bumblebee | afcbefa5e2bdd02162d8c3e1461a4fdf8ba2909d20abcb2e59bcd6eae276a7fc

Analysis

max time kernel
973s
max time network
980s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2023 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e10dbd4a903b0fa82db9794df6496afe17c98a166253d425f3535959110909a3.msi
Size

25.9MB
MD5

711482ca4d5dcaf0aec4c7c4b3e1bef1
SHA1

77b9050f2b974bc67996b6435520b557a6ad1303
SHA256

e10dbd4a903b0fa82db9794df6496afe17c98a166253d425f3535959110909a3
SHA512

face1dba9ba688e5ff8e0e4f490a6183c444e814e6222c92a1bb138d88375a7036341081e77f31299c2f57d9283706bb0da58b701403fe590edb676b2f421c88
SSDEEP

786432:sQrpQ/w8q9m0xGPhXvN202sgPk3W2XhykV:sQr2/l0MZ/NBUk3HXUC

Score

10^/10

bumblebee zoo discovery trojan

Malware Config

Extracted

Family

bumblebee

Botnet

zoo

192.198.82.51:443

142.11.194.198:443

89.44.9.204:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 47 IoCs

flow	pid	Process
61	3552	powershell.exe
62	3552	powershell.exe
63	3552	powershell.exe
64	3552	powershell.exe
66	3552	powershell.exe
67	3552	powershell.exe
68	3552	powershell.exe
69	3552	powershell.exe
70	3552	powershell.exe
71	3552	powershell.exe
75	3552	powershell.exe
76	3552	powershell.exe
77	3552	powershell.exe
78	3552	powershell.exe
80	3552	powershell.exe
81	3552	powershell.exe
82	3552	powershell.exe
83	3552	powershell.exe
84	3552	powershell.exe
85	3552	powershell.exe
87	3552	powershell.exe
88	3552	powershell.exe
89	3552	powershell.exe
91	3552	powershell.exe
92	3552	powershell.exe
93	3552	powershell.exe
95	3552	powershell.exe
96	3552	powershell.exe
97	3552	powershell.exe
99	3552	powershell.exe
100	3552	powershell.exe
101	3552	powershell.exe
103	3552	powershell.exe
104	3552	powershell.exe
105	3552	powershell.exe
107	3552	powershell.exe
108	3552	powershell.exe
109	3552	powershell.exe
111	3552	powershell.exe
112	3552	powershell.exe
113	3552	powershell.exe
115	3552	powershell.exe
116	3552	powershell.exe
117	3552	powershell.exe
119	3552	powershell.exe
120	3552	powershell.exe
121	3552	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	Installer.exe

Executes dropped EXE 6 IoCs

pid	Process
4560	ZoomInstaller.exe
3024	Installer.exe
3996	Installer.exe
3868	Zoom.exe
4236	Zoom.exe
2176	Zoom.exe

Loads dropped DLL 64 IoCs

pid	Process
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Checks system information in the registry 2 TTPs 4 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Zoom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Zoom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Zoom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Zoom.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3552	powershell.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e570a50.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DD475EBC-D960-4AF4-BB8A-BE91FA942756}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICC1.tmp	msiexec.exe
File created	C:\Windows\Installer\e570a52.msi	msiexec.exe
File created	C:\Windows\Installer\e570a50.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a8dca56a4fb650f70000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a8dca56a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900a8dca56a000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a8dca56a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a8dca56a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}\AppName = "Zoom.exe"	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\zoommtg	Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\zoommtg\WarnOnOpen = "0"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}	Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}\Policy = "3"	Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Zoom.exe = "11000"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\zoomus	Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\zoomus\WarnOnOpen = "0"	Installer.exe

Modifies registry class 59 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomLauncher\shell	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoommtg\shell\open\command	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoomus\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe\" \"--url=%1\""	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPhoneCall\ = "URL:ZoomPhoneCall Protocol"	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPbx.zoomphonecall\URL Protocol	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomRecording\shell\open	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPbx.zoomphonecall\shell\open	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.zoommtg	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoomus\URL Protocol	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomRecording\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin\\zTscoder.exe\" \"%1\""	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoommtg\URL Protocol	Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoomus\UseOriginalUrlEncoding = "1"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.zoom	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPbx.zoomphonecall	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomLauncher\shell\open\command	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoomus\shell	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPbx.zoomphonecall\shell	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.zoommtg\Content Type = "application/x-zoommtg-launcher"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomLauncher	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPhoneCall\shell\open\command	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPbx.zoomphonecall\shell\open\command	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.zoommtg\ = "ZoomLauncher"	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomRecording\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe\",0"	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPbx.zoomphonecall\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe\",1"	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoommtg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe\",1"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoomus\DefaultIcon	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoomus\shell\open\command	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomRecording\ = "Zoom Recording File"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPhoneCall\DefaultIcon	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomLauncher\shell\open	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoomus	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoommtg\ = "URL:Zoom Launcher"	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoomus\ = "URL:Zoom Launcher"	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.zoom\ = "ZoomRecording"	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\MIME\Database\Content Type\application/x-zoommtg-launcher\Extension = ".zoommtg"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoomus\shell\open	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomLauncher\ = "Zoom Launcher - 3.0.1"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomRecording\shell	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPhoneCall\URL Protocol	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPhoneCall\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe\",1"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPbx.zoomphonecall\DefaultIcon	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPhoneCall\shell	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPhoneCall\shell\open	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomLauncher\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe\" \"--url=%1\""	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoommtg\shell	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoommtg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe\" \"--url=%1\""	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoomus\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe\",1"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPhoneCall	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\MIME\Database\Content Type\application/x-zoommtg-launcher	Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoommtg\UseOriginalUrlEncoding = "1"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomRecording\DefaultIcon	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPbx.zoomphonecall\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe\" --url=\"%l\""	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoommtg\DefaultIcon	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoommtg\shell\open	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomRecording	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPbx.zoomphonecall\ = "URL:ZoomPhoneCall Protocol"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\zoommtg	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomRecording\shell\open\command	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\ZoomPhoneCall\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe\" --url=\"%l\""	Installer.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Installer.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1344	msiexec.exe
1344	msiexec.exe
3552	powershell.exe
3552	powershell.exe
3552	powershell.exe
3024	Installer.exe
3024	Installer.exe
3552	powershell.exe
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3024	Installer.exe
3996	Installer.exe
3996	Installer.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
4236	Zoom.exe
2176	Zoom.exe
2176	Zoom.exe
2176	Zoom.exe
2176	Zoom.exe
2176	Zoom.exe
2176	Zoom.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2400	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2400	msiexec.exe
Token: SeSecurityPrivilege	1344	msiexec.exe
Token: SeCreateTokenPrivilege	2400	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2400	msiexec.exe
Token: SeLockMemoryPrivilege	2400	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2400	msiexec.exe
Token: SeMachineAccountPrivilege	2400	msiexec.exe
Token: SeTcbPrivilege	2400	msiexec.exe
Token: SeSecurityPrivilege	2400	msiexec.exe
Token: SeTakeOwnershipPrivilege	2400	msiexec.exe
Token: SeLoadDriverPrivilege	2400	msiexec.exe
Token: SeSystemProfilePrivilege	2400	msiexec.exe
Token: SeSystemtimePrivilege	2400	msiexec.exe
Token: SeProfSingleProcessPrivilege	2400	msiexec.exe
Token: SeIncBasePriorityPrivilege	2400	msiexec.exe
Token: SeCreatePagefilePrivilege	2400	msiexec.exe
Token: SeCreatePermanentPrivilege	2400	msiexec.exe
Token: SeBackupPrivilege	2400	msiexec.exe
Token: SeRestorePrivilege	2400	msiexec.exe
Token: SeShutdownPrivilege	2400	msiexec.exe
Token: SeDebugPrivilege	2400	msiexec.exe
Token: SeAuditPrivilege	2400	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2400	msiexec.exe
Token: SeChangeNotifyPrivilege	2400	msiexec.exe
Token: SeRemoteShutdownPrivilege	2400	msiexec.exe
Token: SeUndockPrivilege	2400	msiexec.exe
Token: SeSyncAgentPrivilege	2400	msiexec.exe
Token: SeEnableDelegationPrivilege	2400	msiexec.exe
Token: SeManageVolumePrivilege	2400	msiexec.exe
Token: SeImpersonatePrivilege	2400	msiexec.exe
Token: SeCreateGlobalPrivilege	2400	msiexec.exe
Token: SeBackupPrivilege	1416	vssvc.exe
Token: SeRestorePrivilege	1416	vssvc.exe
Token: SeAuditPrivilege	1416	vssvc.exe
Token: SeBackupPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2400	msiexec.exe
2400	msiexec.exe
3024	Installer.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe
3868	Zoom.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3868	Zoom.exe
4236	Zoom.exe
2176	Zoom.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 4476	1344	msiexec.exe	94
PID 1344 wrote to memory of 4476	1344	msiexec.exe	94
PID 1344 wrote to memory of 3552	1344	msiexec.exe	96
PID 1344 wrote to memory of 3552	1344	msiexec.exe	96
PID 1344 wrote to memory of 4560	1344	msiexec.exe	98
PID 1344 wrote to memory of 4560	1344	msiexec.exe	98
PID 1344 wrote to memory of 4560	1344	msiexec.exe	98
PID 3552 wrote to memory of 1388	3552	powershell.exe	99
PID 3552 wrote to memory of 1388	3552	powershell.exe	99
PID 1388 wrote to memory of 4396	1388	csc.exe	100
PID 1388 wrote to memory of 4396	1388	csc.exe	100
PID 4560 wrote to memory of 3024	4560	ZoomInstaller.exe	101
PID 4560 wrote to memory of 3024	4560	ZoomInstaller.exe	101
PID 4560 wrote to memory of 3024	4560	ZoomInstaller.exe	101
PID 3552 wrote to memory of 4916	3552	powershell.exe	103
PID 3552 wrote to memory of 4916	3552	powershell.exe	103
PID 4916 wrote to memory of 3948	4916	csc.exe	104
PID 4916 wrote to memory of 3948	4916	csc.exe	104
PID 3024 wrote to memory of 3996	3024	Installer.exe	106
PID 3024 wrote to memory of 3996	3024	Installer.exe	106
PID 3024 wrote to memory of 3996	3024	Installer.exe	106
PID 3868 wrote to memory of 4236	3868	Zoom.exe	111
PID 3868 wrote to memory of 4236	3868	Zoom.exe	111
PID 3868 wrote to memory of 4236	3868	Zoom.exe	111
PID 3868 wrote to memory of 2176	3868	Zoom.exe	112
PID 3868 wrote to memory of 2176	3868	Zoom.exe	112
PID 3868 wrote to memory of 2176	3868	Zoom.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e10dbd4a903b0fa82db9794df6496afe17c98a166253d425f3535959110909a3.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2400

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\zoom.ps1"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sti5sx2y\sti5sx2y.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1983.tmp" "c:\Users\Admin\AppData\Local\Temp\sti5sx2y\CSCDDA2549F97064B5195722896F53DCDE.TMP"
      4⤵
      PID:4396
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\d5tvlu1v\d5tvlu1v.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES47E6.tmp" "c:\Users\Admin\AppData\Local\Temp\d5tvlu1v\CSC1E75C94723F044F8846B5F34597182D.TMP"
      4⤵
      PID:3948
- C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\ZoomInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\ZoomInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Users\Admin\AppData\Local\Temp\7zS0D1BF827\Installer.exe
    .\Installer.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\7zS0D1BF827\Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS0D1BF827\Installer.exe" /addfwexception --bin_home="C:\Users\Admin\AppData\Roaming\Zoom\bin"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3996
  - - C:\Users\Admin\AppData\Roaming\Zoom\bin\Zoom.exe
      C:\Users\Admin\AppData\Roaming\Zoom\bin\Zoom.exe Zoom.exe --promptupdateaction=installed
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3868
    - - C:\Users\Admin\AppData\Roaming\Zoom\bin\Zoom.exe
        
        "C:\Users\Admin\AppData\Roaming\Zoom\bin\Zoom.exe" --action=preload --runaszvideo=TRUE
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4236
    - - C:\Users\Admin\AppData\Roaming\Zoom\bin\Zoom.exe
        
        Zoom.exe --action=cleanTmpFile --data=data
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2176

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1416

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518 0x4f0
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e570a51.rbs

Filesize
8KB

MD5
f0c8ecdd874695c4bee5287496d33409

SHA1
39ca5676c2d3a1e3cbac584c3e5dada6a9c14676

SHA256
6513b9edd5b111c6a430b7d139758e60aed84a8e720a133a7863f334072aa580

SHA512
94379153d4b48f04094282fc98cf800a26bf1690194babbc1945796a2784975f8f8bedce4b6df1c36779d3577bd1e3b02f337e7fc373b75f72ea21a89f51be74

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D1BF827\Installer.exe

Filesize
847KB

MD5
7a2c7fb9ed57bd47a4df70af99f0c279

SHA1
7f7f63aef0a7acce490d76c12b63ef21e967e61f

SHA256
05678b95d43d32b19b9cda0a54159849b222e27a091e6d5bed9fcaa2756843b9

SHA512
153b46108fe0585571df0dfd5994ce86ef1c2c1bd4b98d28ba7ce7be92b65ca967ae1b3eb52e18b9a9811092662b743d9f7dd011c89fdaa51f4960f847ffacbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D1BF827\Installer.exe

Filesize
847KB

MD5
7a2c7fb9ed57bd47a4df70af99f0c279

SHA1
7f7f63aef0a7acce490d76c12b63ef21e967e61f

SHA256
05678b95d43d32b19b9cda0a54159849b222e27a091e6d5bed9fcaa2756843b9

SHA512
153b46108fe0585571df0dfd5994ce86ef1c2c1bd4b98d28ba7ce7be92b65ca967ae1b3eb52e18b9a9811092662b743d9f7dd011c89fdaa51f4960f847ffacbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D1BF827\Installer.exe

Filesize
847KB

MD5
7a2c7fb9ed57bd47a4df70af99f0c279

SHA1
7f7f63aef0a7acce490d76c12b63ef21e967e61f

SHA256
05678b95d43d32b19b9cda0a54159849b222e27a091e6d5bed9fcaa2756843b9

SHA512
153b46108fe0585571df0dfd5994ce86ef1c2c1bd4b98d28ba7ce7be92b65ca967ae1b3eb52e18b9a9811092662b743d9f7dd011c89fdaa51f4960f847ffacbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D1BF827\Zoom.msi

Filesize
24.4MB

MD5
b261bbd4d589f253952de9d63c16915f

SHA1
c1d1d7c49e21a1b3ffa49ab1954dae31cdd87844

SHA256
90f4e6fefa87d903cd13756ead2c203e41db34a7e04b674491c21c04f18b7b3c

SHA512
03dc8f124281b633f51d6ffcd91e60c375f3a1a426d3906a4517a6559497120e6c640e6eedc134d97f549fd4e3171ebc8dae25db99411c08ba0f9804cb14152c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\ZoomInstaller.exe

Filesize
24.9MB

MD5
e9d8abe8f59cdcef0a654fa05b274a25

SHA1
899fb74ac89f7c731d164d0f0549e64106001264

SHA256
065938051b32ded2f73fcd28b670d15d331e729a6e8627a1222c58a8e9b1e574

SHA512
d1b83e0d05e8a6709c6f5e54df42e9d794e33757b88921b431a3bf05baf95f419f28016d8174963a25ce2f69b4d716b342e40efdbc92e368a515b8b1874d6e8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\ZoomInstaller.exe

