Windows Analysis Report
webex.exe

Overview

General Information

Sample name: webex.exe
Analysis ID: 1447090
MD5: 253d21dbe18ed326858237394b988416
SHA1: 77a49051e8869eceb9a7babb8908d4177cf26a16
SHA256: c4a6bf1fabb7eec2f96b59691d28812f798974a7f8ebcf8fd314135e2eb55a4b
Infos:

Detection

Score: 39
Range: 0 - 100
Whitelisted: false
Confidence: 0%

Compliance

Score: 33
Range: 0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Self deletion via cmd or bat file
Adds / modifies Windows certificates
Binary contains a suspicious time stamp
Checks for available system drives (often done to infect USB drives)
Contains capabilities to detect virtual machines
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Queries time zone information
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Stores large binary data to the registry
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: webex.exe Avira: detected
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\webexhost.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\wmlhost.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\teamsdcvagent.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\washost.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\CiscoWebExStart.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: msiexec.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\x86\CiscoCollabHost.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\CiscoLocalRecordConverter.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe EXE: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\teamshvdagent.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\CiscoCollabHost.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: cmd.exe Jump to behavior

Compliance
barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\webexhost.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\wmlhost.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\teamsdcvagent.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\washost.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\CiscoWebExStart.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: msiexec.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\x86\CiscoCollabHost.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\CiscoLocalRecordConverter.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe EXE: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\teamshvdagent.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\CiscoCollabHost.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Jump to behavior
Source: C:\Users\user\Desktop\webex.exe EXE: cmd.exe Jump to behavior
Uses 32bit PE files
Source: webex.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Windows\System32\msiexec.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A82B9CC-F7B3-5000-9CA4-89764C5A9DA4} Jump to behavior
Source: webex.exe Static PE information: certificate valid
Source: webex.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: J:\qt_build\workspace\qt_build\qtbase\lib\libGLESv2.pdb source: CiscoCollabHost.exe, 00000013.00000002.3556069538.00007FFDE64E9000.00000002.00000001.01000000.0000004B.sdmp
Source: Binary string: E:\VSExclude\Jenkins_Workspace\wme-release\wme\mediaengine\maps\x64\Release\wmeclient.pdbyy GCTL source: CiscoCollabHost.exe, 00000013.00000002.3563229356.00007FFDE8847000.00000002.00000001.01000000.0000003C.sdmp
Source: Binary string: J:\qt_build\workspace\qt_build\qtbase\plugins\platforms\qwindows.pdb source: CiscoCollabHost.exe, 00000013.00000002.3556621994.00007FFDE66C7000.00000002.00000001.01000000.00000048.sdmp
Source: Binary string: E:\VSExclude\Jenkins_Workspace\wme-release\wme\mediaengine\maps\x64\Release\wmeclient.pdb source: CiscoCollabHost.exe, 00000013.00000002.3563229356.00007FFDE8847000.00000002.00000001.01000000.0000003C.sdmp
Source: Binary string: E:\VSExclude\Jenkins_Workspace\wme-release\wme\mediaengine\maps\x64\Release\wseclient.pdb source: CiscoCollabHost.exe, 00000013.00000002.3563909544.00007FFDE8C54000.00000002.00000001.01000000.00000037.sdmp
Source: Binary string: E:\VSExclude\Jenkins_Workspace\wme-release\wme\vendor\video_process\bin\windows\x86_64\Release\videoprocess.pdb source: CiscoCollabHost.exe, 00000013.00000002.3562293246.00007FFDE85F7000.00000002.00000001.01000000.0000003E.sdmp
Source: Binary string: J:\TeamsVDI\out\hvdsdk\release\bin\VxcCommunication.dll.pdb source: CiscoCollabHost.exe, 00000013.00000002.3557154248.00007FFDE6863000.00000002.00000001.01000000.00000047.sdmp
Source: Binary string: E:\VSExclude\Jenkins_Workspace\wme-release\wme\mediaengine\maps\x64\Release\wbxaudioengine.pdb source: CiscoCollabHost.exe, 00000013.00000002.3558824995.00007FFDE70C6000.00000002.00000001.01000000.00000043.sdmp
Source: Binary string: E:\VSExclude\Jenkins_Workspace\wme-release\wme\mediaengine\maps\x64\Release\wrtp.pdb source: CiscoCollabHost.exe, 00000013.00000002.3560651202.00007FFDE8109000.00000002.00000001.01000000.00000040.sdmp
Source: Binary string: E:\VSExclude\Jenkins_Workspace\wme-release\wme\mediaengine\maps\x64\Release\wbxaudioengine.pdbi source: CiscoCollabHost.exe, 00000013.00000002.3558824995.00007FFDE70C6000.00000002.00000001.01000000.00000043.sdmp
Source: Binary string: J:\TeamsVDI\out\hvdsdk\release\bin\VxcCommunication.dll.pdb``# source: CiscoCollabHost.exe, 00000013.00000002.3557154248.00007FFDE6863000.00000002.00000001.01000000.00000047.sdmp
Source: Binary string: J:\TeamsVDI\out\hvdsdk\release\bin\VDIFramework.dll.pdb source: CiscoCollabHost.exe, 00000013.00000002.3557908733.00007FFDE6B9E000.00000002.00000001.01000000.00000045.sdmp
Source: Binary string: J:\TeamsVDI\out\hvdsdk\release\bin\VDIFramework.dll.pdbmm$ source: CiscoCollabHost.exe, 00000013.00000002.3557908733.00007FFDE6B9E000.00000002.00000001.01000000.00000045.sdmp
Source: Binary string: J:\qt_build\workspace\qt_build\qtbase\lib\libGLESv2.pdb4 source: CiscoCollabHost.exe, 00000013.00000002.3556069538.00007FFDE64E9000.00000002.00000001.01000000.0000004B.sdmp
Source: Binary string: CiscoCollabHost.pdb source: CiscoCollabHost.exe, 00000012.00000002.3326490032.00007FF7EC6B3000.00000002.00000001.01000000.00000008.sdmp, CiscoCollabHost.exe, 00000012.00000000.3322197488.00007FF7EC6B3000.00000002.00000001.01000000.00000008.sdmp, CiscoCollabHost.exe, 00000013.00000000.3323639313.00007FF6F8013000.00000002.00000001.01000000.0000000A.sdmp, CiscoCollabHost.exe, 00000013.00000002.3555496022.00007FF6F8013000.00000002.00000001.01000000.0000000A.sdmp
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: x: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: v: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: t: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: r: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: p: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: n: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: l: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: j: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: h: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: f: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: b: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: y: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: w: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: u: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: s: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: q: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: o: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: m: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: k: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: i: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: g: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: e: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: c: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: a: Jump to behavior
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://angularjs.org
Source: webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000003.3339395518.000001EFB0EA4000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000003.3340180113.000001EFB0EEC000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3549445254.000001EFB0EBA000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000003.3339530361.000001EFB0DCD000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000003.3339802143.000001EFB0EB5000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000003.3338203628.000001EFB0EA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: CiscoCollabHost.exe, 00000013.00000002.3549445254.000001EFB0EBA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.micro
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000003.3339395518.000001EFB0EA4000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000003.3340180113.000001EFB0EEC000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3549445254.000001EFB0EBA000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000003.3339530361.000001EFB0DCD000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000003.3339802143.000001EFB0EB5000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000003.3338203628.000001EFB0EA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://link.com
Source: webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000003.3339395518.000001EFB0EA4000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000003.3340180113.000001EFB0EEC000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3549445254.000001EFB0EBA000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000003.3339530361.000001EFB0DCD000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000003.3339802143.000001EFB0EB5000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000003.3338203628.000001EFB0EA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://policy.camerfirma.com0
Source: CiscoCollabHost.exe, 00000013.00000002.3560651202.00007FFDE8109000.00000002.00000001.01000000.00000040.sdmp String found in binary or memory: http://protocols.cisco.com/av1
Source: CiscoCollabHost.exe, 00000013.00000002.3560651202.00007FFDE8109000.00000002.00000001.01000000.00000040.sdmp String found in binary or memory: http://protocols.cisco.com/framemarking
Source: CiscoCollabHost.exe, 00000013.00000002.3560651202.00007FFDE8109000.00000002.00000001.01000000.00000040.sdmp String found in binary or memory: http://protocols.cisco.com/namedmediagroup
Source: CiscoCollabHost.exe, 00000013.00000002.3560651202.00007FFDE8109000.00000002.00000001.01000000.00000040.sdmp String found in binary or memory: http://protocols.cisco.com/namedmediagrouplist
Source: CiscoCollabHost.exe, 00000013.00000002.3560651202.00007FFDE8109000.00000002.00000001.01000000.00000040.sdmp String found in binary or memory: http://protocols.cisco.com/priority
Source: CiscoCollabHost.exe, 00000013.00000002.3539279947.000001EFAF190000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3560651202.00007FFDE8109000.00000002.00000001.01000000.00000040.sdmp String found in binary or memory: http://protocols.cisco.com/timestamp#100us
Source: CiscoCollabHost.exe, 00000013.00000002.3539279947.000001EFAF190000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://protocols.cisco.com/timestamp#100usn
Source: CiscoCollabHost.exe, 00000013.00000002.3539279947.000001EFAF190000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3560651202.00007FFDE8109000.00000002.00000001.01000000.00000040.sdmp String found in binary or memory: http://protocols.cisco.com/virtualid
Source: CiscoCollabHost.exe, 00000013.00000002.3560651202.00007FFDE8109000.00000002.00000001.01000000.00000040.sdmp String found in binary or memory: http://protocols.cisco.com/virtualidhttp://protocols.cisco.com/framemarkingurn:ietf:params:rtp-hdrex
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/0
Source: webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713612449.0000000003349000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713612449.0000000003349000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcd.com06
Source: webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713612449.0000000003349000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713612449.0000000003349000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713612449.0000000003349000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB0860000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cisco.com/c/en/us/about/legal/privacy.html
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3541683541.000001EFAFA16000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cisco.com/security/pki/certs/crcam1.cer0
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3541683541.000001EFAFA16000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cisco.com/security/pki/crl/crcam1.crl0N
Source: webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.gnu.org/licenses/gpl-2.0.html.
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.html-tidy.org
Source: CiscoCollabHost.exe, 00000013.00000002.3543772157.000001EFB01DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Microsoft
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.msftncsi.com/ncsi.txt
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.qt-project.org/legal
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.qt.io/contact-us.
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.qt.io/licensing/
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.qt.io/terms-conditions.
