41f7f163d85a7f2e5ecb97babe00f7db6b53c7040c924df27fd77da434cd4c66

Analysis

user interaction
yes
max time kernel
105s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZelloSetup (5).exe
Size 3.4MB
Sample260808-tzcw9avtes
SHA256 41f7f163d85a7f2e5ecb97babe00f7db6b53c7040c924df27fd77da434cd4c66
MD5 4de61ce5de9af05d98f07499b7510df9
SHA1 05192f0cc51f54d6a7f64a4f8355971cb59d9a9b
SHA512 2fc0d47621295416631d211c236f0539a457c8804d1a9024d75a377d6ac593d13d35dc88166223d58aed1a991f19a9d290a4007925955c85713fbec4ca57c815
SSDEEP 98304:T2B7+SpqzbwrfjtMnzgZhz+gH/Kksxvc8:T2x+0qfWjqnkZhFH/KksV
TLSH
T17CF53302F199457FCC331B3A6BA7C4DB498B7EBF9614D4C72BD937443A26EC4291A221
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zello = "\"C:\\Program Files (x86)\\Zello\\Zello.exe\" /background"	Zello.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	Zello.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 46 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Zello\Lng\fr	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\fr-CA	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\nl	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Snd\incoming.wav	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Snd\outgoing.wav	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Snd\error.wav	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Snd\chirsp.wav	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Snd\incoming_soft.wav	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\es	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\hr	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\ja	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\ro	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\sv	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\th	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\tr	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\cs	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\he	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\hu	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\pt	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\pt-br	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Snd\new_conversation.wav	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Snd\pow.wav	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\fi	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\gl	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\ms	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\pl	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\sk	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Snd\alert.wav	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Snd\image.wav	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Snd\out.wav	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\ar	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\bg	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\id	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Uninstall.exe	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Zello.exe	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\el	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\ru	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\zh	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\it	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\lt	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\sr	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\zh-Hans	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Snd\over.wav	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Snd\pttup.wav	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\de	ZelloSetup (5).exe
File created	C:\Program Files (x86)\Zello\Lng\en	ZelloSetup (5).exe

Executes dropped EXE 4 IoCs

pid	Process
3568	Zello.exe
820	Zello.exe
2956	Zello.exe
4200	Zello.exe

Loads dropped DLL 3 IoCs

pid	Process
3040	ZelloSetup (5).exe
3040	ZelloSetup (5).exe
3040	ZelloSetup (5).exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZelloSetup (5).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zello.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zello.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zello.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zello.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3768	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306802177789612"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{950D3738-3C16-41F0-B487-9DF73D439E00}	chrome.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	Zello.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	Zello.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1696	chrome.exe
1696	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe
2956	Zello.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2956	Zello.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3568	3040	ZelloSetup (5).exe	87
PID 3040 wrote to memory of 820	3040	ZelloSetup (5).exe	88
PID 3040 wrote to memory of 2956	3040	ZelloSetup (5).exe	90
PID 1696 wrote to memory of 2620	1696	chrome.exe	96
PID 1696 wrote to memory of 1088	1696	chrome.exe	97
PID 1696 wrote to memory of 1088	1696	chrome.exe	97
PID 1696 wrote to memory of 3768	1696	chrome.exe	98
PID 1696 wrote to memory of 5100	1696	chrome.exe	99
PID 1696 wrote to memory of 5100	1696	chrome.exe	99
PID 1696 wrote to memory of 8	1696	chrome.exe	101
PID 1696 wrote to memory of 4360	1696	chrome.exe	102
PID 1696 wrote to memory of 8	1696	chrome.exe	101
PID 1696 wrote to memory of 4360	1696	chrome.exe	102
PID 1696 wrote to memory of 820	1696	chrome.exe	103
PID 1696 wrote to memory of 820	1696	chrome.exe	103
PID 1696 wrote to memory of 1732	1696	chrome.exe	104
PID 1696 wrote to memory of 1300	1696	chrome.exe	106
PID 1696 wrote to memory of 1300	1696	chrome.exe	106
PID 1696 wrote to memory of 1908	1696	chrome.exe	107
PID 1696 wrote to memory of 1908	1696	chrome.exe	107
PID 1696 wrote to memory of 5044	1696	chrome.exe	111
PID 1696 wrote to memory of 892	1696	chrome.exe	110
PID 1696 wrote to memory of 5044	1696	chrome.exe	111

C:\Users\Admin\AppData\Local\Temp\ZelloSetup (5).exe
"C:\Users\Admin\AppData\Local\Temp\ZelloSetup (5).exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\Zello.exe
  "C:\Users\Admin\AppData\Local\Temp\Zello.exe" -preinstall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3568
- C:\Program Files (x86)\Zello\Zello.exe
  "C:\Program Files (x86)\Zello\Zello.exe" -install
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:820
- C:\Program Files (x86)\Zello\Zello.exe
  "C:\Program Files (x86)\Zello\Zello.exe"
  2⤵
  - Adds Run key to start application
  - Enumerates connected drives
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2956