Filesize
24.9MB

MD5
e9d8abe8f59cdcef0a654fa05b274a25

SHA1
899fb74ac89f7c731d164d0f0549e64106001264

SHA256
065938051b32ded2f73fcd28b670d15d331e729a6e8627a1222c58a8e9b1e574

SHA512
d1b83e0d05e8a6709c6f5e54df42e9d794e33757b88921b431a3bf05baf95f419f28016d8174963a25ce2f69b4d716b342e40efdbc92e368a515b8b1874d6e8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\zoom.ps1

Filesize
2.2MB

MD5
9c328249027b8adf831b94cdb36109cc

SHA1
6c85f69dda0379536ca4a64372b0872ac00aaf75

SHA256
14e3998e63889e84aa0430b7df3c4e4bad0e64854c4dfdef01ef095109fe72a5

SHA512
b1f378db53bca8df1e14bd2ffad6d7b45d5abdf7ea8fb907b254578ddb01a23f3d2539573a70f14a261f933cf8a03ad0839cbc1cc4684f6a6e4cbc61907d17cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES1983.tmp

Filesize
1KB

MD5
7016ecdf30e17f56eba364e97841efc0

SHA1
6d2ea04d15c5b6818821d34b12b0854f349a504a

SHA256
1a0397be99d3fddab263f14b6cdb80fb1872b75c9e2ad76744759f798bae74d6

SHA512
f5b77e19eb32c4d91b69fe2ecb4d82477b4b0c4d2c8301746b13e7de3b4d9ec9b4087ca24a751d186e3f4d81bc00f0f7a3305d021a85f70349b04050e0ea3372

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES47E6.tmp

Filesize
1KB

MD5
f23453c5265ce8f131f4a71e94c36ee7

SHA1
717f2259f95c2a070a6b7093a54bd7b073cd02e0

SHA256
235ec5b5744992f0615c90f3895bd7096ab2ef0e0089169a2a9c641e8515025a

SHA512
59ccddc57efe824043a719b53be0fbab0d1a34f60d87f0acae00970dc8bffee2cf8221e64ce3ba240e22238a61f63575e6e0c65b63c04c454ebdeae4ec9f00d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\SAU{01~1

Filesize
978KB

MD5
6aff57c1b0175d679e1d016ea06e4fd9

SHA1
8df185f0d1f366ca09a9470e1e5a3d6d1d87a933

SHA256
19338e2ee354d3ae7c1d28fb2b9672ed848ff7a7425ceadbd0932e299fcf8fda

SHA512
7c4a0e8eb842371670410c7432db3f0437b5cbde54de7e7397603778acc6ac419e3b5bf0bf959f0343061dab79a7e89660f25fd2dddbc2d57dfd396b572ff66d

Download Submit
C:\Users\Admin\AppData\Local\Temp\SAU{FE~1

Filesize
66.9MB

MD5
ec9b4a9cacdb458447c0f29a15685931

SHA1
65aabe378c814dcc2e1490d9674d684004c883ec

SHA256
f3c44ca39d08df4ccfdd0d9da950eed3baebea288f552833a3476ccbe876dc4d

SHA512
2d522201363e792a65e9dc7bca3d95663e341ae923f904ca2a3f497682a7c7d9dd66c41db952b476b7368b084ccc75a667cc6c56c1fb51b7fddd14013e742bf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZCOMPT~1.CAB.zmdownload

Filesize
2.8MB

MD5
eb6b53b101fe873bedf27387e89831e7

SHA1
a7237181160513a858e43616ae1db89fcda70453

SHA256
bf88e38ca82c71bea9d17bdbc8f764215f1c310f207d1533dbba3c532c8a5b95

SHA512
443288482bad1f65c7a35a3b5d9e7884147480b81036bfb9d7739666737759c3c01262b7198676bc3fb50afe9c3075202ff11baf67d446916f9057e17364ed00

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5fae4s5d.vys.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\d5tvlu1v\d5tvlu1v.dll

Filesize
3KB

MD5
0415540d760e97b229b9d9233f3de675

SHA1
8b180b5199cc5d07179fafcfcfce0a8a227206f9

SHA256
066ef1664fa808ad35120ea57156c15959d06cfedf42d0bbe921ca56bc9484fd

SHA512
dd8c454677573821e5f2bd589a73c1f322d163db851f1fe407d39914a1383a8e9ff125d2eb36834e5a6439856c3d4f7f51b52fba2344272a1400ad13822a2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\sti5sx2y\sti5sx2y.dll

Filesize
3KB

MD5
6093a7d1426896be847179e7797cc5e9

SHA1
690addb55bd2595fa94442294e5b546b115c6177

SHA256
e3d2e1b8e45f0f1bf9b72cd438337ea6f1fff6392b1cf852e56b9cb7980f8bde

SHA512
01729771dec47bc90dad75b5017df2e50dfdc5784352c98a25fa531ebcf2551d118a760256d71f3f1a345105ef1f9e33fd2778343066a98deabdd935167eca1f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\Cmmlib.dll

Filesize
1.7MB

MD5
8d80fb0804db6384d504f1cceadcbc22

SHA1
7598007c9bcade34fc9346778e04165d6dc1bc4d

SHA256
7e90b8049bd3427bf8e381e739b6ac484ee69602a7cf60bb25a7c756797bfc84

SHA512
8ae698fec007024f5e2cc96ea985a99876dc21b75ba7e6a8369abf859fc40e269f735d4eed2482696b6205cda7ddb0ab4285926311a35fddf9c1cf7fdb236aee

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\Cmmlib.dll

Filesize
1.7MB

MD5
8d80fb0804db6384d504f1cceadcbc22

SHA1
7598007c9bcade34fc9346778e04165d6dc1bc4d

SHA256
7e90b8049bd3427bf8e381e739b6ac484ee69602a7cf60bb25a7c756797bfc84

SHA512
8ae698fec007024f5e2cc96ea985a99876dc21b75ba7e6a8369abf859fc40e269f735d4eed2482696b6205cda7ddb0ab4285926311a35fddf9c1cf7fdb236aee

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\CptShare.dll

Filesize
310KB

MD5
6375c211e1b732864e386810c7c892ac

SHA1
d57718e6a922ec4d9e01445a7b9d0087863c6a5d

SHA256
923fd570b422bb6334b20a8e11219a345d62b8728c1a84354a9f4fd829afdc10

SHA512
8d402b03c12f9fef4852e7a0be7fe7b9640d2926ac23d30c3ce77b7bd0e48136b0936286ae84a1d303c0b767747e3f1df0e804dc415f0fe6bdcad27225cd3ea7

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\DuiLib.dll

Filesize
1.5MB

MD5
ddf8fc919c176458b6cac47da7d7bc76

SHA1
ab308f806c9a75cebff04ad8309276d8944c1e82

SHA256
49a78ecb689cc4c1e1e546f969b798600c9422f6e93d18b13903ae94d93b96a1

SHA512
b1406fd86a20daf1b3d835652a5f8a76db06ac579ae6d7c1b54ca1507664357b154d13ed1c4adb5e8d3de7d7db8f52af0af78e526a913f2c4cade235ffa9e734

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\DuiLib.dll

Filesize
1.5MB

MD5
ddf8fc919c176458b6cac47da7d7bc76

SHA1
ab308f806c9a75cebff04ad8309276d8944c1e82

SHA256
49a78ecb689cc4c1e1e546f969b798600c9422f6e93d18b13903ae94d93b96a1

SHA512
b1406fd86a20daf1b3d835652a5f8a76db06ac579ae6d7c1b54ca1507664357b154d13ed1c4adb5e8d3de7d7db8f52af0af78e526a913f2c4cade235ffa9e734

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\MSAALIB.dll

Filesize
47KB

MD5
993d8184f9c65e864f1a5736f6dd48fc

SHA1
1e725ead1610efbe7f09c588933ef731d10bb4b2

SHA256
39937e56578b64833e34396844ba166279104e1bfa0cd25b685dd444782ed513

SHA512
5f359c7be472baabb04ad29504a3806bcebcbed53a70c5b84f192786d5132cda6a12be6a8db527783e211f79f77e3220ca696671711e6dbcbf93164aaba2b4a3

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\MSVCP140.dll

Filesize
440KB

MD5
e0dd94aada0b034b212de071c33054da

SHA1
6c4f1b3f66d07bbcdcf41eb39b1480bb335efcc8

SHA256
08442853f19ce4ff3acae37d87eab33ef81c4c6da62a3432d43253ba79842b64

SHA512
76c877056f448e5dab820e990cc186ba886b2d331d689a99295aaff31a63aadb941c2693b0be98d53bd06cd8041a270eb82ddedfbde305cd9a85bcbe42fcf5a2

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\UIBase.dll

Filesize
679KB

MD5
5631117483973d1cf1ff896804cd1448

SHA1
c74f3bcad070377eb12a36b0b4ff8fb4a44421b8

SHA256
9dff330d27399492aac4d11098e3f834504ea00785b6f36c8f443d0ee25ab332

SHA512
aebdd5c517567bcb099b8200f682f9cc215aae8ba6a748f795b7f0bd718a20b720f49b4b027a7e5bffe6ef6f87e26107a0e3d8145c7b07df2fc7357ff6ae78b3

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\UIBase.dll

Filesize
679KB

MD5
5631117483973d1cf1ff896804cd1448

SHA1
c74f3bcad070377eb12a36b0b4ff8fb4a44421b8

SHA256
9dff330d27399492aac4d11098e3f834504ea00785b6f36c8f443d0ee25ab332

SHA512
aebdd5c517567bcb099b8200f682f9cc215aae8ba6a748f795b7f0bd718a20b720f49b4b027a7e5bffe6ef6f87e26107a0e3d8145c7b07df2fc7357ff6ae78b3

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\VCRUNTIME140.dll

Filesize
74KB

MD5
87dd91c56be82866bf96ef1666f30a99

SHA1
3b78cb150110166ded8ea51fbde8ea506f72aeaf

SHA256
49b0fd1751342c253cac588dda82ec08e4ef43cebc5a9d80deb7928109b90c4f

SHA512
58c3ec6761624d14c7c897d8d0842dbeab200d445b4339905dac8a3635d174cdfb7b237d338d2829bc6c602c47503120af5be0c7de6abf2e71c81726285e44d6

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\XmppDll.dll

Filesize
1.3MB

MD5
d210cb3aee5d30bb266364a1824e8d76

SHA1
df425116edfd8fdd2ec071f4e67e1d184c68bb6a

SHA256
730b7085540b9aebe53e6ea7b8ede48d08fa31386a1f3ca70f415f81f41e305c

SHA512
a2f3dcde4a791d92a4493490eb448e0aeae7eacf794bb540d6d6038512889a0df25c0622045bc4b6f959dc2445a53a1c62d04e32c99629b325442b86a3ea09cc

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\XmppDll.dll

Filesize
1.3MB

MD5
d210cb3aee5d30bb266364a1824e8d76

SHA1
df425116edfd8fdd2ec071f4e67e1d184c68bb6a

SHA256
730b7085540b9aebe53e6ea7b8ede48d08fa31386a1f3ca70f415f81f41e305c

SHA512
a2f3dcde4a791d92a4493490eb448e0aeae7eacf794bb540d6d6038512889a0df25c0622045bc4b6f959dc2445a53a1c62d04e32c99629b325442b86a3ea09cc

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\ZRCSdk.dll

Filesize
1.5MB

MD5
5e22984d73c0b1e2c2b7c285581f15f5

SHA1
5008b0319498564624e95a81670acfc48b2d76cf

SHA256
1b698d0bcd932a4d1251b9e4b16f8ce0c1fd3a2ea71262eb49f54a39b5d6a1ee

SHA512
ae065ccbc75f8a7b6bc63ea49a756adc633a6cc771874df9326052febfb2592827d1103d342a07bc1c23b62c3d76eef217678c13554a68aae7804a1bd890a1af

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\ZRCSdk.dll

Filesize
1.5MB

MD5
5e22984d73c0b1e2c2b7c285581f15f5

SHA1
5008b0319498564624e95a81670acfc48b2d76cf

SHA256
1b698d0bcd932a4d1251b9e4b16f8ce0c1fd3a2ea71262eb49f54a39b5d6a1ee

SHA512
ae065ccbc75f8a7b6bc63ea49a756adc633a6cc771874df9326052febfb2592827d1103d342a07bc1c23b62c3d76eef217678c13554a68aae7804a1bd890a1af

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\Zoom.exe

Filesize
339KB

MD5
6a6e6c695069e2c4680a517292bc960d

SHA1
69c63c459b7a01ba37947b048ad1e93014063984

SHA256
20d525446b9fe0a1700866b03ec5a21ac41897006725a25f6c55dcf163c39ac5

SHA512
52d2f612a562b23e5c78b6dc3ed74db943a44c463018b09930ae5cee43cd8ddddf151d329751ef2d73cf96dd402d159fb0fd6291d510a69554a19d1e2dbdc928

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\Zoom.exe

Filesize
339KB

MD5
6a6e6c695069e2c4680a517292bc960d

SHA1
69c63c459b7a01ba37947b048ad1e93014063984

SHA256
20d525446b9fe0a1700866b03ec5a21ac41897006725a25f6c55dcf163c39ac5

SHA512
52d2f612a562b23e5c78b6dc3ed74db943a44c463018b09930ae5cee43cd8ddddf151d329751ef2d73cf96dd402d159fb0fd6291d510a69554a19d1e2dbdc928

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\crashrpt_lang.ini

Filesize
7KB

MD5
fcf61aed8f093bfcf571cdd8f8162a05

SHA1
8de8177798aae82d5bcc0870c1ca5365f5d9966d

SHA256
1f5b45a5411f7fc71b9da789d6d1ead8ad30551fbea7bbb40fc7ea576d581abb

SHA512
8a5d252d115f868a4e20fce10f9f9ec5f3948f0ad5680d656e0eba1fd167d36889e54c6e59bcde756945f93685401b825ba9dd7243d907d74b58a1d826609d72

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\libcrypto-1_1.dll

Filesize
2.5MB

MD5
5f2e381b51a58b4741d0b825ea33306a

SHA1
f3d3068c1518b55864b465a99c6204d40db20302

SHA256
d8e9695232604c37de8e2c75813a49d42aa812b044c03c59960ede6525b6cdea

SHA512
1949812cc7bc635a2e40c78e2cc50822db80793e84e4e9dfa0cf6a86ad793943efe7e07ca49500f4dc0ae6b8f01e1f0d6d9a4afc089faeecb61c9ed96f46afba

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\libcrypto-1_1.dll

Filesize
2.5MB

MD5
5f2e381b51a58b4741d0b825ea33306a

SHA1
f3d3068c1518b55864b465a99c6204d40db20302

SHA256
d8e9695232604c37de8e2c75813a49d42aa812b044c03c59960ede6525b6cdea

SHA512
1949812cc7bc635a2e40c78e2cc50822db80793e84e4e9dfa0cf6a86ad793943efe7e07ca49500f4dc0ae6b8f01e1f0d6d9a4afc089faeecb61c9ed96f46afba

