CmdID

CmdID / Files

CptService.exe

Zoom Sharing Service file version info

Program on Windows 4 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real CptService.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Common Files\Zoom\Support\
Signed byZoom Video Communications
ProductZoom Video Call, Zoom Video Communications, Inc.
DescriptionZoom Sharing Service

4 known copies

5, 4, 2021, 0101 · C:\Program Files (x86)\Common Files\Zoom\Support\CptService.exe · signed by Zoom Video Communications

c6c737081c87d0a748d8a8e34b57d62e2ad5ba9ab7d0f6879acbff705a875400

5, 0, 2020, 0731 · C:\Program Files (x86)\Common Files\Zoom\Support\CptService.exe · signed by Zoom Video Communications

5ee061b14696d95e49650a78800b942d1463e7dfac8a83586ff6db383564a9f4

5, 0, 2020, 0731 · C:\Program Files (x86)\Common Files\Zoom\Support\CptService.exe · signed by Zoom Video Communications

931385fcab18aefaceb6031ce2faf19ed6ba5fa4a7a2b4ba83df86547403e49c

5, 0, 2020, 0731 · C:\program files (x86)\Common Files\Zoom\Support\CptService.exe · signed by Zoom Video Communications

a467f11c77d99647738c91027281054d7adc04290cdb8ce0aa24322328c4567c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names CptService.exe in 2 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.