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2cc 0x150
1⤵
PID:1896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb200dc728,0x7ffb200dc734,0x7ffb200dc740
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,15854359639425929890,7019016289092497023,262144 --field-trial-handle=1992,i,18188940854804673454,17726285132694475285,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2176,i,15144157720227742785,8551266281651446231,524288 --field-trial-handle=1992,i,18188940854804673454,17726285132694475285,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,14058586052744107327,6081457861400985886,524288 --field-trial-handle=1992,i,18188940854804673454,17726285132694475285,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,10728236412516521876,3309339890296613229,2097152 --field-trial-handle=1992,i,18188940854804673454,17726285132694475285,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,5843375099749270615,4285463310899365333,2097152 --field-trial-handle=1992,i,18188940854804673454,17726285132694475285,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4564,i,2820898408325549339,5023169730081466955,2097152 --field-trial-handle=1992,i,18188940854804673454,17726285132694475285,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,9179020156770363252,1470225525913619120,524288 --field-trial-handle=1992,i,18188940854804673454,17726285132694475285,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5456,i,11019272396348130185,13000014001522072124,2097152 --field-trial-handle=1992,i,18188940854804673454,17726285132694475285,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3424,i,2464496992327938467,9524646393340959518,2097152 --field-trial-handle=1992,i,18188940854804673454,17726285132694475285,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3296,i,10432965046663673218,15612840917463887928,524288 --field-trial-handle=1992,i,18188940854804673454,17726285132694475285,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Modifies registry class
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3948,i,6626515962776160424,15690643641406736343,524288 --field-trial-handle=1992,i,18188940854804673454,17726285132694475285,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:5044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3928

C:\Program Files (x86)\Zello\Zello.exe
"C:\Program Files (x86)\Zello\Zello.exe" /background
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Program Files (x86)\Zello\Lng\ar
Size 36KB
SHA256 f334483c44591953fb036b98430dc446408bc70c4cfeb17e1d63e272e59f6948
MD5 00f2780af84e49a496beb5891b7bdfbb
SHA1 b79fadb3258a689387d897962c703d82ca173972
SHA512 7d0331ac20f59ef0c09ba09b1e0b1177fb0daa8e77c07f1ed99dbfce0161d8b69f0925d96f975c4b0cd9b04443de3538e7af05f8ff89454742e575e885541434
SSDEEP 768:AAAqUtSWgNIsrp3e9LCTZS7Bb6sANAJfGIyf:Cqm9gNIOLg7EBAJfGIyf
TLSH
T155F27527C4614D7702F293837CCA5952F6A0934F83910C0B79BDD24C1FB658EE6DBAA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\bg
Size 51KB
SHA256 329a0d7cc29750af4ea0a62a3c304dc1ccefe0818100ebae292ed7fb536e283f
MD5 03d765775f7b617f90036a74176ae607
SHA1 b37e7cb6395e86eb052c0a859b64bcf9f3b4c8b9
SHA512 67dd1d6cc8b22ed4c0c16dbf197069bcd6131e7259b69b51f4b7a321c5eeaca83717921a20224e4c92c9851165de904ab971e3979781b4d168b6f810a39fa036
SSDEEP 1536:RZwNup24sfsH7t1CaklhI2QhhpjYIAjk6:PfcSV5pjgjk6
TLSH
T11F33BB63C6595C9A0071E01A98087D0AFEDA43FF3FE2865735785C6D3FF607482A9A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\cs
Size 36KB
SHA256 797558143d4f57ba5e4c4cc24a7ed049f6c7a877ea9cebebbf43343318c2673a
MD5 66b9fa1caff36f7c97626f5f24eb5136
