Trojan.Siggen34.18701

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Classes\ZoomLauncher\shell\open\command] '' = '"%APPDATA%\Zoom\bin\Zoom.exe" "--url=%1"'
[HKCU\Software\Classes\zoommtg\shell\open\command] '' = '"%APPDATA%\Zoom\bin\Zoom.exe" "--url=%1"'
[HKCU\Software\Classes\zoomus\shell\open\command] '' = '"%APPDATA%\Zoom\bin\Zoom.exe" "--url=%1"'
[HKCU\Software\Classes\ZoomRecording\shell\open\command] '' = '"%APPDATA%\Zoom\bin\zTscoder.exe" "%1"'
[HKCU\SOFTWARE\Classes\ZoomPhoneCall\shell\open\command] '' = '"%APPDATA%\Zoom\bin\Zoom.exe" --url="%l"'
[HKCU\SOFTWARE\Classes\ZoomPbx.zoomphonecall\shell\open\command] '' = '"%APPDATA%\Zoom\bin\Zoom.exe" --url="%l"'

Creates or modifies the following files

<SYSTEM32>\tasks\zoom-auto-installer
<SYSTEM32>\tasks\zoomupdatetaskuser-s-1-5-21-4226853953-3309226944-3078887307-1000

Malicious functions

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\wscript.exe

Modifies file system

Creates the following files

C:\users\public\videos\desktop.ps1
C:\users\public\videos\desktop.vbs
C:\users\public\downloads\zoominstaller.exe
%TEMP%\7zscca20bfe\installer.exe
%TEMP%\7zscca20bfe\zoom.msi
%APPDATA%\zoom\installer.txt
%TEMP%\zm_upgrade_record.tmp
%APPDATA%\zoom\zoom_install_src\archival.pcm
%APPDATA%\zoom\zoom_install_src\clap-high.pcm
%APPDATA%\zoom\zoom_install_src\clap-medium.pcm
%APPDATA%\zoom\zoom_install_src\crashrpt_lang.ini
%APPDATA%\zoom\zoom_install_src\dingdong.pcm
%APPDATA%\zoom\zoom_install_src\dingdong1.pcm
%APPDATA%\zoom\zoom_install_src\directui_license.txt
%APPDATA%\zoom\zoom_install_src\droplet.pcm
%APPDATA%\zoom\zoom_install_src\duilib_license.txt
%APPDATA%\zoom\zoom_install_src\leave.pcm
%APPDATA%\zoom\zoom_install_src\meeting_chat_chime.pcm
%APPDATA%\zoom\zoom_install_src\meeting_raisehand_chime.pcm
%APPDATA%\zoom\zoom_install_src\mute.pcm
%APPDATA%\zoom\zoom_install_src\nanosvg_license.txt
%APPDATA%\zoom\zoom_install_src\pcm\beep_intercom.pcm
%APPDATA%\zoom\zoom_install_src\pcm\double_beep.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_0.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_1.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_2.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_3.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_4.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_5.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_6.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_7.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_8.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_9.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_a.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_hash.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_star.pcm
%APPDATA%\zoom\zoom_install_src\pcm\ring_pstn.pcm
%APPDATA%\zoom\zoom_install_src\percussion.pcm
%APPDATA%\zoom\zoom_install_src\percussion_pause.pcm
%APPDATA%\zoom\zoom_install_src\record_start.pcm
%APPDATA%\zoom\zoom_install_src\record_stop.pcm
%APPDATA%\zoom\zoom_install_src\ring.pcm
%APPDATA%\zoom\zoom_install_src\ring_spatial.pcm
%APPDATA%\zoom\zoom_install_src\unmute.pcm
%APPDATA%\zoom\zoom_install_src\win10rt.7z
%APPDATA%\zoom\zoom_install_src\wr_ding.pcm
%APPDATA%\zoom\zoom_install_src\zoominstall.xml
%APPDATA%\zoom\zoom_install_src\annoter.dll
%APPDATA%\zoom\zoom_install_src\asproxy.dll
%APPDATA%\zoom\zoom_install_src\cares.dll
%APPDATA%\zoom\zoom_install_src\cmmbiz.dll
%APPDATA%\zoom\zoom_install_src\cmmbrowserengine.dll
%APPDATA%\zoom\zoom_install_src\cmmlib.dll
%APPDATA%\zoom\zoom_install_src\cptcontrol.exe
%APPDATA%\zoom\zoom_install_src\cpthost.exe
%APPDATA%\zoom\zoom_install_src\cptinstall.exe
%APPDATA%\zoom\zoom_install_src\cptservice.exe
%APPDATA%\zoom\zoom_install_src\cptshare.dll
%APPDATA%\zoom\zoom_install_src\cptuwpcapture.dll