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\libssl-1_1.dll

Filesize
548KB

MD5
0abba81425f7f8dc0df197cb1d5b6dfd

SHA1
1bce4704e83c5a6a50251400dc793ebb2ff81b53

SHA256
2de8f97820f3d65d0ba0dd788da360f4db40769889b972871a4c8af7b877fa62

SHA512
dbe32b3150747901a865123831872fbbc1fd82d3b33018d15c10f0149c9e920a593ccf0615fea41d6873233e5eaa45d87b520eedb8d700d04f6c20ebfb8d920d

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\libssl-1_1.dll

Filesize
548KB

MD5
0abba81425f7f8dc0df197cb1d5b6dfd

SHA1
1bce4704e83c5a6a50251400dc793ebb2ff81b53

SHA256
2de8f97820f3d65d0ba0dd788da360f4db40769889b972871a4c8af7b877fa62

SHA512
dbe32b3150747901a865123831872fbbc1fd82d3b33018d15c10f0149c9e920a593ccf0615fea41d6873233e5eaa45d87b520eedb8d700d04f6c20ebfb8d920d

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\msaalib.dll

Filesize
47KB

MD5
993d8184f9c65e864f1a5736f6dd48fc

SHA1
1e725ead1610efbe7f09c588933ef731d10bb4b2

SHA256
39937e56578b64833e34396844ba166279104e1bfa0cd25b685dd444782ed513

SHA512
5f359c7be472baabb04ad29504a3806bcebcbed53a70c5b84f192786d5132cda6a12be6a8db527783e211f79f77e3220ca696671711e6dbcbf93164aaba2b4a3

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\msvcp140.dll

Filesize
440KB

MD5
e0dd94aada0b034b212de071c33054da

SHA1
6c4f1b3f66d07bbcdcf41eb39b1480bb335efcc8

SHA256
08442853f19ce4ff3acae37d87eab33ef81c4c6da62a3432d43253ba79842b64

SHA512
76c877056f448e5dab820e990cc186ba886b2d331d689a99295aaff31a63aadb941c2693b0be98d53bd06cd8041a270eb82ddedfbde305cd9a85bcbe42fcf5a2

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\msvcp140.dll

Filesize
440KB

MD5
e0dd94aada0b034b212de071c33054da

SHA1
6c4f1b3f66d07bbcdcf41eb39b1480bb335efcc8

SHA256
08442853f19ce4ff3acae37d87eab33ef81c4c6da62a3432d43253ba79842b64

SHA512
76c877056f448e5dab820e990cc186ba886b2d331d689a99295aaff31a63aadb941c2693b0be98d53bd06cd8041a270eb82ddedfbde305cd9a85bcbe42fcf5a2

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\reslib.dll

Filesize
45KB

MD5
885563cd08e6e15bd7e65f34a8bbf8e6

SHA1
2f4ec98230346b7111ba7644115c4fefd0ff5ec7

SHA256
677dcca5c52b17b226c893a6ae768eff28811cceac58cec7c62f3f1c79e14202

SHA512
4a53c3d1f306ee27d6c153156ffb416371b896f3bd070b807e2df7aa15163bc0092c4f8cf3c8638db41bc045847a1f2972323a7fe6e55a93d146a982ab9c947f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\reslib.dll

Filesize
45KB

MD5
885563cd08e6e15bd7e65f34a8bbf8e6

SHA1
2f4ec98230346b7111ba7644115c4fefd0ff5ec7

SHA256
677dcca5c52b17b226c893a6ae768eff28811cceac58cec7c62f3f1c79e14202

SHA512
4a53c3d1f306ee27d6c153156ffb416371b896f3bd070b807e2df7aa15163bc0092c4f8cf3c8638db41bc045847a1f2972323a7fe6e55a93d146a982ab9c947f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\tp.dll

Filesize
1.4MB

MD5
657dd73dd294410f30644fcea6b6cff6

SHA1
f9b2bf5480f678e3a70c464795e02b08b65d07e8

SHA256
6964f43f76224e521d0a935d6bbb0c6d973f77bf12ecc64629525de9fb17068a

SHA512
87a6738d669e0c1158d482ac4b404e43a64abddb0ceab5f4dc2d172463b980439a19c5836b7aa1039da2d0db1404e81a123af5f7fc8e44682d8235f9cf00e860

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\tp.dll

Filesize
1.4MB

MD5
657dd73dd294410f30644fcea6b6cff6

SHA1
f9b2bf5480f678e3a70c464795e02b08b65d07e8

SHA256
6964f43f76224e521d0a935d6bbb0c6d973f77bf12ecc64629525de9fb17068a

SHA512
87a6738d669e0c1158d482ac4b404e43a64abddb0ceab5f4dc2d172463b980439a19c5836b7aa1039da2d0db1404e81a123af5f7fc8e44682d8235f9cf00e860

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\ucrtbase.dll

Filesize
1.1MB

MD5
2040cdcd779bbebad36d36035c675d99

SHA1
918bc19f55e656f6d6b1e4713604483eb997ea15

SHA256
2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359

SHA512
83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\util.dll

Filesize
326KB

MD5
7558f305524a15f1fbe1544dff52d5e3

SHA1
cabaf24b62afee8990f750cf59e620e6895594fb

SHA256
fd5f27600dc45a984dfb32346cc5228a198a308306f87cd1447940208fc0b9ca

SHA512
a42f6822e7e7284531e89ca6927d7938e3288f96f66141699843d1a8b64e6cd1ca1f64b9ec4b082e0f1bac7b78a3f567fb835327e2211ff6026400a23f2563d6

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\util.dll

Filesize
326KB

MD5
7558f305524a15f1fbe1544dff52d5e3

SHA1
cabaf24b62afee8990f750cf59e620e6895594fb

SHA256
fd5f27600dc45a984dfb32346cc5228a198a308306f87cd1447940208fc0b9ca

SHA512
a42f6822e7e7284531e89ca6927d7938e3288f96f66141699843d1a8b64e6cd1ca1f64b9ec4b082e0f1bac7b78a3f567fb835327e2211ff6026400a23f2563d6

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\vcruntime140.dll

Filesize
74KB

MD5
87dd91c56be82866bf96ef1666f30a99

SHA1
3b78cb150110166ded8ea51fbde8ea506f72aeaf

SHA256
49b0fd1751342c253cac588dda82ec08e4ef43cebc5a9d80deb7928109b90c4f

SHA512
58c3ec6761624d14c7c897d8d0842dbeab200d445b4339905dac8a3635d174cdfb7b237d338d2829bc6c602c47503120af5be0c7de6abf2e71c81726285e44d6

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\vcruntime140.dll

Filesize
74KB

MD5
87dd91c56be82866bf96ef1666f30a99

SHA1
3b78cb150110166ded8ea51fbde8ea506f72aeaf

SHA256
49b0fd1751342c253cac588dda82ec08e4ef43cebc5a9d80deb7928109b90c4f

SHA512
58c3ec6761624d14c7c897d8d0842dbeab200d445b4339905dac8a3635d174cdfb7b237d338d2829bc6c602c47503120af5be0c7de6abf2e71c81726285e44d6

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\vcruntime140.dll

Filesize
74KB

MD5
87dd91c56be82866bf96ef1666f30a99

SHA1
3b78cb150110166ded8ea51fbde8ea506f72aeaf

SHA256
49b0fd1751342c253cac588dda82ec08e4ef43cebc5a9d80deb7928109b90c4f

SHA512
58c3ec6761624d14c7c897d8d0842dbeab200d445b4339905dac8a3635d174cdfb7b237d338d2829bc6c602c47503120af5be0c7de6abf2e71c81726285e44d6

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\zAppUISdk.dll

Filesize
627KB

MD5
6786dc38ee0d1cb053456871694ecfa4

SHA1
c8015bf3d3ef21ab9348fd82e24492167570e311

SHA256
8f0ba655e62e8495fbca9ff0e86b10c2125c59fe95fc525e54e7e10e3208e69a

SHA512
3d6b814d7821205f556f7b83f4b358bbb38d985a551bd5c7e3f848fe3b9a5fdfb9c940041218976a12d06888f44564fd43b034a87ee012524370713f1c4090f7

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\zChatApp.dll

Filesize
3.7MB

MD5
a24a9f7a1eb11449b053f7d392142eac

SHA1
c7206ba4c11a8e3f06a2e8d1f34c064e2b99bf56

SHA256
f560640635830397e07f5acaeffa610ef43efe8d7f47a9ebe7ba758f7acdc509

SHA512
af800ad478c9e27784be05c982411d2a407ec7504e342f9275a9582a1c2aa33fae085f99845158b6c044500a05fc4c558fdbe9964bd59951285aafc33de75260

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\zChatApp.dll

Filesize
3.7MB

MD5
a24a9f7a1eb11449b053f7d392142eac

SHA1
c7206ba4c11a8e3f06a2e8d1f34c064e2b99bf56

SHA256
f560640635830397e07f5acaeffa610ef43efe8d7f47a9ebe7ba758f7acdc509

SHA512
af800ad478c9e27784be05c982411d2a407ec7504e342f9275a9582a1c2aa33fae085f99845158b6c044500a05fc4c558fdbe9964bd59951285aafc33de75260

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\zCrashReport.dll

Filesize
98KB

MD5
5cb5e4f3384884165ed23f0b864d1c7a

SHA1
e878d880080ca865042ccd5436fcb6afc15fd40a

SHA256
d5148b8070b825963505cf86ab6ea90e0cf03a191694bde3d6f9a9766407d2ca

SHA512
56f176f781d6d02d5359ca9d2ebaf3301800e576b084cc629fbf1acd656e04f27e76f282272335eb01e0f194c34218f7ca757c4c44de807e0bb87827e21c1565

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\zCrashReport.dll

Filesize
98KB

MD5
5cb5e4f3384884165ed23f0b864d1c7a

SHA1
e878d880080ca865042ccd5436fcb6afc15fd40a

SHA256
d5148b8070b825963505cf86ab6ea90e0cf03a191694bde3d6f9a9766407d2ca

SHA512
56f176f781d6d02d5359ca9d2ebaf3301800e576b084cc629fbf1acd656e04f27e76f282272335eb01e0f194c34218f7ca757c4c44de807e0bb87827e21c1565

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\zCrashReport.dll

Filesize
98KB

MD5
5cb5e4f3384884165ed23f0b864d1c7a

SHA1
e878d880080ca865042ccd5436fcb6afc15fd40a

SHA256
d5148b8070b825963505cf86ab6ea90e0cf03a191694bde3d6f9a9766407d2ca

SHA512
56f176f781d6d02d5359ca9d2ebaf3301800e576b084cc629fbf1acd656e04f27e76f282272335eb01e0f194c34218f7ca757c4c44de807e0bb87827e21c1565

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\zCrashReport.exe

Filesize
219KB

MD5
58103abc87e9faf39f2fb5438360ae34

SHA1
c87b6303b6c339658a7ca309058fad98641a151e

SHA256
ef8f4ffbd5c6f67e970bd7cf23a16dfb7d4f48202ef8a44d544f87660ded80cd

SHA512
2645066f61907cd494a2543472481f6baa476535167a4e6468cc7ca51d5b3ae8611d63f7b83d8de4fc04932299fc56a3a913d96a9bb06577ba72ea5e65a2614d

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\zMsgAppCommon.dll

Filesize
4.1MB

MD5
5830736815838a5f2dc1fa672c8873cb

SHA1
f35795d7c89640105e63c79df50969fe5eab9e03

SHA256
b584850989b7e43f953d385e05536478855185ae1cadfa87f9ef4efa0fa89a66

SHA512
67dcf8990414a62b2810d79032eb3a05f3ed41977354a24f7a88db5bab7610bd50f35fa58af239733b1a1d4e722d786bfc3bf11241814ce78be0e4f8149dc8a9

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\zMsgAppCommon.dll

Filesize
4.1MB

MD5
5830736815838a5f2dc1fa672c8873cb

SHA1
f35795d7c89640105e63c79df50969fe5eab9e03

SHA256
b584850989b7e43f953d385e05536478855185ae1cadfa87f9ef4efa0fa89a66

SHA512
67dcf8990414a62b2810d79032eb3a05f3ed41977354a24f7a88db5bab7610bd50f35fa58af239733b1a1d4e722d786bfc3bf11241814ce78be0e4f8149dc8a9

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\zWinRes.dll

Filesize
19.9MB

MD5
64089e99b2f40ac6f12705f03cb21ae2

SHA1
fdd81be2c4df7f540ab246834f87e186b2fb34c6

SHA256
362ccb12b1485e1d93a6e79fa9d262d030cc10d980591aab5e49c87b9abace23

SHA512
1117c2506a17fb708584bb89fd69332c3d6a29d171b63e595e3de790bc71f2fd0ee06f2f770d582bf93387924800307df3ebf357480a8365b85991270b37bc25

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\zWinRes.dll

Filesize
19.9MB

MD5
64089e99b2f40ac6f12705f03cb21ae2

SHA1
fdd81be2c4df7f540ab246834f87e186b2fb34c6

SHA256
362ccb12b1485e1d93a6e79fa9d262d030cc10d980591aab5e49c87b9abace23

SHA512
1117c2506a17fb708584bb89fd69332c3d6a29d171b63e595e3de790bc71f2fd0ee06f2f770d582bf93387924800307df3ebf357480a8365b85991270b37bc25

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\data\Zoom.us.ini

Filesize
391B

MD5
282d4990ba4e96fc4b733001f3041a3b

SHA1
884883caa8d3ddfb6d20c6eaca0d42e26b02feb5

SHA256
3cbfdd43bf1e26ba369ea27a8be3f6c55a3f038f942b41d06d45252520d6f848

SHA512
cfc6e2e6fe3635e005baf2ddf201c7a6d511926edc5e7bcedcbfa81e3101d4cb5916746c3ca215f74c26a65570e08b77627087c51c36b7deb92e43085e897dc1

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\installer.txt

Filesize
15KB

MD5
fdc4290cb448d38848aeb0a2c3729175

SHA1
eb33701d9725d3a3f75c32687e8b8186cc94de19

SHA256
d69b8d22162d065af86109ea1427f51947d9920c44b7b821292f09f894e680fd

SHA512
944525ebd87c8bfec06995ff562d1a5512aee716a792ad88640d9fa70f7cfe6fd54c5aa58e14426dc71efa60fcd5065278f04241546861579d8a31574e602343

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\API-MS-Win-core-xstate-l2-1-0.dll

Filesize
10KB

MD5
b74d06f62cd28683b35052715273f70f

SHA1
28f0ff95c64faa31eafdc4e5e95cd7dbeb54ca22

SHA256
144eb756de343fcb063034e9708cded52fe7f83ac3c94244a8de9baf95fe954a

SHA512
fd20a4342d365396c950b7a1c1b9672b4151fc1097af3abff6af9e0723f8bfb0628ac8cf3cdbae466fcb78ad5520ce5ef7a76d76a86f889dfa98b9a4d2fc032d

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\Droplet.pcm

Filesize
856B

MD5
923d4747324854f50ecf69324741c8ca

SHA1
4c19f847fa8fdf55e27b2847bfe09789adfb9e59

SHA256
3568dba00a55d25b736737a48163c13c1348afc5d4022a29ca0d3724d29ffe9f

SHA512
4ae265a89f693304fbeeb661d46d0cd96304083af75b5c245db63a632f40e08ca280a68f20115c6c38f5202801b29084633ffed4da16304689c4379f77693a0d