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: CiscoCollabHost.exe, 00000013.00000002.3549659031.000001EFB0F2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.comMicrosoft
Source: CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB08E8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deNormalNormaaliNormalNorm
Source: CiscoCollabHost.exe, 00000013.00000002.3539279947.000001EFAF190000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3560651202.00007FFDE8109000.00000002.00000001.01000000.00000040.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-time
Source: CiscoCollabHost.exe, 00000013.00000002.3539279947.000001EFAF190000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-timeI
Source: CiscoCollabHost.exe, 00000013.00000002.3560651202.00007FFDE8109000.00000002.00000001.01000000.00000040.sdmp String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-timehttp://protocols.cisco.com/namedmediagr
Source: CiscoCollabHost.exe, 00000013.00000002.3551254415.000001EFB395A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: CiscoCollabHost.exe, 00000013.00000002.3540066323.000001EFAF5F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://accounts.snap.com
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://alpha.webex.com/alpha-sc/j.php?MTID=m2a40b18df319615a16fefa5d8d4df1eb
Source: CiscoCollabHost.exe, 00000013.00000002.3548188494.000001EFB097E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://appleinc.webex.com
Source: CiscoCollabHost.exe, 00000013.00000002.3548188494.000001EFB097E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://appleinc.webex.com.
Source: CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB0842000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3545166079.000001EFB07B0000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3538642634.000001EFACE59000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://appleinc.webex.com/
Source: CiscoCollabHost.exe, 00000013.00000002.3548188494.000001EFB097E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://appleinc.webex.comv
Source: CiscoCollabHost.exe, 00000013.00000002.3544628106.000001EFB04C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://atlas-api-a.wbx2.com/admin/api/v1
Source: CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB087F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.c
Source: webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB0842000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3545166079.000001EFB07B0000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3544235755.000001EFB038E000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB0860000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/.
Source: CiscoCollabHost.exe, 00000013.00000002.3545166079.000001EFB07B0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/B
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/C
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/FranciscE
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/JL
Source: CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB0860000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/LOCALAPP
Source: CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB0860000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/PowerShe
Source: CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB087F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/V$q
Source: webex.exe, 00000000.00000003.1706246150.00000000013E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/Webex
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-32-Gold/20221110032238/WebexVDIPlugin.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-32-Gold/20221110032238/WebexVDIPlugin_x86.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-32-Gold/20221207133244/WebexVDIPlugin.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-32-Gold/20221207133244/WebexVDIPlugin_x86.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-32-Gold/20230216133805/WebexVDIPlugin.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-32-Gold/20230216133805/WebexVDIPlugin_x86.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-32-Gold/20230421085439/WebexVDIPlugin.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-32-Gold/20230421085439/WebexVDIPlugin_x86.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-32-Gold/20231018100743/WebexVDIPlugin.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-32-Gold/20231018100743/WebexVDIPlugin_x86.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-32-Gold/20231211114034/WebexVDIPlugin.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-32-Gold/20231211114034/WebexVDIPlugin_x86.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-32-Gold/20240219145217/WebexVDIPlugin.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-32-Gold/20240219145217/WebexVDIPlugin_x86.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-64-Gold/20230713030330/WebexVDIPlugin.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-64-Gold/20230713030330/WebexVDIPlugin_x86.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-64-Gold/20230906100245/WebexVDIPlugin.7z
Source: CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-VDI-Win-64-Gold/20230906100245/WebexVDIPlugin_x86.7z
Source: webex.exe, 00000000.00000003.2032458997.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1948632756.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1706246150.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1979201557.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032844232.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1982453215.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2095203618.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2813652807.00000000013EB000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.00000000013E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-Win-64-Gold/
Source: webex.exe, 00000000.00000003.1706246150.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1979201557.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032844232.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1982453215.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2095203618.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2813652807.00000000013EB000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.00000000013E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-Win-64-Gold/20240514192927/DynamicComponent-ladon.7z
Source: webex.exe, 00000000.00000003.2032458997.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1948632756.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1706246150.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1979201557.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032844232.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1982453215.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2095203618.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2813652807.00000000013EB000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.00000000013E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-Win-64-Gold/20240514192927/DynamicComponent-xcodec.7zCo
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1706246150.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-Win-64-Gold/20240514192927/DynamicComponent-xnn_engine.7z
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-Win-64-Gold/20240514192927/Webex.exe
Source: webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-Win-64-Gold/20240514192927/WebexStub.msi
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-Win-64-Gold/20240514192927/WebexStub.msi7z
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-Win-64-Gold/20240514192927/WebexStub.msi7zcom
Source: webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-Win-64-Gold/20240514192927/WebexTeams.7z
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-Win-64-Gold/20240514192927/WebexTeams.7z-a.wbx2.com
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-Win-64-Gold/20240514192927/WebexTeams.7z2.comIaB
Source: webex.exe, 00000000.00000003.2032458997.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1948632756.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1706246150.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1979201557.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032844232.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1982453215.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2095203618.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2813652807.00000000013EB000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.00000000013E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-Win-64-Gold/20240514192927/WebexTeamsPatchUpgrade_1.7zE
Source: webex.exe, 00000000.00000003.2032458997.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1948632756.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1706246150.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1979201557.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032844232.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1982453215.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2095203618.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2813652807.00000000013EB000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.00000000013E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-Win-64-Gold/20240514192927/WebexTeamsPatchUpgrade_2.7zH
Source: webex.exe, 00000000.00000003.1706246150.00000000013DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-Win-64-Gold/20240514192927/WebexTeamsPatchUpgrade_3.7z
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-Win-64-MV-Gold/20240514195518/WebexTeams.7ze?
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/WebexDesktop-Win-64-MV-Gold/20240514195518/WebexTeams.7zfa
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/false
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/l
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/mpany
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/nager.cpw
Source: CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB0860000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/nd
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/r.cpp:17
Source: CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB087F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/static-content-pipeline/webex-app-resources/44.5/translations/manifest.jw
Source: CiscoCollabHost.exe, 00000013.00000002.3551254415.000001EFB39A9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/webview2runtime-win64/MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69
Source: CiscoCollabHost.exe, 00000013.00000002.3551254415.000001EFB396F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com/y$
Source: CiscoCollabHost.exe, 00000013.00000002.3551507487.000001EFB3A91000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com:443/static-content-pipeline/webex-app-resources/44.5/translations/spark-w
Source: CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB092C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.com:443/webview2runtime-win64/MicrosoftEdgeWebView2RuntimeInstaller_118.0.208
Source: CiscoCollabHost.exe, 00000013.00000002.3544235755.000001EFB038E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://binaries.webex.comD)
Source: CiscoCollabHost.exe, 00000013.00000002.3543096123.000001EFAFFC3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitmoji.api.snapchat.com/direct/
Source: CiscoCollabHost.exe, 00000013.00000002.3543096123.000001EFAFFC3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitmoji.api.snapchat.com/direct/avatar
Source: CiscoCollabHost.exe, 00000013.00000002.3543096123.000001EFAFFC3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitmoji.api.snapchat.com/direct/avatar8Ev
Source: CiscoCollabHost.exe, 00000013.00000002.3543096123.000001EFAFFC3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitmoji.api.snapchat.com/direct/pack/
Source: CiscoCollabHost.exe, 00000013.00000002.3543096123.000001EFAFFC3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitmoji.api.snapchat.com/direct/packs
Source: CiscoCollabHost.exe, 00000013.00000002.3543096123.000001EFAFFC3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitmoji.api.snapchat.com/direct/packshE&
Source: CiscoCollabHost.exe, 00000013.00000002.3542641508.000001EFAFDD3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://captive.apple.com/hotspot-detect.html
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cisco.com/go/schedule-meetings-from-google-workspace
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cisco.com/go/schedule-meetings-from-outlook
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cisco.com/go/smart-audio-settings
Source: CiscoCollabHost.exe, 00000013.00000002.3538642634.000001EFACED9000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF66E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cisco.com/go/webex-assistant-meetings-voice-commands
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cisco.com/go/webex-events-webcasts
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cisco.com/go/webex-restricted-networks
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://client-upgrade-a.wbx2.com
Source: CiscoCollabHost.exe, 00000013.00000002.3541455192.000001EFAF935000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://client-upgrade-a.wbx2.com/client-upgrade/api/v1
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://collaborationhelp.cisco.com/article/en-us/WBX000028818
Source: webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713612449.0000000003349000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/cps0%
Source: webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713612449.0000000003349000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0
Source: webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713612449.0000000003349000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0.
Source: webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ds.ciscospark.com
Source: webex.exe, 00000000.00000003.2032458997.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1948632756.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2873018624.00000000013EB000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1706246150.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1979201557.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032844232.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1982453215.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2095203618.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2813652807.00000000013EB000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.00000000013E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ds.ciscospark.com/
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ds.ciscospark.com6
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ds.ciscospark.comh
Source: CiscoCollabHost.exe, 00000013.00000002.3551507487.000001EFB3A91000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://go.webex
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://go.webex.com/go/globalcallin.php?serviceType=MC&eventID=169900787&tollFree=1
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://go.webex.com/m/35cf15b4-8b8c-4a99-b33f-20d086d2
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://go.webex.com/meeting/barbara
Source: CiscoCollabHost.exe, 00000013.00000002.3540985171.000001EFAF82F000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3541594618.000001EFAF9D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/0p4gb1
Source: CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB0860000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/article/n6fwepj/Where-is-Webex-available?#id_98290
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF66E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmail
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmail#
Source: CiscoCollabHost.exe, 00000013.00000002.3539279947.000001EFAF190000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmail%
Source: CiscoCollabHost.exe, 00000013.00000002.3542641508.000001EFAFDD3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmail%O
Source: CiscoCollabHost.exe, 00000013.00000002.3541621203.000001EFAF9E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmail)Aa
Source: CiscoCollabHost.exe, 00000013.00000002.3541621203.000001EFAF9E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmail/C
Source: CiscoCollabHost.exe, 00000013.00000002.3539279947.000001EFAF190000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmail3
Source: CiscoCollabHost.exe, 00000013.00000002.3542641508.000001EFAFDD3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmail4M
Source: CiscoCollabHost.exe, 00000013.00000002.3541621203.000001EFAF9E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmail5N
Source: CiscoCollabHost.exe, 00000013.00000002.3539279947.000001EFAF190000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmail=
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmail?