%APPDATA%\zoom\zoom_install_src\duilib.dll
%APPDATA%\zoom\zoom_install_src\libcrypto-3-zm.dll
%APPDATA%\zoom\zoom_install_src\libcurl.dll
%APPDATA%\zoom\zoom_install_src\libmpg123.dll
%APPDATA%\zoom\zoom_install_src\libssl-3-zm.dll
%APPDATA%\zoom\zoom_install_src\mcm.dll
%APPDATA%\zoom\zoom_install_src\mfadapter.dll
%APPDATA%\zoom\zoom_install_src\msaalib.dll
%APPDATA%\zoom\zoom_install_src\nydus.dll
%APPDATA%\zoom\zoom_install_src\reslib.dll
%APPDATA%\zoom\zoom_install_src\ssb_sdk.dll
%APPDATA%\zoom\zoom_install_src\tp.dll
%APPDATA%\zoom\zoom_install_src\turbojpeg.dll
%APPDATA%\zoom\zoom_install_src\uibase.dll
%APPDATA%\zoom\zoom_install_src\util.dll
%APPDATA%\zoom\zoom_install_src\viper.dll
%APPDATA%\zoom\zoom_install_src\viper_async_device.dll
%APPDATA%\zoom\zoom_install_src\webview2loader.dll
%APPDATA%\zoom\zoom_install_src\xmppdll.dll
%APPDATA%\zoom\zoom_install_src\zautoupdate.dll
%APPDATA%\zoom\zoom_install_src\zbusinessuicomponent.dll
%APPDATA%\zoom\zoom_install_src\zchatui.dll
%APPDATA%\zoom\zoom_install_src\zcommonchatutils.dll
%APPDATA%\zoom\zoom_install_src\zcontext.dll
%APPDATA%\zoom\zoom_install_src\zcrashreport64.dll
%APPDATA%\zoom\zoom_install_src\zcrashreport64.exe
%APPDATA%\zoom\zoom_install_src\zdata.dll
%APPDATA%\zoom\zoom_install_src\zeventtracker.dll
%APPDATA%\zoom\zoom_install_src\zkbcrypto.dll
%APPDATA%\zoom\zoom_install_src\zlooper.dll
%APPDATA%\zoom\zoom_install_src\zlt.dll
%APPDATA%\zoom\zoom_install_src\zmbrecord.dll
%APPDATA%\zoom\zoom_install_src\zmcmservice.dll
%APPDATA%\zoom\zoom_install_src\zmdb.dll
%APPDATA%\zoom\zoom_install_src\zmeshnetagent.dll
%APPDATA%\zoom\zoom_install_src\zm_conf_universal_ui.dll
%APPDATA%\zoom\zoom_install_src\znet.dll
%APPDATA%\zoom\zoom_install_src\znetutils.dll
%APPDATA%\zoom\zoom_install_src\zoom.exe
%APPDATA%\zoom\zoom_install_src\zoombase_crypto_shared.dll
%APPDATA%\zoom\zoom_install_src\zoomdocconverter.exe
%APPDATA%\zoom\zoom_install_src\zoomoutlookimplugin.exe
%APPDATA%\zoom\zoom_install_src\zoomtask.dll
%APPDATA%\zoom\zoom_install_src\zoomtelemetry.dll
%APPDATA%\zoom\zoom_install_src\zoom_launcher.exe
%APPDATA%\zoom\zoom_install_src\zoutlookimutil.dll
%APPDATA%\zoom\zoom_install_src\zpsapp.dll
%APPDATA%\zoom\zoom_install_src\zptapp.dll
%APPDATA%\zoom\zoom_install_src\zsettingui.dll
%APPDATA%\zoom\zoom_install_src\zui.dll
%APPDATA%\zoom\zoom_install_src\zuiclient.dll
%APPDATA%\zoom\zoom_install_src\zunifywebviewapp.dll
%APPDATA%\zoom\zoom_install_src\zupdater.exe
%APPDATA%\zoom\zoom_install_src\zvideoapp.dll
%APPDATA%\zoom\zoom_install_src\zvideoappframe.dll
%APPDATA%\zoom\zoom_install_src\zvideoui.dll
%APPDATA%\zoom\zoom_install_src\zwbui.dll
%APPDATA%\zoom\zoom_install_src\zwbuires.dll
%APPDATA%\zoom\zoom_install_src\zwebservice.dll
%APPDATA%\zoom\zoom_install_src\zwinres.dll
%APPDATA%\zoom\zoom_install_src\zzhost.dll
%APPDATA%\zoom\zoom_install_src\zzhostipcsdk.dll
%APPDATA%\zoom\tmp_bin\msaalib.dll
%APPDATA%\zoom\tmp_bin\cmmbrowserengine.dll
%APPDATA%\zoom\tmp_bin\cmmlib.dll
%APPDATA%\zoom\tmp_bin\zcontext.dll
%APPDATA%\zoom\tmp_bin\cmmbiz.dll
%APPDATA%\zoom\tmp_bin\zunifywebviewapp.dll
%APPDATA%\zoom\tmp_bin\cpthost.exe
%APPDATA%\zoom\tmp_bin\cptshare.dll
%APPDATA%\zoom\tmp_bin\cptuwpcapture.dll
%APPDATA%\zoom\tmp_bin\crashrpt_lang.ini
%APPDATA%\zoom\tmp_bin\libcrypto-3-zm.dll
%APPDATA%\zoom\tmp_bin\libcurl.dll
%APPDATA%\zoom\tmp_bin\mcm.dll
%APPDATA%\zoom\tmp_bin\zmbrecord.dll
%APPDATA%\zoom\tmp_bin\nydus.dll
%APPDATA%\zoom\tmp_bin\ring.pcm
%APPDATA%\zoom\tmp_bin\ring_spatial.pcm
%APPDATA%\zoom\tmp_bin\mute.pcm
%APPDATA%\zoom\tmp_bin\unmute.pcm
%APPDATA%\zoom\tmp_bin\dingdong.pcm
%APPDATA%\zoom\tmp_bin\dingdong1.pcm
%APPDATA%\zoom\tmp_bin\record_start.pcm
%APPDATA%\zoom\tmp_bin\record_stop.pcm
%APPDATA%\zoom\tmp_bin\wr_ding.pcm