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-console-l1-1-0.dll

Filesize
11KB

MD5
b951011ba021c374455e8d1e18af84d2

SHA1
2d2e5e097ba5d92e6977cbb23afcc60b2e1d1c8c

SHA256
1c057286bdf0cb90f7dd1fecf5e8afbcff1e27f2a94612967c0634ae639ca43d

SHA512
bc7007ea97647b53a62561c7eafdc292478e2d1dd9cad9f84a3641eba5a57184274fd992f08a18c7f9afa82d5c37a15b6058f147e88623d5d0f5b962931b3850

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-console-l1-2-0.dll

Filesize
11KB

MD5
c26d7d913fd245afc0f0d658595447dc

SHA1
b5e00a0516b6c8c6f6a51ea40fae1beba3dd49ba

SHA256
73e4264dd66696163fbbf868729841f2e9b86f5a59912e64fb9718a8c889a7aa

SHA512
f7e22751671ef8f5d9768cb96733377cd5f38cdf241503234f69c4c6ac9348416c1a7622d7008fc1323a8673359db9e0bef29a4fec7853c5b5fe0b94e294471a

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-datetime-l1-1-0.dll

Filesize
10KB

MD5
7435c7831c7b3b47e55701e5c6cca67a

SHA1
8e0fcc170f5d66beea796b38cd544a045375204b

SHA256
7ea1c2902a47fcd4a30180a4fe5ba5800fcad76b63da5ca4494e24954cea9bd3

SHA512
453fde0df6bf8867dac38e1dd155300a4fb3ab88a20de3420f14ce2c05d890459b767671b23d21422c49ff1aebb9ea84b47bee0e2b2305a7af1314393de28267

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-debug-l1-1-0.dll

Filesize
10KB

MD5
d05f970cf2bdb0da0a1bf33cbc36b53d

SHA1
505b7e21e237d7f8c454bdfb37b19932ae6980d3

SHA256
273516d86d92975ba14f0f85bdce5b81f75f8ba76e08e33575c67f34d7236775

SHA512
62b843ea200fee7868482de417048458c304a218ccacf44b70e0026bafc5e37aec4e7ad2c93513cfdbaa06e5ced7a826fa4701d27d6fb9eb81f183335fa182d0

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
10KB

MD5
801750157960c928af876c3ec8dd4651

SHA1
1cb405eb7339ef121df51f5eba44e0b0177a76d3

SHA256
be330de7aa8f2f33bcdabf0cec2551399b4ea0f22335a0277ea9c3a7aa405bdd

SHA512
70d84b12ec65f497720dd3ee2c634a67d2f0011c9ea825bdbf20343f3572a99432a843cb178f705d923649694cd38aea9ed97b7162138e56374cd369d158d2b0

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-file-l1-1-0.dll

Filesize
14KB

MD5
7f3c75a78482e1ea21cdd81055b3135f

SHA1
e0fa94d72626531aa971c3f1385f03ded6bde6a0

SHA256
50347ffd660720cb1f41691be2793d00b169c864f7260dba1966a8ce5c9da943

SHA512
925ee75ea5261de55d50e0c72de891833e20975b06cf9a1712385c077fef4548639d629354969cc8d18bc7664b6b3e03ffd11d08965e2fc94b3a11d3de6cf839

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-file-l1-2-0.dll

Filesize
11KB

MD5
cd3cec3d65ae62fdf044f720245f29c0

SHA1
c4643779a0f0f377323503f2db8d2e4d74c738ca

SHA256
676a6da661e0c02e72bea510f5a48cae71fdc4da0b1b089c24bff87651ec0141

SHA512
aca1029497c5a9d26ee09810639278eb17b8fd11b15c9017c8b578fced29cef56f172750c4cc2b0d1ebf8683d29e15de52a6951fb23d78712e31ddcb41776b0f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-file-l2-1-0.dll

Filesize
10KB

MD5
b181124928d8eb7b6caa0c2c759155cb

SHA1
1aadbbd43eff2df7bab51c6f3bda2eb2623b281a

SHA256
24ea638dfa9f40e2f395e26e36d308db2ab25ed1baa5c796ac2c560ad4c89d77

SHA512
2a43bf4d50d47924374cde689be24799c4e1c132c0bc981f5109952d3322e91dd5a9352b53bb55ca79a6ea92e2c387e87c064b9d8c8f519b77fff973d752dc8f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-handle-l1-1-0.dll

Filesize
10KB

MD5
d65ef6902015757c4b5e2b550c233e1d

SHA1
8b3a44beceb81727071337a9c9e7d0f3b1370455

SHA256
9f2c87a8f541fd2e563778208c51f1e1852d4874571b6c5218066c0d58f9539c

SHA512
01dc60cf2d8f902848a4234cb97b12329d813f836786407ee090083a9fa6750df7f6b4db6d3496a873fc352bba4edf109ea6d5811d124075d8f3d21008c96773

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-heap-l1-1-0.dll

Filesize
11KB

MD5
8af9779906d36b71166a1e286c880d0d

SHA1
deb18c79ab7def1f7ce1b22f90d21b3f6c5d8ef3

SHA256
2e9a683aa69db2f8186ce9ac3e6a610fc727390155668b2680a728a6e6c67247

SHA512
c9927edc959272747aad42f9d243119fba2d126ac7e0463b59847e3738fe62fe58c01f666791d66177949e61b6bf36da67d558475382aa71a236794137186e96

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
11KB

MD5
2f68cbb35c4c8e66c7d1a8b6c2079700

SHA1
2acb3bdfb7209323d586866e276e152d540d5ae3

SHA256
96509b560bc604a30af26e08d6181d24dde1d51bf3654a12cd663a4ba1a11eac

SHA512
d5886e85abb2b2b4dd0d632e56d7f056f58374b774769bc83dc84f734827fc87b91d85f609f6faae3e3c10703716b31d775ca7f5819a1f719a355a154a8cc1ec

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
11KB

MD5
57a0a074d52e17ce0fec69b4106bceb4

SHA1
f6fbe3fe91884d3aa19ce93156423da55bdd6ced

SHA256
f378ed4e0a68ca5fefff824912a5ec14992a6a8859e088a50a6df6d632611834

SHA512
8878c3bc77e004924e4595e03d0e717c75e44475e3bef923facd8435fbb26d2f7b3e16acb1e0516e0d0a5df502375ef86aa360d7c9cd79a52256b946896a7df3

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-localization-l1-2-0.dll

Filesize
13KB

MD5
21519f4d5f1fea53532a0b152910ef8b

SHA1
7833ac2c20263c8be42f67151f9234eb8e4a5515

SHA256
5fbd69186f414d1d99ac61c9c15a57390ff21fe995e5c01f1c4e14510b6fb9b1

SHA512
97211fad4aae2f6a6b783107938f0635c302445e74fc34a26aa386864509919c3f084e80579d2502105d9256aab9f57ea16137c43344b1c62f64e5bc1125a417

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-memory-l1-1-0.dll

Filesize
11KB

MD5
ed6d551457d8a41b48bf017b79765e27

SHA1
fa1609389caea2192f37017a23ec66e0c7f21d65

SHA256
7733252eb66a1f3ce0efc5c375fadd6fa20a596324658c72d4e707f67909a433

SHA512
a0fb6d1420c9a74266c368f246af06c173379c78f0ac6eb676aa95f5c41e9b12f52fc32ec79c89d1cf4ea67c0a8d092d0ca3caba651188598a52b1a2ff2f4c69

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
10KB

MD5
d8873df4158c5d449f13fd32442f10f5

SHA1
52c9bf4137e466124eab9aa639671795d05125f1

SHA256
04532aed545a391a9e95d6103a816ec5d26df14af51f51dd0c649ddd57862e5c

SHA512
e52876ca557755f50bdd3f9adf124a6a562798a725480238f747348c9f81539903f8a19eeb00a61e50f5fde6e7acc8e613b4ba94cc0d8facc2a91f98078997d3

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
11KB

MD5
0a34f6f91287218a1d451999957701b3

SHA1
05727b747b29845e025d2efde0e43ee36927439e

SHA256
ed755e302cc2a9f5d3cc38140a90697c6bb24965acc6cdaddb63e95c3d2cb9bd

SHA512
24d69f006cdfb91182e3cf9d917dad90353c5824cb19a00a9c4dc9feff0a279a32750a83774a5fe4f5e863386e23efb96a0b54a82c551f28822c6df410eebed8

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
13KB

MD5
45578c4fafc6d9d5ab6e78a07827c19e

SHA1
2fdf383c24a697a0cc29231dab4d0a77207a29f1

SHA256
6d298ae58e7651d23b75a4f6cc070794e716574fe497105fb4ef727ce9782779

SHA512
63ce2272ecc03e7e8c60395360fc685b4b144fb1cadc709f15e070e4e7b769ab282e7a652254386e83827d7982936f38a152014848e183fdb0ea38dff92e83bd

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
11KB

MD5
b5c8334a10b191031769d5de01df9459

SHA1
83a8fcc777c7e8c42fa4c59ee627baf6cbed1969

SHA256
6c27ac0542281649ec8638602fbc24f246424ba550564fc7b290b683f79e712d

SHA512
59e53c515dfa2cd96182ca6539ed0ea2ebb01f5991beb08166d1fc53576aeaafebbb2c5ee0ccbdab60ae45fc6a048fff0b5e1b8c9c26907791d31fb7e75b1f39

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-profile-l1-1-0.dll

Filesize
10KB

MD5
1672a33674cbaf42b3eec20d52930bd9

SHA1
f6e3da76e7de8a0d5f2e254b080ba973c92ba817

SHA256
a99b485112b305623ec3c8ea0d4c9acfac0c5c66821d4a98cde7b43edb8b78fc

SHA512
7b405243d474706c192e3e3b67ff61412adf41ea3bbbdcd5281aab2e7bed01c0c83a09fe60c0a0274d176a3aeb54dc0406dd044e002b8a447503c6dceb34d237

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
10KB

MD5
83cad14da9e92a8baf84a9afe2c9a5b0

SHA1
14c89f2ade657eb9249b95f9290fb4284908c9c6

SHA256
a45a7143971e7f8bbe4d5667927e3ba0fe5d0c025ef5d776ff8a5826341a99cf

SHA512
a5e93d77555e65bff5d47b2d6e9f7668cc6353a815cb1b11eaa6910594d53a9a2a538b8fe6b89cc2589f0dee321215039c012637809fc513b39fb902c02fdb4d

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-string-l1-1-0.dll

Filesize
10KB

MD5
990cba52bd41c096c79778188dd63a15

SHA1
4a902cf7e4500c736ab4830e762cc1e18bb224ec

SHA256
0c1cbbb4630d38632ed6a5bae9ba7e06fe19433f2a5bd548f3d73f315359d79e

SHA512
1ed847989d02ef2c57edbd4726d818ea4bd811a255873765dd6090b9f8b204dff3610e887979ff8016c9b40bdcd2eab39ed064bb0f5f4447a94d56ab24e5183e

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-synch-l1-1-0.dll

Filesize
12KB

MD5
69e1eddc7cd991f9f5db2fc6fdb6f46e

SHA1
6e8a961767f5ac308d569fd57e84b56b145c6c53

SHA256
cc39ce8fe4a38a80c7b316a7191bd319efd99f9f7cb5b97fe8c3d65d2e788070

SHA512
61935e8eab14babb17dc4362e49f06119efde5de0d3b8d0e330b8b8989ffaeacefd23eada19d4747605f9e9f510ed4f11618b047f6c915554162f19e5a138f3f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-synch-l1-2-0.dll

Filesize
11KB

MD5
eb6f7af7eed6aa9ab03495b62fd3563f

SHA1
5a60eebe67ed90f3171970f8339e1404ca1bb311

SHA256
148adef6a34269e403bb509f9d5260abe52f413a6c268e8bd9869841d5f2bd02

SHA512
a9961212b40efc12fd1ab3cc6551c97c987e73b6e409c9ab8a5e1b24542f9e5884811f06883bd31d2585219c4f60c30de2d188788513c01b6cbfe22d539d7875

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
11KB

MD5
d4359815e2a7f10b4dd3ec3945eed45a

SHA1
4c83bd868c963c3afa29d92f75d185ad612c9b11

SHA256
328dff5738e59b78e2951920efcc69e97548c8081f4714540b4e723443b8feb4

SHA512
09ac1040e0a9edd8562c4b76430c82cc25ca94634a9c632803d8bc8eec6ac34d9ad5fb6509416bcd970accb6dce27730bcfeb1ce29d0920c84cc2daf5102d627

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-timezone-l1-1-0.dll

Filesize
11KB

MD5
86421619dad87870e5f3cc0beb1f7963

SHA1
2f0fe3eb94fa90577846d49c03c4fd08ef9d3fb2

SHA256
64eccd818f6ffc13f57a2ec5ca358b401ffbb1ca13b0c523d479ef5ee9eb44ab

SHA512
dbce9904dd5a403a5a69e528ee1179cc5faab1361715a29b1a0de0cd33ad3ae9c9d5620dafb161fda86cb27909d001be8955940fd051077ffe6f3ff82357ad31

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-core-util-l1-1-0.dll

Filesize
10KB

MD5
e0727785f827d39eb167749227a316ed

SHA1
c063a309aeff016f0a7d728c44fe169ce6da12c5

SHA256
e4e4e55abf599d1a9ef7b95da0d7fd37f23a6cf1d368a77f88390eb2e0c1340d

SHA512
83c2bc0f3049b619bf39a8cd6b5fa1ee1346ada2075e7495f264360a62f6fe7ddaafb382b60dfc18857c981c584c750a0b07c1d5d81410a80c296fa1b276ad0b

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-crt-conio-l1-1-0.dll

Filesize
11KB

MD5
a76584c4923b1be911d9ece4ea439116

SHA1
e025b0afc3b9a8046f83e5df718bac4ad05c9c2c

SHA256
3181c520d7ab831c8ff330afe15ad717a5a1ed85b5d91b50b838be1e5c96d052

SHA512
9e701066b81979318f41ac54ef4e1faf7a5e4cfa7482e61a60717fde10bba0851bf86f446f53a8bb26a1df95405cba0969648435fff3368bf9c2fec9ffc333be

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-crt-convert-l1-1-0.dll

Filesize
14KB

MD5
88f89d0f2bd5748ed1af75889e715e6a

SHA1
8ada489b9ff33530a3fb7161cc07b5b11dfb8909

SHA256
02c78781bf6cc5f22a0ecedc3847bfd20bed4065ac028c386d063dc2318c33cc

SHA512
1f5a00284ca1d6dc6ae2dfce306febfa6d7d71d421583e4ce6890389334c2d98291e98e992b58136f5d1a41590553e3ad42fb362247ae8adf60e33397afbb5df

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-crt-environment-l1-1-0.dll

Filesize
11KB

MD5
0979785e3ef8137cdd47c797adcb96e3

SHA1
4051c6eb37a4c0dba47b58301e63df76bff347dd

SHA256
d5164aecde4523ffa2dcfd0315b49428ac220013132ad48422a8ea4ca2361257

SHA512
e369bc53babd327f5d1b9833c0b8d6c7e121072ad81d4ba1fb3e2679f161fb6a9fa2fca0df0bac532fd439beb0d754583582d1dbfeccf2d38cc4f3bdca39b52d

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
12KB

MD5
a1b6cebd3d7a8b25b9a9cbc18d03a00c

SHA1
5516de099c49e0e6d1224286c3dc9b4d7985e913

SHA256
162ccf78fa5a4a2ee380f72fbd54d17a73c929a76f6e3659f537fa8f42602362

SHA512
a322fb09e6faaff0daabb4f0284e4e90ccacff27161dbfd77d39a9a93dbf30069b9d86bf15a07fc2006a55af2c35cd8ea544895c93e2e1697c51f2dafad5a9d7