SHA1 480c071860a3f14bfdca5a301ad43f47c91365ed
SHA512 567be072e20904455f05def2e9a2160dc866bba09ea2e34ec5f157b68917dbeda130b0c70ee60c288297da35c1db441a873dea791c582c815e8acb3aa6818f0b
SSDEEP 384:jUvfq8t+vtMT+J/CEgU8R9Ccez67sVqhp8Q7u85+2S7AH5JTV7GQihTcqkINGAxu:jUFtxEgN+znm9RZS7VQrzAJfGIyf
TLSH
T1B7F2A223C4A14D7602F293C67CCA5942F6A4535F83A20C0B78BDD14C1F7694EE6DBEA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\de
Size 38KB
SHA256 b56cda2456d4c32606757078db6710752b255cee6a3a5516dc4a5d3bd6e40e62
MD5 ebbe27e0e76852b3f287ccb4d19fbbb8
SHA1 19e3f78c62b7804821a80eefaa220d79b2f40027
SHA512 21824c024d7b62fc9ba73f3509ee265c0d4573d64df2babb0e2882d5236e6446ccca0d58961c41d41b9f29011029b28943a9e27b0ddcdfadccd05a89de0f92a6
SSDEEP 384:yavYiWfXqTVemtvcQZMJcajDgx+6b1guyvE2wBPFTiaWGLC5g9kIhkAwnBPisGAd:5vYZqhrZcSMuCY+uPDFLZ+AcLG2f
TLSH
T18703A617C9A09DAA02F19386A8898992F7A4931FC3910C0F78BCD21C1F7655FD3DBA75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\el
Size 55KB
SHA256 03e5d20bad26e39d83073e3ca2ff709f33fbafb1d53a58c9fba4169f7205ea28
MD5 1bee4c76c6a68ee0f9789d52df4b0499
SHA1 45c84268da270f84dfc2defa96de72c327f571ed
SHA512 6cc318039b3526e4e1c1deaa1dea0d15ef9f7ca298c13a871e583bce29b99ef7e3012ebe4478d791d24225c47c108e31be4841dd5999ee48744b1a3e527f18c2
SSDEEP 1536:2OHyU3NlkbNIglPwuBzKR94988XZthrsOX0nak1t:2CrOIYBe3k6nay
TLSH
T1F243B6DFE0941DBD40B5810288E8A079F7865F2F9655CADA763ECA2C7FF9462D810D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\en
Size 40KB
SHA256 0f3e54a0b7aebc9952701d7efcc3f2cbef42da56a340633a2abf1f5e87ea42e2
MD5 62ef36d16bc2d2d4073aaeb499f61f83
SHA1 81a7dd32333e12051be8b2115ff2c0073f8ebfa1
SHA512 dea6f288b0f73bea650e7b43c5fcdd6a59d4a3de4928777c883eadd579de35c4e6394fd0eb6a8134dc704d283900ab1058cafb2f219e7b3dbd63a600f504b799
SSDEEP 384:tjnaUQeWBZbhsZu+S/jNRNjoNhsF3hP4aX4FOUvbtiO/7eP/0rSSO9yFzIhpKs3u:tbUeKUu+6Ru0B4Fdde30FO0kpK2Ov
TLSH
T187134127D4604D6701F2A3927CBA8592F614A36F53410D0F397CD24C1FB78AAE687B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\es
Size 39KB
SHA256 be3b4a21a896da371d952083ffc71408fa18c3f96eca235dad7b6c65fe2800a0
MD5 36705321fd638713e179e9b83a23f5ec
SHA1 81535b818cc4e9e1fe35f087581ef68dbf979913
SHA512 761be5e041bb8b412c1958bea45e1420775dcdee046c7f70cd70b426a9905b6857104ca8a1326b1a221c718da424faa2737fc54fea6d8d526edf0401b6f6b2c7
SSDEEP 768:ow1JvStx9/mYWnwvRmW0pSBtfbLJTUAx9L1+Qoge2exOQABcW8JZZLTipTQZFqtX:/USwvRmWT3APcQhbZZXs
TLSH
T10C03A513C4944E6303F25386788A9A13F190934FA1958C4B79BEC35C2FF59CEC59BEA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\fi
Size 36KB
SHA256 00492622fb9f7786bf2f85303844ed4ee2ce5b7b40fb549e63dacae7feda1ceb
MD5 24126e76fdae2505e474464148f90db8
SHA1 e37ba8907cbc9de749172dd963766bb3bdf4ea28
SHA512 d27880e5ae5e37b07a003e5df7acef8e60c8052d8be442d847ad09a37c001758477877154093f76743134fb015dac3545be9e5d56cb2bcc8a2a2ec77287be327
SSDEEP 384:ryQUpCigbdBzMJQPAc+U8a9/Tho2hdGsVuRpfLiRI8+2S7AH53ctG6qho8AqkIr0:r+8dQc+NQThBltPZS766eANAJfGIyf
TLSH
T179F28417C4615D7702F293C778CA5552F6A0634F83910C0B79BDD24C0FB698AE2DBEAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\fr
Size 37KB
SHA256 d23824e5f4ca060fc3abeaa599f2e420313942689aa11d9415161549844ea4d7
MD5 69473dd6c4bc56028657a92e68e8f503
SHA1 cb03b130f87bf20d0a785bcfd771ffa96363538a
SHA512 24d5d60e1c6d7efa0d5e00b5b2a788ea18b580a8e9735e6ce04ffb901602063814ca3821f5c8128cf603b3e8b9903b36ddf34d587dd7a89da00df63772f81fd1
SSDEEP 768:6sgt4qWsNPPuCrcytWZS7b6iANAJfGIyf:Ry4FsNuC4g7unAJfGIyf
TLSH
T166038427C4A14D6702F293C37C8A5542F6A0934FC3910D0B75BDD25C4FB658EE29BAEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr-CA

