5487cf02db06718bb951da1d7f7e778e28aedba65f207d5af7b58fbc212d5e90

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-09-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZoomInstaller.exe
Size

12.2MB
MD5

03fb80c4cded881a8f6c21a7712643e1
SHA1

8a6d2fe2cb14400c3ca85958e9aca30274c7b84f
SHA256

5487cf02db06718bb951da1d7f7e778e28aedba65f207d5af7b58fbc212d5e90
SHA512

7dd7b5dcbbb76d2a94481c60902a3b238428f286aa01fac7a1b97756aa76071fa0d0f5718048af8e0cb086435f1916e50176d4dfad779ed597d7b3b17562df76
SSDEEP

393216:Qch2kBJTdPk1SDnezY7ucsuS3fEYueEAIDvV6zD:PlzTgSD7ucsuYueEAwsX

Score

5^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\International\Geo\Nation	Zoom.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 4 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Zoom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Zoom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Zoom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Zoom.exe

Executes dropped EXE 4 IoCs

pid	Process
2204	Installer.exe
2972	Installer.exe
2324	Zoom.exe
2656	Zoom.exe

Loads dropped DLL 64 IoCs

pid	Process
2980	ZoomInstaller.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
2656	Zoom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZoomInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zoom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zoom.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\zoommtg	Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\zoommtg\WarnOnOpen = "0"	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}\AppName = "Zoom.exe"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Zoom.exe = "11000"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\ProtocolExecute	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Low Rights	Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}\Policy = "3"	Installer.exe

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ZoomLauncher\shell\open	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\zoommtg\DefaultIcon	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\zoommtg\shell\open	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ZoomRecording\DefaultIcon	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ZoomRecording\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe\",0"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ZoomRecording\shell	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.zoommtg\ = "ZoomLauncher"	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.zoommtg\Content Type = "application/x-zoommtg-launcher"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\MIME\Database\Content Type\application/x-zoommtg-launcher	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\zoommtg	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ZoomRecording\shell\open	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ZoomLauncher	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\MIME\Database	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\zoommtg\URL Protocol	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.zoommtg	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ZoomLauncher\shell	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ZoomLauncher\shell\open\command	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\MIME	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\MIME\Database\Content Type\application/x-zoommtg-launcher\Extension = ".zoommtg"	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ZoomRecording\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin\\zTscoder.exe\" \"%1\""	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.zoom\ = "ZoomRecording"	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ZoomLauncher\ = "Zoom Launcher - 3.0.1"	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\zoommtg\ = "URL:Zoom Launcher"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ZoomRecording	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\zoommtg\shell\open\command	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\zoommtg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe\" \"--url=%1\""	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ZoomRecording\ = "Zoom Recording File"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.zoom	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\MIME\Database\Content Type	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\zoommtg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe\",1"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ZoomRecording\shell\open\command	Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ZoomLauncher\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe\" \"--url=%1\""	Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\zoommtg\UseOriginalUrlEncoding = "1"	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\zoommtg\shell	Installer.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Installer.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2204	Installer.exe
2324	Zoom.exe
2324	Zoom.exe
2656	Zoom.exe
2656	Zoom.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe
2324	Zoom.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2324	Zoom.exe
2656	Zoom.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2204	2980	ZoomInstaller.exe	30
PID 2980 wrote to memory of 2204	2980	ZoomInstaller.exe	30
PID 2980 wrote to memory of 2204	2980	ZoomInstaller.exe	30
PID 2980 wrote to memory of 2204	2980	ZoomInstaller.exe	30
PID 2980 wrote to memory of 2204	2980	ZoomInstaller.exe	30
PID 2980 wrote to memory of 2204	2980	ZoomInstaller.exe	30
PID 2980 wrote to memory of 2204	2980	ZoomInstaller.exe	30
PID 2204 wrote to memory of 2972	2204	Installer.exe	31
PID 2204 wrote to memory of 2972	2204	Installer.exe	31
PID 2204 wrote to memory of 2972	2204	Installer.exe	31
PID 2204 wrote to memory of 2972	2204	Installer.exe	31
PID 2204 wrote to memory of 2972	2204	Installer.exe	31
PID 2204 wrote to memory of 2972	2204	Installer.exe	31
PID 2204 wrote to memory of 2972	2204	Installer.exe	31
PID 2204 wrote to memory of 2324	2204	Installer.exe	32
PID 2204 wrote to memory of 2324	2204	Installer.exe	32
PID 2204 wrote to memory of 2324	2204	Installer.exe	32
PID 2204 wrote to memory of 2324	2204	Installer.exe	32
PID 2324 wrote to memory of 2656	2324	Zoom.exe	34
PID 2324 wrote to memory of 2656	2324	Zoom.exe	34
PID 2324 wrote to memory of 2656	2324	Zoom.exe	34
PID 2324 wrote to memory of 2656	2324	Zoom.exe	34

C:\Users\Admin\AppData\Local\Temp\ZoomInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\ZoomInstaller.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\7zS4AB6AB86\Installer.exe
  .\Installer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\7zS4AB6AB86\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4AB6AB86\Installer.exe" /addfwexception --bin_home="C:\Users\Admin\AppData\Roaming\Zoom\bin"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2972
- - C:\Users\Admin\AppData\Roaming\Zoom\bin\Zoom.exe
    "C:\Users\Admin\AppData\Roaming\Zoom\bin\Zoom.exe" C:\Users\Admin\AppData\Roaming\Zoom\bin\Zoom.exe
    3⤵
    - Checks computer location settings
    - Checks system information in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Users\Admin\AppData\Roaming\Zoom\bin\Zoom.exe
      C:\Users\Admin\AppData\Roaming\Zoom\bin\Zoom.exe --action=preload --runaszvideo=TRUE
      4⤵
      Checks system information in the registry
      Executes dropped EXE
      Access Token Manipulation: Create Process with Token
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d931da5fe8ef76c0d2825bc2a94ed71

SHA1
a9a01b417f44d2cc8b1c7773db7bd938cbbb94ff

SHA256
d7b1894f1344136ffb9b5f503057d982005ee518d62c3a48344d976cb4d6df6d

SHA512
7d8871834a7803cf7e5bde6598d33183863df77421aaf08aa157f9796ed52b76e7fec9c1001e169c4132a3a02fbfc2b58b513677929fed16ef9a61ed4ab817c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4AB6AB86\Zoom.msi

Filesize
11.8MB

MD5
e997e32037f298411bd01ae8e8f57163

SHA1
5f4b1fa3615bdd702d74c9ee0a429f2478f1ae5c

SHA256
48baa2099c066fbc4fd40baa5495753a3645599947ef8ee9b413a3f3d0d7e49a

SHA512
92020d30eafd2ea9b9ff2004772a8a51ea2a50a8c240c8bbc0d7a1d052ec346ed6a3380ebc1303327d8c1cad3f4058b84093f38d52e05f8f81680c77c46b032b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAF25.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF86.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\Droplet.pcm