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-crt-heap-l1-1-0.dll

Filesize
11KB

MD5
a6a9dfb31be2510f6dbfedd476c6d15a

SHA1
cdb6d8bd1fbd1c71d85437cff55ddeb76139dbe7

SHA256
150d32b77b2d7f49c8d4f44b64a90d7a0f9df0874a80fc925daf298b038a8e4c

SHA512
b4f0e8fa148fac8a94e04bf4b44f2a26221d943cc399e7f48745ed46e8b58c52d9126110cdf868ebb723423fb0e304983d24fe6608d3757a43ad741bddb3b7ec

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-crt-locale-l1-1-0.dll

Filesize
11KB

MD5
50b721a0c945abe3edca6bcee2a70c6c

SHA1
f35b3157818d4a5af3486b5e2e70bb510ac05eff

SHA256
db495c7c4ad2072d09b2d4506b3a50f04487ad8b27d656685ea3fa5d9653a21d

SHA512
ef2f6d28d01a5bad7c494851077d52f22a11514548c287e513f4820c23f90020a0032e2da16cc170ae80897ae45fc82bffc9d18afb2ae1a7b1da6eef56240840

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-crt-math-l1-1-0.dll

Filesize
21KB

MD5
461d5af3277efb5f000b9df826581b80

SHA1
935b00c88c2065f98746e2b4353d4369216f1812

SHA256
f9ce464b89dd8ea1d5e0b852369fe3a8322b4b9860e5ae401c9a3b797aed17bf

SHA512
229bf31a1de1e84cf238a0dfe0c3a13fee86da94d611fbc8fdb65086dee6a8b1a6ba37c44c5826c3d8cfa120d0fba9e690d31c5b4e73f98c8362b98be1ee9600

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
18KB

MD5
cce453c53f6dac9496bfa5415cc92731

SHA1
18fee669be0aa8a1839a75a167980f3f246c93a4

SHA256
50752719a62627e7a8d2c26970fe59af839692d060c009fd0652325362752659

SHA512
2cfe07c602c2e6205a2a2aa0de4ca8e105c9973d14b9d131a6372ba54697d17af7c84c898329425a3d19fd6c1434bcaf162ca0dbc5f0d20cb5973c63aee6b23a

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-crt-private-l1-1-0.dll

Filesize
64KB

MD5
1f72bfe2fb7bb2a403efda6ee963d259

SHA1
bcfb984771542970488bd6132dfa2746267b7fbc

SHA256
601ccd84d252fc6e024b1319902e48cf98bb922bf7799384a85640d5ce6f4a16

SHA512
e47c4c7a939d8e1022b6ce41ca15b1e3e4028f3bb302d1836bbdb3ec8d0c0141dd79ff147e6dc7fe56e09ab65dd15385362ea190d8792173674660a33acd5d61

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-crt-process-l1-1-0.dll

Filesize
11KB

MD5
108433c271995786a8289afd611ea28c

SHA1
ba58c577311e39ff7e92a6be0dd6b80abfee6edc

SHA256
4c058e5b8f83ce395a7004d8c4043735526de01c5764242d4ce4f683dcf1425c

SHA512
800bd7a8702905fd9be83f17087440228f1428237d202160a5618aa6cfe1d1aad3c2608f324db38d235348bd2c8682f55d8ff52d13f9c37fa7c32d64a967db77

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
4f06da894ea013a5e18b8b84a9836d5a

SHA1
40cf36e07b738aa8bba58bc5587643326ff412a9

SHA256
876bd768c8605056579dd8962e2fd7cc96306fab5759d904e8a24e46c25bd732

SHA512
1d7c0682d343416e6942547e6a449be4654158d6a70d78ad3c7e8c2b39c296c9406013a3cfe84d1ae8608f19bee1d4f346d26576d7ed56456eea39d5d7200f79

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
16KB

MD5
5765103e1f5412c43295bd752ccaea03

SHA1
6913bf1624599e55680a0292e22c89cab559db81

SHA256
8f7ace43040fa86e972cc74649d3e643d21e4cad6cb86ba78d4c059ed35d95e4

SHA512
5844ac30bc73b7ffba75016abefb8a339e2f2822fc6e1441f33f70b6eb7114f828167dfc34527b0fb5460768c4de7250c655bc56efd8ba03115cd2dd6f6c91c0

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-crt-string-l1-1-0.dll

Filesize
17KB

MD5
f364190706414020c02cf4d531e0229d

SHA1
5899230b0d7ad96121c3be0df99235ddd8a47dc6

SHA256
a797c0d43a52e7c8205397225ac931638d73b567683f38dd803195da9d34eac2

SHA512
a9c8abbd846ab55942f440e905d1f3864b82257b8daa44c784b1997a060de0c0439ecc25a2193032d4d85191535e9253e435deed23bdf3d3cb48c4209005a02e

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-crt-time-l1-1-0.dll

Filesize
13KB

MD5
d0b6a2caec62f5477e4e36b991563041

SHA1
8396e1e02dace6ae4dde33b3e432a3581bc38f5d

SHA256
fd44d833ea40d50981b3151535618eb57b5513ed824a9963251d07abff2baedf

SHA512
69bd6df96de99e6ab9c12d8a1024d20a034a7db3e2b62e8be7fdbc838c4e9001d2497b04209e07a5365d00366c794c31ee89b133304e475dde5f92fdb7fcb0bc

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\api-ms-win-crt-utility-l1-1-0.dll

Filesize
11KB

MD5
3dfb82541979a23a9deb5fd4dcfb6b22

SHA1
5da1d02b764917b38fdc34f4b41fb9a599105dd9

SHA256
0cd6d0ff0ff5ecf973f545e98b68ac6038db5494a8990c3b77b8a95b664b6feb

SHA512
f9a20b3d44d39d941fa131c3a1db37614a2f9b2af7260981a0f72c69f82a5326901f70a56b5f7ad65862630fce59b02f650a132ee7ecfe2e4fc80f694483ca82

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\archival.pcm

Filesize
5KB

MD5
135dbed64d143ba06e65f149cc9afc78

SHA1
07641e6b5ac44a786ea14dc92e9fb7f105e2190a

SHA256
354807d23bbc4aa1a8ca9e4bf0519d1efd6ca08a417958ccccfa1b611902201f

SHA512
5144bafa72616cf0db1e6416fbd35b410ce988f67e54ccc28893a6b2a12551440cc688da7687b1798d7c8bbe8f2d1692e7912e1d5a56704471c9477e8970d5e0

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\beep_intercom.pcm

Filesize
1KB

MD5
618a307ef3efad70399a6107cb1ce9e3

SHA1
8b42e7fc116a27a3fa868db49b3d0204f42cd913

SHA256
32567197286cbb2dffc282f7cae8d46d13af9d5e83bc98773a836904d244326f

SHA512
3181f538cf34e09de3ced6b702eb55654888b3b533a339eaff97f6f6da9014900f076c76ddd407c0c3736156a896fd23a07952c04c06664103cc74f317b8ea74

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\clap-high.pcm

Filesize
9KB

MD5
c32f95839557340b4b4197a68847ca1d

SHA1
0feed637c4766b9b30ab6732259670f8c12c5538

SHA256
0a16435cb3f7b8b1787476575ad646361e6fb4c07587df874940413de004dd08

SHA512
f5f0dd4a313ff6686bed5090aaa64885d319b8fba51fb2722b764668b26f06ce95164444652661b027e35f3c6928d3919422e4816bbb81bbd0f7914869004700

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\clap-low.pcm

Filesize
8KB

MD5
aa8e7645deea3fac51a6764349278f52

SHA1
9cbda1c4c751a871d46ca5a0a3cec1988657fc5f

SHA256
e527ab2d7d3da5ca63419213adf33ee3127e740afedb95a032026477155e5df8

SHA512
7a9e3de72bf2ca0e35db6b8996da21af3c913976521f3d2b9d48a9cf91138a6d7b98841b18ba2f456f10fcba95fd362e22b81956da44e26dc3a46008a7d9cdad

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\clap-medium.pcm

Filesize
8KB

MD5
aa93ab138ec89cf7cfb8b4b0ea8990a6

SHA1
d13b139d666c76cb12e1c0280c1343770adc8aac

SHA256
d754fc9d9378772b7a17a53e6598c9cfe4a0f3ec492f0ed30241020562f58509

SHA512
f91c59cf1b1645b24997a1201bddb52953c0904f855b78add275d71401e4f9e6bcef59fe1d7205e222470689dacf2d55ae752cc2be66bbee5258db284b42e6c6

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\clap-very-low.pcm

Filesize
6KB

MD5
eabf35649f5be60ce0116fc90c8f8dfa

SHA1
fd94a4a2a2c8457af3ef74d55e08a5d8d3b2af7c

SHA256
2d7c0634cd9a486649290ef6652f340df6a3b25b3369d7617adbb6eebe11ee9c

SHA512
cbdb7177c54c21a1c9560c9fcfd9bf3bc90b0d79b071bcb263de2c8521d9137f55df4c2acc976b0523d95ceb147c5fe42bc00e5289088a97d9e45e4ccebb72c4

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\concrt140.dll

Filesize
238KB

MD5
8fffb33f52be9781285a666f800c6a81

SHA1
479913b06eaa223999d8342d0de439d4b78c6ecd

SHA256
0ad01f6b1eb2fe2c343ba9fbcffd92c3577af9b52e366b2923891f11e8c9a6c2

SHA512
2d0b12e4a1426fd5765e6dc1b690504429715b62a511fc3807e865c2197091ad2a1f31aa9091c54ba1ac2199a401405feed0d8507378696678c4ee44ab540eb8

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\crashrpt_lang.ini

Filesize
7KB

MD5
fcf61aed8f093bfcf571cdd8f8162a05

SHA1
8de8177798aae82d5bcc0870c1ca5365f5d9966d

SHA256
1f5b45a5411f7fc71b9da789d6d1ead8ad30551fbea7bbb40fc7ea576d581abb

SHA512
8a5d252d115f868a4e20fce10f9f9ec5f3948f0ad5680d656e0eba1fd167d36889e54c6e59bcde756945f93685401b825ba9dd7243d907d74b58a1d826609d72

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\dingdong.pcm

Filesize
3KB

MD5
54511224e61e71d2915ff67e57dcb268

SHA1
ba45f16f12d2e29480952367c0c6bd34fcd16827

SHA256
7aadf0e317831d287b51e41992b43f0f381ae48a312cb77a426eeb3b6129d6d7

SHA512
46b4ea771328a25c6384d5cdff7643ced94dd446830b165f80fb69df2dd2754062dca0636604602a7ebad4ce29b3f8ef62a81f59cf5502bfc78468c8c67a41ff

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\dingdong1.pcm

Filesize
4KB

MD5
8fe86d9e8aa5c709bb0563243172e580

SHA1
c22bb02d82516a66f8473dbb4209bf22bb60fa14

SHA256
2fbbb9ae6a463b360e1459bee558dafa8d864db2423f0fe4d2c56d22c3f3a5a2

SHA512
6c47e964421ebab2c0c6199b97fb9c61b0a228fc654abf2e4d2bbaeec9640be2a5acca92474dfdd0b43facc71c60a9c9ba727d300cadb6128ef1f3dcd9a6c10f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\directui_license.txt

Filesize
593B

MD5
ab54b14548a4cc76dd7c27414d971111

SHA1
68a3888b33ee1c5d5efb913846867c9a8788cadb

SHA256
6033476be3d1d41166b65984e2be94c87ac98dce55bfec887e932b696e859295

SHA512
cc8c4d90efedf4aeb3ba3b64ebd0e938576867618a334bccf3cb6790338c6a1da239393a618f6e6a1186cb363cb514ac9528ada51f0090fe2fc709e5c666d971

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\duilib_license.txt

Filesize
1KB

MD5
7faec2006bb231d14b794a9f31769448

SHA1
c2b5a34fe521502f6fca3031201b47074f30f258

SHA256
7ed2acca31a243ba107d8c12fddecd52462fd326d3d2c73b04d4cf10c76765ff

SHA512
777e0ec5d6b599fb0eabb8180fb6f302012ff12245e3de6a3dc568798cb057858eff18b08dacd28a72250236c4767abc2583670d92a946f684b45cb5144bd7e2

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\leave.pcm

Filesize
3KB

MD5
3fcc19f6a199e97646a0ab32423c9332

SHA1
05613b14d6c7336b24e9779963d245098e73b40c

SHA256
efbd514b0ea241a560f1333cdbb90a9885d5c70c01ed032d11b8a672b1096a04

SHA512
b370ad863badd0d86d982eada1fd98306b686ef1cca4cc522558cbde40257effa96afd7327141beb08d9927a6b190e0047ad7978e87a41bf299f030c1cee121c

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\meeting_chat_chime.pcm

Filesize
2KB

MD5
b30a997b4a9df68d8796eef6f457f4aa

SHA1
23890fbc1f66c1061c60b8287659566c69b297d1

SHA256
f2ff5d73ee2a89135094ecb5165b30e351bb24ee4eeee95508f311eecdc9811f

SHA512
8cfc3b13d7c2ffa0438ab12669aef756bac76063cbf317e449e5ba4127c0604bab6fba793866857f4a68806e9ed779c0c521fc46c5ae3aab42de7c72d98613f4

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\meeting_raisehand_chime.pcm

Filesize
1KB

MD5
cd7d41d5204013ce176c99c225016d6d

SHA1
996ea48981e81ecb107cd77fd0d6e35edc4d4214

SHA256
cd9b81d47633fe9aa3f1020d895161de8c31797b365f93dfb22a60d920cc2eb3

SHA512
44afe616a2596abc76cf9f862837b26c00e6214a08b61c6569e7ee07ab4331f4968d718889863cffc74ceed55ff377932432c7191dba4efdb638ea3b96badebc

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\msvcp140.dll

Filesize
440KB

MD5
e0dd94aada0b034b212de071c33054da

SHA1
6c4f1b3f66d07bbcdcf41eb39b1480bb335efcc8

SHA256
08442853f19ce4ff3acae37d87eab33ef81c4c6da62a3432d43253ba79842b64

SHA512
76c877056f448e5dab820e990cc186ba886b2d331d689a99295aaff31a63aadb941c2693b0be98d53bd06cd8041a270eb82ddedfbde305cd9a85bcbe42fcf5a2

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\msvcp140_1.dll

Filesize
20KB

MD5
8d7f05e7f0b3ff4a4fff6dea96530c4b

SHA1
c63b270dbbf53318f7db5c980d6b0a62c6dbde49

SHA256
83cfb5fdfbb874dbe0ac3746838b79b227e6cae8015ed9b3f9f2ba350d70476e

SHA512
08dac7bd468b8923a4d99f0717a3f94a6ae6a169f3ed09d27d1de3c3e8c8057a92f5a16daeb24c56b4f432c9e2ed5cc87bcef2657e311343629478254b8fbf5a

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\msvcp140_2.dll

Filesize
162KB

MD5
79f7f9901176f90a6f9f45c406335286

SHA1
5a425b3cbe73c8bdf5593d9387b9ef3b52ac8c25

SHA256
5e04c86e1ea8d79f2c1b52e4deceeef5785eb67375699f60609feedf59f13ab1

SHA512
a03a2c63aa37451eecbc67d0492d53fe5a057414c3fc75a64c8d6b303d30c2a1da46c84bf9549b6e937ef07a01857cc3f2784f816f187e6c7aa59dc890ccb505