Source: CiscoCollabHost.exe, 00000013.00000002.3541621203.000001EFAF9E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmail?OK
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailC
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailG
Source: CiscoCollabHost.exe, 00000013.00000002.3539279947.000001EFAF190000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailI
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailL
Source: CiscoCollabHost.exe, 00000013.00000002.3539279947.000001EFAF190000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailM
Source: CiscoCollabHost.exe, 00000013.00000002.3541621203.000001EFAF9E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailMJ
Source: CiscoCollabHost.exe, 00000013.00000002.3539279947.000001EFAF190000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailN
Source: CiscoCollabHost.exe, 00000013.00000002.3541621203.000001EFAF9E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailOM
Source: CiscoCollabHost.exe, 00000013.00000002.3541621203.000001EFAF9E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailPN
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailQ
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailR
Source: CiscoCollabHost.exe, 00000013.00000002.3541621203.000001EFAF9E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailSC
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailT
Source: CiscoCollabHost.exe, 00000013.00000002.3539279947.000001EFAF190000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailW
Source: CiscoCollabHost.exe, 00000013.00000002.3541621203.000001EFAF9E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailXC
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF66E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailZ
Source: CiscoCollabHost.exe, 00000013.00000002.3541621203.000001EFAF9E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmaildK
Source: CiscoCollabHost.exe, 00000013.00000002.3539279947.000001EFAF190000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmaile
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmailg
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmailh
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmaili
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmailj
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmaill
Source: CiscoCollabHost.exe, 00000013.00000002.3539279947.000001EFAF190000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmailr
Source: CiscoCollabHost.exe, 00000013.00000002.3541621203.000001EFAF9E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailrK
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmailu
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmailv
Source: CiscoCollabHost.exe, 00000013.00000002.3541621203.000001EFAF9E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailvA2
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3542641508.000001EFAFDD3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmailw
Source: CiscoCollabHost.exe, 00000013.00000002.3541621203.000001EFAF9E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-GmailwL3
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmailz
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF6B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/now4kjcb/Explore-Cisco-Webex-for-G-Suite-Google-Calendar-and-Gmail~
Source: CiscoCollabHost.exe, 00000013.00000002.3540182171.000001EFAF66E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/en-us/nttajz6/Schedule-and-Join-Meetings-with-Cisco-Webex-Scheduler-for-Micro
Source: CiscoCollabHost.exe, 00000013.00000002.3548188494.000001EFB09E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/ld-n0bl93g-CiscoWebexTeams/Webex-Teams-App?omiReferProduct=WebexTeams
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.webex.com/n0qtkri
Source: CiscoCollabHost.exe, 00000013.00000002.3542700270.000001EFAFE23000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3544235755.000001EFB038E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://idbroker.webex.com
Source: CiscoCollabHost.exe, 00000013.00000002.3544235755.000001EFB038E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://identity.webex.com
Source: CiscoCollabHost.exe, 00000013.00000002.3544628106.000001EFB04C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mercury-connection-a.wbx2.com/v1
Source: CiscoCollabHost.exe, 00000013.00000002.3548188494.000001EFB099A000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3536542014.000000DFB04FD000.00000004.00000010.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3548188494.000001EFB097E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://metrics-a.wbx2.com
Source: CiscoCollabHost.exe, 00000013.00000002.3548188494.000001EFB097E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://metrics-a.wbx2.com/
Source: CiscoCollabHost.exe, 00000013.00000002.3544628106.000001EFB04C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://metrics-a.wbx2.com/metrics/api/v1
Source: CiscoCollabHost.exe, 00000013.00000002.3548188494.000001EFB099A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://metrics-a.wbx2.com/metrics/api/v1/clientmetrics-prelogin
Source: CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB08C3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://metrics-a.wbx2.com/metrics/api/v1/clientmetrics-preloginrigin.clientIn
Source: CiscoCollabHost.exe, 00000013.00000002.3548188494.000001EFB099A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://metrics-a.wbx2.comi
Source: CiscoCollabHost.exe, 00000013.00000002.3542700270.000001EFAFE23000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://reachable.webex.comU
Source: CiscoCollabHost.exe, 00000013.00000002.3540066323.000001EFAF5F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sdk.bitmoji.com
Source: CiscoCollabHost.exe, 00000013.00000002.3543096123.000001EFAFFC3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sdk.bitmoji.com/me/sticker/
Source: CiscoCollabHost.exe, 00000013.00000002.3540066323.000001EFAF5F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sdk.bitmoji.com5
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://snap.com/en-GB/privacy/privacy-policy
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://snap.com/en-GB/terms
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://snap.com/en-US/privacy/privacy-policy
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://snap.com/en-US/terms
Source: CiscoCollabHost.exe, 00000013.00000002.3543096123.000001EFAFFC3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://status.webex.com/incidents
Source: CiscoCollabHost.exe, 00000013.00000002.3543096123.000001EFAFFC3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://status.webex.com/index.json
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB0860000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.ciscospark.com/customer/en/portal/articles/1911657-firewall-and-network-requirements
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://test.webex.com/meet/pmrlink
Source: CiscoCollabHost.exe, 00000013.00000002.3544482263.000001EFB042C000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3543171994.000001EFB0019000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://u2c-intb.ciscospark.com/u2c/api/v1
Source: CiscoCollabHost.exe, 00000013.00000002.3542641508.000001EFAFDD3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://u2c.gov.ciscospark.com/u2c/api/v1
Source: CiscoCollabHost.exe, 00000013.00000002.3544482263.000001EFB042C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://u2c.gov.ciscospark.com/u2c/api/v1/
Source: CiscoCollabHost.exe, 00000013.00000002.3544482263.000001EFB042C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://u2c.gov.ciscospark.com/u2c/api/v1/ndard
Source: CiscoCollabHost.exe, 00000013.00000002.3542700270.000001EFAFE23000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3544235755.000001EFB038E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://u2c.wbx2.com/u2c/api/v1
Source: CiscoCollabHost.exe, 00000013.00000002.3548188494.000001EFB09E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.webex.com
Source: CiscoCollabHost.exe, 00000013.00000002.3544315068.000001EFB03D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.webex.com/deviceAuth?
Source: CiscoCollabHost.exe, 00000013.00000002.3542243530.000001EFAFC25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.webex.com/logout?mobile=webex
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://webex.meeting.com/meet/longname
Source: CiscoCollabHost.exe, 00000013.00000002.3560651202.00007FFDE8109000.00000002.00000001.01000000.00000040.sdmp String found in binary or memory: https://webrtc.googlesource.com/src/
Source: CiscoCollabHost.exe, 00000013.00000002.3540066323.000001EFAF5F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.bitmoji.com/avatar
Source: CiscoCollabHost.exe, 00000013.00000002.3540066323.000001EFAF5F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.bitmoji.com/avatarR
Source: CiscoCollabHost.exe, 00000013.00000002.3540066323.000001EFAF5F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.bitmoji.com/connect
Source: CiscoCollabHost.exe, 00000013.00000002.3540066323.000001EFAF5F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.bitmoji.com/connectW
Source: CiscoCollabHost.exe, 00000013.00000002.3540066323.000001EFAF5F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.bitmoji.com/login
Source: CiscoCollabHost.exe, 00000013.00000002.3540066323.000001EFAF5F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.bitmoji.com/sign-up
Source: CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB0860000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cisco.com/c/dam/en_us/about/doing_business/legal/docs/universal-cloud-agreement.pdf
Source: CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB0860000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cisco.com/c/dam/en_us/about/doing_business/legal/eula/cisco_end_user_license_agreement-e
Source: CiscoCollabHost.exe, 00000013.00000002.3545415184.000001EFB0860000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cisco.com/c/en/us/about/legal/privacy-full.html
Source: CiscoCollabHost.exe, 00000013.00000002.3550823039.000001EFB3826000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cisco.com/c/en/us/about/legal/privacy-full.htmlreLo
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ciscospark.com/notices-and-disclaimers.html
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ciscospark.com/plans.html
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gnu.org/licenses/gpl-2.0.html
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gnu.org/licenses/gpl-3.0.html.
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gnu.org/licenses/lgpl-3.0.html.
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gnu.org/licenses/lgpl.html.
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.qt.io/contact-us.
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.qt.io/licensing/
Source: webex.exe, 00000000.00000003.2948404053.000000000929B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.qt.io/terms-conditions.