Filesize
856B

MD5
923d4747324854f50ecf69324741c8ca

SHA1
4c19f847fa8fdf55e27b2847bfe09789adfb9e59

SHA256
3568dba00a55d25b736737a48163c13c1348afc5d4022a29ca0d3724d29ffe9f

SHA512
4ae265a89f693304fbeeb661d46d0cd96304083af75b5c245db63a632f40e08ca280a68f20115c6c38f5202801b29084633ffed4da16304689c4379f77693a0d

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-core-synch-l1-2-0.dll

Filesize
11KB

MD5
eb6f7af7eed6aa9ab03495b62fd3563f

SHA1
5a60eebe67ed90f3171970f8339e1404ca1bb311

SHA256
148adef6a34269e403bb509f9d5260abe52f413a6c268e8bd9869841d5f2bd02

SHA512
a9961212b40efc12fd1ab3cc6551c97c987e73b6e409c9ab8a5e1b24542f9e5884811f06883bd31d2585219c4f60c30de2d188788513c01b6cbfe22d539d7875

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\crashrpt_lang.ini

Filesize
7KB

MD5
3be1f13a7a5c5490d4669f3051cc5572

SHA1
c27a32f489951b7f47aa81e52e0f51fd68958e4f

SHA256
9f124594495b209908d79cecadd63ee55d2282d763212c0fcd0930a5f858ca8c

SHA512
89ee786953f09c1097925930c33766867392aa4f72b7552e2b0104d792bbc999da2c77a0d8ee54744c647af10fdfa41ee7043057e9c0df2ff6a9600458a566ca

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\dingdong.pcm

Filesize
3KB

MD5
54511224e61e71d2915ff67e57dcb268

SHA1
ba45f16f12d2e29480952367c0c6bd34fcd16827

SHA256
7aadf0e317831d287b51e41992b43f0f381ae48a312cb77a426eeb3b6129d6d7

SHA512
46b4ea771328a25c6384d5cdff7643ced94dd446830b165f80fb69df2dd2754062dca0636604602a7ebad4ce29b3f8ef62a81f59cf5502bfc78468c8c67a41ff

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\dingdong1.pcm

Filesize
4KB

MD5
8fe86d9e8aa5c709bb0563243172e580

SHA1
c22bb02d82516a66f8473dbb4209bf22bb60fa14

SHA256
2fbbb9ae6a463b360e1459bee558dafa8d864db2423f0fe4d2c56d22c3f3a5a2

SHA512
6c47e964421ebab2c0c6199b97fb9c61b0a228fc654abf2e4d2bbaeec9640be2a5acca92474dfdd0b43facc71c60a9c9ba727d300cadb6128ef1f3dcd9a6c10f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\directui_license.txt

Filesize
593B

MD5
ab54b14548a4cc76dd7c27414d971111

SHA1
68a3888b33ee1c5d5efb913846867c9a8788cadb

SHA256
6033476be3d1d41166b65984e2be94c87ac98dce55bfec887e932b696e859295

SHA512
cc8c4d90efedf4aeb3ba3b64ebd0e938576867618a334bccf3cb6790338c6a1da239393a618f6e6a1186cb363cb514ac9528ada51f0090fe2fc709e5c666d971

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\duilib_license.txt

Filesize
1KB

MD5
7faec2006bb231d14b794a9f31769448

SHA1
c2b5a34fe521502f6fca3031201b47074f30f258

SHA256
7ed2acca31a243ba107d8c12fddecd52462fd326d3d2c73b04d4cf10c76765ff

SHA512
777e0ec5d6b599fb0eabb8180fb6f302012ff12245e3de6a3dc568798cb057858eff18b08dacd28a72250236c4767abc2583670d92a946f684b45cb5144bd7e2

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\leave.pcm

Filesize
3KB

MD5
3fcc19f6a199e97646a0ab32423c9332

SHA1
05613b14d6c7336b24e9779963d245098e73b40c

SHA256
efbd514b0ea241a560f1333cdbb90a9885d5c70c01ed032d11b8a672b1096a04

SHA512
b370ad863badd0d86d982eada1fd98306b686ef1cca4cc522558cbde40257effa96afd7327141beb08d9927a6b190e0047ad7978e87a41bf299f030c1cee121c

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\meeting_chat_chime.pcm

Filesize
2KB

MD5
b30a997b4a9df68d8796eef6f457f4aa

SHA1
23890fbc1f66c1061c60b8287659566c69b297d1

SHA256
f2ff5d73ee2a89135094ecb5165b30e351bb24ee4eeee95508f311eecdc9811f

SHA512
8cfc3b13d7c2ffa0438ab12669aef756bac76063cbf317e449e5ba4127c0604bab6fba793866857f4a68806e9ed779c0c521fc46c5ae3aab42de7c72d98613f4

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\meeting_raisehand_chime.pcm

Filesize
1KB

MD5
79c133b6e58fa3bf72dfc7ecadaefdf8

SHA1
4b55c7e257b3281bb200a0c0ad1a23f0ba27d9ea

SHA256
30312a652460655f85a6daf3728823668b38089b23a5999d7a5e2e44c26acf2b

SHA512
f9b340e66cfe3773bc11c54e51ed6db6e9ccc10a089b1e63bae36daa265b485b0bccefaacd8bcccf06f3437ca9110ca34adf8f56bf6532038a533369561742ca

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\nanosvg_LICENSE.txt

Filesize
880B

MD5
078690812af4ba8567fcc2af2ca1d307

SHA1
f4f94babc436555d2f5992e29aacc47433fbadb4

SHA256
e82bc3dd03400aecabe12201219ba14750dbc4b36faab58663a7a6068548d372

SHA512
f4e1f1092ab90f380a63ed1954023722d265e32f7f3d9b86100fbfa7d6ecd8c584a7dc22b4e3cc4182957136e2d765d0d6a293694b739377c09b076e5fe448fb

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\record_start.pcm

Filesize
4KB

MD5
ab8a5f2981e225d3edaacb520083835a

SHA1
c60c383fdb6850cb5013065576de87610270fba7

SHA256
193c4ffea3de04802e97e9e62fcd8533d8ca53e7306ba113a2234959b5262eb4

SHA512
4381f709c5e9d0172027fd2fe65ce37b0444087d3e9d7864cd54651cdae6e8429653c02ebb7a55a5de194ccf0d674f376961b012b088e131a11b7352f1ba69dd