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\msvcp140_atomic_wait.dll

Filesize
38KB

MD5
405b49c177b285fc755da361a084e1f8

SHA1
1230b6665df9475f8b56cc62c98c65bdbb2c155a

SHA256
e6555a79a6a7090c9b0f39be88968edb57f481a5ac5c66b21dd75274aee7fd3a

SHA512
6ef19e97c93cf5d31f95fa2855d9b22ea3483d8fe6ee31c1537e7a1fd59c636b5c3d7dbd786ee032fff913bb470d8785f1f42cd364593d152184ce098e67cf65

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\msvcp140_codecvt_ids.dll

Filesize
18KB

MD5
4c86499f2e55087acb24ee059c444a9e

SHA1
dfac896156c5556f8b5e570d8099f75e2cfb3305

SHA256
732694604cecc115662b9e29b26003dc358314381cef33e7d91aea28d42eb36b

SHA512
58fc984cc98227c05320af5047a0229bd62aafb046151950c4b88d20cb56b347ddc29e8be6bbbd5ad0bc4606472d5ecdca5b55eeb67d712bc1368e8d11b76a50

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\nanosvg_LICENSE.txt

Filesize
880B

MD5
078690812af4ba8567fcc2af2ca1d307

SHA1
f4f94babc436555d2f5992e29aacc47433fbadb4

SHA256
e82bc3dd03400aecabe12201219ba14750dbc4b36faab58663a7a6068548d372

SHA512
f4e1f1092ab90f380a63ed1954023722d265e32f7f3d9b86100fbfa7d6ecd8c584a7dc22b4e3cc4182957136e2d765d0d6a293694b739377c09b076e5fe448fb

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\record_start.pcm

Filesize
4KB

MD5
ab8a5f2981e225d3edaacb520083835a

SHA1
c60c383fdb6850cb5013065576de87610270fba7

SHA256
193c4ffea3de04802e97e9e62fcd8533d8ca53e7306ba113a2234959b5262eb4

SHA512
4381f709c5e9d0172027fd2fe65ce37b0444087d3e9d7864cd54651cdae6e8429653c02ebb7a55a5de194ccf0d674f376961b012b088e131a11b7352f1ba69dd

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\record_stop.pcm

Filesize
3KB

MD5
0001fecb6b6e044d221fbc6a7e22e313

SHA1
c73a6506c92d9a1188aaa793afbfc1951cd5340a

SHA256
8cd8b4d3e8447d82dd045c7a3a8f175b97376c3db5895506cab0af6a0075226f

SHA512
1588169348727306e9c4ab444a7857924bcb88e4dca2be8e3526a2227cf117702c47431325df1c83f71da34bb35c28d1589eb3f59cffddbb3dbbe1d00d8d76de

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\ring.pcm

Filesize
8KB

MD5
15f886cbaee088418b6ffcc29115c64d

SHA1
9147beae4e9138ba609f67e75f9cbea7651ca307

SHA256
29792a0893ed2457c3872c4418bdd71f5e6c1b8e5894c2c921f8a8f8d797d4dc

SHA512
e5228897cffb5e05a7a66471c52089ddb682d544ac3b4ac312804883a2d335b60edb6236286dbfb6934ed12715709f8ffa09dc7014844acb89bb1b0e205a2daa

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\ucrtbase.dll

Filesize
1.1MB

MD5
2040cdcd779bbebad36d36035c675d99

SHA1
918bc19f55e656f6d6b1e4713604483eb997ea15

SHA256
2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359

SHA512
83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\vccorlib140.dll

Filesize
261KB

MD5
948275a307ddba050eaab66448e07d26

SHA1
e06ab60c66ba361baf3f3e2eb4b1949587854b0a

SHA256
f1d630a5bfd0292502274621cee911f4bac2d314795a105f5e8ccc0bfa70c117

SHA512
07afd6fef2c01e849943d2c9744d2ed813517a667915ec76cd7402786525f181a51967346538820b71b72d4ef46b5576619261bd06db7c8cde4d8a83cdbd7667

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\vcruntime140.dll

Filesize
74KB

MD5
87dd91c56be82866bf96ef1666f30a99

SHA1
3b78cb150110166ded8ea51fbde8ea506f72aeaf

SHA256
49b0fd1751342c253cac588dda82ec08e4ef43cebc5a9d80deb7928109b90c4f

SHA512
58c3ec6761624d14c7c897d8d0842dbeab200d445b4339905dac8a3635d174cdfb7b237d338d2829bc6c602c47503120af5be0c7de6abf2e71c81726285e44d6

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_bin\wr_ding.pcm

Filesize
2KB

MD5
c9318cc2306bf6b1ee74a5987a8d371a

SHA1
f482d3de9e8dd7c04344fab37d067a08233b64dd

SHA256
58cbaef9b7177a4e4427ceb303b852463964a5ac4e979055021eed1901ff164c

SHA512
04ccca6ed6c13872e8d967a9eceb7b485c5f0f7442259395773a1ef168fcf317e60e22ad2840579e4d8b849d1606190cf5dca0e00c2f88cd1891b8206e9a5ec6

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\tmp_uninstall\Installer.exe

Filesize
847KB

MD5
7a2c7fb9ed57bd47a4df70af99f0c279

SHA1
7f7f63aef0a7acce490d76c12b63ef21e967e61f

SHA256
05678b95d43d32b19b9cda0a54159849b222e27a091e6d5bed9fcaa2756843b9

SHA512
153b46108fe0585571df0dfd5994ce86ef1c2c1bd4b98d28ba7ce7be92b65ca967ae1b3eb52e18b9a9811092662b743d9f7dd011c89fdaa51f4960f847ffacbf

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\CmmBrowserEngine.dll

Filesize
163KB

MD5
dfdba18b6de1ec88c6f75230cf7b03bd

SHA1
b57a0b936b40b9934e4c5b6656d4bbf667aa865c

SHA256
5decfb6c6edcf870c43e6a27fcf2806eb623e0096868fc50662107e4eac041da

SHA512
d1eeb31c40ff7ffaf1fe9f8f41bb8fc56c15e5c64f48508d0593b62b9c94890961d7f2e272035e8707bf6238ca84d4f0c3629805040ff5ba05a373cd3401ee7f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\Cmmlib.dll

Filesize
1.7MB

MD5
8d80fb0804db6384d504f1cceadcbc22

SHA1
7598007c9bcade34fc9346778e04165d6dc1bc4d

SHA256
7e90b8049bd3427bf8e381e739b6ac484ee69602a7cf60bb25a7c756797bfc84

SHA512
8ae698fec007024f5e2cc96ea985a99876dc21b75ba7e6a8369abf859fc40e269f735d4eed2482696b6205cda7ddb0ab4285926311a35fddf9c1cf7fdb236aee

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\CptControl.exe

Filesize
127KB

MD5
7460c50ad8edfce9b039ff0f3b2b5497

SHA1
e6687d8569d92031915cd1f97c26b14e8abea514

SHA256
fa5b222a168dfa0cf5c2f03f821264e1dfbbad183dbadaddee32060c41d05a9a

SHA512
3c5c1f4d919f9a25ede3d3376f93a6f63f5e89e8b0d6dcad6d25c379cde9050e116da93578e785a99a3895280359e1c05dc1b721d349004807595ad8ffd96ddc

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\CptHost.exe

Filesize
827KB

MD5
bd73edab901fab8ba2e73f42bf7ef403

SHA1
12dab04e13ae76d15d659d17382f5585b93bc647

SHA256
6a5de4767e2bd22ce4707ba46ac3a0538baed453634bab51a3315ca865e54e96

SHA512
01446c9230a79609f94038124c2c69045cb99a62f9c44c91361bd33762c9b4d46092761fad150cf2ac83c35b14a5187a7de641668f8e75441eb3aa41e900c488

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\CptInstall.exe

Filesize
307KB

MD5
882a2d38b5c93441f5a63a37cc966dbb

SHA1
31b5e6deacd1cc9ca7299ff61df14867d014f71b

SHA256
51fd29cef39b6ac0e554a5450024339a54cdfb625fceba6f37fe6554613ba7c0

SHA512
bcac7af5c03b84f31e5eb1061acce1eb7ab0e4c11e639fe57c2108ad767d830c5ed7d4f040c7cf2dcdee24c5e523c543b30777e631109396d1439eab1a328c6a

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\CptService.exe

Filesize
306KB

MD5
8a2ddf15139218e46c009077d9b4bc81

SHA1
c0bbd122b09295e65481b266bdc7e3833f8bcad0

SHA256
451d4c1c0935d084d4a897229a15607a6a0316410d1d62af80d38035dcd50b08

SHA512
326b867fd2b1b4d095f54f650d52a0b2a79843acc0246d15e960a2d2e810e2040bcf239d6ecfb579e8770ebfd2a645f3fd612141a6ec283365a02fa87d413ce5

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\CptShare.dll

Filesize
310KB

MD5
6375c211e1b732864e386810c7c892ac

SHA1
d57718e6a922ec4d9e01445a7b9d0087863c6a5d

SHA256
923fd570b422bb6334b20a8e11219a345d62b8728c1a84354a9f4fd829afdc10

SHA512
8d402b03c12f9fef4852e7a0be7fe7b9640d2926ac23d30c3ce77b7bd0e48136b0936286ae84a1d303c0b767747e3f1df0e804dc415f0fe6bdcad27225cd3ea7

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\DuiLib.dll

Filesize
1.5MB

MD5
ddf8fc919c176458b6cac47da7d7bc76

SHA1
ab308f806c9a75cebff04ad8309276d8944c1e82

SHA256
49a78ecb689cc4c1e1e546f969b798600c9422f6e93d18b13903ae94d93b96a1

SHA512
b1406fd86a20daf1b3d835652a5f8a76db06ac579ae6d7c1b54ca1507664357b154d13ed1c4adb5e8d3de7d7db8f52af0af78e526a913f2c4cade235ffa9e734

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\UIBase.dll

Filesize
679KB

MD5
5631117483973d1cf1ff896804cd1448

SHA1
c74f3bcad070377eb12a36b0b4ff8fb4a44421b8

SHA256
9dff330d27399492aac4d11098e3f834504ea00785b6f36c8f443d0ee25ab332

SHA512
aebdd5c517567bcb099b8200f682f9cc215aae8ba6a748f795b7f0bd718a20b720f49b4b027a7e5bffe6ef6f87e26107a0e3d8145c7b07df2fc7357ff6ae78b3

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\WebView2Loader.dll

Filesize
111KB

MD5
187ebe3e687679673716d1013b8e18a0

SHA1
b043a53544a6a2a28f090630537d42dcd4665adb

SHA256
c5697253aa5d203206e0961f8ddfe2db8e27dd377ebebc4059cb460cb87a64ed

SHA512
688b982d9680fb6ff07c2e7bfba4df920fbbc232d70e01835fbe6e1b93da6aa73889a88fcbc4324cd752ad5df75a56b105249ad9bd360a4e0250bcecb86fe4ca

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\XmppDll.dll

Filesize
1.3MB

MD5
d210cb3aee5d30bb266364a1824e8d76

SHA1
df425116edfd8fdd2ec071f4e67e1d184c68bb6a

SHA256
730b7085540b9aebe53e6ea7b8ede48d08fa31386a1f3ca70f415f81f41e305c

SHA512
a2f3dcde4a791d92a4493490eb448e0aeae7eacf794bb540d6d6038512889a0df25c0622045bc4b6f959dc2445a53a1c62d04e32c99629b325442b86a3ea09cc

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\ZRCSdk.dll

Filesize
1.5MB

MD5
5e22984d73c0b1e2c2b7c285581f15f5

SHA1
5008b0319498564624e95a81670acfc48b2d76cf

SHA256
1b698d0bcd932a4d1251b9e4b16f8ce0c1fd3a2ea71262eb49f54a39b5d6a1ee

SHA512
ae065ccbc75f8a7b6bc63ea49a756adc633a6cc771874df9326052febfb2592827d1103d342a07bc1c23b62c3d76eef217678c13554a68aae7804a1bd890a1af

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\ZZHostIPCSDK.dll

Filesize
227KB

MD5
e2873b4b1ffb4e4bf0dead745f5ad8e1

SHA1
137aa56f02bd19bc8db0becfb26d1f6dd9936a4c

SHA256
d343bf7eb84a619c6c9964d599a8654898841e0b8df65eb91ecfdede826e76f8

SHA512
1a0f3df7e01831bf73f9614851708f1787a65d471c4b2c5f3f352649d5dd367b3fe319288da2437a15af2a5536b86bbefae1efb890a1c300590261a9f11e5720

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\Zoom.exe

Filesize
339KB

MD5
6a6e6c695069e2c4680a517292bc960d

SHA1
69c63c459b7a01ba37947b048ad1e93014063984

SHA256
20d525446b9fe0a1700866b03ec5a21ac41897006725a25f6c55dcf163c39ac5

SHA512
52d2f612a562b23e5c78b6dc3ed74db943a44c463018b09930ae5cee43cd8ddddf151d329751ef2d73cf96dd402d159fb0fd6291d510a69554a19d1e2dbdc928

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\ZoomDocConverter.exe

Filesize
309KB

MD5
dfeeb654d47e4a430a89d059bb490abd

SHA1
c2b1ecc40b89d7d618d08a494d6217433740f851

SHA256
f84b68f3b989dead320fe779f1687934e1e99d0efbf6974ed77a2b445b7f04a2

SHA512
f110385c2ce73ceb942b8685745a7ee372d293fd748ae95fd827cfdca204262b030ee9116a380e3abfef61124f0b429aa2f529b0eb6b6837bd561b01ac78a029

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\ZoomInstall.xml

Filesize
9KB

MD5
44e6d325651fd6fb9c00677317903048

SHA1
198023dfa41992c0e0678c8e06bf56109980edc4

SHA256
b6f2d98595b5d349703dcf2b5b835f068fbf2c3690bcbe581d6a48f679144a43

SHA512
9a334416127758db14bab2171fcadcd017bfbc3431a5919f5c3e0ad99ff5ec88a6a118de82e5280d837df51dea738eb4d8463b9ce21edf8d748055fe023595b6

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\ZoomOutlookIMPlugin.exe

Filesize
583KB

MD5
e98c150a7078eeb6da8d8da883bfbc2d

SHA1
0f93ce210505b238815b52efbd61dca26c29eefb

SHA256
81362c4b08ce51caa6ec6b450718b2849e6df178b4efa0f74cc61264da3408de

SHA512
b20b4fba2b074293a7a7979cfccd3d6d37540aa11c35856b9ee17011135fbfc94bcaad082e2ec63f43b1d0e53b4a4130c3bb831e90ba9e33e74c17ad7ffa50b1

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\Zoom_launcher.exe

Filesize
359KB

MD5
a7b60e4ca45ab5889ad34d593a567009

SHA1
7d86bd6fe8ec970bcbfe4212103606db6a0f4181

SHA256
d24f456d25495a0ab029e52b5d6a0fedf1b04441d11109501915a719a1e49d5e

SHA512
3a875023a529b373e1ea33ff94e3510fe80dce5aecfcda728c2facef3250042ccd27b178e2201f70758fdd1e9fa2cd3979922f42eac4317eb5ac94b3420f2b51