Source: CiscoCollabHost.exe, 00000013.00000002.3540066323.000001EFAF5F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.snapchat.com/bitmoji
Source: webex.exe, 00000000.00000003.1713521252.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713706381.0000000003354000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713249908.0000000006C71000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713571138.0000000003357000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713631047.000000000335B000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C73000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1713658818.0000000006C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.webex.com
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.webex.com/license.html
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.webex.com/pdf/tollfree_restrictions.pdf
Source: CiscoCollabHost.exe, 00000013.00000003.3419221960.000001EFB4ACB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.webex.com/security.html
Creates a DirectInput object (often for capturing keystrokes)
Source: CiscoCollabHost.exe, 00000013.00000002.3563909544.00007FFDE8C54000.00000002.00000001.01000000.00000037.sdmp Binary or memory string: DirectDrawCreateEx failed! errorcode = memstr_a3b71437-b
Potential key logger detected (key state polling based)
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE65D20E0 GetWindowLongPtrW,GetClientRect,ClientToScreen,GetCursorPos,?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ,?handleNativeEvent@QWindowSystemInterface@@SA_NPEAVQWindow@@AEBVQByteArray@@PEAXPEAJ@Z,??1?$QVector@VQPointF@@@@QEAA@XZ,?cast@QMetaObject@@QEBAPEAVQObject@@PEAV2@@Z,ImmAssociateContext,?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ,?transientParent@QWindow@@QEBAPEAV1@XZ,?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ,?parent@QWindow@@QEBAPEAV1@XZ,?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?warning@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6@YA?AVQDebug@@V0@PEBVQWindow@@@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6@YA?AVQDebug@@V0@PEBVQWindow@@@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6@YA?AVQDebug@@V0@PEBVQWindow@@@Z,??1QDebug@@QEAA@XZ,??1QDebug@@QEAA@XZ,??1QDebug@@QEAA@XZ,??1QDebug@@QEAA@XZ,?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ,?isTopLevel@QWindow@@QEBA_NXZ,?flags@QWindow@@QEBA?AV?$QFlags@W4WindowType@Qt@@@@XZ,DwmGetWindowAttribute,DwmGetWindowAttribute,??0QMessageLogger@@QEAA@PEBDH0@Z,?warning@QMessageLogger@@QEBAXPEBDZZ,?nextNode@QHashData@@SAPEAUNode@1@PEAU21@@Z,?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ,??$handleThemeChange@UDefaultDelivery@QWindowSystemInterface@@@QWindowSystemInterface@@SAXPEAVQWindow@@@Z,?nextNode@QHashData@@SAPEAUNode@1@PEAU21@@Z,?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ,GetCursor,SetCursor,GetWindowDpiAwarenessContext,GetAwarenessFromDpiAwarenessContext,EnableNonClientDpiScaling,GetLastError,?qErrnoWarning@@YAXHPEBDZZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?warning@QMessageLogger@@QEBAXPEBDZZ,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6@YA?AVQDebug@@V0@PEBVQWindow@@@Z,??1QDebug@@QEAA@XZ,??1QDebug@@QEAA@XZ,?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ,ScreenToClient,GetWindowLongPtrW,GetClientRect,GetClientRect,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,?handleContextMenuEvent@QWindowSystemInterface@@SAXPEAVQWindow@@_NAEBVQPoint@@2V?$QFlags@W4KeyboardModifier@Qt@@@@@Z,?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ,?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ,?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ,?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ,?isTopLevel@QWindow@@QEBA_NXZ,?minimumSize@QWindow@@QEBA?AVQSize@@XZ,?maximumSize@QWindow@@QEBA?AVQSize@@XZ,?scaleAndOrigin@QHighDpiScaling@@SA?AUScaleAndOrigin@1@PEBVQWindow@@PEAVQPoint@@@Z,?mapFromGlobal@QWindow@@QEBA?AVQPoint@@AEBV2@@Z,?window@QPlatformWindow@@QEBAPEAVQWindow@@XZ,?flags@QWindow@@QEBA?AV?$QFlags@W4WindowType@Qt@@@@XZ,?parent@QWindow@@QEBAPEAV1@XZ,?cast@QMetaObject@@QEBAPEAVQObject@@PEAV2@@Z,?qt_localeFromLCID@@YA?AVQLocale@@K@Z,??4QUrl@@QEAAAEAV0@$$QEAV0@@Z,??1QLocale@@QEAA@XZ,?emitLocaleChanged@QPlatformInputContext@@QEAAXXZ,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBA?AVQDebug 19_2_00007FFDE65D20E0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE65D41E0 ?mouseButtons@QGuiApplication@@SA?AV?$QFlags@W4MouseButton@Qt@@@@XZ,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetCursorPos,?mimeData@QDrag@@QEBAPEAVQMimeData@@XZ,?contains@QRect@@QEBA_NAEBVQPoint@@_N@Z,??$handleMouseEvent@UDefaultDelivery@QWindowSystemInterface@@@QWindowSystemInterface@@SA_NPEAVQWindow@@AEBVQPointF@@1V?$QFlags@W4MouseButton@Qt@@@@W4MouseButton@Qt@@W4Type@QEvent@@V?$QFlags@W4KeyboardModifier@Qt@@@@W4MouseEventSource@5@@Z, 19_2_00007FFDE65D41E0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE65DE930 GetWindowLongPtrW,GetClientRect,GetWindowLongPtrW,GetClientRect,ClientToScreen,ScreenToClient,GetWindowLongPtrW,GetClientRect,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,?mimeData@QDrag@@QEBAPEAVQMimeData@@XZ,GetCapture,?flags@QWindow@@QEBA?AV?$QFlags@W4WindowType@Qt@@@@XZ,?parent@QWindow@@QEBAPEAV1@XZ,??0QRect@@QEAA@AEBVQPoint@@AEBVQSize@@@Z,?contains@QRect@@QEBA_NAEBVQPoint@@_N@Z,?mimeData@QDrag@@QEBAPEAVQMimeData@@XZ,ScreenToClient,GetWindowLongPtrW,GetClientRect,?handleWheelEvent@QWindowSystemInterface@@SA_NPEAVQWindow@@AEBVQPointF@@1VQPoint@@2V?$QFlags@W4KeyboardModifier@Qt@@@@W4ScrollPhase@Qt@@W4MouseEventSource@7@@Z,GetMessageExtraInfo,?handleFrameStrutMouseEvent@QWindowSystemInterface@@SA_NPEAVQWindow@@AEBVQPointF@@1V?$QFlags@W4MouseButton@Qt@@@@W4MouseButton@Qt@@W4Type@QEvent@@V?$QFlags@W4KeyboardModifier@Qt@@@@W4MouseEventSource@6@@Z,??$handleMouseEvent@UDefaultDelivery@QWindowSystemInterface@@@QWindowSystemInterface@@SA_NPEAVQWindow@@AEBVQPointF@@1V?$QFlags@W4MouseButton@Qt@@@@W4MouseButton@Qt@@W4Type@QEvent@@V?$QFlags@W4KeyboardModifier@Qt@@@@W4MouseEventSource@5@@Z,?handleFrameStrutMouseEvent@QWindowSystemInterface@@SA_NPEAVQWindow@@AEBVQPointF@@1V?$QFlags@W4MouseButton@Qt@@@@W4MouseButton@Qt@@W4Type@QEvent@@V?$QFlags@W4KeyboardModifier@Qt@@@@W4MouseEventSource@6@@Z,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6@YA?AVQDebug@@V0@PEBVQWindow@@@Z,??1QDebug@@QEAA@XZ,??1QDebug@@QEAA@XZ,??$handleLeaveEvent@UDefaultDelivery@QWindowSystemInterface@@@QWindowSystemInterface@@SAXPEAVQWindow@@@Z,??$handleMouseEvent@UDefaultDelivery@QWindowSystemInterface@@@QWindowSystemInterface@@SA_NPEAVQWindow@@AEBVQPointF@@1V?$QFlags@W4MouseButton@Qt@@@@W4MouseButton@Qt@@W4Type@QEvent@@V?$QFlags@W4KeyboardModifier@Qt@@@@W4MouseEventSource@5@@Z,?flushWindowSystemEvents@QWindowSystemInterface@@SA_NV?$QFlags@W4ProcessEventsFlag@QEventLoop@@@@@Z, 19_2_00007FFDE65DE930
Creates files inside the system directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\59c988.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICB5D.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICBCC.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{4A82B9CC-F7B3-5000-9CA4-89764C5A9DA4} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID11C.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\59c98b.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\59c98b.msi Jump to behavior
Deletes files inside the Windows folder
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\MSICB5D.tmp Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334C2FE 0_3_0334C2FE
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334C2FE 0_3_0334C2FE
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CAFE 0_3_0334CAFE
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CAFE 0_3_0334CAFE
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CBFE 0_3_0334CBFE
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CBFE 0_3_0334CBFE
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334C2FE 0_3_0334C2FE
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334C2FE 0_3_0334C2FE
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CAFE 0_3_0334CAFE
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CAFE 0_3_0334CAFE
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CBFE 0_3_0334CBFE
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CBFE 0_3_0334CBFE
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Code function: 18_2_00007FF7EC6B10C0 18_2_00007FF7EC6B10C0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FF6F80110C0 19_2_00007FF6F80110C0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE626C490 19_2_00007FFDE626C490
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE6266880 19_2_00007FFDE6266880
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE626A0A0 19_2_00007FFDE626A0A0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE626E0A0 19_2_00007FFDE626E0A0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE626B4E0 19_2_00007FFDE626B4E0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE626D2E0 19_2_00007FFDE626D2E0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE626BB40 19_2_00007FFDE626BB40
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE6265B60 19_2_00007FFDE6265B60
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE6266960 19_2_00007FFDE6266960
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE6266F60 19_2_00007FFDE6266F60
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE626B7B0 19_2_00007FFDE626B7B0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE626EBA0 19_2_00007FFDE626EBA0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE626E400 19_2_00007FFDE626E400
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE626A7F0 19_2_00007FFDE626A7F0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE626D640 19_2_00007FFDE626D640
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE6267030 19_2_00007FFDE6267030
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE626E820 19_2_00007FFDE626E820
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE65C6660 19_2_00007FFDE65C6660
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE65C8820 19_2_00007FFDE65C8820
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE65D44E0 19_2_00007FFDE65D44E0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE65F0120 19_2_00007FFDE65F0120
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE65D20E0 19_2_00007FFDE65D20E0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE65D4DA0 19_2_00007FFDE65D4DA0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE65DE930 19_2_00007FFDE65DE930
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE65C2A50 19_2_00007FFDE65C2A50
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE65D14C0 19_2_00007FFDE65D14C0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE66294C0 19_2_00007FFDE66294C0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE65CD2B8 19_2_00007FFDE65CD2B8
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE66090A0 19_2_00007FFDE66090A0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE65C50E0 19_2_00007FFDE65C50E0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE6601F30 19_2_00007FFDE6601F30
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE6609FE0 19_2_00007FFDE6609FE0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE6633890 19_2_00007FFDE6633890
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE66099B0 19_2_00007FFDE66099B0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE66666D0 19_2_00007FFDE66666D0
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE660E660 19_2_00007FFDE660E660
PE file contains executable resources (Code or Archives)
Source: libmp3lame.dll.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
PE file contains more sections than normal
Source: libav1rtp.dll.0.dr Static PE information: Number of sections : 13 > 10
Source: libav1enc.dll.0.dr Static PE information: Number of sections : 13 > 10
Source: libdav1d.dll.0.dr Static PE information: Number of sections : 13 > 10
PE file does not import any functions
Source: api-ms-win-core-util-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: webex.exe, 00000000.00000000.1670922438.0000000000C31000.00000008.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilename, vs webex.exe
Uses 32bit PE files
Source: webex.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: webex.exe Static PE information: Section: UPX1 ZLIB complexity 0.9990817866726297
Source: Qt5Core.dll.0.dr Static PE information: Section: .qtmimed ZLIB complexity 0.997458770800317
Source: CiscoCollabHost.exe, 00000013.00000002.3539279947.000001EFAF190000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3542641508.000001EFAFDD3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: .vbproj
Source: CiscoCollabHost.exe, 00000013.00000002.3539279947.000001EFAF190000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3541867501.000001EFAFABD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: .csproj
Source: classification engine Classification label: sus39.evad.winEXE@20/756@0/6
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Mutant created: NULL
Source: C:\Users\user\Desktop\webex.exe Mutant created: \Sessions\1\BaseNamedObjects\WebexInstallerMutex
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7664:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\Temp\WebInstaller Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\msiexec.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: webex.exe String found in binary or memory: nnen Sie die installierte Version nicht ersetzen. Weitere Informationen erhalten Sie bei Ihrem Administrator.", "AppNameText": "{APP_NAME}-Installationsprogramm", "ConvergedDownloadingText": "{APP_NAME} wird heruntergeladen...", "Con
Source: webex.exe String found in binary or memory: .", "ConvergedGenericErrorDetails": "Offenbar ist ein Fehler aufgetreten. Versuchen wir es erneut.", "ConvergedQuitInstallationHeader": "{APP_NAME}-Installation beenden?", "ConvergedQuitInstallationDetails": "{APP_NAME}-App-Installat
Source: webex.exe String found in binary or memory: tzt derzeit keine Befehlszeilenparameter.", "InstallPackageRejected": "Die App-Installation kann nicht autorisiert werden", "InstallPackageRejectedDetails": "Wenden Sie sich an den Systemadministrator, um Webex zu installieren.", "In
Source: CiscoCollabHost.exe String found in binary or memory: <!--StartFragment-->
Source: C:\Users\user\Desktop\webex.exe File read: C:\Users\user\Desktop\webex.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\webex.exe "C:\Users\user\Desktop\webex.exe"
Source: C:\Users\user\Desktop\webex.exe Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe /i "C:\Users\user\AppData\Local\Temp\c64e3759-805b-47c0-b4ab-a6ec7fecd393.msi" /quiet /norestart AUTOSTART_WITH_WINDOWS=false
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 305732C6DAD0EE72C0E34B949704E1E8
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\\taskkill.exe" /F /IM CiscoCollabHost.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 80617056B0CA03034534C28A67086463