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\record_stop.pcm

Filesize
3KB

MD5
0001fecb6b6e044d221fbc6a7e22e313

SHA1
c73a6506c92d9a1188aaa793afbfc1951cd5340a

SHA256
8cd8b4d3e8447d82dd045c7a3a8f175b97376c3db5895506cab0af6a0075226f

SHA512
1588169348727306e9c4ab444a7857924bcb88e4dca2be8e3526a2227cf117702c47431325df1c83f71da34bb35c28d1589eb3f59cffddbb3dbbe1d00d8d76de

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\ring.pcm

Filesize
8KB

MD5
15f886cbaee088418b6ffcc29115c64d

SHA1
9147beae4e9138ba609f67e75f9cbea7651ca307

SHA256
29792a0893ed2457c3872c4418bdd71f5e6c1b8e5894c2c921f8a8f8d797d4dc

SHA512
e5228897cffb5e05a7a66471c52089ddb682d544ac3b4ac312804883a2d335b60edb6236286dbfb6934ed12715709f8ffa09dc7014844acb89bb1b0e205a2daa

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\wr_ding.pcm

Filesize
2KB

MD5
c9318cc2306bf6b1ee74a5987a8d371a

SHA1
f482d3de9e8dd7c04344fab37d067a08233b64dd

SHA256
58cbaef9b7177a4e4427ceb303b852463964a5ac4e979055021eed1901ff164c

SHA512
04ccca6ed6c13872e8d967a9eceb7b485c5f0f7442259395773a1ef168fcf317e60e22ad2840579e4d8b849d1606190cf5dca0e00c2f88cd1891b8206e9a5ec6

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\bin\zcacert.pem

Filesize
221KB

MD5
be2b0736ea029fff398559fa7df4e646

SHA1
70fc16edf57e15567cd70f4d919c93dbbb072dbc

SHA256
c05a79296d61e3b2a2ebaf5af476839b976d69a5acb6f581a667e60e681049a2

SHA512
c6dd35579b664e37721d470b2e3c4d8ab681a1bc32c4994b1ca9e5e042fbc21a78f4a3ba775d01b919f8dbbaad08f9eecf6f8dbb7f0224fb72b819b615993011

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\data\Zoom.us.ini

Filesize
391B

MD5
56e38a16b0745fdf3b26398cbb2ae303

SHA1
6c91e035226beaaffee8568b71abae3df1a88f4c

SHA256
61337bb83094276416eaaf1857f4b777dde0338565b632f7b2f81304860b00a4

SHA512
ad0aa7651bf710f31a77094f11dada4961d184e80d2e93c800d602576c0c9a517761a478199415c11f0c05c80f2f571384c9ef5ca57ef5fed09439a2fcfe942e

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\installer.txt

Filesize
2KB

MD5
9ae78e0dc757e164972c1c3a1903d854

SHA1
a4acbef9d45e99ab12f3b6584fb798146f4af767

SHA256
0538df53bffe8871f8cd8d5b173ea2b00aa90b654d850991fb6078c8594dc264

SHA512
2eb4542080171c8818ab91709aef63b875fc82eef0e3f19056bc22e52c4c0c1d9755fd3fa1aca4e43d5543c50a72f17166f450ea8caf9a8aa143c0e7b762b23f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\CmmBrowserEngine.dll

Filesize
154KB

MD5
e1491a441649bb100e5193719fe6f546

SHA1
05e2b47cc444acbe9d9599f41d5c7aa0607627d8

SHA256
15b0537ef2fbdc071bc2fc297bdd368d95223fff5946f74ed7dc6f8db410f7aa

SHA512
ec1c7c9289942745de789e4864ba9643d84552dc1dee8ac7b723cdbc3b7d2c04e6a9211644a00eb015a38016b9e3287d23caa49611c88ac95aea17e41e5d69c4

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\Cmmlib.dll

Filesize
1.1MB

MD5
72e03fc3a36885efe3b6f91c2a5a4e11

SHA1
639d405b64b9ab80f4fde40d47ccc2bca63d0bd7

SHA256
8f3b25e42a10da422ddbd6d2326f3ec6904074887d474bbf9452920b58d76d48

SHA512
5d96b9670cd868be5eb22c159ae88c5c15c6aadaad623df29e5008872fec4b12ebafad1d5bf2f950fe7012b7526057a8f440bb23aa7a4f4e2669d4fc7cc346eb

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\CptControl.exe

Filesize
74KB

MD5
5c11026af3b0f77858a5b03cbc1b045f

SHA1
dcd49721cdb771bebf8f67e55cc1de556bdae638

SHA256
4b096ec88445a85fbf412961d8b934d3becb817d44118597e8dd2ace805950c6

SHA512
d17f11ec41f4a6118b7d90690dbf1600f1708a99cc664a7320d50584f323225a627f44fdebcccb75932570c94f1273cd9a45ff86ae6e31c0642776a62e5708cd

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\CptHost.exe

Filesize
591KB

MD5
d6766fc3c1cbe0664aac6b07f9382bba

SHA1
ba2f48d89de31704c999779df394f1f7c5890dfe

SHA256
24e8d7ecd488efb723fe554961578cf862192753c41dd2f3bdea332a9adef65a

SHA512
3ee058337cd33a7c632e96360f577dabe94bd51c7f2e2cb9e2e2a21034552edc7c6b4df20ac5eb2f26a578551f7296236cc8dcf2245a9abba139049f8d36f623

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\CptInstall.exe

Filesize
203KB

MD5
fb135309492bc6c876d225126ecb8739

SHA1
6d2fa204a3414bce3c4d307735df5847fe224823

SHA256
41f739551117c3f37aef1cd2e3e30d85a9d546ecdec1ce66a89eaec0092a7e4e

SHA512
0b4f625a6c2de046804688331fc62a9e114d577c665ef9e7de4fae297341437bbf925af48e6ccd7abf273ad7061e3f81285c33546a932b7ef243adcaf354092a

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\CptService.exe

Filesize
83KB

MD5
4cc55095aa9458082484405af14c285b

SHA1
52e1c06f18347938c5c0c30c58d4a62eab43688e

SHA256
ae03ef51853f50c89f22c26fb45c8e72941b54ff9084a292b25d1b8969b120b1

SHA512
3554de7c1a211f546928a8aaa97a10ea0662f810f0d86eda51fc5af472f6f2d4897fe1d80526c62d84e713b8711452bff4883f94c514b64990fff373b31d2305

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\CptShare.dll

Filesize
227KB

MD5
d77478f15fe1df1cdde8790e0e779cae

SHA1
394c949e32a4c2428020a68403869cea7be8f5c7

SHA256
65bd50a5607ceb18af1b2090d5f7c796b1b34239f4aaffae04cbdb6da5f26d40

SHA512
eb6e06082f7393aa7deca4802a309bc68bf89e3b20f58a433b6c63164ad8aaa8b6089bafbf4e52f90380c0b1d3b93831bc68d56d235378786652ff6a9dd111da