%APPDATA%\zoom\tmp_bin\ssb_sdk.dll
%APPDATA%\zoom\tmp_bin\libssl-3-zm.dll
%APPDATA%\zoom\tmp_bin\tp.dll
%APPDATA%\zoom\tmp_bin\turbojpeg.dll
%APPDATA%\zoom\tmp_bin\util.dll
%APPDATA%\zoom\tmp_bin\viper.dll
%APPDATA%\zoom\tmp_bin\zautoupdate.dll
%APPDATA%\zoom\tmp_bin\zptapp.dll
%APPDATA%\zoom\tmp_bin\zcommonchatutils.dll
%APPDATA%\zoom\tmp_bin\zchatui.dll
%APPDATA%\zoom\tmp_bin\zmcmservice.dll
%APPDATA%\zoom\tmp_bin\zcrashreport64.dll
%APPDATA%\zoom\tmp_bin\zcrashreport64.exe
%APPDATA%\zoom\tmp_bin\zdata.dll
%APPDATA%\zoom\tmp_bin\zwinres.dll
%APPDATA%\zoom\tmp_bin\zlt.dll
%APPDATA%\zoom\tmp_bin\zoom.exe
%APPDATA%\zoom\tmp_bin\zoom_launcher.exe
%APPDATA%\zoom\tmp_bin\zoominstall.xml
%APPDATA%\zoom\tmp_bin\zvideoapp.dll
%APPDATA%\zoom\tmp_bin\zvideoappframe.dll
%APPDATA%\zoom\tmp_bin\zvideoui.dll
%APPDATA%\zoom\tmp_bin\zwebservice.dll
%APPDATA%\zoom\tmp_bin\zeventtracker.dll
%APPDATA%\zoom\tmp_bin\znet.dll
%APPDATA%\zoom\tmp_bin\znetutils.dll
%APPDATA%\zoom\tmp_bin\cares.dll
%APPDATA%\zoom\tmp_bin\annoter.dll
%APPDATA%\zoom\tmp_bin\zwbuires.dll
%APPDATA%\zoom\tmp_bin\zwbui.dll
%APPDATA%\zoom\tmp_bin\clap-high.pcm
%APPDATA%\zoom\tmp_bin\clap-medium.pcm
%APPDATA%\zoom\tmp_bin\zpsapp.dll
%APPDATA%\zoom\tmp_bin\zui.dll
%APPDATA%\zoom\tmp_bin\zuiclient.dll
%APPDATA%\zoom\tmp_bin\reslib.dll
%APPDATA%\zoom\tmp_bin\duilib.dll
%APPDATA%\zoom\tmp_bin\directui_license.txt
%APPDATA%\zoom\tmp_bin\duilib_license.txt
%APPDATA%\zoom\tmp_bin\xmppdll.dll
%APPDATA%\zoom\tmp_bin\asproxy.dll
%APPDATA%\zoom\tmp_bin\leave.pcm
%APPDATA%\zoom\tmp_bin\cptinstall.exe
%APPDATA%\zoom\tmp_bin\cptservice.exe
%APPDATA%\zoom\tmp_bin\cptcontrol.exe
%APPDATA%\zoom\tmp_bin\zzhost.dll
%APPDATA%\zoom\tmp_bin\libmpg123.dll
%APPDATA%\zoom\tmp_bin\nanosvg_license.txt
%APPDATA%\zoom\tmp_bin\meeting_raisehand_chime.pcm
%APPDATA%\zoom\tmp_bin\meeting_chat_chime.pcm
%APPDATA%\zoom\tmp_bin\zoomdocconverter.exe
%APPDATA%\zoom\tmp_bin\droplet.pcm
%APPDATA%\zoom\tmp_bin\zupdater.exe
%APPDATA%\zoom\tmp_bin\api-ms-win-core-console-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-console-l1-2-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-datetime-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-debug-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-errorhandling-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-fibers-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-fibers-l1-1-1.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-file-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-file-l1-2-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-file-l2-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-handle-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-heap-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-interlocked-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-kernel32-legacy-l1-1-1.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-libraryloader-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-localization-l1-2-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-memory-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-namedpipe-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-processenvironment-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-processthreads-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-processthreads-l1-1-1.