Source: C:\Users\user\Desktop\webex.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c timeout /NOBREAK /T 3 > nul & del /f /q "C:\Users\user\Desktop\webex.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /NOBREAK /T 3
Source: C:\Users\user\Desktop\webex.exe Process created: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe "C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe" /protocolUri="webex://meet/?bt=12&bv=121&cr=065f9a40-5723-45ab-9507-cf2766bb45fe&dns=appleinc.webex.com&en=3&flag=17&jointxid=x7Pbq0RE2n&jt=eyJkdDAiOjE3MTY1NDg2NDIsImR0MSI6Nzk4LCJkdDIiOjIxODUsImR0MyI6MzUzNSwiZHQ0IjoyNDEyODMsImR0NSI6MzcxODI4NTUxLCJkdDYiOjE3MTY5MjA3MjEsImZ0IjoxLCJ0IjoyNSwidXAiOjF9&mtid=m547a808dce8d2d3d893e20fa794cb8a1&od=6f783f73-9637-4b83-90b9-434a5fccb49d&rc=4&sip=24877802128@appleinc.webex.com&siteurl=appleinc&tr=7A2D3FEB1EC64A498D4F669177387376_1709540815837&uuid=04485f8191de4a7c891a7dfe933370dc&vp=0"
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Process created: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe "C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe" "C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1" spark-windows-app.dll /Hosted=true "C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe" /protocolUri="webex://meet/?bt=12&bv=121&cr=065f9a40-5723-45ab-9507-cf2766bb45fe&dns=appleinc.webex.com&en=3&flag=17&jointxid=x7Pbq0RE2n&jt=eyJkdDAiOjE3MTY1NDg2NDIsImR0MSI6Nzk4LCJkdDIiOjIxODUsImR0MyI6MzUzNSwiZHQ0IjoyNDEyODMsImR0NSI6MzcxODI4NTUxLCJkdDYiOjE3MTY5MjA3MjEsImZ0IjoxLCJ0IjoyNSwidXAiOjF9&mtid=m547a808dce8d2d3d893e20fa794cb8a1&od=6f783f73-9637-4b83-90b9-434a5fccb49d&rc=4&sip=24877802128@appleinc.webex.com&siteurl=appleinc&tr=7A2D3FEB1EC64A498D4F669177387376_1709540815837&uuid=04485f8191de4a7c891a7dfe933370dc&vp=0"
Source: C:\Users\user\Desktop\webex.exe Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe /i "C:\Users\user\AppData\Local\Temp\c64e3759-805b-47c0-b4ab-a6ec7fecd393.msi" /quiet /norestart AUTOSTART_WITH_WINDOWS=false Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c timeout /NOBREAK /T 3 > nul & del /f /q "C:\Users\user\Desktop\webex.exe" Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Process created: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe "C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe" /protocolUri="webex://meet/?bt=12&bv=121&cr=065f9a40-5723-45ab-9507-cf2766bb45fe&dns=appleinc.webex.com&en=3&flag=17&jointxid=x7Pbq0RE2n&jt=eyJkdDAiOjE3MTY1NDg2NDIsImR0MSI6Nzk4LCJkdDIiOjIxODUsImR0MyI6MzUzNSwiZHQ0IjoyNDEyODMsImR0NSI6MzcxODI4NTUxLCJkdDYiOjE3MTY5MjA3MjEsImZ0IjoxLCJ0IjoyNSwidXAiOjF9&mtid=m547a808dce8d2d3d893e20fa794cb8a1&od=6f783f73-9637-4b83-90b9-434a5fccb49d&rc=4&sip=24877802128@appleinc.webex.com&siteurl=appleinc&tr=7A2D3FEB1EC64A498D4F669177387376_1709540815837&uuid=04485f8191de4a7c891a7dfe933370dc&vp=0" Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 305732C6DAD0EE72C0E34B949704E1E8 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 80617056B0CA03034534C28A67086463 Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\\taskkill.exe" /F /IM CiscoCollabHost.exe /T Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /NOBREAK /T 3 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Process created: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe "C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe" "C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1" spark-windows-app.dll /Hosted=true "C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe" /protocolUri="webex://meet/?bt=12&bv=121&cr=065f9a40-5723-45ab-9507-cf2766bb45fe&dns=appleinc.webex.com&en=3&flag=17&jointxid=x7Pbq0RE2n&jt=eyJkdDAiOjE3MTY1NDg2NDIsImR0MSI6Nzk4LCJkdDIiOjIxODUsImR0MyI6MzUzNSwiZHQ0IjoyNDEyODMsImR0NSI6MzcxODI4NTUxLCJkdDYiOjE3MTY5MjA3MjEsImZ0IjoxLCJ0IjoyNSwidXAiOjF9&mtid=m547a808dce8d2d3d893e20fa794cb8a1&od=6f783f73-9637-4b83-90b9-434a5fccb49d&rc=4&sip=24877802128@appleinc.webex.com&siteurl=appleinc&tr=7A2D3FEB1EC64A498D4F669177387376_1709540815837&uuid=04485f8191de4a7c891a7dfe933370dc&vp=0" Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: spark-windows-desktop-ui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: libcurl.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: libcrypto-1_1-x64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: libssl-1_1-x64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: d3dcompiler_47.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: sparkprtdll.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: hunspell.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: windows-os-integrations.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msdelta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5widgets.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5gui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: spark-windows-desktop-ui-rcc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: kf5syntaxhighlighting.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: eventbus.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: servicessignalemitters.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5quickwidgets.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5quick.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5qml.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5network.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: lambdathreadswitcher.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: uitoolkit.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: meetingcontaineractivitystreamtype.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5svg.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5winextras.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: uielements.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: webview2loader.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: threadids.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5multimediawidgets.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5multimedia.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140_atomic_wait.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: concrt140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: spark-windows-office-integration.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: bwc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: common_md.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: enhanced-callcontrol_md.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: hid.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: mediasession.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: wseclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: wmeclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: sqlite3.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: threadids.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140_atomic_wait.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: concrt140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140_atomic_wait.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: threadids.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5network.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: threadids.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140_atomic_wait.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5quick.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5qml.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5qmlmodels.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5network.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: qt5network.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: uielements.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: csflogger.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: libxml2.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: csflogger.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: libxml2.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: srtp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: util.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: tp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: wmeclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: mediastores.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: util.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: mediastores.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: videoprocess.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: ddraw.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: wbxaudioengine.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: mediastores.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: wrtp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: dbgcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: dciman32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: wqos.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: ciscosrtp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: avrt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msdmo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: wbxaecodec.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: common-vdiframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: vxccommunication.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: netprofm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: msi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: libegl.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: libglesv2.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\webex.exe File opened: C:\Users\user\Desktop\dependencies\accessories\DseaSupportList.cfg Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\msiexec.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A82B9CC-F7B3-5000-9CA4-89764C5A9DA4} Jump to behavior
Source: webex.exe Static PE information: certificate valid
Source: webex.exe Static file information: File size 1485096 > 1048576
Source: webex.exe Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x15d600
Source: webex.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: J:\qt_build\workspace\qt_build\qtbase\lib\libGLESv2.pdb source: CiscoCollabHost.exe, 00000013.00000002.3556069538.00007FFDE64E9000.00000002.00000001.01000000.0000004B.sdmp
Source: Binary string: E:\VSExclude\Jenkins_Workspace\wme-release\wme\mediaengine\maps\x64\Release\wmeclient.pdbyy GCTL source: CiscoCollabHost.exe, 00000013.00000002.3563229356.00007FFDE8847000.00000002.00000001.01000000.0000003C.sdmp
Source: Binary string: J:\qt_build\workspace\qt_build\qtbase\plugins\platforms\qwindows.pdb source: CiscoCollabHost.exe, 00000013.00000002.3556621994.00007FFDE66C7000.00000002.00000001.01000000.00000048.sdmp
Source: Binary string: E:\VSExclude\Jenkins_Workspace\wme-release\wme\mediaengine\maps\x64\Release\wmeclient.pdb source: CiscoCollabHost.exe, 00000013.00000002.3563229356.00007FFDE8847000.00000002.00000001.01000000.0000003C.sdmp
Source: Binary string: E:\VSExclude\Jenkins_Workspace\wme-release\wme\mediaengine\maps\x64\Release\wseclient.pdb source: CiscoCollabHost.exe, 00000013.00000002.3563909544.00007FFDE8C54000.00000002.00000001.01000000.00000037.sdmp
Source: Binary string: E:\VSExclude\Jenkins_Workspace\wme-release\wme\vendor\video_process\bin\windows\x86_64\Release\videoprocess.pdb source: CiscoCollabHost.exe, 00000013.00000002.3562293246.00007FFDE85F7000.00000002.00000001.01000000.0000003E.sdmp
Source: Binary string: J:\TeamsVDI\out\hvdsdk\release\bin\VxcCommunication.dll.pdb source: CiscoCollabHost.exe, 00000013.00000002.3557154248.00007FFDE6863000.00000002.00000001.01000000.00000047.sdmp
Source: Binary string: E:\VSExclude\Jenkins_Workspace\wme-release\wme\mediaengine\maps\x64\Release\wbxaudioengine.pdb source: CiscoCollabHost.exe, 00000013.00000002.3558824995.00007FFDE70C6000.00000002.00000001.01000000.00000043.sdmp
Source: Binary string: E:\VSExclude\Jenkins_Workspace\wme-release\wme\mediaengine\maps\x64\Release\wrtp.pdb source: CiscoCollabHost.exe, 00000013.00000002.3560651202.00007FFDE8109000.00000002.00000001.01000000.00000040.sdmp
Source: Binary string: E:\VSExclude\Jenkins_Workspace\wme-release\wme\mediaengine\maps\x64\Release\wbxaudioengine.pdbi source: CiscoCollabHost.exe, 00000013.00000002.3558824995.00007FFDE70C6000.00000002.00000001.01000000.00000043.sdmp
Source: Binary string: J:\TeamsVDI\out\hvdsdk\release\bin\VxcCommunication.dll.pdb``# source: CiscoCollabHost.exe, 00000013.00000002.3557154248.00007FFDE6863000.00000002.00000001.01000000.00000047.sdmp
Source: Binary string: J:\TeamsVDI\out\hvdsdk\release\bin\VDIFramework.dll.pdb source: CiscoCollabHost.exe, 00000013.00000002.3557908733.00007FFDE6B9E000.00000002.00000001.01000000.00000045.sdmp
Source: Binary string: J:\TeamsVDI\out\hvdsdk\release\bin\VDIFramework.dll.pdbmm$ source: CiscoCollabHost.exe, 00000013.00000002.3557908733.00007FFDE6B9E000.00000002.00000001.01000000.00000045.sdmp
Source: Binary string: J:\qt_build\workspace\qt_build\qtbase\lib\libGLESv2.pdb4 source: CiscoCollabHost.exe, 00000013.00000002.3556069538.00007FFDE64E9000.00000002.00000001.01000000.0000004B.sdmp
Source: Binary string: CiscoCollabHost.pdb source: CiscoCollabHost.exe, 00000012.00000002.3326490032.00007FF7EC6B3000.00000002.00000001.01000000.00000008.sdmp, CiscoCollabHost.exe, 00000012.00000000.3322197488.00007FF7EC6B3000.00000002.00000001.01000000.00000008.sdmp, CiscoCollabHost.exe, 00000013.00000000.3323639313.00007FF6F8013000.00000002.00000001.01000000.0000000A.sdmp, CiscoCollabHost.exe, 00000013.00000002.3555496022.00007FF6F8013000.00000002.00000001.01000000.0000000A.sdmp
Binary contains a suspicious time stamp
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr Static PE information: 0x7D43BEB4 [Tue Aug 5 23:28:52 2036 UTC]
PE file contains sections with non-standard names
Source: qtaudio_windows.dll.0.dr Static PE information: section name: .qtmetad
Source: qgenericbearer.dll.0.dr Static PE information: section name: .qtmetad
Source: cfom.dll.0.dr Static PE information: section name: fipstx
Source: cfom.dll.0.dr Static PE information: section name: fipsro
Source: cfom.dll.0.dr Static PE information: section name: fipsda
Source: cfom.dll.0.dr Static PE information: section name: fipsrd
Source: common_MD.dll.0.dr Static PE information: section name: .didat
Source: common_MD.dll.0.dr Static PE information: section name: .00cfg
Source: qsvgicon.dll.0.dr Static PE information: section name: .qtmetad
Source: qgif.dll.0.dr Static PE information: section name: .qtmetad
Source: qicns.dll.0.dr Static PE information: section name: .qtmetad
Source: qico.dll.0.dr Static PE information: section name: .qtmetad
Source: qjpeg.dll.0.dr Static PE information: section name: .qtmetad
Source: qsvg.dll.0.dr Static PE information: section name: .qtmetad
Source: qtga.dll.0.dr Static PE information: section name: .qtmetad
Source: qwbmp.dll.0.dr Static PE information: section name: .qtmetad
Source: libav1enc.dll.0.dr Static PE information: section name: .buildid
Source: libav1enc.dll.0.dr Static PE information: section name: .xdata
Source: libav1rtp.dll.0.dr Static PE information: section name: .buildid
Source: libav1rtp.dll.0.dr Static PE information: section name: .xdata
