugin.exe
PID 4852 wrote to memory of 3860	4852	MsiExec.exe	CptInstall.exe
PID 4852 wrote to memory of 3860	4852	MsiExec.exe	CptInstall.exe
PID 4852 wrote to memory of 3860	4852	MsiExec.exe	CptInstall.exe

C:\Users\Admin\AppData\Local\Temp\ZoomInstallerFull.exe
"C:\Users\Admin\AppData\Local\Temp\ZoomInstallerFull.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2344

C:\WINDOWS\SYSTEM32\rundll32.exe
C:\WINDOWS\SYSTEM32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ikm.aaa, init
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2756

C:\Windows\SYSTEM32\msiexec.exe
msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\ikm.msi
2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3776

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 520BB51DD2A0EBE16623F085630E603B E Global\MSI0000
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852

C:\Program Files (x86)\Zoom\bin\ZoomOutlookIMPlugin.exe
"C:\Program Files (x86)\Zoom\bin\ZoomOutlookIMPlugin.exe" /Check
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3932

C:\Program Files (x86)\Zoom\bin\CptInstall.exe
"C:\Program Files (x86)\Zoom\bin\CptInstall.exe" -install -unelevate -product Zoom
3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3860

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
PID:4024

C:\Program Files (x86)\Common Files\Zoom\Support\CptService.exe
"C:\Program Files (x86)\Common Files\Zoom\Support\CptService.exe" -user_path "C:\Users\Admin\AppData\Roaming\Zoom"
1⤵
- Executes dropped EXE
PID:2440

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Zoom\Support\CptService.exe
Filesize
225KB

MD5
9e5451ac860085c00d10e6e02ace93cd

SHA1
df62392329cd02d9a8b1b6b7fa694aee6ad8d7a7

SHA256
0580a8af804708ed9a86d9958eecdb84845455d285fc25e5a8f618ae46f7ffab

SHA512
e84589fdb855cee28000e51d5be922f9cfc8901dd3099838c1d92796fdf917c24e26afc01122b9379be2f753062ccdfdc395c012d6b91d319c8b0cbc82cc5686

Download Submit
C:\Program Files (x86)\Common Files\Zoom\Support\CptService.exe
Filesize
225KB

MD5
9e5451ac860085c00d10e6e02ace93cd

SHA1
df62392329cd02d9a8b1b6b7fa694aee6ad8d7a7

SHA256
0580a8af804708ed9a86d9958eecdb84845455d285fc25e5a8f618ae46f7ffab

SHA512
e84589fdb855cee28000e51d5be922f9cfc8901dd3099838c1d92796fdf917c24e26afc01122b9379be2f753062ccdfdc395c012d6b91d319c8b0cbc82cc5686

Download Submit
C:\Program Files (x86)\Zoom\Zoom(32bit)\CustomAction.dll
Filesize
463KB

MD5
cd93acb0b47d809d49de75b5e62098b9

SHA1
6cf726521daff980823667e6cb659c7ccf67085b

SHA256
b4786fcaa00af8739df2b73922ad750d5799538448712e5933470211c230068c

SHA512
832cf816d2e2713d9f1b4a805cb25b608eb02bb2fa3c001f980c70c4281c4b6456c7a5c4e492a0c3d1df106a70efe15250a8993e6c1af1c53359860082cce174

Download Submit
C:\Program Files (x86)\Zoom\bin\Cmmlib.dll
Filesize
1.6MB

MD5
4fda1fc1054dab4cd2a8c61a9b98b7dc

SHA1
f52dae000279e4b30a28f3aca23b5f04654ac7c5

SHA256
894905b29f5ca31dd0c696333fcc7e23bd3c7ba8fb758b2293df7a7f2268acf8

SHA512
09531c83673fb6a458978158016ec4daadbd6606780be7f47daa4f4b48c5a68affb63dd35797d825647c237bd218ddd50131bc4961ca59fe26318123fdd52dee