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-profile-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-rtlsupport-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-string-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-synch-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-synch-l1-2-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-sysinfo-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-sysinfo-l1-2-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-timezone-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-util-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-conio-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-convert-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-environment-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-filesystem-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-heap-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-locale-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-math-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-multibyte-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-private-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-process-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-runtime-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-stdio-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-string-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-time-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-utility-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\concrt140.dll
%APPDATA%\zoom\tmp_bin\msvcp140.dll
%APPDATA%\zoom\tmp_bin\msvcp140_1.dll
%APPDATA%\zoom\tmp_bin\msvcp140_2.dll
%APPDATA%\zoom\tmp_bin\msvcp140_atomic_wait.dll
%APPDATA%\zoom\tmp_bin\msvcp140_codecvt_ids.dll
%APPDATA%\zoom\tmp_bin\ucrtbase.dll
%APPDATA%\zoom\tmp_bin\vccorlib140.dll
%APPDATA%\zoom\tmp_bin\vcruntime140.dll
%APPDATA%\zoom\tmp_bin\vcruntime140_1.dll
%APPDATA%\zoom\tmp_bin\vcruntime140_threads.dll
%APPDATA%\zoom\tmp_bin\zoomoutlookimplugin.exe
%APPDATA%\zoom\tmp_bin\uibase.dll
%APPDATA%\zoom\tmp_bin\zkbcrypto.dll
%APPDATA%\zoom\tmp_bin\zoombase_crypto_shared.dll
%APPDATA%\zoom\tmp_bin\zoutlookimutil.dll
%APPDATA%\zoom\tmp_bin\zzhostipcsdk.dll
%APPDATA%\zoom\tmp_bin\mfadapter.dll
%APPDATA%\zoom\tmp_bin\viper_async_device.dll
%APPDATA%\zoom\tmp_bin\webview2loader.dll
%APPDATA%\zoom\tmp_bin\archival.pcm
%APPDATA%\zoom\tmp_bin\percussion.pcm
%APPDATA%\zoom\tmp_bin\percussion_pause.pcm
%APPDATA%\zoom\tmp_bin\zmeshnetagent.dll
%APPDATA%\zoom\tmp_bin\pcm\dtmf_0.pcm
%APPDATA%\zoom\tmp_bin\pcm\dtmf_1.pcm
%APPDATA%\zoom\tmp_bin\pcm\dtmf_2.pcm
%APPDATA%\zoom\tmp_bin\pcm\dtmf_3.pcm
%APPDATA%\zoom\tmp_bin\pcm\dtmf_4.pcm
%APPDATA%\zoom\tmp_bin\pcm\dtmf_5.pcm
%APPDATA%\zoom\tmp_bin\pcm\dtmf_6.pcm
%APPDATA%\zoom\tmp_bin\pcm\dtmf_7.pcm
%APPDATA%\zoom\tmp_bin\pcm\dtmf_8.pcm
%APPDATA%\zoom\tmp_bin\pcm\dtmf_9.pcm
%APPDATA%\zoom\tmp_bin\pcm\dtmf_a.pcm
%APPDATA%\zoom\tmp_bin\pcm\dtmf_star.pcm
%APPDATA%\zoom\tmp_bin\pcm\dtmf_hash.pcm
%APPDATA%\zoom\tmp_bin\pcm\ring_pstn.pcm
%APPDATA%\zoom\tmp_bin\pcm\beep_intercom.pcm
%APPDATA%\zoom\tmp_bin\pcm\double_beep.pcm
%APPDATA%\zoom\tmp_bin\zbusinessuicomponent.dll
%APPDATA%\zoom\tmp_bin\zoomtask.dll
%APPDATA%\zoom\tmp_bin\zmdb.dll
%APPDATA%\zoom\tmp_bin\zm_conf_universal_ui.dll
%APPDATA%\zoom\tmp_bin\zlooper.dll
%APPDATA%\zoom\tmp_bin\zsettingui.dll
%APPDATA%\zoom\tmp_bin\installer.exe
%APPDATA%\zoom\tmp_uninstall\installer.exe
nul
%APPDATA%\microsoft\windows\start menu\programs\zoom\zoom workplace.lnk
%APPDATA%\microsoft\windows\start menu\programs\zoom\uninstall zoom workplace.lnk
%APPDATA%\zoom\data\zoomus.zmdb.default.noenc.rlock.db-journal
%APPDATA%\zoom\data\zoomus.zmdb.default.noenc.rlock.db
%APPDATA%\zoom\data\zoom.us.ini
%APPDATA%\zoom\data\local_dns_cache.db-journal
%APPDATA%\zoom\data\local_dns_cache.db
%APPDATA%\zoom\data\zoomus.zmdb.kvs.enc.db-journal
%APPDATA%\zoom\data\zoomus.zmdb.kvs.enc.db
%APPDATA%\zoom\data\3dcustomavatar.enc.db-journal
%APPDATA%\zoom\data\3dcustomavatar.enc.db
%APPDATA%\zoom\data\process_monitoring.db-journal
%APPDATA%\zoom\data\process_monitoring.db
%APPDATA%\zoom\data\zoomus.enc.db-journal
%APPDATA%\zoom\data\zoomus.enc.db
%APPDATA%\zoom\data\zoomus.tmp.enc.db-journal