Source: libcrypto-1_1-x64.dll.0.dr Static PE information: section name: .00cfg
Source: libcurl.dll.0.dr Static PE information: section name: .00cfg
Source: libdav1d.dll.0.dr Static PE information: section name: .buildid
Source: libdav1d.dll.0.dr Static PE information: section name: .xdata
Source: libmp3lame.dll.0.dr Static PE information: section name: .00cfg
Source: libssl-1_1-x64.dll.0.dr Static PE information: section name: .00cfg
Source: dsengine.dll.0.dr Static PE information: section name: .qtmetad
Source: qtmedia_audioengine.dll.0.dr Static PE information: section name: .qtmetad
Source: wmfengine.dll.0.dr Static PE information: section name: .qtmetad
Source: ngraph.dll.0.dr Static PE information: section name: _RDATA
Source: openh264.dll.0.dr Static PE information: section name: .rodata
Source: openh264.dll.0.dr Static PE information: section name: _RDATA
Source: qwindows.dll.0.dr Static PE information: section name: .qtmetad
Source: qtmultimedia_m3u.dll.0.dr Static PE information: section name: .qtmetad
Source: qtlabscalendarplugin.dll.0.dr Static PE information: section name: .qtmetad
Source: qmlfolderlistmodelplugin.dll.0.dr Static PE information: section name: .qtmetad
Source: labsmodelsplugin.dll.0.dr Static PE information: section name: .qtmetad
Source: qmlsettingsplugin.dll.0.dr Static PE information: section name: .qtmetad
Source: Qt5Core.dll.0.dr Static PE information: section name: .qtmimed
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0337D9E4 push esp; iretd 0_3_0337D9EA
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0337D94F push edi; iretd 0_3_0337D953
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_03351936 push FFFFFF9Ah; ret 0_3_0335193D
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_03351936 push FFFFFF9Ah; ret 0_3_0335193D
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334C366 push 680334C3h; ret 0_3_0334C36D
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334C366 push 680334C3h; ret 0_3_0334C36D
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CB66 push 680334CBh; retf 0_3_0334CB6D
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CB66 push 680334CBh; retf 0_3_0334CB6D
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CF66 push 680334CFh; iretd 0_3_0334CF6D
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CF66 push 680334CFh; iretd 0_3_0334CF6D
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334C362 pushad ; ret 0_3_0334C365
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334C362 pushad ; ret 0_3_0334C365
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CB62 pushad ; retf 0_3_0334CB65
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CB62 pushad ; retf 0_3_0334CB65
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CF62 pushad ; iretd 0_3_0334CF65
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CF62 pushad ; iretd 0_3_0334CF65
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334C352 push eax; ret 0_3_0334C355
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334C352 push eax; ret 0_3_0334C355
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CB52 push eax; retf 0_3_0334CB55
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CB52 push eax; retf 0_3_0334CB55
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CF52 push eax; iretd 0_3_0334CF55
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CF52 push eax; iretd 0_3_0334CF55
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334EB53 push eax; ret 0_3_0334EB71
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334EB53 push eax; ret 0_3_0334EB71
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334C35E pushad ; ret 0_3_0334C361
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334C35E pushad ; ret 0_3_0334C361
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CB5E pushad ; retf 0_3_0334CB61
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CB5E pushad ; retf 0_3_0334CB61
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CF5E pushad ; iretd 0_3_0334CF61
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334CF5E pushad ; iretd 0_3_0334CF61
Source: C:\Users\user\Desktop\webex.exe Code function: 0_3_0334C34E push eax; ret 0_3_0334C351
Source: cfom.dll.0.dr Static PE information: section name: fipstx entropy: 7.59093805812135
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Drops PE files
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml\StateMachine\qtqmlstatemachine.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\inference_engine_ir_reader.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\mediaservice\wmfengine.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\accessories\JabraPluginController.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\bin\vcruntime140_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\libdav1d.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\msvcp140_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\mediastores.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoSparkLauncher.dll (copy) Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\CiscoSparkLauncher.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Common-HvdAgent.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Dialogs\Private\dialogsprivateplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5QmlWorkerScript.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\EventBus.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\bin\msvcp140_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\imageformats\qtga.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\playlistformats\qtmultimedia_m3u.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\msvcp140.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5MultimediaWidgets.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects\private\qtgraphicaleffectsprivate.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls.2\Material\qtquickcontrols2materialstyleplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\libssl-1_1-x64.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Dialogs\dialogplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5OpenGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\inference_engine_legacy.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\CitrixServer.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\concrt140.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\HttpDownloader.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\ServicesFramework.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\calendar\qtlabscalendarplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\CiscoLocalRecordConverter.exe Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\hunspell.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\imageformats\qicns.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5Gui.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\ciscosrtp.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtMultimedia\declarative_multimedia.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\RDPServer.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\imageformats\qsvg.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\settings\qmlsettingsplugin.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe File created: C:\Users\user\AppData\Local\Temp\WebView2Runtime\MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\mediaservice\qtmedia_audioengine.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Shapes\qmlshapesplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Templates.2\qtquicktemplates2plugin.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICB5D.tmp Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\bwc.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\clDNNPlugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5RemoteObjects.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\KF5SyntaxHighlighting.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml\WorkerScript.2\workerscriptplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5QuickShapes.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\libxml2.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\DCVServer.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5Network.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\MKLDNNPlugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\JCFCoreUtils.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5QuickControls2.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Layouts\qquicklayoutsplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\libcrypto-1_1-x64.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\ServicesSignalEmitters.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\csfstorage.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Common-VDIFramework.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\imageformats\qico.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\mediaconverter.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\scenegraph\qsgd3d12backend.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls\qtquickcontrolsplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\accessories\DSEAPluginController.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\msvcp140_atomic_wait.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5MultimediaQuick.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick.2\qtquick2plugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\libcurl.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml\Models.2\modelsplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5QmlModels.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\ConfigService.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Window.2\windowplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\dnsutils.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\bin\concrt140.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5QuickTemplates2.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls.2\Imagine\qtquickcontrols2imaginestyleplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\bin\msvcp140_2.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\inference_engine_transformations.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5Core.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\mediasession.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls.2\Universal\qtquickcontrols2universalstyleplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\imageformats\qwbmp.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\msvcp140_2.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\spark-windows-accessories.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICBCC.tmp Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls\Styles\Flat\qtquickextrasflatplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\audio\qtaudio_windows.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\bin\msvcp140_atomic_wait.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5Qml.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\libav1enc.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5WinExtras.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\common_MD.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\HVDAgent.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\ngraph.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects\qtgraphicaleffectsplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\csfdiagnostics.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\appshare.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\spark-windows-desktop-ui-rcc.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\csflogger.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5Widgets.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\accessories\PolyPluginController.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\bin\msvcp140.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\LambdaThreadSwitcher.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\folderlistmodel\qmlfolderlistmodelplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\ProcessCleaner.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\bin\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\accessories\CiscoPluginControl.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5QuickWidgets.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\spark-windows-media.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\accessories\Cisco3rdPartyPlugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\openh264.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-fibers-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\msvcp140_codecvt_ids.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-console-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5Multimedia.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5Svg.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\MeetingContainerActivityStreamType.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\spark-windows-desktop-ui.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\inference_engine_lp_transformations.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\enhanced-callcontrol_MD.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls.2\qtquickcontrols2plugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\iconengines\qsvgicon.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Extras\qtquickextrasplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\csfnetutils.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\imageformats\qgif.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\mediaservice\dsengine.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\bearer\qgenericbearer.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\PrivateWidgets\widgetsplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\bin\msvcp140_codecvt_ids.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\libmp3lame.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml\qmlplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\CiscoWebExStart.exe Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\inference_engine.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\qmlmodels\labsmodelsplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\cfom.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\libav1rtp.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\spark-windows-app-impl.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\LadonSDK.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls.2\Fusion\qtquickcontrols2fusionstyleplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml\RemoteObjects\qtqmlremoteobjects.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\spark-windows-bwc.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\MJPGDecoder.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe File created: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5Quick.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICB5D.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSICBCC.tmp Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Webex Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Webex\Webex.lnk Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Self deletion via cmd or bat file
