zoom.us
executablemacOS101.2 KBarm64
Application helper — manages keychain access and interprocess communication
Performs credential and certificate operations through Keychain access, likely supporting a parent application's authentication or signing workflows. Communicates with other applications via shared IPC group containers to coordinate state or data. Makes network calls to 13 different endpoints, suggesting integration with remote services for certificate validation, credential synchronization, or security token operations. The combination of Keychain entitlements with IPC group container access indicates this runs as a helper process managing security operations on behalf of multiple related applications.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- arm64
- Min OS
- 11.0.0
- SDK
- 15.1.0
- File Size
- 101.2 KB
- UUID
- DB430DCF-6EE7-376B-B34B-803A165FA66A
- Analyzed
- 2026-04-09T08:31:44Z
- Team ID
- BJ4HAAB9B3
- CDHash
- c7cabc295d1c73fc8ec1a9e527234a164e312928804b8cda1ff2308a171667b6
Capabilities
IpcShared application group container access
com.apple.security.application-groupsSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecurityFrameworks28
UserNotifications(weak)ZoomUnitSecurityZoomKitPrismCocoaZoomSettingFoundationlibobjc.A.dyliblibc++.1.dyliblibSystem.B.dylibAppKitCoreFoundationCoreServiceslibswiftCore.dyliblibswiftCoreFoundation.dylib(weak)libswiftCoreImage.dylib(weak)libswiftDarwin.dylib(weak)libswiftDispatch.dylib(weak)libswiftIOKit.dylib(weak)libswiftMetal.dylib(weak)libswiftOSLog.dylib(weak)libswiftObjectiveC.dylib(weak)libswiftQuartzCore.dylib(weak)libswiftUniformTypeIdentifiers.dylib(weak)libswiftXPC.dylib(weak)libswiftos.dylib(weak)libswiftFoundation.dylib(weak)
Entitlements8
Interesting Strings
Bundle IDs(16)
File Paths(12)
%@/Contents/Library/LaunchAgents/ZoomUpdater.app/Contents/MacOS/ZoomUpdater/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit/System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
Network Surface
Networking Frameworks
Endpoints(13)
Hostnamezoom.us
Ipv60:8:16
Hostnamewww.apple.com
Hostnamedevep-int.zoomdev.us
Hostnamecrl.apple.com
Hostnameocsp.apple.com
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
1
Analytics
0
Security
1
System
0
Behavioral Profile
URL Endpoints
7
Telemetry Strings
0
File Paths
12
Bundle IDs
16
IOKit Constants
0
Library Functions
9
Structural HashesSHA-256
Static Libraries9 / 121 functions identified
Identified Libraries
Functions(121)
0x1000041ac-[ZMAppBaseDelegate cleanUp]
0x10000423c-[ZMAppBaseDelegate applicationWillFinishLaunching:]
0x100004240-[ZMAppBaseDelegate applicationDidFinishLaunching:]
0x100004280-[ZMAppBaseDelegate beforeLoadModules]
0x10000438c-[ZMAppBaseDelegate loadModules]
0x100004424-[ZMAppBaseDelegate afterLoadModules]
0x10000442c-[ZMAppBaseDelegate applicationWillBecomeActive:]
0x100004458-[ZMAppBaseDelegate applicationDidBecomeActive:]
0x100004484-[ZMAppBaseDelegate applicationWillResignActive:]
0x1000044b0-[ZMAppBaseDelegate applicationDidResignActive:]
0x1000044dc-[ZMAppBaseDelegate initLoaderMgr]
0x100004564-[ZMAppBaseDelegate loadZPMModule]
0x100004578-[ZMAppBaseDelegate updateAppAppearance]
0x1000045f4-[ZMAppBaseDelegate requestUserNotificationAuthorization]
0x10000461c-[ZMAppBaseDelegate initAppNotifications]
0x100004684-[ZMAppBaseDelegate observeValueForKeyPath:ofObject:change:context:]
0x100004754-[ZMAppBaseDelegate onConfirmLeavingPT:]
0x100004758-[ZMAppBaseDelegate quitPTApplication]
0x100004784-[ZMAppBaseDelegate zmLoaderMgr]
0x10000478c-[ZMAppBaseDelegate setZmLoaderMgr:]
Imports168 symbols from 13 dylibs
Exports1
_mh_execute_header0x0