%APPDATA%\zoom\data\zoomus.tmp.enc.db
%APPDATA%\zoom\data\zoom_conf_local_asr.enc.db-journal
%APPDATA%\zoom\data\zoom_conf_local_asr.enc.db
%LOCALAPPDATA%\d3dscache\27079885d0c7ce7b\f4eb2d6c-ed2b-4bdd-ad9d-f913287e6768.idx
%LOCALAPPDATA%\d3dscache\27079885d0c7ce7b\f4eb2d6c-ed2b-4bdd-ad9d-f913287e6768.lock
%LOCALAPPDATA%\d3dscache\27079885d0c7ce7b\f4eb2d6c-ed2b-4bdd-ad9d-f913287e6768.val
%APPDATA%\zoom\data\viper.ini
%APPDATA%\zoom\logs\zoom_feedback\pt\zoom_memlog_5064_20260922-011722.log.zenc
%TEMP%\zcompt~1.cab.zmdownload
%TEMP%\zclips~1.zmdownload
%TEMP%\zlang~1.7z{.zmdownload
%APPDATA%\zoom\bin\temp_psapp\zpsui.dll
%APPDATA%\zoom\bin\temp_psapp\zclipsapp.dll
%APPDATA%\zoom\bin\temp_psapp\swscale_zm-8.dll
%APPDATA%\zoom\bin\temp_psapp\avcodec_zm-61.dll
%APPDATA%\zoom\bin\temp_psapp\avformat_zm-61.dll
%APPDATA%\zoom\bin\temp_psapp\avutil_zm-59.dll
%APPDATA%\zoom\bin\temp_psapp\swresample_zm-5.dll
%APPDATA%\zoom\bin\temp_psapp\zm_clips_universal_ui.dll
%APPDATA%\zoom\bin\avcodec_zm-61.dll
%APPDATA%\zoom\bin\avformat_zm-61.dll
%APPDATA%\zoom\bin\avutil_zm-59.dll
%APPDATA%\zoom\bin\swresample_zm-5.dll
%APPDATA%\zoom\bin\swscale_zm-8.dll
%APPDATA%\zoom\bin\zclipsapp.dll
%APPDATA%\zoom\bin\zm_clips_universal_ui.dll
%APPDATA%\zoom\bin\zpsui.dll
%APPDATA%\zoom\bin\language\zlang_de.dll
%APPDATA%\zoom\bin\language\zlang_es.dll
%APPDATA%\zoom\bin\language\zlang_fr.dll
%APPDATA%\zoom\bin\language\zlang_id.dll
%APPDATA%\zoom\bin\language\zlang_it.dll
%APPDATA%\zoom\bin\language\zlang_jp.dll
%APPDATA%\zoom\bin\language\zlang_korean.dll
%APPDATA%\zoom\bin\language\zlang_nl.dll
%APPDATA%\zoom\bin\language\zlang_pl.dll
%APPDATA%\zoom\bin\language\zlang_ptg.dll
%APPDATA%\zoom\bin\language\zlang_ru.dll
%APPDATA%\zoom\bin\language\zlang_sv.dll
%APPDATA%\zoom\bin\language\zlang_tr.dll
%APPDATA%\zoom\bin\language\zlang_vi.dll
%APPDATA%\zoom\bin\language\zlang_zh_cn.dll
%APPDATA%\zoom\bin\language\zlang_zh_tw.dll
%TEMP%\zcompt~1.cab
%APPDATA%\zoom\bin\license-skia.txt
%APPDATA%\zoom\bin\amd_ags_x64.dll
%APPDATA%\zoom\bin\libmagic.dll
%APPDATA%\zoom\bin\offline_audio.dll
%APPDATA%\zoom\bin\spacesclient.dll
%APPDATA%\zoom\bin\zapp.dll
%APPDATA%\zoom\bin\zappres.dll
%APPDATA%\zoom\bin\zappui.dll
%APPDATA%\zoom\bin\zbt.dll
%APPDATA%\zoom\bin\zccimeeting.dll
%APPDATA%\zoom\bin\zcciui.dll
%APPDATA%\zoom\bin\zccivideo.dll
%APPDATA%\zoom\bin\zchatjsres.dll
%APPDATA%\zoom\bin\zchatuiplugin.dll
%APPDATA%\zoom\bin\zchatuipluginim.dll
%APPDATA%\zoom\bin\zcommonchat.dll
%APPDATA%\zoom\bin\zcommonchatres.dll
%APPDATA%\zoom\bin\zcontinuitymedia.dll
%APPDATA%\zoom\bin\zcustomizemeetingui.dll
%APPDATA%\zoom\bin\zdiagnostic.dll
%APPDATA%\zoom\bin\zhybridsdk.dll
%APPDATA%\zoom\bin\zhybridsdkhost.dll
%APPDATA%\zoom\bin\zmbtranscode.dll
%APPDATA%\zoom\bin\zmscheduler.dll
%APPDATA%\zoom\bin\zmsgapp.dll
%APPDATA%\zoom\bin\zmsgappcommon.dll
%APPDATA%\zoom\bin\zm_conf_universal_ui_plugin.dll
%APPDATA%\zoom\bin\znetdiagnostic.dll
%APPDATA%\zoom\bin\zoomhybridconf.exe
%APPDATA%\zoom\bin\zoomproxy.dll
%APPDATA%\zoom\bin\zoomspeechsdk.dll
%APPDATA%\zoom\bin\zoomtelemetry.dll
%APPDATA%\zoom\bin\zoom_meeting_bridge.dll
%APPDATA%\zoom\bin\zpremeetingapp.dll
%APPDATA%\zoom\bin\zptkbcrypto.dll
%APPDATA%\zoom\bin\zrenderengine.dll
%APPDATA%\zoom\bin\zsafechecker.exe
%APPDATA%\zoom\bin\zspacesui.dll
%APPDATA%\zoom\bin\ztelemetrybiz.dll
%APPDATA%\zoom\bin\ztoolsuiteipchost.dll
%APPDATA%\zoom\bin\ztscoder.exe
%APPDATA%\zoom\bin\zvideoappplugin.dll
%APPDATA%\zoom\bin\zvideouiplugin.dll
%APPDATA%\zoom\bin\zvideouipluginres.dll
%APPDATA%\zoom\bin\zvoicenotesconfui.dll
%APPDATA%\zoom\bin\zwebhomepageres.dll
%APPDATA%\zoom\bin\zwebview2agent.exe
%APPDATA%\zoom\data\telemetrydata.db-journal
%APPDATA%\zoom\data\telemetrydata.db
%APPDATA%\zoom\data\transcoding.ini