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\annoter.dll

Filesize
2.8MB

MD5
1f1a9cc219d3cb029777d878f096a858

SHA1
23777d0293572d2c4ceaffa27e639d69187e9002

SHA256
6514633b9482fb029c959fa85020967f7b104fe8bc9a29cac8323e14f6ed5fea

SHA512
c614122148289eaf01d52ad832ae2d1e9def2010c2d2bcb404bac3d36cc1fb3eeec0201e1ed6d87883720ccfa44fd772ab8134a99c753f2d489ad62ba98003ca

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\aomagent.dll

Filesize
283KB

MD5
33e97823cc8ddb699f76fa20f63f5922

SHA1
6bdce9bc16bc4b00a02d7d9b999b72968b1b328e

SHA256
654741efed43591fa3c209d613ec3a7792baed94b41efddc9d47b8ca2200e2d2

SHA512
f081ee44b6dbcde3f00d54095268ee46ee388cd65807bab9b732f7d7474ae5230aec997f920b3af13bc96275f025aa036057cc72dda3ad4007f4b205616beab5

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\asproxy.dll

Filesize
190KB

MD5
c7b9383d61c4bbedfae5ccb2287fad15

SHA1
1349ad29bbbe9bbeddb31bcb79d11b2e7cb68265

SHA256
3c98d6c0cf7d9fed3c428d6c5bb01e784c627a0a99a23cf8bac9807f9e6760e5

SHA512
c8ae47b62fc3b9de5432b8a6f5ca31a6f98ca2e8034ebe2b78a79b659e35f50e655eb02763e3a7c2d072e5e2a05e11bf9c6375c775ca632a4b7483efd4970251

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\cares.dll

Filesize
97KB

MD5
f092bb4894cb0f77e062fe816b1fb26b

SHA1
462114570d1bec92f83ef4841a53e2462a8b5d4c

SHA256
581ab47404bbf9149d2096e9bce413a3331816de28a2fc2d4b0d0ee61742b55f

SHA512
a114f6618c3791a6ed02353364e7362e9544e183c62561de5efed66ed9c0f23060edc962fb7b09656b54333489e136250310530c2b36a41e10ca54e15de92b8a

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\libcrypto-1_1.dll

Filesize
2.5MB

MD5
5f2e381b51a58b4741d0b825ea33306a

SHA1
f3d3068c1518b55864b465a99c6204d40db20302

SHA256
d8e9695232604c37de8e2c75813a49d42aa812b044c03c59960ede6525b6cdea

SHA512
1949812cc7bc635a2e40c78e2cc50822db80793e84e4e9dfa0cf6a86ad793943efe7e07ca49500f4dc0ae6b8f01e1f0d6d9a4afc089faeecb61c9ed96f46afba

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\libfdkaac2.dll

Filesize
569KB

MD5
97e7499fe0f0ec398ce0871ad507ad89

SHA1
bd8752cb1680cf975ee58fd937c4552f83b10e1b

SHA256
5057a948e652f17681155cff7679989c1016ae8bce20e369c57d52967f6bbebf

SHA512
53d13ac5cbb3f335e8a323c39d4ed134e533ff14eb28d96ecfa958222c2dec24507f84857b871341b19ef87e6a681edb349c7a69fcb5cba330c9f8d3b7579891

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\libmpg123.dll

Filesize
208KB

MD5
dce3cdac80a733f227bb7209c33ad4f3

SHA1
4340852aa8d68ef54598f370ccb07f10ec5a7225

SHA256
4cc142ed191ce49a3c4ca2509b15fd382127b19d98c4f20915ab7801437374f7

SHA512
5d3607165917f44f2707378a5afa2d7a494ebdfb8d8efb35cc21927a65969b3ecfd0bf6362d69ba144dcde114fe20c74c000b81726775a1c8744fc14a513c27d

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\libssl-1_1.dll

Filesize
548KB

MD5
0abba81425f7f8dc0df197cb1d5b6dfd

SHA1
1bce4704e83c5a6a50251400dc793ebb2ff81b53

SHA256
2de8f97820f3d65d0ba0dd788da360f4db40769889b972871a4c8af7b877fa62

SHA512
dbe32b3150747901a865123831872fbbc1fd82d3b33018d15c10f0149c9e920a593ccf0615fea41d6873233e5eaa45d87b520eedb8d700d04f6c20ebfb8d920d

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\mcm.dll

Filesize
1.4MB

MD5
f7eca6f48e7bd08678f53539721ac729

SHA1
520a19499f92574bcbc9c81a0b08b468418ee5ca

SHA256
e5e97c776c66483af65e66daec9ae1da6c86cf2a6b2ee8874a2e767c3ef0f772

SHA512
03411687b38f4dc3948752f0d5b0290ee379fb92ede855a3c187a66ec2d62d4f145fd143c05f8d51d0506cbaef2835b60121deacb805654c11a1fabf2a0a9a57

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\mfAdapter.dll

Filesize
103KB

MD5
8274b7c7ed2a8c444b7fcd288b065b26

SHA1
87ff33e393cfe87f14631ebd35f332a3330da0d7

SHA256
aa022ab983597a2094611f096d36c570e00e827d76512cf2aeb96ce68ada4fe0

SHA512
a436d84384ae195a46768f41d4c83080836556ff0223ae523a3835211b54d6743a846581c7ab0e8f13a414b6a3d497a419bf18abee1808098f23982d5ca78208

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\msaalib.dll

Filesize
47KB

MD5
993d8184f9c65e864f1a5736f6dd48fc

SHA1
1e725ead1610efbe7f09c588933ef731d10bb4b2

SHA256
39937e56578b64833e34396844ba166279104e1bfa0cd25b685dd444782ed513

SHA512
5f359c7be472baabb04ad29504a3806bcebcbed53a70c5b84f192786d5132cda6a12be6a8db527783e211f79f77e3220ca696671711e6dbcbf93164aaba2b4a3

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\nydus.dll

Filesize
2.0MB

MD5
0a6be26721c5f63ae42e7da283152416

SHA1
55d58a9c68d312fb869e129cf3f4d0a9e98e1e28

SHA256
4ee4c2f02c61cc6f0cfa1fe231a52a5c82a7c7473acf950893fe9d07663948ef

SHA512
9276418adf7215fbf6441730a703a5f5ef9312d632eeff209a91b7c940ec3cdc31a7fb7ff32b6abd1cbf7d29978a14698c4a9f1efe8d57c488429db61b52feaa

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\reslib.dll

Filesize
45KB

MD5
885563cd08e6e15bd7e65f34a8bbf8e6

SHA1
2f4ec98230346b7111ba7644115c4fefd0ff5ec7

SHA256
677dcca5c52b17b226c893a6ae768eff28811cceac58cec7c62f3f1c79e14202

SHA512
4a53c3d1f306ee27d6c153156ffb416371b896f3bd070b807e2df7aa15163bc0092c4f8cf3c8638db41bc045847a1f2972323a7fe6e55a93d146a982ab9c947f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\ssb_sdk.dll

Filesize
2.9MB

MD5
19e058659e9733eabb60aa1eae880085

SHA1
dd2419ce0611f6255bd15f6f7fbc77c808de7a1e

SHA256
ae95f5c4a80f01a70484a2f9e21e0c2dfd3289aceb00483240758b200e95b960

SHA512
f826b89704884f700fa3f21df719a4e09fa9d057640c281d33bba25598c0ab28cb456718776b74cf423a9e1361a8d5f387d1827c4e67a92d446bff46324c03ea

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\tp.dll

Filesize
1.4MB

MD5
657dd73dd294410f30644fcea6b6cff6

SHA1
f9b2bf5480f678e3a70c464795e02b08b65d07e8

SHA256
6964f43f76224e521d0a935d6bbb0c6d973f77bf12ecc64629525de9fb17068a

SHA512
87a6738d669e0c1158d482ac4b404e43a64abddb0ceab5f4dc2d172463b980439a19c5836b7aa1039da2d0db1404e81a123af5f7fc8e44682d8235f9cf00e860

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\turbojpeg.dll

Filesize
790KB

MD5
b856a30ae4b2a71726056112ade94d59

SHA1
c18191248ff545cbfb22f911aa85104073cdfa1b

SHA256
f53cb022711f437e0ffc3676a274b67dbb67ea6b083838a6115cf23fb7ed9108

SHA512
0ca5fe516e53baefa79bac7979fe934ca8fa402f5ecde0ac3b11bf48f58840531fe0b4c0d79135ecdca342b9f8a1b2a898689f9e8d1f8b5f63d51f5a0791697b

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\util.dll

Filesize
326KB

MD5
7558f305524a15f1fbe1544dff52d5e3

SHA1
cabaf24b62afee8990f750cf59e620e6895594fb

SHA256
fd5f27600dc45a984dfb32346cc5228a198a308306f87cd1447940208fc0b9ca

SHA512
a42f6822e7e7284531e89ca6927d7938e3288f96f66141699843d1a8b64e6cd1ca1f64b9ec4b082e0f1bac7b78a3f567fb835327e2211ff6026400a23f2563d6

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\viper.dll

Filesize
1.9MB

MD5
20e14528e3105ecb6f9b0a38db162437

SHA1
b399316b7025f1668d1232881227828618635928

SHA256
7d8c32d9f355cd416c5e6dd56a8f2d9eee556037f0594a4a4cbd7f09e503a5b3

SHA512
6ac4154df44c0ea3e6bdca540c30933b9ef6874b7f01b30dd2f0062c5f832f85d50f7caddfd9aa946dec56e30098ed86d7d65bb251f63a075a34c10e1b215669

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\viper_async_device.dll

Filesize
184KB

MD5
517ab645b294592e3ecf1ea80050417d

SHA1
44a2a546b2c543f5c9b2c9d88aca67b6105c6644

SHA256
50009939267230ae3695096bac15475d812553177646ff9ea0f89693e7c7b982

SHA512
d371dbd7e3f1ea22179ba86671ddb4bca8eb6caf3df4b1608b583219ad38f4051b3aabc01d5724fda81eb4a7e0f6a5579ab01af73e29f3dc4c62d4173f6ed69d

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\win10rt.7z

Filesize
710KB

MD5
55f0d616082b1a8a25e5248558d33389

SHA1
935f4bbecf50be0c1494356cfefef04bd1193e0a

SHA256
a0a4c47a66d53fa346ac3f0455727a5373bf70450b3e784c613f9ded67ae7481

SHA512
4e7992ef74762b5d1155d72764146a4488a71beb03b34d4e19fceb9ca65a831ae032a48793776e969aa75147e280548124ac281a8dc6ceacfb50417265adb547

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zAutoUpdate.dll

Filesize
50KB

MD5
0985ebea2e4484428d1c90f979dd6337

SHA1
35b35954bd4592621f92585f04e0f2a6856921fd

SHA256
6eaca349ed39a851c1670d08bec0ec9f99d94a59ee6b96d233af9e502aaa2460

SHA512
9b1c0a0e8299538976632dd7a0783f1a036c168609065e0bade42a6ae9e271d9d626e66b3dd5544135e928823c549024d93b9a9407e3836dd3ec3ca3962a8aeb

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zChatApp.dll

Filesize
3.7MB

MD5
a24a9f7a1eb11449b053f7d392142eac

SHA1
c7206ba4c11a8e3f06a2e8d1f34c064e2b99bf56

SHA256
f560640635830397e07f5acaeffa610ef43efe8d7f47a9ebe7ba758f7acdc509

SHA512
af800ad478c9e27784be05c982411d2a407ec7504e342f9275a9582a1c2aa33fae085f99845158b6c044500a05fc4c558fdbe9964bd59951285aafc33de75260

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zChatUI.dll

Filesize
8.1MB

MD5
aa9d1224d4a9c25ff8fbd1103ab83c4d

SHA1
4085ecc83edac5105ba68dbd991e4cd97253ca41

SHA256
9003822a3cd021cbbe24b15905bd4f8d9c21f3269edeb98cedfa3ed25145ba38

SHA512
1ce2333c2169fa37abf5f426748bd7588742ed0098a832213b4c48f6467b6c88d3d4c1d8ec145ca914e41882c2d728374f898b0f681248431da2d2aa7fd22433

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zCommonChat.dll

Filesize
5.9MB

MD5
12dafcac8270645a114423c94eed5c9a

SHA1
956aadafbcd32d74287fd63de56f76f246a06f49

SHA256
cd909c6a591e79802631a2ce7b08dc3f89dfb682b697c0bd7672944c3788182d

SHA512
19f5790ecd83696813f541496059aef91bbf78c3515ec8c2e989545ae9d94ab872609fc180cb42c7e92eac6eb6d91d0190d701561f59ddb59c2d310d9204b752

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zCrashReport.dll

Filesize
98KB

MD5
5cb5e4f3384884165ed23f0b864d1c7a

SHA1
e878d880080ca865042ccd5436fcb6afc15fd40a

SHA256
d5148b8070b825963505cf86ab6ea90e0cf03a191694bde3d6f9a9766407d2ca

SHA512
56f176f781d6d02d5359ca9d2ebaf3301800e576b084cc629fbf1acd656e04f27e76f282272335eb01e0f194c34218f7ca757c4c44de807e0bb87827e21c1565

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zCrashReport.exe

Filesize
219KB

MD5
58103abc87e9faf39f2fb5438360ae34

SHA1
c87b6303b6c339658a7ca309058fad98641a151e

SHA256
ef8f4ffbd5c6f67e970bd7cf23a16dfb7d4f48202ef8a44d544f87660ded80cd

SHA512
2645066f61907cd494a2543472481f6baa476535167a4e6468cc7ca51d5b3ae8611d63f7b83d8de4fc04932299fc56a3a913d96a9bb06577ba72ea5e65a2614d

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zData.dll

Filesize
2.0MB

MD5
d91c70f3190f9aa6dce2baa785c375b0

SHA1
6cc1197c486d82d3689a99b2ea6a41533980d738

SHA256
42c5d4ef43096f5161ae6fe155532bb2e5784103828f0ecb8fe0f4cf633fca50

SHA512
462e9dd726f51525afef26f1a0fc70cf82987edff820bc2e5ec18b526c8b498833f7e762204ff7f6172833f38863b63410235019e1878bb48c485db0f0644dc7

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zKBCrypto.dll

Filesize
7.0MB

MD5
c7bf2e7a0a7e1e57ae9adc4359e901a5

SHA1
375d7a2490fa0b2d3be575233ee547e67c30c38e

SHA256
d70103e0e1be41c6c9c735b5df49388b42d5b8beb617700fbeaad24296364c80

SHA512
f76cffdb4b8ee50e5aff75934a92bfac318cadefd93f567e06ea84f1f62e71548dbf519f3673b2226dbd0f7763554476b56f22642eed6e2b8d1cf6ef64f5df6f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zMeshNetAgent.dll

Filesize
331KB

MD5
de4935e159ffb5e807d6b336fe6af280

SHA1
574d9fce6497b43283983d7633e3ed6bd5164ffb

SHA256
0418a36ef3c2fe671c4f52287ec6374cf9621e1e8e94ff589412761c2f84e250

SHA512
c6fd272031706b4b6a04f1c1b547286318b21469a81e1e188f69f3413e1ca9414309c2cc8c45e29e94943dc6e19ed03d43415471c36957d8b9bb49ec4af6979a