Source: C:\Users\user\Desktop\webex.exe Process created: cmd.exe /c timeout /NOBREAK /T 3 > nul & del /f /q "C:\Users\user\Desktop\webex.exe"
Source: C:\Users\user\Desktop\webex.exe Process created: cmd.exe /c timeout /NOBREAK /T 3 > nul & del /f /q "C:\Users\user\Desktop\webex.exe" Jump to behavior
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE65D2CC1 IsIconic, 19_2_00007FFDE65D2CC1
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE6608BF0 ?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,?fromLatin1@QString@@SA?AV1@PEBDH@Z,?utf16@QString@@QEBAPEBGXZ,LoadLibraryW,??1?$QVector@VQPointF@@@@QEAA@XZ,GetLastError,?qErrnoWarning@@YAXHPEBDZZ,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 19_2_00007FFDE6608BF0
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\webex.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Stores large binary data to the registry
Source: C:\Windows\System32\msiexec.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54 Blob Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\webex.exe File opened / queried: C:\Users\user\Desktop\dependencies\VMWareServer.dll Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\webex.exe Window / User API: threadDelayed 855 Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Window / User API: threadDelayed 1417 Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Window / User API: threadDelayed 2557 Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Window / User API: threadDelayed 744 Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Window / User API: threadDelayed 952 Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Window / User API: threadDelayed 471 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml\StateMachine\qtqmlstatemachine.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\mediaservice\wmfengine.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\inference_engine_ir_reader.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\accessories\JabraPluginController.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\libdav1d.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoSparkLauncher.dll (copy) Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\CiscoSparkLauncher.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Common-HvdAgent.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Dialogs\Private\dialogsprivateplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5QmlWorkerScript.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\imageformats\qtga.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\playlistformats\qtmultimedia_m3u.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls.2\Material\qtquickcontrols2materialstyleplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects\private\qtgraphicaleffectsprivate.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Dialogs\dialogplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5OpenGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\inference_engine_legacy.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\CitrixServer.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\ServicesFramework.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\HttpDownloader.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\calendar\qtlabscalendarplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\CiscoLocalRecordConverter.exe Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\imageformats\qicns.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\RDPServer.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtMultimedia\declarative_multimedia.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\imageformats\qsvg.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\settings\qmlsettingsplugin.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\WebView2Runtime\MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Shapes\qmlshapesplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\mediaservice\qtmedia_audioengine.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Templates.2\qtquicktemplates2plugin.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSICB5D.tmp Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\clDNNPlugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5RemoteObjects.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml\WorkerScript.2\workerscriptplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5QuickShapes.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\DCVServer.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\MKLDNNPlugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5QuickControls2.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\JCFCoreUtils.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Layouts\qquicklayoutsplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\csfstorage.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\imageformats\qico.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\scenegraph\qsgd3d12backend.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\mediaconverter.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls\qtquickcontrolsplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\accessories\DSEAPluginController.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick.2\qtquick2plugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5MultimediaQuick.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml\Models.2\modelsplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\ConfigService.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Window.2\windowplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\dnsutils.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\bin\msvcp140_2.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt5QuickTemplates2.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls.2\Imagine\qtquickcontrols2imaginestyleplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\inference_engine_transformations.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls.2\Universal\qtquickcontrols2universalstyleplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\imageformats\qwbmp.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\msvcp140_2.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSICBCC.tmp Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\spark-windows-accessories.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls\Styles\Flat\qtquickextrasflatplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\audio\qtaudio_windows.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\libav1enc.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\HVDAgent.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects\qtgraphicaleffectsplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\ngraph.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\csfdiagnostics.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\appshare.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\accessories\PolyPluginController.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\folderlistmodel\qmlfolderlistmodelplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\ProcessCleaner.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\accessories\CiscoPluginControl.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\spark-windows-media.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\accessories\Cisco3rdPartyPlugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\openh264.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-fibers-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-console-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\msvcp140_codecvt_ids.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\inference_engine_lp_transformations.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls.2\qtquickcontrols2plugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\iconengines\qsvgicon.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Extras\qtquickextrasplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\mediaservice\dsengine.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\imageformats\qgif.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\bearer\qgenericbearer.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\PrivateWidgets\widgetsplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\bin\msvcp140_codecvt_ids.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\libmp3lame.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml\qmlplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\CiscoWebExStart.exe Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\inference_engine.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\qmlmodels\labsmodelsplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\cfom.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\spark-windows-app-impl.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\LadonSDK.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls.2\Fusion\qtquickcontrols2fusionstyleplugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml\RemoteObjects\qtqmlremoteobjects.dll Jump to dropped file
Source: C:\Users\user\Desktop\webex.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\MJPGDecoder.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\webex.exe TID: 7284 Thread sleep time: -30000s >= -30000s Jump to behavior
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE65D02E0 GetKeyboardLayoutList followed by cmp: cmp ecx, 31h and CTI: je 00007FFDE65D064Dh 19_2_00007FFDE65D02E0
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: CiscoCollabHost.exe, 00000013.00000002.3542641508.000001EFAFDD3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware Virtual Platform
Source: webex.exe, 00000000.00000003.2871943685.0000000006D26000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2220147328.0000000006D26000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2217530290.0000000006D26000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2030837751.0000000006D26000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2217819546.0000000006D26000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2162928824.0000000006D26000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2167379117.0000000006D16000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2764198146.0000000006D26000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815876681.0000000006D26000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2165355487.0000000006D16000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2813726842.0000000006D26000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: qemUb
Source: CiscoCollabHost.exe, 00000013.00000002.3563909544.00007FFDE8C54000.00000002.00000001.01000000.00000037.sdmp Binary or memory string: VMware
Source: CiscoCollabHost.exe, 00000013.00000002.3557908733.00007FFDE6B9E000.00000002.00000001.01000000.00000045.sdmp Binary or memory string: invalid string positionCITRIXVMWARERDPTCPSocketDCVNONEteamshvdagent.exemeetingshvdagent.execiscohvdagent.exeLocal\018AD6CC-18A5-4EBE-A3B7-ACE1C7414F52_hvd_agent_identifier_Local\018AD6CC-18A5-4EBE-A3B7-ACE1C7414F52_hvd_agent_start_event_Local\018AD6CC-18A5-4EBE-A3B7-ACE1C7414F52_hvd_agent_shutdown_HvdAgentProcessManagerstart hvdagent process.VDIFramework::HvdAgentProcessManager::startHvdAgentProcesssrc\VDIFramework\src\HVD\HvdAgentProcessManager.cppHVDAgent.dll|hvdagent process started.stop hvdagent process.VDIFramework::HvdAgentProcessManager::stopHvdAgentProcesshvdagent released the appropriate mutex, meaning it has completed the execution.Error: hvdagent has not released the appriate mutex, so it might be still running.hvdagent process is not running, nothing to be terminated.Hvdagent process has not completely exited, will restart it after 3s.VDIFramework::HvdAgentProcessManager::onHvdAgentExitHvdagent process restart count exceeds max value
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3542615898.000001EFAFDB5000.00000004.00000020.00020000.00000000.sdmp, CiscoCollabHost.exe, 00000013.00000002.3548188494.000001EFB09CE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: CiscoCollabHost.exe, 00000013.00000002.3557908733.00007FFDE6B9E000.00000002.00000001.01000000.00000045.sdmp Binary or memory string: VMWARE
Source: CiscoCollabHost.exe, 00000013.00000002.3563909544.00007FFDE8C54000.00000002.00000001.01000000.00000037.sdmp Binary or memory string: CDirect3D9ExDraw::InitD3D9Ex find a VMware device which driver version is low
Source: CiscoCollabHost.exe, 00000013.00000002.3557908733.00007FFDE6B9E000.00000002.00000001.01000000.00000045.sdmp Binary or memory string: vmwareversion
Source: webex.exe, 00000000.00000003.1994943691.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2164822879.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2815671744.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.2032458997.000000000136F000.00000004.00000020.00020000.00000000.sdmp, webex.exe, 00000000.00000003.1976435661.000000000136F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW@
Source: CiscoCollabHost.exe, 00000013.00000002.3557908733.00007FFDE6B9E000.00000002.00000001.01000000.00000045.sdmp Binary or memory string: VMWare:
Source: CiscoCollabHost.exe, 00000013.00000002.3557908733.00007FFDE6B9E000.00000002.00000001.01000000.00000045.sdmp Binary or memory string: WindowsLinuxMacvc.healthCheck1.0.705.0HealthCheckManager::initHealthCheckManagerBasicVDIFramework::HealthCheckManager::initHealthCheckManagersrc\VDIFramework\src\HVD\VirutalChannelManager\HealthCheckManager.cpponConnectionDeadDetectedVDIFramework::HealthCheckManager::onConnectionLostDetectedonHeartBeatReceived: VDIFramework::HealthCheckManager::onHeartBeatReceivedOnVirtualChannelStateChange: VDIFramework::HealthCheckManager::OnVirtualChannelStateChangeOnSessionStateChange: VDIFramework::HealthCheckManager::OnSessionStateChangeOnVirtualChannelProcessIdReceived: VDIFramework::HealthCheckManager::OnVirtualChannelProcessIdReceivedHVD Agent exited, pid: VDIFramework::HealthCheckManager::onVirtualChannelProcessDiedHealthCheckManager stopped.VDIFramework::HealthCheckManager::OnStreamStateChangeOnThinClientPlatformChange: VDIFramework::HealthCheckManager::OnThinClientPlatformChangeOnChannelBlockedByPolicySetting: VDIFramework::HealthCheckManager::OnChannelBlockedByPolicySettingVDIFramework::HealthCheckManager::OnStreamMessageReceivedreceived unsupported message, but no detail infosVDIFramework::HealthCheckManager::sendMessageToChannel PeerInternal: MyInternal: VMWare: Citrix: HVDAgent: TCPlugin: HVDSDK: TCSDK: ThinClient: HVDClient:VDIFramework::HealthCheckManager::printVersionsCurrent process id:VDIFramework::HealthCheckManager::setHVDClientInfoPeer is legacy version, ignore feature set.VDIFramework::HealthCheckManager::broadcastVirtualChannelStatusPeer is NOT legacy version, merge feature set into virutal channel status.