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\DllSafeCheck.dll

Filesize
71KB

MD5
3d1b87df721da6e07a618ceed6fc5b6a

SHA1
8a5fb1fd843fa502dede4daee7bcda76c965adbd

SHA256
23e76ff6e12e080033b11e6540f1e672e23fe2bbb96b5dcb283243da1f08be42

SHA512
2c05dfcaab04a5702b01f0111f181ea78e7051f1fcdc9e6cd234338a947ce3928b2aecd3bd65959333b2934eb2894c53c11e8b2d31bf21aab268afa040a03289

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\DuiLib.dll

Filesize
1001KB

MD5
4711bb1722d4b77d6b877e3492dd4761

SHA1
d0b53bd158788bc2c5ba06da5feb026682d380db

SHA256
d86193041f518e330e741b849d956990583914ff89256ca1979ce1c77b941df5

SHA512
bccd29ab5d106a37c31ca7fb55f96385d341344d0614ad50eaf7bc48158fed09e2e63b8a8d86a12f605bd411f3cc5313ce891594a0983a1a52509d23b73a004d

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\XmppDll.dll

Filesize
921KB

MD5
0552c55cc0430fdd04314d870390f8b5

SHA1
dc69a9b9c466064f6a2d3e8fc7b4afe50775ed48

SHA256
71ad55cf1fb7bf8fa5d14446d833b443eb298f817a159d03e52bf7d87cb60517

SHA512
4767f9ac39e9076a7219c5334d6e3b4837bf781d5e5f93d98530029c5568e26d8ec11b89ce78843fe00d32cbb4825e9239caf033b877399a1622da5916297302

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\Zoom.exe

Filesize
253KB

MD5
8ea9620fc249e7ab58a275d11a54b89a

SHA1
f552ac13cf615aa26198b1fe39c3b4d3601ac4a2

SHA256
5ce8d9562a01ad7961bfa1ae920e6c5852e9cbe115720451991304be68687fc6

SHA512
1732b1613919aa029c43135bcb9212e76571eb475d3264fdfe2bf27c38c72ef106f3eb055a1ff210d5b8af389e9323763b3a4d6bc3d820c2f6f58502ee4a9ca0

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\ZoomInstall.xml

Filesize
7KB

MD5
d6bdf002c317e89f7e227571db0e3388

SHA1
c159b9570c8f2a354b25395e2dfe9d6f82624a04

SHA256
153a644657db8a312dfa20e8827af158bfa447dbd35e0701fcdfcbabc121ca39

SHA512
e3bba5ea3169b67a0fe154ae51bbd84c718bae469f5678eb770f5d865b9561c7c3a63fd2908945eb13c1c0e873070adec9c7ba0cb45da5ec73d64e0368eac44f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\Zoom_launcher.exe

Filesize
309KB

MD5
f7690d8387a60250e7cf9c683aa6a48f

SHA1
8e70611b23a97ed6eb12eb776af7ade680a12012

SHA256
a59fbd746dde5934641ea1c69b8e01c09278a68d30ca4fef0f67e785a6821e41

SHA512
d80ef4dddcb82dddbaed2cae787c651cf138140470686368e13da94dcb7f9bb3ad1117b6ee2a65f3983c055ce372ed1e8773888d8de3dd0c722d115738dcbc1d

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\annoter.dll

Filesize
857KB

MD5
b4dafd827061bb57e34f478ced872d96

SHA1
e9bac2dd4bed30987ef0707c8629ddacdd47b218

SHA256
cf63b7abd276c1cff0245e5800fd24850066b5f65938b3e9793db2561a4bbf82

SHA512
0c281d11e0a455c3acf073e30289ff06b8bbf56af68e64cd6f698256bd0375b27e00b2aa5b8c69d06981ebdba079372dfba9caa76dae6ec0ace517d427e32a22

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\aomagent.dll

Filesize
109KB

MD5
ae97a988b74b249d6527da8c49c09c85

SHA1
7e56a4a000de24e3041e5afcfee675142d73e745

SHA256
66cf3ada6f8cf3a360266768f8440f0bc652eea3f5a4fa2284efa55a6fad7751

SHA512
e12a06779de81fec7612fe538a7be62e2f2d69f1911f582e6ccaeb1fa1b7156835b34560ba08e13d4720aed31e069fd91fef2a6478f435a37591547f0a9f6539

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\asproxy.dll

Filesize
161KB

MD5
89f4f74d0e2cdcd633970dab8987f485

SHA1
9c9120a9980245e3a13d106e3db0c3a446ca9677

SHA256
8818b71ed00f213b3a81fe7e7ecaee03640282be89faa209987a58387f59fdca

SHA512
33d34f21c7e51e81a283900a0d360352d7436dfab5576a72f93613adb77d5425a13c148a3fb54fbad0cb6046f6bc9837978021c79fba16814be5b327c5860bc9

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\libcrypto-1_1.dll

Filesize
2.6MB

MD5
8138b6001f8590db67e14b9182f5b978

SHA1
a2a9a06bd68f348f88399f8d57f4fdbcdfe4f3ce

SHA256
10c3ee83cf4a206775fea06f747a654b0b907e5cab50b17a4c2ba21c254be2f0

SHA512
5f5aa014afe31762b1f5da2279d0f1bbfeb65f4d892b9e5e057b3c7742df15e588bf06ca5615285fd46a26736affbb985c565065936eb1a8ab612e7313480e9d

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\libfaac.dll

Filesize
89KB

MD5
9e364cd1aafbecc3acc89edee5ddf0c0

SHA1
d22d1787dd27657ca45cffa3d1e3eb47598067d6

SHA256
20288258912dc4bf6bea7a9d0470d25aa0bc7d366c4ef32a0f61421c9386d9ef

SHA512
c8919147fc25d6dace4b180707401d67e26512378f37df766e4672eaa86106b39bce7e388bef592da07484fc639d3e81863e609b3fcdec433c19a61cfc195ab7

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\libssl-1_1.dll

Filesize
569KB

MD5
33dc3c09d4de3b732508e45fe6deb63e

SHA1
dd43b6ddfbb4a3e61af09b166f1830805800209a

SHA256
09fea520e32651bb43102d3cb401ce2d9db744a0e89134217a2d1ffa3867fe3f

SHA512
6e31f9f096d5ec09fa0671e308c81963e5e4ee364263a2c8c382edb380b349a3e65317e5d22b7f7c586e7899fec8dd374572b52cacff1fea82be2b22639fb382