Download Submit
C:\Program Files (x86)\Zoom\bin\CptControl.exe
Filesize
96KB

MD5
d7e39303a4d41e8f27310c2601cdb34c

SHA1
595b000756f2f6483ccaaf751f5ae3309f10e4f6

SHA256
8f9db23d84f8c3cfe3365a64d4aa4c87d4fa02fffa64dcc00d17c66307fc0c82

SHA512
a0088fd79630780dea041abf89e78af48ed5bd8a3976e72e89043c8a604c4d1146eb4cb35ff8206829fd2da66675652ca4bc7953301a8865a4066572f9ce2552

Download Submit
C:\Program Files (x86)\Zoom\bin\CptInstall.exe
Filesize
226KB

MD5
c380b703ef0cb2e5bca13004a242ae65

SHA1
b52a1a3ad31688244124769f02351effc3952248

SHA256
1159dfd3f1a2a87efa7ed0d6fa16001695c3a0f7b21473bbf94d133ca1c41e25

SHA512
de096b58b55f69294d68497686a76a5fca10b1fb27f087dc3216036d2a829605d6ee738eb7e346fc98e327f1398954851a4db33b71357443e657ae61e87ecc91

Download Submit
C:\Program Files (x86)\Zoom\bin\CptInstall.exe
Filesize
226KB

MD5
c380b703ef0cb2e5bca13004a242ae65

SHA1
b52a1a3ad31688244124769f02351effc3952248

SHA256
1159dfd3f1a2a87efa7ed0d6fa16001695c3a0f7b21473bbf94d133ca1c41e25

SHA512
de096b58b55f69294d68497686a76a5fca10b1fb27f087dc3216036d2a829605d6ee738eb7e346fc98e327f1398954851a4db33b71357443e657ae61e87ecc91

Download Submit
C:\Program Files (x86)\Zoom\bin\CptService.exe
Filesize
225KB

MD5
9e5451ac860085c00d10e6e02ace93cd

SHA1
df62392329cd02d9a8b1b6b7fa694aee6ad8d7a7

SHA256
0580a8af804708ed9a86d9958eecdb84845455d285fc25e5a8f618ae46f7ffab

SHA512
e84589fdb855cee28000e51d5be922f9cfc8901dd3099838c1d92796fdf917c24e26afc01122b9379be2f753062ccdfdc395c012d6b91d319c8b0cbc82cc5686

Download Submit
C:\Program Files (x86)\Zoom\bin\CptShare.dll
Filesize
280KB

MD5
03c0ad10f2e76ac88586a8093111a545

SHA1
2bd73faa30fc09d1b1d036c43075da5a18f712a9

SHA256
817d66e6ce83acf907ebf7952e72ab17e384c698998dc93d836ee7f1bd94d6e3

SHA512
a77d36ef13e5910d7b1e8b2a0abff97371cd1d16b7cb8818d3da1ebd5d1aa6d4b4d63b4919c2f721d42e16d8b25dab25da3b72639bae3f59a457892167ca2b5e

Download Submit
C:\Program Files (x86)\Zoom\bin\MSVCP140.dll
Filesize
440KB

MD5
e0dd94aada0b034b212de071c33054da

SHA1
6c4f1b3f66d07bbcdcf41eb39b1480bb335efcc8

SHA256
08442853f19ce4ff3acae37d87eab33ef81c4c6da62a3432d43253ba79842b64

SHA512
76c877056f448e5dab820e990cc186ba886b2d331d689a99295aaff31a63aadb941c2693b0be98d53bd06cd8041a270eb82ddedfbde305cd9a85bcbe42fcf5a2

Download Submit
C:\Program Files (x86)\Zoom\bin\VCRUNTIME140.dll
Filesize
74KB

MD5
87dd91c56be82866bf96ef1666f30a99

SHA1
3b78cb150110166ded8ea51fbde8ea506f72aeaf

SHA256
49b0fd1751342c253cac588dda82ec08e4ef43cebc5a9d80deb7928109b90c4f

SHA512
58c3ec6761624d14c7c897d8d0842dbeab200d445b4339905dac8a3635d174cdfb7b237d338d2829bc6c602c47503120af5be0c7de6abf2e71c81726285e44d6