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\msiexec.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE64DC6B4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 19_2_00007FFDE64DC6B4
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\webex.exe Process created: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe "C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe" /protocolUri="webex://meet/?bt=12&bv=121&cr=065f9a40-5723-45ab-9507-cf2766bb45fe&dns=appleinc.webex.com&en=3&flag=17&jointxid=x7Pbq0RE2n&jt=eyJkdDAiOjE3MTY1NDg2NDIsImR0MSI6Nzk4LCJkdDIiOjIxODUsImR0MyI6MzUzNSwiZHQ0IjoyNDEyODMsImR0NSI6MzcxODI4NTUxLCJkdDYiOjE3MTY5MjA3MjEsImZ0IjoxLCJ0IjoyNSwidXAiOjF9&mtid=m547a808dce8d2d3d893e20fa794cb8a1&od=6f783f73-9637-4b83-90b9-434a5fccb49d&rc=4&sip=24877802128@appleinc.webex.com&siteurl=appleinc&tr=7A2D3FEB1EC64A498D4F669177387376_1709540815837&uuid=04485f8191de4a7c891a7dfe933370dc&vp=0" Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\\taskkill.exe" /F /IM CiscoCollabHost.exe /T Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /NOBREAK /T 3 Jump to behavior
Uses taskkill to terminate processes
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\\taskkill.exe" /F /IM CiscoCollabHost.exe /T Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\Desktop\webex.exe Process created: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe "c:\users\user\appdata\local\programs\cisco spark\ciscocollabhost.exe" /protocoluri="webex://meet/?bt=12&bv=121&cr=065f9a40-5723-45ab-9507-cf2766bb45fe&dns=appleinc.webex.com&en=3&flag=17&jointxid=x7pbq0re2n&jt=eyjkddaioje3mty1ndg2ndisimr0msi6nzk4lcjkddiiojixodusimr0myi6mzuznswizhq0ijoyndeyodmsimr0nsi6mzcxodi4ntuxlcjkddyioje3mty5mja3mjesimz0ijoxlcj0ijoynswidxaiojf9&mtid=m547a808dce8d2d3d893e20fa794cb8a1&od=6f783f73-9637-4b83-90b9-434a5fccb49d&rc=4&sip=24877802128@appleinc.webex.com&siteurl=appleinc&tr=7a2d3feb1ec64a498d4f669177387376_1709540815837&uuid=04485f8191de4a7c891a7dfe933370dc&vp=0"
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Process created: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe "c:\users\user\appdata\local\ciscosparklauncher\ciscocollabhost.exe" "c:\users\user\appdata\local\ciscosparklauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1" spark-windows-app.dll /hosted=true "c:\users\user\appdata\local\programs\cisco spark\ciscocollabhost.exe" /protocoluri="webex://meet/?bt=12&bv=121&cr=065f9a40-5723-45ab-9507-cf2766bb45fe&dns=appleinc.webex.com&en=3&flag=17&jointxid=x7pbq0re2n&jt=eyjkddaioje3mty1ndg2ndisimr0msi6nzk4lcjkddiiojixodusimr0myi6mzuznswizhq0ijoyndeyodmsimr0nsi6mzcxodi4ntuxlcjkddyioje3mty5mja3mjesimz0ijoxlcj0ijoynswidxaiojf9&mtid=m547a808dce8d2d3d893e20fa794cb8a1&od=6f783f73-9637-4b83-90b9-434a5fccb49d&rc=4&sip=24877802128@appleinc.webex.com&siteurl=appleinc&tr=7a2d3feb1ec64a498d4f669177387376_1709540815837&uuid=04485f8191de4a7c891a7dfe933370dc&vp=0"
Source: C:\Users\user\Desktop\webex.exe Process created: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe "c:\users\user\appdata\local\programs\cisco spark\ciscocollabhost.exe" /protocoluri="webex://meet/?bt=12&bv=121&cr=065f9a40-5723-45ab-9507-cf2766bb45fe&dns=appleinc.webex.com&en=3&flag=17&jointxid=x7pbq0re2n&jt=eyjkddaioje3mty1ndg2ndisimr0msi6nzk4lcjkddiiojixodusimr0myi6mzuznswizhq0ijoyndeyodmsimr0nsi6mzcxodi4ntuxlcjkddyioje3mty5mja3mjesimz0ijoxlcj0ijoynswidxaiojf9&mtid=m547a808dce8d2d3d893e20fa794cb8a1&od=6f783f73-9637-4b83-90b9-434a5fccb49d&rc=4&sip=24877802128@appleinc.webex.com&siteurl=appleinc&tr=7a2d3feb1ec64a498d4f669177387376_1709540815837&uuid=04485f8191de4a7c891a7dfe933370dc&vp=0" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Process created: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe "c:\users\user\appdata\local\ciscosparklauncher\ciscocollabhost.exe" "c:\users\user\appdata\local\ciscosparklauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1" spark-windows-app.dll /hosted=true "c:\users\user\appdata\local\programs\cisco spark\ciscocollabhost.exe" /protocoluri="webex://meet/?bt=12&bv=121&cr=065f9a40-5723-45ab-9507-cf2766bb45fe&dns=appleinc.webex.com&en=3&flag=17&jointxid=x7pbq0re2n&jt=eyjkddaioje3mty1ndg2ndisimr0msi6nzk4lcjkddiiojixodusimr0myi6mzuznswizhq0ijoyndeyodmsimr0nsi6mzcxodi4ntuxlcjkddyioje3mty5mja3mjesimz0ijoxlcj0ijoynswidxaiojf9&mtid=m547a808dce8d2d3d893e20fa794cb8a1&od=6f783f73-9637-4b83-90b9-434a5fccb49d&rc=4&sip=24877802128@appleinc.webex.com&siteurl=appleinc&tr=7a2d3feb1ec64a498d4f669177387376_1709540815837&uuid=04485f8191de4a7c891a7dfe933370dc&vp=0" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls\Styles VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls\Styles VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls.2 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Dialogs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Dialogs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\x86 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\lib VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls\Styles\Flat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\accessories VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\accessories VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\accessories VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\calendar VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\calendar VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\calendar VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\calendar VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\folderlistmodel VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\folderlistmodel VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\qmlmodels VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\qmlmodels VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\settings VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\Qt\labs\settings VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects\private VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects\private VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects\private VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects\private VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects\private VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects\private VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects\private VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects\private VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtGraphicalEffects VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtMultimedia VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtMultimedia VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtMultimedia VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml\Models.2 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml\Models.2 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml\RemoteObjects VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml\StateMachine VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQml VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls\Private VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls\Private VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls\Private VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls\Private VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls\Private VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls\Private VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies\QtQuick\Controls VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\webex.exe Queries volume information: C:\Users\user\AppData\Local\CiscoSparkLauncher\44.5.0.29672_fd820904-d9be-4b15-8bfd-e6f6b0f45db1\dependencies VolumeInformation Jump to behavior
Queries time zone information
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Code function: 18_2_00007FF7EC6B1FE0 GetSystemTime,GetDateFormatEx,GetTimeFormatEx, 18_2_00007FF7EC6B1FE0
Source: C:\Users\user\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe Code function: 18_2_00007FF7EC6B2300 GetUserNameW,SHGetKnownFolderPath,lstrlenW,WriteFile, 18_2_00007FF7EC6B2300
Source: C:\Users\user\Desktop\webex.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Adds / modifies Windows certificates
Source: C:\Windows\System32\msiexec.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54 Blob Jump to behavior
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe Code function: 19_2_00007FFDE660E3F0 ??1?$QVector@VQPointF@@@@QEAA@XZ,AddClipboardFormatListener,?qErrnoWarning@@YAXPEBDZZ,SetClipboardViewer,?isDebugEnabled@QLoggingCategory@@QEBA_NXZ,??0QMessageLogger@@QEAA@PEBDH00@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBX@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@_N@Z,??6QDebug@@QEAAAEAV0@PEBD@Z,??6QDebug@@QEAAAEAV0@PEBX@Z,??1QDebug@@QEAA@XZ, 19_2_00007FFDE660E3F0
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1447090 Sample: webex.exe Startdate: 24/05/2024 Architecture: WINDOWS Score: 39 63 Antivirus / Scanner detection for submitted sample 2->63 8 webex.exe 16 902 2->8         started        13 msiexec.exe 115 65 2->13         started        process3 dnsIp4 53 170.72.245.107 FEDMOG-ASN-01US United States 8->53 55 170.72.245.220 FEDMOG-ASN-01US United States 8->55 57 2 other IPs or domains 8->57 37 C:\Users\...\CiscoSparkLauncher.dll (copy), PE32+ 8->37 dropped 39 C:\Users\user\...\spark-windows-media.dll, PE32+ 8->39 dropped 41 C:\Users\...\spark-windows-desktop-ui.dll, PE32+ 8->41 dropped 49 184 other files (none is malicious) 8->49 dropped 65 Self deletion via cmd or bat file 8->65 15 CiscoCollabHost.exe 7 8->15         started        17 cmd.exe 1 8->17         started        19 msiexec.exe 8->19         started        43 C:\Windows\Installer\MSICBCC.tmp, PE32 13->43 dropped 45 C:\Windows\Installer\MSICB5D.tmp, PE32 13->45 dropped 47 C:\Users\user\AppData\...\CiscoCollabHost.exe, PE32+ 13->47 dropped 21 msiexec.exe 13->21         started        23 msiexec.exe 1 13->23         started        file5 signatures6 process7 process8 25 CiscoCollabHost.exe 56 15->25         started        29 conhost.exe 17->29         started        31 timeout.exe 1 17->31         started        33 taskkill.exe 1 21->33         started        dnsIp9 59 18.66.112.32 MIT-GATEWAYSUS United States 25->59 61 144.196.56.82 CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN United States 25->61 51 MicrosoftEdgeWebVi...r_118.0.2088.69.exe, PE32 25->51 dropped 35 conhost.exe 33->35         started        file10 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
3.161.119.106
 unknown United States
16509 AMAZON-02US false
170.133.160.218
 unknown United States
13445 13445US false
170.72.245.220
 unknown United States
16761 FEDMOG-ASN-01US false
144.196.56.82
 unknown United States
58541 CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN false
18.66.112.32
 unknown United States
3 MIT-GATEWAYSUS false
170.72.245.107
 unknown United States
16761 FEDMOG-ASN-01US false