Path C:\Program Files (x86)\Zello\Lng\fr-CA
Size 39KB
SHA256 efb2620e4bcd7b3828e738a5a4ceefd92dfbb907635b1cebde18d48fd045f7ce
MD5 337a6b366e598e2277921184e3e214f5
SHA1 96eebd0688981c49c6fa8bd6ad727c1a8038bf8c
SHA512 ad841e8d8152aaf0ba4d1e110fa2c2d2bd62820a88ad5203500936505d3ea418376e4ce1e818d964f601301cc29bdb80166565b5bb1a29908f4b5ea0bbc6a5c8
SSDEEP 768:YK4K/uADyPFSM5s4XoJ1r0yNzekYTfdd1Q:YKBhDyPFns4XgzeTTfdd1Q
TLSH
T11A037417C4D04D6603F143867A8A9643F160C34FD3A1490BB9BD934C1FBA9DDE29BAE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\gl
Size 36KB
SHA256 573c3a044abb3aee6a1726d523132c14f834e832444aadec01922b425927e89d
MD5 17e2e77254e07cdcf9ac920508ea7b96
SHA1 5e72b9bff68c81ebb0ca2126deb8b594f6ecc478
SHA512 ea239f0dc28738ded816e21a679570dd4cdbec934764fe509319139e0d6d891fdefa92196c9e667ba209ec26b2cd2ce95c2cc8b7972916f7708dc462dfe754a8
SSDEEP 768:qG62tvWgNEZ1SJ7/OZdZS7K6AARAJfGIyf:qh2cgNE3xg7fZAJfGIyf
TLSH
T12DF27617C4614D7702F293C27CCA5552F6A0934F83910C0B79BDD24C5FB698EE2DBAAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\he
Size 39KB
SHA256 5a279adc56280ededa21c15df3fe4610c0037338211b1474d7569328ec6a6931
MD5 a5bc510e11d9e6916cda01263226f7b1
SHA1 56720c266f710a066fe8274aa4f44c737ae65134
SHA512 29cbc2ea1c76dfd60616927382ecaac73d91b7b22844c5826e30bccbb7bb3b0218175202d31fcae27789654f440eaf7cfe96634407ee3d25b3c243417621afa5
SSDEEP 768:Fv3k3C3T4P9ZWhBqDVDnFnTnusv90dsLAEfGIyf:x0yD4P3WTahFTusv90aAEfGIyf
TLSH
T15E033383D5F00D25427156835DA8A505FBA18FBF86D8288BBB3C920C5F334D6E997BB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\hr
Size 38KB
SHA256 8c8017ab8b1e6ca0265e1117f4352aa92e7157e4afe4fd077ef384432c5442b9
MD5 0f60c2647e47de26984b22e20efb1b4e
SHA1 785f66c747b64b60b6e6c6fddc24e792fbb6238f
SHA512 045f8c106eb45c569c4768bf976e8b644179ae5450c94d26cc6b4cbcb42b196a0daf599dd5f73b346446b9e04dd79fdaa3be23e0987dc4f0f6e7d8b52e2c7f4e
SSDEEP 768:5YfoY33ooIVcVPhV3M7HX0HSp9iUlCrBnmodLnj:53Y33oFVcVPhV3M7HX0HGQUgJmodLnj
TLSH
T11C038513C8B08D6947F693CA6ED64602F5B9030FD2904C1B38BDD60D5FB658EA0DEE69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\hu
Size 37KB
SHA256 55c4dd61495e7e35eb3a5e0835c5be57316fd8994b229bc68849f0502c755706
MD5 676af4c3d460d195575acc7a5d1725ed
SHA1 0ca4a4820195db001fbc669b292fbc06d35ca694
SHA512 06abf98d57f6b03009a795cf26ca12f5db6dc96f0ffbdac50dda99556903db685e540a4bf9d8b838e7d0f5b97d0c9aadae64faa631b730e878388d9c5738aa7c
SSDEEP 768:h08t3yLHTNt4yJqTTIQunAlZS7DCt2NNAWfGIyf:O+oTNtpJET/lg7DCEnAWfGIyf
TLSH
T1D203A623C4614DB646F193C378DD1552F2A4930F83A20C0F75BED24C1F7658AE6DBAAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\id
Size 36KB
SHA256 3c73d7e4f64cf3fbccee6d0e4b46651387769c1ac70ad59dafc1b3729d361b2e
MD5 b6ddfe3ce1096c8dfd9017b35ca533d7
SHA1 8a30de4197309d7579869e67f7b6e1db3ce81b4e
SHA512 333b362760905394e549d8e4fba39cffb2cd9de8c6ce248c2f53c8063df564439b43184b3b2353d5ecc8bc3324dd6107cad26a24d80a013f4269d505b212f4cf
SSDEEP 384:cytiLaUIwyGJ84KrwcAPJZwStlCJSCHpv2uJfdEscEGOX15yoN2AoVBy3G170tdw:jtiLaUIEJ8jrw3wSIHVsOXaAXGRv
TLSH
T16903A823C8A55CA607F143D6A8CD0A52F5A4531F93910C0BB57CCF2C1F76999F28AEB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\it
Size 35KB
SHA256 09ef962d7fd8336fdfc2fc46145c30a2b344c36ade72211dbe7a582e35535ab7
MD5 c54d766c5553802dec3cdf5429ffb50f
SHA1 06a545ff191fa910209cc8abc571a526be557a51
SHA512 4e904e42e2be3587651a0f332b84bdba99dc1a254de07397006b7c80a382ecfb206465eea7a540cb3dff7de2a579ece3e3fb45f91f4bc08be8b16e5dd064bcf1