Download Submit
C:\Program Files (x86)\Zoom\bin\Zoom.exe
Filesize
336KB

MD5
260c0125fe9cae11da4cef073b077f68

SHA1
869b78d539340ba055e6810b24217021debf0fae

SHA256
306aa18dcb46b14c1d76f9c7cf78a49c88ef564b54cd4a523a1a4b5076a3ef36

SHA512
d3a78b209e0cef40d35d552e32540a3a2b4d0e4683c5443a74cb1528ae5997d6c17c5413a65fd2d3b1b13c4e1c27d81c5e2bce5ce4ccc3cdb2725330607767ec

Download Submit
C:\Program Files (x86)\Zoom\bin\ZoomOutlookIMPlugin.exe
Filesize
581KB

MD5
8ec8a4e243853dea877d12266a88cfbf

SHA1
4f6129129c0cdda57d8232a2a10d7124d06d6762

SHA256
cf8638536dd901843119c0b56cd4a61a46c3461b2d374658a713763e18389474

SHA512
54e50dded7c661c854a86a2b65899accc923c51e4fa44d463abdfc94e7e7412e6765b7feda81dc82fbf0eee49a08288defc56723da4ce3768f2187b887232eb1

Download Submit
C:\Program Files (x86)\Zoom\bin\ZoomOutlookIMPlugin.exe
Filesize
581KB

MD5
8ec8a4e243853dea877d12266a88cfbf

SHA1
4f6129129c0cdda57d8232a2a10d7124d06d6762

SHA256
cf8638536dd901843119c0b56cd4a61a46c3461b2d374658a713763e18389474

SHA512
54e50dded7c661c854a86a2b65899accc923c51e4fa44d463abdfc94e7e7412e6765b7feda81dc82fbf0eee49a08288defc56723da4ce3768f2187b887232eb1

Download Submit
C:\Program Files (x86)\Zoom\bin\crashrpt_lang.ini
Filesize
7KB

MD5
fcf61aed8f093bfcf571cdd8f8162a05

SHA1
8de8177798aae82d5bcc0870c1ca5365f5d9966d

SHA256
1f5b45a5411f7fc71b9da789d6d1ead8ad30551fbea7bbb40fc7ea576d581abb

SHA512
8a5d252d115f868a4e20fce10f9f9ec5f3948f0ad5680d656e0eba1fd167d36889e54c6e59bcde756945f93685401b825ba9dd7243d907d74b58a1d826609d72

Download Submit
C:\Program Files (x86)\Zoom\bin\libcrypto-1_1.dll
Filesize
2.5MB

MD5
a97d2029f96df8bb27b22c00d84f7900

SHA1
cdbb1c2fa62f8c9ee9027335cb64a527a79b46ca

SHA256
606bea4c0de0ad49486774990e3590de06d8bc6da366d6d0cb74aebf8573ffca

SHA512
b5353b73cb9279e62aaafa4a5912a9fe127e039bd2f07a5e23100462445e74112f40f7aa157aa6593e970dab2e85000eff386cf25f4ee84449517ca8eaa2305e

Download Submit
C:\Program Files (x86)\Zoom\bin\ucrtbase.dll
Filesize
1.1MB

MD5
2040cdcd779bbebad36d36035c675d99

SHA1
918bc19f55e656f6d6b1e4713604483eb997ea15

SHA256
2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359

SHA512
83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f

Download Submit
C:\Program Files (x86)\Zoom\bin\zCrashReport.dll
Filesize
97KB

MD5
f82f0a3932e73d4f6973632d42c0f296

SHA1
9a59389cc938121a5941a589fc4b66a7d65af7e3

SHA256
aab43f8a9ab37b205e651ac629404ee8dbbc9bf0b4fee85b422275406a1c2572

SHA512
97a098112f448362bd677f2991243b8b024d37f03adf7facdb0601639bc0fb9ca99945bc08d8eca580903120c0a6de7a35106984500207a3c5562a34dbc37ea9

Download Submit
C:\Program Files (x86)\Zoom\bin\zCrashReport.exe
Filesize
219KB

MD5
97042fb62a7ef502dcd1bc96bc490e28

SHA1
1d1f822fe6095660c9bcae225d110298ab3be32e

SHA256
52089b799c309f023b8d58b703302c3165bc4c680ea8135cb18d7fabc0d42c1c

SHA512
916a1f34871aec9433605bb8a3b208018df30d0e5fdbb935566793523b5b9281d7ac4c1a94932541267a0b4bdb3b71a1f389ce48f7e5a90838d58fd351921bd1