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\mcm.dll

Filesize
1.0MB

MD5
77284fabda95dc2424fa66d236de1d92

SHA1
16f15a8030bb82ff927877b87cf190974b3e56f1

SHA256
3c6d8a289bd0a50cd98135138940dd01bc435a79bcbd73126476bbf498612a2b

SHA512
d677618613feadabb36597d4452ccce683b8f8582c306ead48c87f87d0894bf948b06040e8a99eaf1f9fbce08d17f4b73b151206c0f8416c5a371b9c0793cb0f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\msaalib.dll

Filesize
37KB

MD5
902fc9159a70d58705511d140f4d434f

SHA1
70bd471be924f8dc90caa40d64193acb5448314f

SHA256
c7569fba40731559c0d98a3b1a6a53c7dec01de41197742c30ba60e8ea411ac6

SHA512
456761680693d48200e54992a6070d3bfa5bd0e1ae47cc6105b3e4234a3b632f8bbde78239d685d31782e7f64aaf6f6aff3b2bd81f1d7715e0e91331cfda12ae

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\nydus.dll

Filesize
1.3MB

MD5
1dcba908653c614a1fb3e8cf7498f95c

SHA1
699bfc33616daf33a974f8388e99512d09ae782b

SHA256
137af6dfb909488e813284ac2cbd28df9018f9eb09e006a5c86dae159081b7c6

SHA512
48d92062bd6fd9df71e128d718c1d10446ff554e0afb20bc3075ae377fc94233ceceac4de7f14ad99e259543d7324db43d2cedb163f4a724d0dfdefc5c9fe5cf

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\reslib.dll

Filesize
36KB

MD5
1aa5fded5dc1216da895b6cc0ab078d3

SHA1
451a514ff619075fa19f69b8871e1b87af4010d1

SHA256
207a5c03dec7085412ea419c98ad2f17a9986e8a468283a43e85dbcec68fed66

SHA512
d55381931809bb8dbdb53687f273db2e5c36d8b0dbe8e9f608f3ce435f7732ee84e61e1e35e0bd5464593b9249f37f29d07571e24dbd8113dd268bd1c21b03d1

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\ssb_sdk.dll

Filesize
1.6MB

MD5
eaa8095e171ea1c0b3f42ff14c906db0

SHA1
72ada1c5707ea66fe444c4d66192554f192ca539

SHA256
10306083fc8fc7ae70ab830853381f714d3b1795d0bf35815f1a1a99d53eb751

SHA512
26064480f64df0e42a3af815ecebeea1b32d113682e00cb4f4e5d74e59b2328acbb6302399c9f40d151e064f20d1c58c6a290ac25bad6ecf01fc9291b27e1159

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\tp.dll

Filesize
740KB

MD5
da8c332869ac0d0954092ea1ce21f99c

SHA1
24ccb5c55b43de164f8f3a5bb57fa516226e7b62

SHA256
7bd5dce19557822fd00d5a6a05e5c536722e9e4087efb79b82420d8e9eeb7d9f

SHA512
429edf2b636b4504afd3e3080eba5119e6b2b8a278152404194c96393ca81ae712e59da4b599da9daf4c43a4f471b0478fb3598db63c27553c949c89e8f117ea

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\turbojpeg.dll

Filesize
591KB

MD5
b86887e296bb9f410ebf225751c8bc78

SHA1
386a0655de8de3438fc3a1d474fdb11db5dca906

SHA256
adf444c7b87e2e34641100f89ebed49c07741e96065a4915e394664cc4583fee

SHA512
25f73d52aabffcea8a3ef0b9c0edd18659b735c0d8c82c5906e41ede762982584f8a0862c7496b254fa080a7cb56f8c2d36f8a0ed5d904ed838f4e3f1e639e7f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\util.dll

Filesize
308KB

MD5
17722d04492ede2527586ff2487087f6

SHA1
1e92a00b9b43542e563adf0c1c2a1424fc92b549

SHA256
e7a3832df0cca53232b0b78f3e823a226397a6f0ac2ba951c6498844437e38c4

SHA512
465ec7c79139f3ef9a869fac6caa8f9275e11790779f10cf1e9e14a6fc8a98b1386615dbe19e992e8d0ca2243e84c7bcf5bdedadd56d6e359eb6b601f002cc5f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\viper.dll

Filesize
1.5MB

MD5
457b234de0d2282c675733d0cbed6558

SHA1
63090dfcb24b7f3c945266e9c96c0dfa5696d03c

SHA256
0f1b9ff5637be0ac1c359ac2a754ee514ffa0f042079147cc10ba820d27da77c

SHA512
01b0f063d94ad03837703b71929bcb7fed68ed7a3f6a7ac1e1c59975c1b0828eca047fac808d4344ea786bb864b4864a38566814571c701bef561ecd974f166a

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zAutoUpdate.dll

Filesize
41KB

MD5
20773df8f0a95591c24678db85084ab9

SHA1
40bd7f3164091b935922b4ba4c387b60aec25009

SHA256
16c52d4e1b9a0c457b14b50ef951748a4e64e4d2219b9a0f3528a06507d0b0eb

SHA512
2629bb4e010b76e9cb3ec15593c2a5f607c14a1163c6eb4a519c850056e2fb5362fcc7d8f64447d269bf87e3aa1f04d9c55cf08c2dc3d39499142d521d489ce3

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zChatApp.dll

Filesize
4.1MB

MD5
3ee63e820bb1ae65d90b5b4050826b2a

SHA1
6d1508a917b4fa7c64b4b223f47115c206c068f9

SHA256
3b2d72d715dc7dc8d79a1c6d55fbfc9ad76a2d417525e59befe295aa19690f27

SHA512
f9d652955e56271d4888f9759107fae889b693c0a0b34f2db9cef224255b41e00e20a2b023e828258e7b43e2aa83e857b1a8b2f13fd6442bfc146ad0bd53158e

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zChatUI.dll

Filesize
4.7MB

MD5
f28b4c94752ba1a009d42ee788125aec

SHA1
d251394fb14bd791d38d2c976daddd44bd643081

SHA256
cba258829277aaf211b460d9084c639b9acea838e422f32836d64782b8973c92

SHA512
392f6ab43ffbee0b1d20e8987f11c7853f519d25118a7b502ad27ff728ceaf37c365c389391c21c910123d7a829195ad50b126c522483dfd403e08c24465281a

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zCrashReport.dll

Filesize
84KB

MD5
3397037bc719183318d3dd7519a73e06

SHA1
6a03f62b06a539bd29f1ba16582f152774c6119a

SHA256
132f9695dbfa8fa73ad65cb2ac9640792a9b59217113f32070ba7ad8a73576fc

SHA512
6a5cef4d8f59e0d54027149278f1d2284826740e10ac7101c7bce51944d16a1fa4291c88ab65baf031c3d2928faedb9e86245d46ca4b465ea4675ff507aa1bd0