SSDEEP 768:ufmY7WgNEZ1SJ7/OZdZS7K6AARAJfGIyf:kBKgNE3xg7fZAJfGIyf
TLSH
T1DFF26427C4614D6702F293837CCA5552F660934F83910C0F79BDD24C5FB698EE2DBAAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\ja
Size 41KB
SHA256 deeaf1d1084e07aa1383c561b944c0a34697f62c0d24f301ecf57daf3593608a
MD5 1a10c6e82b225d1a240be9c3f465f668
SHA1 881b193979e4ddc8ffb171f5fd85092e0d0d171c
SHA512 5dac0da71c37e9559bb84f4c05e6ac0225396bedd04c0b3c5ebc084c5ffae58bcb46f456a59376413c553228b1fdd18fef4dc97ddcc2cc1c7a9f7e5c2ccc07d7
SSDEEP 384:QdA0sJ36/Mlb3BEBvkBgZZGwnw9szpcUIbNIloS52vNjSIBRenxKQzop/nC4DcJm:gAR3RWGrHIGrf7lw9n5ae/A5GID
TLSH
T10013732FC2904C2605B193E36C8D6582F6609F5FD7A20A0B747DC25C1F7198EE19ABF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\lt
Size 39KB
SHA256 431e2df2f5a792a584bb7e5fe7e88f10d650601902bad604a7e1bc11fc4bb7ef
MD5 dff1e4d6c96b919502704fa88f744942
SHA1 63ff97a8f45a70ba7a26cc4194ca080342f60480
SHA512 6e3b9d28ec95d09348d93e6cbaf10a4be252a0e5ca85d2ec41555ff71f3762576762eb55b9458528506a8856b660d005458c9468d7f5fff9824cdd9a889a0359
SSDEEP 768:t03gTGQqrPqCF4/yTbZHLFd6IKJtKARW5t5sgS3fQTXiyhsWOzTnh:AVrCCF4qfMI4fQTXiyhyh
TLSH
T1C603A503C4A15DFA07B1C3C658994666F1A8470F91D00C0BB87EC35DAF7788AE5E9E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\ms
Size 35KB
SHA256 f37bb3a116b260edf2cad2f76547d3660c991f39f45ec08b39fa2a17f5630d2a
MD5 d441281f5db1efdd06b096f96031b1d8
SHA1 5f8c01e919703092f72304ed61b3ad4fb6c7fcea
SHA512 adbffcec89174136c91a876bf5e0af3151550ddc82ffefcf6eee37f1a0d946fc3c04491085d4962a80ff2a431e18637603430182978c3ad2728e368b63f0fbd7
SSDEEP 768:ufmY7WgNEZ1SJ7/OZdZS7K6AARAJfGIyf:kBKgNE3xg7fZAJfGIyf
TLSH
T155F26427C4614D6702F293837CCA5552F660934F83910C0F79BDD24C5FB698EE2DBAAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\nl
Size 36KB
SHA256 d83535d81a0f9504deb5589d7e837868b2eace261a56fc09892e1c66df13073f
MD5 6b385e0f091461202c9d41e0944bab65
SHA1 8cf9293231251d2a5be8479674416d9d2b628611
SHA512 caee1d5033cf8b878a057dbe4cc852391c4e987c629f9343d569f87e295446453483c3121c83b10cb932fc9c51e9d72f69c7d20c399eb9c959f4e56a540793eb
SSDEEP 384:LoMBtLWUtWCVvV74o7Ulp908hAIMx5V6Vu37ssI6QzBCDvO9EK5mGrG62hOqgR1F:L1qUtUo7oI8W3ey7Nk9G6lOAOyf
TLSH
T1E3F28617C8514D7B03F293C2B88A5952F6A0535F83910C0F78BDD25C1F7698EE29BAA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\pl
Size 39KB
SHA256 7ac170752ed6ec75b74db1a6f87ebdf581b6d55f81ce5669b67edb8efd2464ae
MD5 695e3dfe37e55bc81246ac8f195b2784
SHA1 da78dde70c0f1e14d28ac7ca3aff825cab9fa227
SHA512 d69f883757c927fb281b05a005bd744ac066c26420a784f14dc02274512519179b617e799f553cca8d4682a4ce625aacbf48c9db8f5988ce5522e440edf7b31a
SSDEEP 768:J7wqrnVbO2tCgPiNYevios4WjufwB847p3GsYXnEcf:J7LTVC2tnPeYkBWjufG847wsCEw
TLSH
T17903A62BC0E05E6A0AF143C7A9DB5A66F5D9430FC2504D0F387ED10C2F7518AD5EEAA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\pt
Size 38KB
SHA256 003046847964ef0bbde636f799cc89d95c536989009a51e61ef2f3678f878896
MD5 4206bf9825a5c86a871feecbba1a5d34
SHA1 ca667550775eb424fe7eb7cab4c47b3102b83a6a
SHA512 104f660d40e9ca08d4c28d638a941fb1b9a618594bc620b14d37bb4f0e75b17f6fa073442a8bcf8efc8f65259900819329d5cca98b0ade71973019d489161049
SSDEEP 384:v7qc/RyJbfEjBAHiE7FxmztsqtR1rI8bx9aifaCSSyzZ6cIm9lPQD7EIeHHe3nJY:v7x5T6FBq98FSnRpqbAxGpf
TLSH
T18303A617C9900D7703B253C3788A5A52F290534F93914C4BB9BED34C1FB698AE2DBAB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-br