Download Submit
C:\Program Files (x86)\Zoom\bin\zOutlookIMUtil.dll
Filesize
474KB

MD5
6934de614ca4dd452966e086bea3ead0

SHA1
7c5ca8e69cd685dffa4537285ec601bc760e11c9

SHA256
a81057faa8bd295d0708a34c1879ad5abd4a46ac82a322b7027c027de0439451

SHA512
2ddee6238212d190ccfe4cd06c5a77c9c5c956e6a8f733a1781ace2f4db3457a2e38295aba6469a2e8e12957fb435fcb514de5f4516fb2dcbd005f58bd4d9d60

Download Submit
C:\Program Files (x86)\Zoom\resources\emojione_low.7z
Filesize
7.4MB

MD5
4d4920bf542c67be8e85249faf9bb89e

SHA1
3ae7e5ae51179056c61487902534336c1996a807

SHA256
ed3419d21d69fd71d2133bfcf83732215f4c65eb547ef73107cb98d03e86cd2f

SHA512
402e878f8976cc4c59264ad5ece9bd8a6c6d371103626d6d0f65b55a0d6139eaa1f0a74c1f63149d158de267467b3cd124038d9447808646a8350736a5e9bc9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2A7611428D62805A3E4E5BC4103D82E4_5DFDB51029B86E246C6BBA4B4F208E9A
Filesize
471B

MD5
69c611121824cdfa751e4de829b53948

SHA1
bb701c6a75d4b1ddfd3428e414b6344c1b7e9d8c

SHA256
d082e9b308b9bda0923bb5639e7b049c3509a359d26b520fa0668b5f0c08c759

SHA512
c9042a790c350f6eb18f71ecc63a22ffa277ec66376f1112cf2eb2c8ea43003c5dc6babf6156bd62fb081b36acc049962de4274c89e59fbfaf42c28296495a68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize
471B

MD5
da5a9f149955d936a31dc5e456666aac

SHA1
195238d41c1e13448f349f43bb295ef2d55cb47a

SHA256
79ac574c7c45144bb35b59ff79c78dc59b66592715dea01b389e3620db663224

SHA512
60d7d1f5405470ba1e6b80066af2e78240acbea8db58b5a03660874605178aebaa9ce342ca97f17798109e7411e82466db5af064e39eaddc05410f2abe672f77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_8DBAD5A433D1F9275321E076E8B744D4
Filesize
727B

MD5
ab42de4c2ae29257e0cb10561971285c

SHA1
c388c1ae38f1830ad6c25f31c3bd28aed4edb8ea

SHA256
3a866bf8c697771e95716e84809f48bfcc4b75930d2693c68832b5a51f73ef63

SHA512
1727a26274c84300d0de89f7ecd4ae3b42ff95a4262844e1b153dd4b78a7da353c01f9011780cec262351de4e99da12015c8d76f8a0977a6be5d468589b2188e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D9CB7DFFEEA63BAB482BD2705E7E24AB_C5076ACD41E9D9741BBEE5F165E53636
Filesize
727B

MD5
af8ff1d134724bf7e20b37226d20cae3

SHA1
3dd2709a0895cdda1397763ea0f4f4e849d733ed

SHA256
3974f800bce3991a21ec3b82f7071c4b71bc66a979ff83e59b64f8a64a5760c0

SHA512
59c5e36680223911a043fc3bf8e9078364ad2bfadf00ac40757491f4506558d9271592e82239f8eb5783e89f206bf3d040785897880e3948d113f6cca5bb4860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A7611428D62805A3E4E5BC4103D82E4_5DFDB51029B86E246C6BBA4B4F208E9A
Filesize
430B

MD5
8ab334726d5fecee7bd481690d50696c

SHA1
e75e8cb194cd8ebe2e1dc81292acc28a7e674cd0

SHA256
c565b2026195561bedc95db8ebb12392da2c4808c613bf364955c6aec9ad944a

SHA512
4d23c2e65e29df36e22f2ac17c6265ae69d298d0ae0fec2d7e37947468813268c5162f4307e51ae557472482b6ec1fa3c73c5b9654c3780b71e91ebba7f8d1f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize
430B