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zMsgApp.dll

Filesize
448KB

MD5
abffd6093718b807b59c15e36fc28e43

SHA1
f34c431a8e541b96d84ced144922b21d3c93a267

SHA256
ff63fcf5b46c892fcb746f2ef9e948a86957f4969a3ce540263838c4727f8cb2

SHA512
77c18572f5dda23317eb5b40ca7151a90cdd9a64634789aaecac344463b3203dcbf40993721a69ac4f934a321f1d094b965cda85c5f2bbd59b0e5e635812170c

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zMsgAppCommon.dll

Filesize
4.1MB

MD5
5830736815838a5f2dc1fa672c8873cb

SHA1
f35795d7c89640105e63c79df50969fe5eab9e03

SHA256
b584850989b7e43f953d385e05536478855185ae1cadfa87f9ef4efa0fa89a66

SHA512
67dcf8990414a62b2810d79032eb3a05f3ed41977354a24f7a88db5bab7610bd50f35fa58af239733b1a1d4e722d786bfc3bf11241814ce78be0e4f8149dc8a9

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zOutlookIMUtil.dll

Filesize
474KB

MD5
a66b8b38d40b2d9b275f57d5c64dd7f5

SHA1
63a859a2863632a3f6a88f80b04ce195427e9d99

SHA256
87db558438f73fce370f034b600fdab6e0ea26d79345a9170a507cc6dc6148b0

SHA512
00b295c757f3e404021da00e8bb7565a5ef38a1670f762e77aa58a37016d7b58f5fbd6cfa3cf39f2de30aece1f4ebd6d680b3a405b57d6ff87f21b5c3644acbf

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zStudioApp.dll

Filesize
282KB

MD5
aeb895ee8e05ec4f0e43c4dfc157ac3a

SHA1
ca36559c4958b2b03534274cb7e628a92491e0ed

SHA256
e514da25c54630c08c3fc31229f6a46447fd7053565e7470a33c8f5b33e22a68

SHA512
880bb742da45d2c6713866d6f53ec0ba8e7cf903788c73dd7c5b612780a18db277232eef49ed235ff46f7ce22a007a89157301ab31fb0a0d5bf11550d1858544

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zTscoder.exe

Filesize
378KB

MD5
c1cac713f7a04fb1a1ff77dee748f929

SHA1
30c90b0f6ac85835fcc3ce0b44df4bb736d46c69

SHA256
de2b0758df42e8e90d809d5b2a1c9f911d539468edda373ed2b6f5c92dfe4c8a

SHA512
41ba4494985b0e06937ec9ae08a3b9e074b58be5de3ed20aa9a4e418688d8d78b78edd7a378ad6ad3f22259596a643a96b1dff7276c858ef88c67a56be73404f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zUpdater.exe

Filesize
147KB

MD5
3eb6aa709d63c7a4a61a2f1cda60885d

SHA1
065e4032ed7a9d8ef4a24de8a901caf2e449a0b4

SHA256
835e235f3e109be0867c290727b0743a84e28a0bd3b038e7b8b049e5de2a451c

SHA512
a86c5307f1e323d02a906e884638209cc854a04f47db134a4e817a84272878ec41e07195bafa573a8a2299b48c94c7211a19f17dd1d30a8549c96107e6a9b998

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zVideoApp.dll

Filesize
4.6MB

MD5
85ff73000d225f83d9a1c8515dd193a8

SHA1
1535a567479bb950bc33e0a10231c1c5ff2d984c

SHA256
329c3d852809c6a7af92f40813b81464cdf2fd2582c71d1113903321768e4099

SHA512
aa097c499adbdb6b466f97aac0c0867f4ec3a70659ad6f0cc67c8e9871ea196a0e5bc58e23a52155f650f7f597390f63bd06d2249a00077d64bb07c5e8cc5265

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zVideoUI.dll

Filesize
8.3MB

MD5
f7107d34dcd815933c30dad85eed9137

SHA1
a333d19c6e0e9c7b49b82c6094d45152ce38f6f3

SHA256
f9af157e2310f3481bc4d0d416f2f93700b8486d953ac0791d9abbe81dd61609

SHA512
e20256f912b7e2b2fe05b4ebc673e1279248cd9b72aff74a2a71de78dc79f76baf28cb0a71c9e92910f6611c84d68e13edadc74abcb980d8f8e5c532db2ed09c

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zWBUI.dll

Filesize
747KB

MD5
b74673bcc4b6d02f04851ff17441629d

SHA1
dd002293b063eb809bc679fef07aaf280015b481

SHA256
1ce5e214fb394f10a323d592f3a8530e90951a1efb3c8d2dbca2a42e9a2d34e5

SHA512
cdea6cc98a62e1a4bbd456df5d36efd94eaa51d90c2193754e180b0a4ffd5d5b66bb02a3e620133bd8afd8e4a846ab527247823c5b677f0e44b906e922c0c761

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zWBUIRes.dll

Filesize
259KB

MD5
b70134df07d874a1237d2974a413089a

SHA1
5157f5e213fd85abb2d2c6dc905c1a7c9c0cc5fd

SHA256
ab12e2be8b25b4d1a6a4ea8f9bc090b4775d7bd5239b13919384eeecc71fb346

SHA512
0b560ebee83d569bfce496dbcd7ab1daad0203efb162d893f3ad4e665a85945cb7e6ed999a1c72d0d459223a8e828e9e2ece085bb0ea2d9be79eb8e3d5c3af51

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zWebService.dll

Filesize
7.4MB

MD5
5f4370e06bac78f3b989f42a873f82c7

SHA1
3b4621ffc9ee7b87e7a2e76c373ba1da6ed0cb37

SHA256
c6a46e89bd33a33555e05d08caa68df1d9b9ac9703818c3c3e84ddf48bf72808

SHA512
b465a3ac6e39cdea2552b8a5c83f2b8017193c00d17c6d514f46395451e801494a94382a6716c0e177ee8f974ac9acf09b6ec6594b487db53369b8010214fbfd

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zWinRes.dll

Filesize
19.9MB

MD5
64089e99b2f40ac6f12705f03cb21ae2

SHA1
fdd81be2c4df7f540ab246834f87e186b2fb34c6

SHA256
362ccb12b1485e1d93a6e79fa9d262d030cc10d980591aab5e49c87b9abace23

SHA512
1117c2506a17fb708584bb89fd69332c3d6a29d171b63e595e3de790bc71f2fd0ee06f2f770d582bf93387924800307df3ebf357480a8365b85991270b37bc25

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zlt.dll

Filesize
4.1MB

MD5
a5e072f8c712f08e363939edb176024e

SHA1
edde4a102b6c6ba61e6c47c65104615ce0902e6b

SHA256
8720191d6f963dac3a99e657d30fbb9a14912ac03cf96d030db4f5005538154c

SHA512
8c815f9f4660532a1b717c5f74116a98b660e255973a160eb1c388dd8c1975e1a3e9e6966ae02d54833af7e0d4cca3923bc51f832f2df9ad160388c187d10329

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zmb.dll

Filesize
509KB

MD5
97dc48bbd71021e7d13bcc7b56350e1e

SHA1
062b41c0c8e0ec15a6c104805147c21e8aa15056

SHA256
4df69305e30cd463803d59febe8946d3165ef652b175918779f3f25f225adb70

SHA512
ea1a083c7f20be66d322fc1325ee8005c46a9e5e62319b2e7ca079f437b1a6eccdb38ac19089d36d18cb17c0d1ae58e014a1846a2da76e761ec55ef2f3fceb47

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zoombase_crypto_shared.dll

Filesize
941KB

MD5
2d8ed4b12ce9069810b7b7cc647d2877

SHA1
128ac41b8bb9ca61b62cd52b7c9dc8fc6d71b293

SHA256
8d6bb6d0552b62c393fe2eddcdd96627394e00658aacfb5093999a637abcc9be

SHA512
61e048493a325ff66bcbd65e58458f53ac58ec999ade55fe89551df6f502cc0bf1b4b03dd362134c00a162b55470470e574729b790fecda3731efed36ca78e44

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zzhost.dll

Filesize
277KB

MD5
ea0bb9204a9091d385641ddc051f9084

SHA1
f8b0ae4907e831ce35154c097acd12430c6aad47

SHA256
f90060225031d81e7484429e371f29404f6056396ee96346593e156376afe1c0

SHA512
b9def3053da46c13a3b9a3649f137516d8fef77c93ecddf276b3adb9d628d81022ff74d77bf6b4f95c2f58cedbeb138cac871aa1cb6a3a3a4aee0e564834a4d9

Download Submit
C:\Windows\Installer\e570a50.msi

Filesize
25.9MB

MD5
711482ca4d5dcaf0aec4c7c4b3e1bef1

SHA1
77b9050f2b974bc67996b6435520b557a6ad1303

SHA256
e10dbd4a903b0fa82db9794df6496afe17c98a166253d425f3535959110909a3

SHA512
face1dba9ba688e5ff8e0e4f490a6183c444e814e6222c92a1bb138d88375a7036341081e77f31299c2f57d9283706bb0da58b701403fe590edb676b2f421c88

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
11.8MB

MD5
7a694017aaf09cfadaacf6e36fc382ef

SHA1
132dfd6d00dde6bce02883f56b925b719eda9efc

SHA256
c155e984814c71dedd3cb06edfca4103b48efd551200582c487e0140e6b541cc

SHA512
6c3ee3366916fc7951fe3beaf8168624e94a124db0f0861d0324a249c5f00444d7115e0752541b18b5f5b8bb9b347e7a6739f3fe4fd1c32c24c9b03156b0a4cb

Download Submit
\??\Volume{6aa5dca8-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6e7fbe4d-10dd-4ee1-9bd5-9c09acb39f57}_OnDiskSnapshotProp

Filesize
5KB

MD5
7a99b1753de05497b893d5bc1072746a

SHA1
660399a98b1a43ed3fa4d74b2259cd5de046f806

SHA256
dea53f0d0fa2c0d17b0ac3fb1d4203484131b857720a41a8bd831b7913478d7c

SHA512
0b7476790a89a87053338bbb059ee56260a7acace15992b34b0c8e5e1fd138e64275b9288e8723ad45a813addeb3e97c2291f62d1f60fef21ee03ce4e3f3c758

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\d5tvlu1v\CSC1E75C94723F044F8846B5F34597182D.TMP

Filesize
652B

MD5
b41dd612c4b2e708d95a53267570c9fe

SHA1
f9b1812de32efa7e6cd3f7b625fc158565784348

SHA256
b2dd9584ae35d21a7ce02575d6b3b0488a49a4a78c434dd54911b53eb184f376

SHA512
07f9aee12fb51ef3b787ac63d9608a8e8d8a511bb95a1d3fecf31bbd956654c45490012e7d07fdc6a100c4c001d230b835db6caf97d512b6e623f60b5d0cd2aa

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\d5tvlu1v\d5tvlu1v.0.cs

Filesize
582B

MD5
2bb8d0ee93aeae61a09adf4db6f29c1c

SHA1
8da3034bb8f84ea2522e276b492b2797b5db30ca

SHA256
68d44e3c373d2aec9dacf51326cbfebcba76c1c1a56545e5e1cbf58b44a9f817

SHA512
b3ec6841a9541e96a671a7d81378293567972541d9cdfc3137b478d9b4d3cccd4b5f536d0f059ee9c12fe9ba86bca62b795139a5215843465cb751e0ade95677

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\d5tvlu1v\d5tvlu1v.cmdline

Filesize
369B

MD5
c1a3e979856163788ecd9138706340c0

SHA1
e411b2efb27612404a30810835d37757d176e06c

SHA256
477b30a3144b8cc8172b65ddb4ff3c92db3c81e4435df6c0bca8d4fdc426c8d2

SHA512
f1d83df80c15e2952090b212830c6ad51b426071609ff0b1b9dd79e9b6c74df51af5bd6a629bbc225453ad83cbc4ca354c993299360bf791523417747cf8b241

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sti5sx2y\CSCDDA2549F97064B5195722896F53DCDE.TMP

Filesize
652B

MD5
c306215928f1c1ba7e23d11a561b33d4

SHA1
e93cf57c09243683c62a172d1be5976dd4579fc7

SHA256
b1214c2563359e58669246484fca1cd285f2858de2d8261e6de17a050d094de0

SHA512
469c8077845102fe2ff241bed63bd7e5d0edb6d4f3d2f3ad0320f6ca31ade5189ebf19f67b3b0295e38d70b947af397b2ea8ea6176daedca14383b103359c803

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sti5sx2y\sti5sx2y.0.cs

Filesize
203B

MD5
b611be9282deb44eed731f72bcbb2b82

SHA1
cc1d606d853bbabd5fef87255356a0d54381c289

SHA256
ee09fdd61a05266e4e09f418fc6a452f1205d9f29afba6b8a1579333dc3ff3b6

SHA512
63b5ad7b65fd4866fb8841e4eee567e4f1e7888bb9fda8dd5c8dca3461d084d3f80ce920ae321609e4ff32ba13a55b7320282ce7201bb74a793d4700240360a4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sti5sx2y\sti5sx2y.cmdline

Filesize
369B

MD5
080031163bfaed09c1cd3b4353370b5d

SHA1
d96adc9f695eb95fac645bb1515c5bd8ab914da9

SHA256
09645138cc05955685bf49343c512faf54ce612e14029eb8f0cd4b47122abe50

SHA512
c3ef5ecd12fcf10aa45ef7c74f6f9a08ca2f0f53af8179960a6cd1b60c2be4758c852b64206253d441149bf1180d9f7e0be917e3920834d10d00c4a3ea313e5f

Download Submit
memory/2176-2185-0x0000000070640000-0x0000000070E7C000-memory.dmp

Filesize
8.2MB

Download
memory/3552-889-0x00007FFEFB770000-0x00007FFEFB771000-memory.dmp

Filesize
4KB

Download
memory/3552-483-0x0000022DD0320000-0x0000022DD0330000-memory.dmp

Filesize
64KB

Download
memory/3552-705-0x0000022DEC590000-0x0000022DEC704000-memory.dmp

Filesize
1.5MB

Download
memory/3552-495-0x0000022DD0320000-0x0000022DD0330000-memory.dmp

Filesize
64KB

Download
memory/3552-689-0x0000022DD0320000-0x0000022DD0330000-memory.dmp

Filesize
64KB

Download
memory/3552-1836-0x0000022DD0320000-0x0000022DD0330000-memory.dmp

Filesize
64KB

Download
memory/3552-494-0x0000022DD0320000-0x0000022DD0330000-memory.dmp

Filesize
64KB

Download
memory/3552-851-0x0000022DEC710000-0x0000022DEC884000-memory.dmp

Filesize
1.5MB

Download
memory/3552-163-0x0000022DD0320000-0x0000022DD0330000-memory.dmp

Filesize
64KB

Download
memory/3552-156-0x0000022DEC120000-0x0000022DEC142000-memory.dmp

Filesize
136KB

Download
memory/3552-850-0x0000022DEC710000-0x0000022DEC884000-memory.dmp

Filesize
1.5MB

Download
memory/3552-2059-0x0000022DEC710000-0x0000022DEC884000-memory.dmp

Filesize
1.5MB

Download
memory/3552-167-0x0000022DD0320000-0x0000022DD0330000-memory.dmp

Filesize
64KB

Download
memory/3552-165-0x0000022DD0320000-0x0000022DD0330000-memory.dmp

Filesize
64KB

Download
memory/3868-1849-0x0000000070640000-0x0000000070E7C000-memory.dmp

Filesize
8.2MB

Download
memory/4236-2007-0x000000006C230000-0x000000006CAC1000-memory.dmp

Filesize
8.6MB

Download