Path C:\Program Files (x86)\Zello\Lng\pt-br
Size 38KB
SHA256 3ff03b4db4df26abd242812dd73c1a9c754f087db25fcc7def2e44c3e7891c4e
MD5 7004a871ac603527b8a083f10a12483a
SHA1 3618ce8f0051a63f0742c55e63615974b5190aff
SHA512 272e4ff550aae368fe82ccde37e33d6c831caa764af19e5692220d0b93c964605ea3da4eff07d0ec133076519f6e971c069b652d2632ca31a002c836ec25d575
SSDEEP 384:zinMbo5YDzzN0ipxfxKX+r5w8Cq9nCQgy89v13qkTvnY/inoRbd/safOHNqJOuoT:ZE0p3JQMWfPQqaVwu/aynQ
TLSH
T127039417C9910D6707B253C2788A5A12F290430FD2A68C4FB9FED74C1FF5986D28BA79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\ro
Size 40KB
SHA256 6d2da9e8d50d4b6c43dd99a49a640c1bec5b3330a07d82fd6e0740fb961e1360
MD5 af9d5f63d618c6c067441190a31c91b2
SHA1 7c2ab110c3f31c35ce7d8511bb8d51d7eab111d3
SHA512 5a2e703c6e60f4dc835f2318cae5a0d47cb0ccb2a07871212998bc20bc8af0638320737436418ff97b9a76b5ab60bbe7f68f077b370f8bf914f2626a6d6db9c9
SSDEEP 384:o6fuC40JXuO4N9sFl1O9O4MiIx8/QhO/s4PDJlVIsAzxrJG4GpCJKlZ37hdcIOSg:Xur0JelsF/h0QFzDgZsIOhcm1
TLSH
T1AE03A223C4E04CA60AF1038279AA5A43F5C9135FD281084B75FEC69C1F75ACBD65AEDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\ru
Size 52KB
SHA256 e60c0b95b9677bd785dec482bd2f2ab2149c69bf98416c14626a3c78bca889bf
MD5 f8e8e948e03f45bd4d51ff842bde699c
SHA1 87db79276f45b7045c2334b4a12e31a1647d58b0
SHA512 9c85eb7810885c243cdb1f93ebfb868d60bd9e2ac31fd454c9a7bacadf68f3262ac2f9f467f1e823056786a951f0d2d329a38dbef8acbbbcfefe2db23057170d
SSDEEP 768:dNKrOg9jXlaBeP6m2pa3vDtytrxUjIKxydQN+n:dNKrOg9jlaBeAC5kxUjl8dQN+n
TLSH
T1ED33CE63C259AC9E0171B01BD8046D0BFAAA43BF6F960717383C5C6E3FF3525C269A56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\sk
Size 36KB
SHA256 6b6c25b5ad064dd00acc4c06977a094c0db309a49c1664c78782809713356da3
MD5 68390ca49120f061965403e2f3f70d2f
SHA1 2eb0235c72d18933756c33986b5235da06070bed
SHA512 86e6a6b4526009b2b5bdc6bbe6b417a32298b973482c02d58d0ccadb5646af672a4fc39162eb1c8fa48a2f86c6156f3c9141ccf129cc58a5cd04b898cc3766e3
SSDEEP 768:kMFY7WgNEZ1SJ7/OZdZS7K6AARAJfGIyf:R6KgNE3xg7fZAJfGIyf
TLSH
T1BFF28527C4614D6707F293837CCA5952F2A4934F83910C0B79BDD24C1F7658EE2DBAAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\sr
Size 38KB
SHA256 e727c6e314979ce8d46a9dd7d4cc20790114f483990ebc58bc8673b9ac2e7460
MD5 3400a48939474e20d07a7f2e494c73be
SHA1 0f6c4c0f61d94d45cdcad3d36fcf7a0934d532a0
SHA512 c09b6eb8bc2d87a484f1a6ba13dc559d270a94a8cf5de23458309452292658d486f1f277512c57da5959ed2fd618dc68abb27ad08d0fd83f7147ebfa6bef8b1e
SSDEEP 768:XY5oBR36i5hcVPhV3M7XWMwtSk9EXKCZBnmodJnW:XfBR36WhcVPhV3M7XWMwtvuXJLmodJnW
TLSH
T1EE037523C8B04D6907F693CA6ED74642F5B9030FC2904C1B38BDD60D5FB658AA0DEE69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\sv
Size 37KB
SHA256 6160fd3b495da28e768adb8aeddb0b138575c9704b9d004260fd82612984baee
MD5 bd9130e680440a4b95d2d9f7aaa4a98a
SHA1 02de0c9e9352a3b829616c0578aa037b37085ff5
SHA512 556bf100aca319a3049373c4b20913421411784f81a23aab59c17a7a02615a9dbf15e276f3490861b97e1c7d626099cb27092bab32549377982747e56eff6fd1
SSDEEP 384:bantQz8X18LhTGDHg6YnRASyNR5utZ0Aqq1lN1gLaWoFuZSzi6RNitdNI3nHIGDG:bGQweNGU6YWlOWhSkmDOADG/
TLSH
T1EB03A613C8605D7B16F18386689D0986F6E8535F82E10C0B38FDC65C1F76489E6DFAAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\th
Size 57KB
SHA256 0a291059a5e7667bf59588f8e9d04d96ee8a0ce150fb97011745df55ae41f21a
MD5 e944edb57d1b08373cd9cd180d749ca7
SHA1 9aecf3bd6bf9a5fae217f0d1b9b35c930c54597c
SHA512 0ee3151fb90f246767f00c3dcea8952388d089664392f4921eebd6274bed778fc9f1dfb778296d62d90151a2d44ad371a468e3878f3960ea297264e35018f477
SSDEEP 768:djIlOs/UDfqjTpUsxDHI4RUImwEoMe5nzW1IAHW3XvAnQqLI5RClf43k+3WY4B4z:wrB0p4qGGS8N+/ZAJfGIyf
TLSH
T1BC43CD33E04A9D9425740B47285AB285F2686B5F3762F8D6B0BC554E6FF470EC022EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\tr
Size 37KB
SHA256 84b0ce3f80994e4e001e591f74728eea8870234e602c6f435c3a7495036197a8
MD5 0d0b33e7efd9865c6ce7b29f042981c0
SHA1 bc267471566a7a398de61014b2ef7bcb3edcc81b
SHA512 0a6d213327ba4b9a4a90edc7389cd99f51150bf50897fe02426d39f0bfb20908c4351e2ef30999ea212aa7637fbd48feec14e75c192bae0ab99740926b4bdee1
SSDEEP 768:uk+auyMLnBg1rqVUzFPd5HlK5x6xezqC0Aq+v/A/GAf:uPEMLOuqpjcx6xezqC0AH/A/GAf
TLSH
T17C03C603C8B10C6A47F213C6B88E4992F5E5535FC3A10C0B79BDC24C1F7659AE2DBA69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files (x86)\Zello\Lng\zh
Size 35KB
SHA256 60800b4d040bef558db77d222932b58353e2c48c89b3bbfaa91178cd5298953e
MD5 d4f31257c164a86c94701713c96b110a
SHA1 706a36e96f6c60c5ed830f62751e9e25052d68c3
SHA512 f0159ea0b796e855d9b1eca6f5bc279a868da6c0605e8d54f308dc2e137de9b38dcc3a23e2ddf4f5da57148385fcd7d62075a0d03964933e508d87f62ce00cae
SSDEEP 768:rUskDzQHNZP8PynAzuGMRUmkNO3E6ZS7AnvG0PAbVAfGIyf:QzQ3P8Wg7AOuA2fGIyf
TLSH
T15EF29727C8654D7A01F293827C9A5542F2A0934F93A10C0B787DE24C5F7698FE2DBE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-Hans