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zCrashReport.exe

Filesize
131KB

MD5
1db415bb38c498cf22aac33143e981fa

SHA1
f7612059e364e01cb5979b550fd057427b86574c

SHA256
d3fcca05cb19dacbbf4c9f30ccb72982a2d8053efb54f490c7b0264126749afd

SHA512
6a10fdbec708780fac03658f11d7fa958a3c736112a1478773d0bef87216c45f604e37b0e759817290cc8166c88dfee8267cc495f3cadc45ab80e311bea1b0a4

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zData.dll

Filesize
1.4MB

MD5
0219f038bf3c86c041cbd7997d52e76e

SHA1
7e51e5610541eaefe3b86c5c5d27ec04a6a21123

SHA256
e4698dd1ef92f62bfa76cbb487d50a23adaac513204ac7c9509ee893d16a4a0e

SHA512
26bcec5e2e0afe1343a115f0757b31cd592d6f34c09637eb5552ce55a1a0c38eed61b4665b9428fe5742fa382bda95814c7b8053f43a84b109dc311354c7645b

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zTscoder.exe

Filesize
236KB

MD5
32ea343172629c10e268b90f7ab62c03

SHA1
ef80e30788acf7cfe7ede0758dd113235947dd4f

SHA256
b80fc5b1ab667e7d197d2931a91b8e96c557073f2fec89978fe93bac69a9d96b

SHA512
e3e9b1be47d213fa6c3a08a67d5790e7e44040cd1702fd5e049dd2fef60dd562547b4af97674391ae71f16be3610620406019f5a7b8c065ceb8086b5b84c4fdc

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zUpdater.exe

Filesize
102KB

MD5
b4f7524fee1650ba3d17bdfd20c610c7

SHA1
6a6e2e09d2683011b3e83a11392ac6a61638d08d

SHA256
deca5db616efd25179d03360712745f51cb62717f2f04a54b0f14d425f92cc76

SHA512
02a91624c054c5bae5e40422525ecf64a812c56cb482fe59af99cebac056f53c68e9ac0b6f17595229f5ac74d3aaf5a0ca5ce49a99ae1c1e0e82b0b4853528d8

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zVideoApp.dll

Filesize
1.3MB

MD5
62e2278cd48c94e3f351885ffbd4ef62

SHA1
6500e51731a6ccdb05913496199dfc867c515481

SHA256
c4e5ed3949ec4850660e645f7dc20adf3530f2e0a3ad88c1b411c3f5b8f0fbbf

SHA512
42a1b1c05cb6970bacf7ffc48112584a9f50b5a83c6ad407a88737c4ac654e8f6d0d870cf9b96097baa373fbf3a4201ad0f7ae663e433d2bd6b54c04093d5507

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zVideoUI.dll

Filesize
3.2MB

MD5
8448faecd392bf61863ef8e2fca57257

SHA1
aea6978bcc85205b141bf32e643f6dfeb9642176

SHA256
c4b9d734c96004a6cdf04cdeec64640178b1afffadbe16f9071da70b9c149d76

SHA512
f015b51ab9433aa35b78b4a7bb125704e3b482de1a9e956c065d599ce9de36018d8f6da7de4a14a845536eb9e1f0381ad11ccb054ef0039dc0151f06533bbb6f

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zWebService.dll

Filesize
2.8MB

MD5
160cfbcfc2dfa83541706e3dd7425b16

SHA1
3cf0d752564051186efbf055fb3aa64f1fc835a8

SHA256
918d73909f517e9bd31ef27501445970e5f4d3475326eb14e1a0a6cf7f8e8b2e

SHA512
258c8e389a392678646e9a838d6c3221f7c98d20617460f5047c80a02ef2f322cfbffa356e4d8198924420f70a20edfa3866127a6e9ade57d118a231794f0e6b

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zWinRes.dll

Filesize
7.3MB

MD5
7aa5019cb38f3dc000f97e12586d9342

SHA1
70b500935f6626080c00a7d0302987492a614901

SHA256
59c8be97883c23ccfbbd113f00ae6dc71dac2e224dcd0b264dc54af574a9280e

SHA512
6e47389954bcc7c073593fda619d2e725b32ea18d453ed29817104df02d6071c92f3dac0308ba10cef37ef37339b932d0b8f09fc211287d74deb00f4350e9745

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zlt.dll

Filesize
2.3MB

MD5
06198a822c205ad16084be60aaf46982

SHA1
0613a834621f6dd5895ede0d0d7c148a837cc787

SHA256
ac29345aa3c790efbfd67bb950b71f00504716c6239a03b27dde5906e2629469

SHA512
38485d4e0c4a2112070ec8664bd2e1e69008ae82af425bc77aa63d1fa76512b920f48e7889d78e30d35ad0c8e8b220c05ede9162b78edb201fb7afb15ab843ed

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zmb.dll

Filesize
440KB

MD5
09df3071c49c48cc0a8c8fb8af12732d

SHA1
a032f0f5e67c3b0655d835a39f05dd05448002d1

SHA256
9efe424b9304c33c7dade89051f9fddedae807e8c9bf0899983b168a59346423

SHA512
84b21255213eabd229444e2346dba0682666422f9943537e9bef8560c648c8d826bf10dbbbc1614fb1119a4e9ed15cff2ca82a16f7ece4feb6c1682c18b1b2c2

Download Submit
C:\Users\Admin\AppData\Roaming\Zoom\zoom_install_src\zzhost.dll

Filesize
176KB

MD5
0f3304b271bcc1890ecbc605584bee81

SHA1
397555af21ececf365ae0166dbe81d1e05d6d6f3

SHA256
2da4f67bb344bdfec83414343e0a80e808e47c6e480a195fe8fc45e13566a3fd

SHA512
eeed34277b8d4e216cc91fea8ffc9c46a65c32d8a70907558ffac405b06bb05be7592f9c6bdc4d79a288810d079e4d41d7e8743e9a6c10d6e10520ee6ffe014c

Download Submit
\Users\Admin\AppData\Local\Temp\7zS4AB6AB86\Installer.exe

Filesize
701KB

MD5
43e530d07712171ce7d27fb7e5b7396c

SHA1
419fc02ee22783f62d7bb320ad75c13daf050206

SHA256
6e7b59c9d55cac0bfa97cd93fb612c7267bb05d8d3400ddaf802285a33f40066

SHA512
2f13818c5d43976a12d35985644af361a5662805e002e0b243a88a39223ed3ffeccc3053dcd0e80f2298cece68441dbe14c8a7c1d4bbcd8b2fd92ce9e850a629