Deletes following files that it created itself

%APPDATA%\zoom\zoom_install_src\annoter.dll
%APPDATA%\zoom\zoom_install_src\archival.pcm
%APPDATA%\zoom\zoom_install_src\asproxy.dll
%APPDATA%\zoom\zoom_install_src\cares.dll
%APPDATA%\zoom\zoom_install_src\clap-high.pcm
%APPDATA%\zoom\zoom_install_src\clap-medium.pcm
%APPDATA%\zoom\zoom_install_src\cmmbiz.dll
%APPDATA%\zoom\zoom_install_src\cmmbrowserengine.dll
%APPDATA%\zoom\zoom_install_src\cmmlib.dll
%APPDATA%\zoom\zoom_install_src\cptcontrol.exe
%APPDATA%\zoom\zoom_install_src\cpthost.exe
%APPDATA%\zoom\zoom_install_src\cptinstall.exe
%APPDATA%\zoom\zoom_install_src\cptservice.exe
%APPDATA%\zoom\zoom_install_src\cptshare.dll
%APPDATA%\zoom\zoom_install_src\cptuwpcapture.dll
%APPDATA%\zoom\zoom_install_src\crashrpt_lang.ini
%APPDATA%\zoom\zoom_install_src\dingdong.pcm
%APPDATA%\zoom\zoom_install_src\dingdong1.pcm
%APPDATA%\zoom\zoom_install_src\directui_license.txt
%APPDATA%\zoom\zoom_install_src\droplet.pcm
%APPDATA%\zoom\zoom_install_src\duilib.dll
%APPDATA%\zoom\zoom_install_src\duilib_license.txt
%APPDATA%\zoom\zoom_install_src\leave.pcm
%APPDATA%\zoom\zoom_install_src\libcrypto-3-zm.dll
%APPDATA%\zoom\zoom_install_src\libcurl.dll
%APPDATA%\zoom\zoom_install_src\libmpg123.dll
%APPDATA%\zoom\zoom_install_src\libssl-3-zm.dll
%APPDATA%\zoom\zoom_install_src\mcm.dll
%APPDATA%\zoom\zoom_install_src\meeting_chat_chime.pcm
%APPDATA%\zoom\zoom_install_src\meeting_raisehand_chime.pcm
%APPDATA%\zoom\zoom_install_src\mfadapter.dll
%APPDATA%\zoom\zoom_install_src\msaalib.dll
%APPDATA%\zoom\zoom_install_src\mute.pcm
%APPDATA%\zoom\zoom_install_src\nanosvg_license.txt
%APPDATA%\zoom\zoom_install_src\nydus.dll
%APPDATA%\zoom\zoom_install_src\pcm\beep_intercom.pcm
%APPDATA%\zoom\zoom_install_src\pcm\double_beep.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_0.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_1.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_2.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_3.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_4.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_5.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_6.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_7.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_8.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_9.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_a.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_hash.pcm
%APPDATA%\zoom\zoom_install_src\pcm\dtmf_star.pcm
%APPDATA%\zoom\zoom_install_src\pcm\ring_pstn.pcm
%APPDATA%\zoom\zoom_install_src\percussion.pcm
%APPDATA%\zoom\zoom_install_src\percussion_pause.pcm
%APPDATA%\zoom\zoom_install_src\record_start.pcm
%APPDATA%\zoom\zoom_install_src\record_stop.pcm
%APPDATA%\zoom\zoom_install_src\reslib.dll
%APPDATA%\zoom\zoom_install_src\ring.pcm
%APPDATA%\zoom\zoom_install_src\ring_spatial.pcm
%APPDATA%\zoom\zoom_install_src\ssb_sdk.dll
%APPDATA%\zoom\zoom_install_src\tp.dll
%APPDATA%\zoom\zoom_install_src\turbojpeg.dll
%APPDATA%\zoom\zoom_install_src\uibase.dll
%APPDATA%\zoom\zoom_install_src\unmute.pcm