Path C:\Program Files (x86)\Zello\Lng\zh-Hans
Size 35KB
SHA256 ca15323a27288af50277fe3322b9634484fa71ddd2bb66239f09342246638141
MD5 2a5f491c2e1fa59032adf395bb237323
SHA1 e5b058cb708835ca21481502611513d8dcab7f4c
SHA512 edb25ab106dfa1be6e0537a92532c7c06aa167e00d4efebf58d4cfd5ac38937cd508a6c013778280a0beda2a2ad3b9ae4555c3f44176bec36bfd50d821df4e3b
SSDEEP 768:nSB4oty0Hj5M8FPIxLzXwse0xEZS7Mve5nb/ANXjfGIyf:VoFM8Ng7MGBA1fGIyf
TLSH
T1F4F29527C8A54DB602F293C27C8A5552F2A0534FD3910C0B79BDD20C5F7698EE2DBB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6ec7a551d8200c280d0a9ac63bf961cd6793b1e9217ca597e7bc1f1b27057704
MD5 82bd52d0fbfe121d40e8067d616ba2b0
SHA1 c891bbe23670e7f57b93237e5960da634025847a
SHA512 c4695cfd361e382e6fc4b0f063e4bdf2844837dfbfd0ba347264b294b1a6e65f33e366afef9a629df94256b4754a6a32be38764742d397d4951b443b1182f143
TLSH
T18AE02BBADE35BC2B1DF9172C51541746E74013573B40D98F3A3C910ACFB4A37018581C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 888B
SHA256 85cc355a6af49b012848561f894c06fb23f4482fcadcd4d3afec630632b709e2
MD5 176e015867ce202b074606cde80cb96d
SHA1 5722ec952dccd0bdb3638b68022ae415f6560b66
SHA512 3a913bc52ad451a9967ae879d44d2b3ff004134b40d288cba156e89382aa0c10562ed93e942943b4bca73b7f43783aff6e8681478bef830c70bf9f21258e5f36
TLSH
T1B411AC084042B67CCBF46C717C9B856C19C75F3A16C31B0517E46EFA636662F09E5A1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 23774de8648ee9e13a499d0c6a927f2b9f663e2f709f399f026638490c4f808c
MD5 067538ad97be2e193a69d58f6db195db
SHA1 d41725431dfca12796a3b790325ecee80e828cb0
SHA512 a967254a56658c482d1b7a790829ad648020e827325d85ee5cab32974ec5d8cf40cad359a4992ef080d6f87269e3fd63a4dcff18dd203a3ddd894473591e5dc0
SSDEEP 192:DDpWURXYaIxO88GK4k0SIPIgPIZsaPavEfPvNPv/E:DDpWURXYaIxO88GK4k0SIPIgPIZsayMa
TLSH
T18FE1CFF7C3D9D92DC91156F89B256F1ECE2A0A18432C3C27C8D8AE1B93E2871D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 0fb0e1626962b8fea585940a330896c0e9f57840c9dfa62cd9baad49279ab8c8
MD5 138675f647f700449d5e758e2c2ac1eb
SHA1 f4e4a7136e87847afd19e724b83b2fd0e23bbafa
SHA512 10bf10830fe828b6c507b5765a87bdd621a63f682925487e841e18f717988e36099c8585a98de8e48b2d3df3d4242780027ccb161a61906506f4255f06419f24
TLSH
T1D8F09EAB92EE707350BD54EB0D00F80D69F9A4311545ACF8CF6B81ADD0824F31F2240B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 547a8762e3afe41e263030ced2e8e29916a08146d03532f83fb2bd3b3db868f2
MD5 663d9b7135daa9029fa3fc9d09347ad5
SHA1 6ac99f5b0efa4aca20a26b9f5606b50c633c1297
SHA512 aae33cf111b14842ea13d08f67907bc4e717a0f1707e6a8d6cdd163e8c047dd9ab2f3c664c88ce69412b48122c733b9ddc32d52e9ca4df98e09f29e4701bf085
SSDEEP 192:yRfax2uv78pAPRp2WA9DHsb+WNnfj4xh2EjkkwcasVyIsnAUgtaJ:yRfaUK4UXq5w7e2t8aI8
TLSH
T15A42C72EAD14693B6CEAD219FD657723D3F6102161D42E94EBFC892C14DB9CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3e7bec98803e6334c8edb2b92574a0b10b92d58e9a2e6f7e17d2ff5c298e24a1
MD5 a477bce63638dac24f3b91f0f53f98dc
SHA1 d16a2b124039c0e832a2ceb6b57f841c4f05ff87
SHA512 1a320e2603907babbf342ed0462f166fdfe6490a50d17e20aaea7abf9dd495c03d698c8e6c08c65e24c5f462e2a2a3e353024db78c4302ee9f6f8520bb3a6900
SSDEEP 192:yRjcBzax2uv7YpAPRp2Z7G9DHsb+WNZmLfj47fejjkkwcazPyIsnAUgtaJ:yRjmzaUKMUXR5wEP6ek8an8
TLSH
T14342C72FAD24693B6CEAD21AFD657767D3F6102161D42E94EAFC892C14D79CC322700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 42014eb997c4300a6ceea5b687eb80a2342fa091b7dc46639295627f4785ec20
MD5 c9a03f8ea0888d4cc76f8af9df19330f
SHA1 3669e77e0cffa944cb1ef2f409b01c337310758f
SHA512 2ffdabe36240d10c533f0131400495a2fbdcad29c85baa3a87aa3ca7fb80abbee0a11a470e7a9ea53f46f876a821ae9e0d8870a580eb7a1fefd6eb70ac47cd43
TLSH
T1D0A002641383802AD419427160410D60770048225193534151D440D4CDA44449637D1F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 767aef80a18d4938d951ed752120e507d3defc0fa55c84263d3a3c223434795b
MD5 597ff8ebd2ba8d5fe8b8e0515c03424e
SHA1 133cb9a68c7e542150c9f015b1951d3870b7cdac
SHA512 d20e15b1a3814b0a2c1251651c98ff47b4ed637bd64cb62bb51cc33ae338a7e5d01dd751c922ba25fb5b1edd8a347e0e9b9635148ad3b849c84c9b719b91e65e
SSDEEP 6144:X2hxNPRW2PYddqmY7U52Fym7Rkm1tYpBeh2BAou:XiXPRW4Kq97UAH9oBGcAou
TLSH
T1C93423127CB5AA390C5DFE1D308F1D2E2EF28EE494A4BEC2C8D49F0827AED941555D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 70cb54a2973ccabf31e60e36f60bc32f0245709a54084e864949d642d7e62c04
MD5 1d6d941b29f16bb5a3a8016da35b9ae5
SHA1 8b955f5e194afb262d42f7d2b340b87ba59a869d
SHA512 767c16bb3fbb56d4f514ae63262ebe4d703df1827cf2980950181190c8e6ce4306683af2cc7aef6e8cf08bda78ebd228a4392818c294ed3ca38ba4bb56545d12
SSDEEP 3072:nGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Gm7Rkm1tYpBeh2BAoO
TLSH
T1B5C3123B5D65E9375979A71EB48E0B1E1EF24DA6C930DE42C8D86B0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 fd61fe514e54fc35bb715dbcd717ca62479669705c6717f4f30f7857ef0cc7df
MD5 9ae81498687f0f06050f23c343b1cc21
SHA1 bc3e389e4f167e08e696bd69912200507467d4b7
SHA512 791cd3ddbf87deb3db590ba5f08084390793057bfae6412793dd541acbf243f3221af774ffaa6777dba4830ad00e11054a3f413a9e94d73ee3e56b24e627d4fc
SSDEEP 6144:D2hxNPRW2PYddqmY7U52Fym7Rkm1tYpBeh2BAou:DiXPRW4Kq97UAH9oBGcAou
TLSH
T1FC3423127CB5AA390C5DFE1D308F1D2E2EF28EE494A4BEC2C8D49F0827AED941555D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Zello.exe