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-core-file-l1-2-0.dll

Filesize
11KB

MD5
cd3cec3d65ae62fdf044f720245f29c0

SHA1
c4643779a0f0f377323503f2db8d2e4d74c738ca

SHA256
676a6da661e0c02e72bea510f5a48cae71fdc4da0b1b089c24bff87651ec0141

SHA512
aca1029497c5a9d26ee09810639278eb17b8fd11b15c9017c8b578fced29cef56f172750c4cc2b0d1ebf8683d29e15de52a6951fb23d78712e31ddcb41776b0f

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-core-file-l2-1-0.dll

Filesize
10KB

MD5
b181124928d8eb7b6caa0c2c759155cb

SHA1
1aadbbd43eff2df7bab51c6f3bda2eb2623b281a

SHA256
24ea638dfa9f40e2f395e26e36d308db2ab25ed1baa5c796ac2c560ad4c89d77

SHA512
2a43bf4d50d47924374cde689be24799c4e1c132c0bc981f5109952d3322e91dd5a9352b53bb55ca79a6ea92e2c387e87c064b9d8c8f519b77fff973d752dc8f

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-core-localization-l1-2-0.dll

Filesize
13KB

MD5
21519f4d5f1fea53532a0b152910ef8b

SHA1
7833ac2c20263c8be42f67151f9234eb8e4a5515

SHA256
5fbd69186f414d1d99ac61c9c15a57390ff21fe995e5c01f1c4e14510b6fb9b1

SHA512
97211fad4aae2f6a6b783107938f0635c302445e74fc34a26aa386864509919c3f084e80579d2502105d9256aab9f57ea16137c43344b1c62f64e5bc1125a417

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
11KB

MD5
b5c8334a10b191031769d5de01df9459

SHA1
83a8fcc777c7e8c42fa4c59ee627baf6cbed1969

SHA256
6c27ac0542281649ec8638602fbc24f246424ba550564fc7b290b683f79e712d

SHA512
59e53c515dfa2cd96182ca6539ed0ea2ebb01f5991beb08166d1fc53576aeaafebbb2c5ee0ccbdab60ae45fc6a048fff0b5e1b8c9c26907791d31fb7e75b1f39

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-core-timezone-l1-1-0.dll

Filesize
11KB

MD5
86421619dad87870e5f3cc0beb1f7963

SHA1
2f0fe3eb94fa90577846d49c03c4fd08ef9d3fb2

SHA256
64eccd818f6ffc13f57a2ec5ca358b401ffbb1ca13b0c523d479ef5ee9eb44ab

SHA512
dbce9904dd5a403a5a69e528ee1179cc5faab1361715a29b1a0de0cd33ad3ae9c9d5620dafb161fda86cb27909d001be8955940fd051077ffe6f3ff82357ad31

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-crt-convert-l1-1-0.dll

Filesize
14KB

MD5
88f89d0f2bd5748ed1af75889e715e6a

SHA1
8ada489b9ff33530a3fb7161cc07b5b11dfb8909

SHA256
02c78781bf6cc5f22a0ecedc3847bfd20bed4065ac028c386d063dc2318c33cc

SHA512
1f5a00284ca1d6dc6ae2dfce306febfa6d7d71d421583e4ce6890389334c2d98291e98e992b58136f5d1a41590553e3ad42fb362247ae8adf60e33397afbb5df

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-crt-environment-l1-1-0.dll

Filesize
11KB

MD5
0979785e3ef8137cdd47c797adcb96e3

SHA1
4051c6eb37a4c0dba47b58301e63df76bff347dd

SHA256
d5164aecde4523ffa2dcfd0315b49428ac220013132ad48422a8ea4ca2361257

SHA512
e369bc53babd327f5d1b9833c0b8d6c7e121072ad81d4ba1fb3e2679f161fb6a9fa2fca0df0bac532fd439beb0d754583582d1dbfeccf2d38cc4f3bdca39b52d

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
12KB

MD5
a1b6cebd3d7a8b25b9a9cbc18d03a00c

SHA1
5516de099c49e0e6d1224286c3dc9b4d7985e913

SHA256
162ccf78fa5a4a2ee380f72fbd54d17a73c929a76f6e3659f537fa8f42602362

SHA512
a322fb09e6faaff0daabb4f0284e4e90ccacff27161dbfd77d39a9a93dbf30069b9d86bf15a07fc2006a55af2c35cd8ea544895c93e2e1697c51f2dafad5a9d7

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-crt-heap-l1-1-0.dll

Filesize
11KB

MD5
a6a9dfb31be2510f6dbfedd476c6d15a

SHA1
cdb6d8bd1fbd1c71d85437cff55ddeb76139dbe7

SHA256
150d32b77b2d7f49c8d4f44b64a90d7a0f9df0874a80fc925daf298b038a8e4c

SHA512
b4f0e8fa148fac8a94e04bf4b44f2a26221d943cc399e7f48745ed46e8b58c52d9126110cdf868ebb723423fb0e304983d24fe6608d3757a43ad741bddb3b7ec

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-crt-locale-l1-1-0.dll

Filesize
11KB

MD5
50b721a0c945abe3edca6bcee2a70c6c

SHA1
f35b3157818d4a5af3486b5e2e70bb510ac05eff

SHA256
db495c7c4ad2072d09b2d4506b3a50f04487ad8b27d656685ea3fa5d9653a21d

SHA512
ef2f6d28d01a5bad7c494851077d52f22a11514548c287e513f4820c23f90020a0032e2da16cc170ae80897ae45fc82bffc9d18afb2ae1a7b1da6eef56240840

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-crt-math-l1-1-0.dll

Filesize
21KB

MD5
461d5af3277efb5f000b9df826581b80

SHA1
935b00c88c2065f98746e2b4353d4369216f1812

SHA256
f9ce464b89dd8ea1d5e0b852369fe3a8322b4b9860e5ae401c9a3b797aed17bf

SHA512
229bf31a1de1e84cf238a0dfe0c3a13fee86da94d611fbc8fdb65086dee6a8b1a6ba37c44c5826c3d8cfa120d0fba9e690d31c5b4e73f98c8362b98be1ee9600

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
4f06da894ea013a5e18b8b84a9836d5a

SHA1
40cf36e07b738aa8bba58bc5587643326ff412a9

SHA256
876bd768c8605056579dd8962e2fd7cc96306fab5759d904e8a24e46c25bd732

SHA512
1d7c0682d343416e6942547e6a449be4654158d6a70d78ad3c7e8c2b39c296c9406013a3cfe84d1ae8608f19bee1d4f346d26576d7ed56456eea39d5d7200f79