MD5
5021319d1e1d2bfd1ebe3a0e90733bd1

SHA1
a20bb598e4aa5f89f2b5009eb9f2518608686286

SHA256
b72b3805d38e2acde0464e7c33156be8dfac75c00d50e81808cc46001f6049af

SHA512
ffbaef8aa2158c2ecc5b639d7b16b35ae92c8a727e64832710b47388416a842bb28031327dc31ef3730144639a0bba5e010f155b054d1b895511a79328fcf30d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_8DBAD5A433D1F9275321E076E8B744D4
Filesize
446B

MD5
3367f581ee180a49261950176bd8c14d

SHA1
7bc5e17ab3d93ca260377250c64ce0414ff3b7c6

SHA256
d37ec749cb73e2e034c4e72059da4f489428160c5d98199c474d5012c3112579

SHA512
9d24c3aea7d586da908b34e3e46947269245140ace3a6c074af21c9c3bcdfff73811fd4f715f439eb4209272db1cb37db1a44e038a1196ac534f631217993220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D9CB7DFFEEA63BAB482BD2705E7E24AB_C5076ACD41E9D9741BBEE5F165E53636
Filesize
438B

MD5
f2890ab30b83baf7d38cd24a5aa4f5b4

SHA1
ae1c77732ef8284bef3b3f02f2eab55469cb16a3

SHA256
706a0131aaf6585354185c3ee7715cda175a51c22450766af82b4f311ac3b265

SHA512
dca01e8c050d4d12dbdeeb527759820631cd2ea6acf700ca9c4b75c707ac930289babc06e3e1d1b5751aba411700e77f0bee4d27d08ca91920cec9e6d6c04e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\ikm.aaa
Filesize
374KB

MD5
f371a5d45d6aa7bf79c73c6ac1e27db8

SHA1
fc5cfb8d23f4c4b7b0d866679860a4b51a53f52e

SHA256
a91ab1223bc23763dca1e0bd8d47553b7d3a7d4b8c114504ec67439845519eeb

SHA512
f5ef2ab57d0f309194331c1d45aa30632656f26c17913db325a40a9e4f186346c53e1aa82a0a336fac8d2e664a143e0b8621fc5c00ebca31ec369e19ca91c02d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ikm.msi
Filesize
75.1MB

MD5
f7f764ed7be9356b85c73462542b36c3

SHA1
e0a67fa1d899d464ec6a268dcfb1b14de172c582

SHA256
839c1a8a906bd0bce47262a904708ed58eb832a1acae917ecd758ab5a01f3234

SHA512
fafa807291c19bac4da510edc5ccea607b77b0220c5c9090d1eb5a7c3a022f67c113bdf51ef13bc6af830ae3843ca4ea53d96a033fc5aae9714a8708e068b45c

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
25.0MB

MD5
9f4c452a74c4456b0a9592834e7586db

SHA1
43df89dc9eb9a0621f264a4ddb1baa3ba61573e3

SHA256
56ae5a4b8c8da82f177464353ec8a94d28ca67c0c424c076e569c98ac1bd7881

SHA512
cbd3277d8931a652517a114c24565189c37af9ee33526e845deaecf4019706053c64ab6786018cf30d626579352f08fb60e008f15ab136aedab2a397d4c66e91

Download Submit
\??\Volume{420c8c0f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5707e377-3612-4f12-a48a-658a3642a992}_OnDiskSnapshotProp
Filesize
5KB

MD5
8cbeea8721e245bffbc2b7e21b20a35c

SHA1
172454d88bfbea0ca6329cdb1840a64df241c7a5

SHA256
866c358e863b79c23159ffa4a16a2886c7d62a01b4f719bdb7e54dada53360bb

SHA512
b308766f28612880406c24838703c36458e656aee8dcedb0ee78aeaedb1f0197f755feacb1f1fdca8950519725ed059317013d488bb610548cf1924c108f4f8c

Download Submit
\Program Files (x86)\Zoom\Zoom(32bit)\CustomAction.dll
Filesize
463KB