Path C:\Users\Admin\AppData\Local\Temp\Zello.exe
Size 7.7MB
SHA256 48b0770ac9463b84be6508cb946edf03c9088fa01333c95182a76e065407b7fe
MD5 4dcabf7d7a4f3dff7cc46eea6d1e7a4c
SHA1 19ddb006148f3a4200fac73e6540ea2a8b744019
SHA512 5c769636c2e769661233144c4824f41e44f2597e6add7c258c5334217bb1d76784870bebcb373ced5f2c3958b063efe43a5726c1a252824696971457ed53330b
SSDEEP 98304:XDwY2pBXHqPDOBzorVUBZLbhzFuMnozB9TwvHHmxYQCgff3dXDedNqG4ROXPP+wf:kY2/9v8zB9TaHNQXAdoGtn+wf
TLSH
T11586BE02BBD4C0F5E5E21B7098669BA94AB2FB304B31C4C776C44A1D6E70ED18E39767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nstEA3.tmp\InstallOptions.dll
Size 15KB
SHA256 b34fb342f21d690aac024b6f48a597e78d15791ef480ac55159cd585d0f64af7
MD5 0a9fb96a7579b685ec36b17fc354e6a3
SHA1 355754104dd47d5fcf8918dee0dc2e2ee53390a6
SHA512 67870206fa7f1e7df45c8c1bc2f51fb430f0a048a2bdb55a4a41525388ca3b50203784537f139169705a03db4bb13b591162a79a5d2df81a4d11fd849615c86b
SSDEEP 384:EFC43tPegZ3eBaRwCPOYY7nNYXCg/Yosa:EMTgZ3eBTCmrnNAo
TLSH
T183624D1137C558B3E2D62A797EE2B7138FA5F722A4438E0BC7332E06281A5956E7C311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nstEA3.tmp\System.dll
Size 12KB
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
TLSH
T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nstEA3.tmp\ioSpecial.ini
Size 1KB
SHA256 9edc99e37fc4f653f37813729768dbaf3df827f96e48f679bdf910f97a5c9199
MD5 a0b5e098d1f7b1e2eb78acc6a615b6cc
SHA1 99f0f1c5c894450480b6de211e9d486da1aad7a8
SHA512 f664df2effd1b0d25348d4d32734c7d0c6e093cec2351beb1ad0067235bbc9f72a0c60e71af1800ec23bb8d1eb634d7decad8151f3def5280fc2d1bb8702c801
TLSH
T1191182033EF95114E2BABB18FFF5807587397851581DD90E91C10A4E48E56408923BEB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nstEA3.tmp\ioSpecial.ini
Size 1KB
SHA256 913b57e260757d6b0d493ad507f75ed0f935e2668ac0bb533e24f9b0affa71dc
MD5 8e1adc903352aae4c8c1c19c342d1173
SHA1 7a8906079d0a7a00ea3b48e80a8c0bdb1e1434cd
SHA512 66e79f579cbb0288f41fd87a44daf43565b39cb8601b1a20e864e81e119699c096449d53f548ff452765435b7eac697badece7d1eb688bce444ffe60c51f0b3f
TLSH
T1C6219F437BFD1114F2BABB14FFB541758B3A7C16A839DA0D81C0090E09E5B808963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

ltnsis.dll

Path C:\Users\Admin\AppData\Local\Temp\nstEA3.tmp\ltnsis.dll
Size 78KB
SHA256 082ecda048088ca888073637cd6628b37581816db9b999da7c70af38dd736bb3
MD5 ac3ad7a7662fc4b51a5b107d22045941
SHA1 bd88d4d23d4316668a17f2a77c2b919bef086d01
SHA512 7ff02c3b38b512e8276ed8c7235579ea913704c2720ccf057b3c95d1f2248e1a4a680d3971f7ff59ed20db4cbcc18da2fbbc2d8f1f986b177f56765103cefee1
SSDEEP 1536:Cw+lnkkQc/8CCLSDXOPWFI2X7+JZjaeabuvTJt7+pK+AUfC:CXR/fCYeIL4ZjaNuvTJt7zv
TLSH
T156738D12B690C473C96A993864A5CB319E7DB8109EF2848B7F5B07BD5F223C2573931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download