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
16KB

MD5
5765103e1f5412c43295bd752ccaea03

SHA1
6913bf1624599e55680a0292e22c89cab559db81

SHA256
8f7ace43040fa86e972cc74649d3e643d21e4cad6cb86ba78d4c059ed35d95e4

SHA512
5844ac30bc73b7ffba75016abefb8a339e2f2822fc6e1441f33f70b6eb7114f828167dfc34527b0fb5460768c4de7250c655bc56efd8ba03115cd2dd6f6c91c0

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-crt-string-l1-1-0.dll

Filesize
17KB

MD5
f364190706414020c02cf4d531e0229d

SHA1
5899230b0d7ad96121c3be0df99235ddd8a47dc6

SHA256
a797c0d43a52e7c8205397225ac931638d73b567683f38dd803195da9d34eac2

SHA512
a9c8abbd846ab55942f440e905d1f3864b82257b8daa44c784b1997a060de0c0439ecc25a2193032d4d85191535e9253e435deed23bdf3d3cb48c4209005a02e

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-crt-time-l1-1-0.dll

Filesize
13KB

MD5
d0b6a2caec62f5477e4e36b991563041

SHA1
8396e1e02dace6ae4dde33b3e432a3581bc38f5d

SHA256
fd44d833ea40d50981b3151535618eb57b5513ed824a9963251d07abff2baedf

SHA512
69bd6df96de99e6ab9c12d8a1024d20a034a7db3e2b62e8be7fdbc838c4e9001d2497b04209e07a5365d00366c794c31ee89b133304e475dde5f92fdb7fcb0bc

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\api-ms-win-crt-utility-l1-1-0.dll

Filesize
11KB

MD5
3dfb82541979a23a9deb5fd4dcfb6b22

SHA1
5da1d02b764917b38fdc34f4b41fb9a599105dd9

SHA256
0cd6d0ff0ff5ecf973f545e98b68ac6038db5494a8990c3b77b8a95b664b6feb

SHA512
f9a20b3d44d39d941fa131c3a1db37614a2f9b2af7260981a0f72c69f82a5326901f70a56b5f7ad65862630fce59b02f650a132ee7ecfe2e4fc80f694483ca82

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\msvcp140.dll

Filesize
443KB

MD5
eceff9c92e14b580ea84365f3d60f7de

SHA1
00699126456379fa48cb122e21b7f4731a72c57c

SHA256
265591a709a5db413d73c95b538da321edeacb40059bdceb142f997a3d458b49

SHA512
fd325d77eb2c30e1cd1b2d871986e057318c1be911793521c7bf79fb2c5dc359cb7db90c6d6c5711fedd734b6b03117b8baf241dfbd78585cf55a25983ec8727

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\ucrtbase.dll

Filesize
1.1MB

MD5
2040cdcd779bbebad36d36035c675d99

SHA1
918bc19f55e656f6d6b1e4713604483eb997ea15

SHA256
2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359

SHA512
83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f

Download Submit
\Users\Admin\AppData\Roaming\Zoom\bin\vcruntime140.dll

Filesize
81KB

MD5
cfc08fca16c3647a42e78ef7556e4090

SHA1
83c0d044850ce034632e4ea8deabdb6a44fb2652

SHA256
0b08756920415c5f087e65c85da1fbc7a1fafc0d91038e0425cd339c0d903910

SHA512
623028520da82aeb5be1133af4432d4fa2dcc5007c3ffcf99ba25fa82532769a78802e78b65ad62a4cd69af4dc1661730f03cc0cceb78fc3798050b9aafbafda

Download Submit
memory/2324-760-0x0000000001240000-0x000000000124A000-memory.dmp

Filesize
40KB

Download
memory/2324-761-0x0000000001240000-0x000000000124A000-memory.dmp

Filesize
40KB

Download
memory/2324-672-0x0000000001240000-0x000000000124A000-memory.dmp

Filesize
40KB

Download
memory/2324-673-0x0000000001240000-0x000000000124A000-memory.dmp

Filesize
40KB

Download
memory/2656-767-0x00000000011C0000-0x00000000011CA000-memory.dmp

Filesize
40KB

Download
memory/2656-773-0x0000000007ED0000-0x0000000007EDA000-memory.dmp

Filesize
40KB

Download
memory/2656-763-0x0000000007EC0000-0x0000000007ECA000-memory.dmp

Filesize
40KB

Download
memory/2656-762-0x0000000007EC0000-0x0000000007ECA000-memory.dmp

Filesize
40KB

Download
memory/2656-757-0x00000000011C0000-0x00000000011CA000-memory.dmp

Filesize
40KB

Download
memory/2656-759-0x0000000007EC0000-0x0000000007ECA000-memory.dmp

Filesize
40KB

Download
memory/2656-765-0x0000000007EC0000-0x0000000007ECA000-memory.dmp

Filesize
40KB

Download
memory/2656-769-0x0000000007EC0000-0x0000000007ECA000-memory.dmp

Filesize
40KB

Download
memory/2656-768-0x00000000011C0000-0x00000000011CA000-memory.dmp

Filesize
40KB

Download
memory/2656-758-0x00000000011C0000-0x00000000011CA000-memory.dmp

Filesize
40KB

Download
memory/2656-766-0x0000000007EC0000-0x0000000007ECA000-memory.dmp

Filesize
40KB

Download
memory/2656-764-0x0000000007EC0000-0x0000000007ECA000-memory.dmp

Filesize
40KB

Download
memory/2656-772-0x0000000007ED0000-0x0000000007EDA000-memory.dmp

Filesize
40KB

Download
memory/2656-774-0x0000000007F70000-0x0000000007F7A000-memory.dmp

Filesize
40KB

Download
memory/2656-779-0x0000000007F90000-0x0000000007F9A000-memory.dmp

Filesize
40KB

Download
memory/2656-778-0x0000000007F90000-0x0000000007F9A000-memory.dmp

Filesize
40KB

Download
memory/2656-777-0x0000000007F90000-0x0000000007F9A000-memory.dmp

Filesize
40KB

Download
memory/2656-776-0x0000000007F70000-0x0000000007F7A000-memory.dmp

Filesize
40KB

Download
memory/2656-775-0x0000000007F70000-0x0000000007F7A000-memory.dmp

Filesize
40KB

Download
memory/2656-798-0x0000000007EC0000-0x0000000007ECA000-memory.dmp

Filesize
40KB

Download
memory/2656-799-0x0000000007EC0000-0x0000000007ECA000-memory.dmp

Filesize
40KB

Download
memory/2656-800-0x0000000007ED0000-0x0000000007EDA000-memory.dmp

Filesize
40KB

Download