%APPDATA%\zoom\zoom_install_src\util.dll
%APPDATA%\zoom\zoom_install_src\viper.dll
%APPDATA%\zoom\zoom_install_src\viper_async_device.dll
%APPDATA%\zoom\zoom_install_src\webview2loader.dll
%APPDATA%\zoom\zoom_install_src\win10rt.7z
%APPDATA%\zoom\zoom_install_src\wr_ding.pcm
%APPDATA%\zoom\zoom_install_src\xmppdll.dll
%APPDATA%\zoom\zoom_install_src\zautoupdate.dll
%APPDATA%\zoom\zoom_install_src\zbusinessuicomponent.dll
%APPDATA%\zoom\zoom_install_src\zchatui.dll
%APPDATA%\zoom\zoom_install_src\zcommonchatutils.dll
%APPDATA%\zoom\zoom_install_src\zcontext.dll
%APPDATA%\zoom\zoom_install_src\zcrashreport64.dll
%APPDATA%\zoom\zoom_install_src\zcrashreport64.exe
%APPDATA%\zoom\zoom_install_src\zdata.dll
%APPDATA%\zoom\zoom_install_src\zeventtracker.dll
%APPDATA%\zoom\zoom_install_src\zkbcrypto.dll
%APPDATA%\zoom\zoom_install_src\zlooper.dll
%APPDATA%\zoom\zoom_install_src\zlt.dll
%APPDATA%\zoom\zoom_install_src\zmbrecord.dll
%APPDATA%\zoom\zoom_install_src\zmcmservice.dll
%APPDATA%\zoom\zoom_install_src\zmdb.dll
%APPDATA%\zoom\zoom_install_src\zmeshnetagent.dll
%APPDATA%\zoom\zoom_install_src\zm_conf_universal_ui.dll
%APPDATA%\zoom\zoom_install_src\znet.dll
%APPDATA%\zoom\zoom_install_src\znetutils.dll
%APPDATA%\zoom\zoom_install_src\zoom.exe
%APPDATA%\zoom\zoom_install_src\zoombase_crypto_shared.dll
%APPDATA%\zoom\zoom_install_src\zoomdocconverter.exe
%APPDATA%\zoom\zoom_install_src\zoominstall.xml
%APPDATA%\zoom\zoom_install_src\zoomoutlookimplugin.exe
%APPDATA%\zoom\zoom_install_src\zoomtask.dll
%APPDATA%\zoom\zoom_install_src\zoomtelemetry.dll
%APPDATA%\zoom\zoom_install_src\zoom_launcher.exe
%APPDATA%\zoom\zoom_install_src\zoutlookimutil.dll
%APPDATA%\zoom\zoom_install_src\zpsapp.dll
%APPDATA%\zoom\zoom_install_src\zptapp.dll
%APPDATA%\zoom\zoom_install_src\zsettingui.dll
%APPDATA%\zoom\zoom_install_src\zui.dll
%APPDATA%\zoom\zoom_install_src\zuiclient.dll
%APPDATA%\zoom\zoom_install_src\zunifywebviewapp.dll
%APPDATA%\zoom\zoom_install_src\zupdater.exe
%APPDATA%\zoom\zoom_install_src\zvideoapp.dll
%APPDATA%\zoom\zoom_install_src\zvideoappframe.dll
%APPDATA%\zoom\zoom_install_src\zvideoui.dll
%APPDATA%\zoom\zoom_install_src\zwbui.dll
%APPDATA%\zoom\zoom_install_src\zwbuires.dll
%APPDATA%\zoom\zoom_install_src\zwebservice.dll
%APPDATA%\zoom\zoom_install_src\zwinres.dll
%APPDATA%\zoom\zoom_install_src\zzhost.dll
%APPDATA%\zoom\zoom_install_src\zzhostipcsdk.dll
%TEMP%\7zscca20bfe\installer.exe
%TEMP%\7zscca20bfe\zoom.msi
%APPDATA%\zoom\data\zoomus.enc.db-journal
%APPDATA%\zoom\data\zoomus.tmp.enc.db-journal
%TEMP%\zclips~1.zmdownload
%TEMP%\zlang~1.7z{.zmdownload
%APPDATA%\zoom\bin\temp_psapp\avcodec_zm-61.dll
%APPDATA%\zoom\bin\temp_psapp\avformat_zm-61.dll
%APPDATA%\zoom\bin\temp_psapp\avutil_zm-59.dll
%APPDATA%\zoom\bin\temp_psapp\swresample_zm-5.dll
%APPDATA%\zoom\bin\temp_psapp\swscale_zm-8.dll
%APPDATA%\zoom\bin\temp_psapp\zclipsapp.dll
%APPDATA%\zoom\bin\temp_psapp\zm_clips_universal_ui.dll
%APPDATA%\zoom\bin\temp_psapp\zpsui.dll
%TEMP%\zcompt~1.cab.zmdownload
%TEMP%\zcompt~1.cab
%TEMP%\zm_upgrade_record_temp.tmp