MD5
cd93acb0b47d809d49de75b5e62098b9

SHA1
6cf726521daff980823667e6cb659c7ccf67085b

SHA256
b4786fcaa00af8739df2b73922ad750d5799538448712e5933470211c230068c

SHA512
832cf816d2e2713d9f1b4a805cb25b608eb02bb2fa3c001f980c70c4281c4b6456c7a5c4e492a0c3d1df106a70efe15250a8993e6c1af1c53359860082cce174

Download Submit
\Program Files (x86)\Zoom\Zoom(32bit)\CustomAction.dll
Filesize
463KB

MD5
cd93acb0b47d809d49de75b5e62098b9

SHA1
6cf726521daff980823667e6cb659c7ccf67085b

SHA256
b4786fcaa00af8739df2b73922ad750d5799538448712e5933470211c230068c

SHA512
832cf816d2e2713d9f1b4a805cb25b608eb02bb2fa3c001f980c70c4281c4b6456c7a5c4e492a0c3d1df106a70efe15250a8993e6c1af1c53359860082cce174

Download Submit
\Program Files (x86)\Zoom\bin\Cmmlib.dll
Filesize
1.6MB

MD5
4fda1fc1054dab4cd2a8c61a9b98b7dc

SHA1
f52dae000279e4b30a28f3aca23b5f04654ac7c5

SHA256
894905b29f5ca31dd0c696333fcc7e23bd3c7ba8fb758b2293df7a7f2268acf8

SHA512
09531c83673fb6a458978158016ec4daadbd6606780be7f47daa4f4b48c5a68affb63dd35797d825647c237bd218ddd50131bc4961ca59fe26318123fdd52dee

Download Submit
\Program Files (x86)\Zoom\bin\CptShare.dll
Filesize
280KB

MD5
03c0ad10f2e76ac88586a8093111a545

SHA1
2bd73faa30fc09d1b1d036c43075da5a18f712a9

SHA256
817d66e6ce83acf907ebf7952e72ab17e384c698998dc93d836ee7f1bd94d6e3

SHA512
a77d36ef13e5910d7b1e8b2a0abff97371cd1d16b7cb8818d3da1ebd5d1aa6d4b4d63b4919c2f721d42e16d8b25dab25da3b72639bae3f59a457892167ca2b5e

Download Submit
\Program Files (x86)\Zoom\bin\libcrypto-1_1.dll
Filesize
2.5MB

MD5
a97d2029f96df8bb27b22c00d84f7900

SHA1
cdbb1c2fa62f8c9ee9027335cb64a527a79b46ca

SHA256
606bea4c0de0ad49486774990e3590de06d8bc6da366d6d0cb74aebf8573ffca

SHA512
b5353b73cb9279e62aaafa4a5912a9fe127e039bd2f07a5e23100462445e74112f40f7aa157aa6593e970dab2e85000eff386cf25f4ee84449517ca8eaa2305e

Download Submit
\Program Files (x86)\Zoom\bin\msvcp140.dll
Filesize
440KB

MD5
e0dd94aada0b034b212de071c33054da

SHA1
6c4f1b3f66d07bbcdcf41eb39b1480bb335efcc8

SHA256
08442853f19ce4ff3acae37d87eab33ef81c4c6da62a3432d43253ba79842b64

SHA512
76c877056f448e5dab820e990cc186ba886b2d331d689a99295aaff31a63aadb941c2693b0be98d53bd06cd8041a270eb82ddedfbde305cd9a85bcbe42fcf5a2

Download Submit
\Program Files (x86)\Zoom\bin\msvcp140.dll
Filesize
440KB

MD5
e0dd94aada0b034b212de071c33054da

SHA1
6c4f1b3f66d07bbcdcf41eb39b1480bb335efcc8

SHA256
08442853f19ce4ff3acae37d87eab33ef81c4c6da62a3432d43253ba79842b64

SHA512
76c877056f448e5dab820e990cc186ba886b2d331d689a99295aaff31a63aadb941c2693b0be98d53bd06cd8041a270eb82ddedfbde305cd9a85bcbe42fcf5a2

Download Submit
\Program Files (x86)\Zoom\bin\ucrtbase.dll
Filesize
1.1MB

MD5
2040cdcd779bbebad36d36035c675d99

SHA1
918bc19f55e656f6d6b1e4713604483eb997ea15

SHA256
2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359

SHA512
83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f

Download Submit
\Program Files (x86)\Zoom\bin\vcruntime140.dll
Filesize
74KB

MD5
87dd91c56be82866bf96ef1666f30a99

SHA1
3b78cb150110166ded8ea51fbde8ea506f72aeaf

SHA256
49b0fd1751342c253cac588dda82ec08e4ef43cebc5a9d80deb7928109b90c4f

SHA512
58c3ec6761624d14c7c897d8d0842dbeab200d445b4339905dac8a3635d174cdfb7b237d338d2829bc6c602c47503120af5be0c7de6abf2e71c81726285e44d6

Download Submit
\Program Files (x86)\Zoom\bin\vcruntime140.dll
Filesize
74KB

MD5
87dd91c56be82866bf96ef1666f30a99

SHA1
3b78cb150110166ded8ea51fbde8ea506f72aeaf

SHA256
49b0fd1751342c253cac588dda82ec08e4ef43cebc5a9d80deb7928109b90c4f

SHA512
58c3ec6761624d14c7c897d8d0842dbeab200d445b4339905dac8a3635d174cdfb7b237d338d2829bc6c602c47503120af5be0c7de6abf2e71c81726285e44d6

Download Submit
\Program Files (x86)\Zoom\bin\zCrashReport.dll
Filesize
97KB

MD5
f82f0a3932e73d4f6973632d42c0f296

SHA1
9a59389cc938121a5941a589fc4b66a7d65af7e3

SHA256
aab43f8a9ab37b205e651ac629404ee8dbbc9bf0b4fee85b422275406a1c2572

SHA512
97a098112f448362bd677f2991243b8b024d37f03adf7facdb0601639bc0fb9ca99945bc08d8eca580903120c0a6de7a35106984500207a3c5562a34dbc37ea9

Download Submit
\Program Files (x86)\Zoom\bin\zCrashReport.dll
Filesize
97KB

MD5
f82f0a3932e73d4f6973632d42c0f296

SHA1
9a59389cc938121a5941a589fc4b66a7d65af7e3

SHA256
aab43f8a9ab37b205e651ac629404ee8dbbc9bf0b4fee85b422275406a1c2572

SHA512
97a098112f448362bd677f2991243b8b024d37f03adf7facdb0601639bc0fb9ca99945bc08d8eca580903120c0a6de7a35106984500207a3c5562a34dbc37ea9

Download Submit
\Users\Admin\AppData\Local\Temp\ikm.aaa
Filesize
374KB

MD5
f371a5d45d6aa7bf79c73c6ac1e27db8

SHA1
fc5cfb8d23f4c4b7b0d866679860a4b51a53f52e

SHA256
a91ab1223bc23763dca1e0bd8d47553b7d3a7d4b8c114504ec67439845519eeb

SHA512
f5ef2ab57d0f309194331c1d45aa30632656f26c17913db325a40a9e4f186346c53e1aa82a0a336fac8d2e664a143e0b8621fc5c00ebca31ec369e19ca91c02d

Download Submit
memory/2756-121-0x00000206DF660000-0x00000206DF669000-memory.dmp

Filesize
36KB

Download
memory/2756-118-0x0000000000000000-mapping.dmp

Download
memory/3776-127-0x0000000000000000-mapping.dmp

Download
memory/3860-336-0x0000000000000000-mapping.dmp

Download
memory/3932-224-0x0000000000000000-mapping.dmp

Download
memory/4836-133-0x0000000000000000-mapping.dmp

Download
memory/4852-155-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-177-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-183-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-184-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-185-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-186-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-187-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-188-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-189-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-190-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-181-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-193-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-180-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-194-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-195-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-196-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-197-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-198-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-199-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-200-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-201-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-202-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-203-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-204-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-205-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-206-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-179-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-178-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-176-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-182-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-175-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-174-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-173-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-171-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-172-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-170-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-169-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-168-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-167-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-166-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-165-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-164-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-163-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-162-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-161-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-160-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-159-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-158-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-157-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-156-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-154-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-153-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-151-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-150-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-148-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-147-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-146-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-145-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-144-0x0000000000000000-mapping.dmp

Download