Moves the following files

from %TEMP%\zm_upgrade_record.tmp to %TEMP%\zm_upgrade_record_temp.tmp

Substitutes the following files

%APPDATA%\zoom\data\zoomus.enc.db-journal

Network activity

Connects to

'cd#.zoom.us':443
'oc##.#igicert.cn':80
'11#.#2.246.145':12345
'zo#m.us':443

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bb##############
http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEA%2FgMquETQMxBsUMjhPIsGg%3D

Other

'cd#.zoom.us':443
'zo#m.us':443

UDP

DNS ASK cd#.zoom.us
DNS ASK oc##.#igicert.cn
DNS ASK zo#m.us
DNS ASK st#.zoom.us
'20#.#47.133.213':3478
'14#.#95.128.213':3478
'14#.#95.128.213':3479

Miscellaneous

Searches for the following windows

ClassName: 'zoom.us Installer Engine' WindowName: 'Zoom Workplace Installer'

Creates and executes the following

'C:\users\public\downloads\zoominstaller.exe'
'%TEMP%\7zscca20bfe\installer.exe'
'<SYSTEM32>\wscript.exe' C:\Users\Public\Videos\desktop.vbs
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Public\Videos\desktop.ps1"
'%TEMP%\7zscca20bfe\installer.exe' /addfwexception --bin_home="%APPDATA%\Zoom\bin"

Executes the following

'<SYSTEM32>\schtasks.exe' /create /tn "Zoom-Auto-Installer" /tr "<SYSTEM32>\wscript.exe C:\Users\Public\Videos\desktop.vbs" /sc minute /mo 1
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Public\Videos\desktop.ps1"' (with hidden window)
'%TEMP%\7zscca20bfe\installer.exe' /addfwexception --bin_home="%APPDATA%\Zoom\bin"' (with hidden window)

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial