09312bbb6a9f4c94aa4828292443097ab4181703dc585d407ca00b8394db4871

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZA_Access_My_Department.msi
Size 31.1MB
Sample260820-g2fppsfn3t
SHA256 09312bbb6a9f4c94aa4828292443097ab4181703dc585d407ca00b8394db4871
MD5 3f107515c9c3799bf64b500e492c2514
SHA1 1197150b57a6a42fc2ea9b02cb375afe7fa235d7
SHA512 68f425d20c2b93838a1478fde4f899aa3baddedd4f022bbe6191a4b718a5c7dd284920cd5ee66f43b9706e34d1fa6413ed70c377908f9fa18590b8c2f0102793
SSDEEP 786432:5tSKzXTwCbIa56qamnWoOEygy2s+cI2XW:VPwa4baWjEjTN2
TLSH
T1966733BC6D8A8B3DD6C22D76490FB64C5A23ED8A50608049F0B9F87CA5F36D1D6F0E54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

costura discovery packer persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6040	ZADeployer.exe
4804	7z.exe

Loads dropped DLL 1 IoCs

pid	Process
4804	7z.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000c00000001c5d1-154.dat	costura

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Tools	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_fr_CA.properties	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\RTCUtil.dll	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\URSCredentialProvider32.dll	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\uems.ico	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Toolsmanager.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_ja.properties	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZADeployer.exe	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\agent.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\agent.exe	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_zh.properties	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ToolsIQ.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoTray.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\VideoProcessor.dll	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\VirtualMonitor.dll	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZA_Bulk_Deployment_Manager.exe	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_es_BR.properties	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_de.properties	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_es_CL.properties	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZADeployer.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZAService.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\agent_ui.exe	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_es.properties	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_es_CO.properties	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_fr.properties	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\cad.exe	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_it.properties	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ScreenSharingUtils.dll	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\AssistSilentUninstall.iss	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_es_MX.properties	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_it.properties	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\HttpClient.dll	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\RASilentUninstall.iss	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources.properties	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_pl.properties	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Version.txt	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\AssistSilentUninstall.iss	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_es_AR.properties	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_es_BR.properties	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_nl.properties	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\rap.ico	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\dctoolshardware.exe.config	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\RemComm.dll	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\AssistLogo_white_border_32.ico	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_es_PE.properties	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Version.txt	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ScriptLauncher.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\sysmanager.dll	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\7z.exe	msiexec.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\license.rtf	msiexec.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_pt.properties	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ScriptLauncher.exe.config	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Settings.conf	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\sysmanager.dll	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\dctoolshardware.exe.config	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ClientSocket.dll	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\RemComm.dll	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZAFileTransfer.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_ja.properties	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Tools\ZohoAssistAgent.iss	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\AgentTroubleshootingTool.exe	7z.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59e044.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e044.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF571DE88008C14E1C.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A0FEF036-409E-4F92-A33A-661CFB19A884}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF75898B84A139209C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEDB2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{A0FEF036-409E-4F92-A33A-661CFB19A884}\_853F67D554F05449430E7E.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF50FAD33EA26CB835.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{A0FEF036-409E-4F92-A33A-661CFB19A884}\_853F67D554F05449430E7E.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF64D8FEF3BE5ECEDE.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1900	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZADeployer.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5492	msiexec.exe
5492	msiexec.exe
6040	ZADeployer.exe
6040	ZADeployer.exe
6040	ZADeployer.exe
6040	ZADeployer.exe
6040	ZADeployer.exe
6040	ZADeployer.exe
6040	ZADeployer.exe
6040	ZADeployer.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1900	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1900	msiexec.exe
Token: SeSecurityPrivilege	5492	msiexec.exe
Token: SeCreateTokenPrivilege	1900	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1900	msiexec.exe
Token: SeLockMemoryPrivilege	1900	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1900	msiexec.exe
Token: SeMachineAccountPrivilege	1900	msiexec.exe
Token: SeTcbPrivilege	1900	msiexec.exe
Token: SeSecurityPrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeLoadDriverPrivilege	1900	msiexec.exe
Token: SeSystemProfilePrivilege	1900	msiexec.exe
Token: SeSystemtimePrivilege	1900	msiexec.exe
Token: SeProfSingleProcessPrivilege	1900	msiexec.exe
Token: SeIncBasePriorityPrivilege	1900	msiexec.exe
Token: SeCreatePagefilePrivilege	1900	msiexec.exe
Token: SeCreatePermanentPrivilege	1900	msiexec.exe
Token: SeBackupPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeShutdownPrivilege	1900	msiexec.exe
Token: SeDebugPrivilege	1900	msiexec.exe
Token: SeAuditPrivilege	1900	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1900	msiexec.exe
Token: SeChangeNotifyPrivilege	1900	msiexec.exe
Token: SeRemoteShutdownPrivilege	1900	msiexec.exe
Token: SeUndockPrivilege	1900	msiexec.exe
Token: SeSyncAgentPrivilege	1900	msiexec.exe
Token: SeEnableDelegationPrivilege	1900	msiexec.exe
Token: SeManageVolumePrivilege	1900	msiexec.exe
Token: SeImpersonatePrivilege	1900	msiexec.exe
Token: SeCreateGlobalPrivilege	1900	msiexec.exe
Token: SeBackupPrivilege	1908	vssvc.exe
Token: SeRestorePrivilege	1908	vssvc.exe
Token: SeAuditPrivilege	1908	vssvc.exe
Token: SeBackupPrivilege	5492	msiexec.exe
Token: SeRestorePrivilege	5492	msiexec.exe
Token: SeRestorePrivilege	5492	msiexec.exe
Token: SeTakeOwnershipPrivilege	5492	msiexec.exe
Token: SeRestorePrivilege	5492	msiexec.exe
Token: SeTakeOwnershipPrivilege	5492	msiexec.exe
Token: SeRestorePrivilege	4804	7z.exe
Token: 35	4804	7z.exe
Token: SeSecurityPrivilege	4804	7z.exe
Token: SeSecurityPrivilege	4804	7z.exe
Token: SeBackupPrivilege	4900	srtasks.exe
Token: SeRestorePrivilege	4900	srtasks.exe
Token: SeSecurityPrivilege	4900	srtasks.exe
Token: SeTakeOwnershipPrivilege	4900	srtasks.exe
Token: SeBackupPrivilege	4900	srtasks.exe
Token: SeRestorePrivilege	4900	srtasks.exe
Token: SeSecurityPrivilege	4900	srtasks.exe
Token: SeTakeOwnershipPrivilege	4900	srtasks.exe
Token: SeRestorePrivilege	5492	msiexec.exe
Token: SeTakeOwnershipPrivilege	5492	msiexec.exe
Token: SeRestorePrivilege	5492	msiexec.exe
Token: SeTakeOwnershipPrivilege	5492	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1900	msiexec.exe
1900	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1900	msiexec.exe
5492	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5492 wrote to memory of 4900	5492	msiexec.exe	95
PID 5492 wrote to memory of 6040	5492	msiexec.exe	97
PID 6040 wrote to memory of 4804	6040	ZADeployer.exe	98

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ZA_Access_My_Department.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1900

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5492
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4900
- C:\Program Files (x86)\ZohoMeeting\UnAttended\ZADeployer.exe
  "C:\Program Files (x86)\ZohoMeeting\UnAttended\ZADeployer.exe" install
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Program Files (x86)\ZohoMeeting\UnAttended\7z.exe
    "C:\Program Files (x86)\ZohoMeeting\UnAttended\\\7z.exe" x "C:\Program Files (x86)\ZohoMeeting\UnAttended\\\ZohoMeeting.7z" -o"C:\Program Files (x86)\ZohoMeeting\UnAttended\\" -y
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4804

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\7z.dll
Size 1.1MB
SHA256 25a52dd0a38f58001779b12e84c2937aa52a922a4db9c43fa89214f11a3f4766
MD5 a8f57d77bac092272792730872a1d8f7
SHA1 e85d4eb97ed735bbf209c7fbcc8f6d37d70fcb36
SHA512 bfba966b23292adfe38d2bbc36cae6fce8465ba4f30a7fd8fb4e51aaef5126363b11bc3e352ad267a9a64b18ea083974ce94e431b4cc40238951f9015df4578d
SSDEEP 24576:Oi6tfenkDGFiGi/7KQNLjoonYynrnJUTqrbL44HdvWZX:O/zDGwGi/7KBynrnaGvn9vWZX
TLSH
T188358D11F7F1C478C98A45308A29ABF550F9E71ACA1068C36BC0FF6E6F31CD6D229959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\7z.exe
Size 265KB
SHA256 54353ea62390f3151fc9dd9cadc86694e17d7d75a7ee6e39ca6285fa4bfb7336
MD5 bf7cf1b380ba84e60ffafd1f5bfcfa78
SHA1 1bac9e6ede9f6e0971146a27265175c40799c72d
SHA512 744d2a3234e1a7db5a626ca986b46e1af7367272fb3e6d3cb4f8608cdcf7a51988a934c530ed7d36c7f5c1af678d99fbf004426b317735e1872a855c1a437c25
SSDEEP 6144:ve/bz8iKQFmDISg2fGsrV5X5gVhUf3nvWZ/6:W/8ihqvg2fGsRt5YhCWZ
TLSH
T18F446C123BF0C57AD6430233CE5D5BE5A0FAA7694D21488367C40E2CEB758D6E369E2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssistLogo_white_border_32.ico

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\AssistLogo_white_border_32.ico
Size 14KB
SHA256 dd72cc36c3e664913059cc64a852fe673a8b6eb264632fefae20649a27e999d4
MD5 d669e7bceff12a455fd097dedef847eb
SHA1 eba799a79331e06d412b8ed81bdacdf1f3a824bb
SHA512 23ca689e8b076440b9d255782649555d79d227b026ca737fb928a7181bb54b2f6d5331894f10e7e9b5b661e1d23815a4dae7a25918b86352e371f4781e197b42
SSDEEP 192:jVi4fDR6guVkGFWrktZqlXR/BRVjUXGGNGOF5cMZX4RvJYZ/:jR9xAFWr5lXR/fuL5cMZX4ZJc/
TLSH
T15562B5A43148C266E13902309C7BDCDA4326FCAB5E14D60DFE74B3EF6B76102A559CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZADeployer.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZADeployer.exe
Size 6.5MB
SHA256 b32b33d64a786565fe0cefdf4f8c4b457dd7110dcabf349de8a6c4023a4f2dba
MD5 9ea13eaa26acc94d4db5d2c2d002a753
SHA1 70fdd9bfa1477110a42fa0065e6f026a629cc79a
SHA512 d5d731dd4a29461a1ab6ad04f2a64ec4fb7326a68473df58d1df972fe9a3bd1523fc4f2c12c9bc8204b1e4fede281ec3cedafbcf405baeff0d79eeb4a8d60146
SSDEEP 98304:ehoJaAVcMqOWrHtKZDORnVjBd7BOgHzCmO6Vb7XIPtCMNLUZeIIp+9IU:ecaA2MqOhZeO0OVPt5LUZeIIpmIU
TLSH
T18B66BE12BA43C072EC4205724A6DFBBE967DAD34073544C767986B3D5C322D32A397AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZohoMeeting.7z

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting.7z
Size 26.9MB
SHA256 d6a67e507b6d53c074abca700b518403ddb9ed3a86b29a67620e9b20a627adfc
MD5 1cc1b9fe5b65ac7b04b7dfe0e583f5af
SHA1 91170a6baf472e38603e19a51dab105edb5cb0fb
SHA512 3093cc19ed71241b894593d8ad155ed3fe7f5fd6ade4977039ad3e63c478cc996c4244f3b0bd2dc83f11a3ef3ee1d554a6c98f482f81110e69b9c299ad887d29
SSDEEP 393216:ej3El+GECSrYYkQKHiACTnb+scVJbnDfU6cYwic8wBxYyoC7/Tqv0egLEKLlZtfv:eopEHkYkLibX+Vj/fUcwie0pslbfv
TLSH
T1B95733BCAEF4D50D55C617AF4D0EBAC5BD2A8DDFA420D45E50C8D024EAF1652EE80F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentTroubleshootingTool.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\AgentTroubleshootingTool.exe
Size 12.4MB
SHA256 9f0147f10aeb141f68f92571642677ab405f844d0c2903d67bec075d4f4424f5
MD5 c2079a0cfaf92223698a52e3ac058685
SHA1 579c6bb062f94ec1c50740dd4a1ea9cbb4657ab1
SHA512 5ada890ef5ea4412f0076b85ff0a988b7fdf9243dcde74dccd8476876838ea7e4ea045589ad883b5da064cecd1c1af9f3ab5d3bf05efe0ccbb4196ee0cc4c5fc
SSDEEP 98304:q/Wlc0rAUz6P/QCPM7pZUo0aVAd5In3FSkcEb8gDMaanIbiGCyCt:qmc0SP/TPM7oXdan3Myb6OCyCt
TLSH
T128D64A47E86544E9C1ADD5348A7A9233BF717C484B2027DB2BA0F7242FB2BD05EB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssistSilentUninstall.iss

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\AssistSilentUninstall.iss
Size 368B
SHA256 d350f197a976b193edcc8f801be12fa5dacc61d12f6c60b66598c348351d4dda
MD5 10dcb233f91cfb59412cd6eb528f340b
SHA1 f1b09c17cdaa32c6bd7caf5fbc90e46c46c65bba
SHA512 e92da37d6879766680418daa68c6965727d885950c28981dfd0159ea2df5da663c011b622449b632dd14f622525d42ececa8d1d1e655ec8feaf00cfba6675cec
TLSH
T148E0C0E68538005CD6031B3513031BFB053F6F1D6DFD148CDFEC8C0A2181811C40A447
MD5 SHA1 SHA512 TLSH

Submit Download

ClientSocket.dll

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ClientSocket.dll
Size 3.2MB
SHA256 5fd38d21ccf356933c160e32c6b82d7a558d7ca5e5c837b30cd2dd657b536006
MD5 8ef96d344e3b873f89088e14b16e727b
SHA1 55310a7cefd119f06564184e126e24b43a49073e
SHA512 22245c2e867e14ed048155bc13b55b194d3362e885038259f919fddf249c185f764b5964f3f5c56bc960048d504e1dff2982c6928328a6fc93b702411f9e3a60
SSDEEP 49152:x04wgUVZ+39GdFPF8I2WJtnAgzCPdVXDCfvJWNJSskp:UgU63EdFqI2WrnFzKVzCn
TLSH
T142F5AE13BA83C572DCCE02701566DBBE893A9A10473484D397D47E6A9C731D2273BB6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Connect.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Connect.exe
Size 4.9MB
SHA256 eb4a85f2188ec702e4d6343870f581d6b79de182264f990d8df26eb48d90e97d
MD5 43bb5ac8553ae323c8f5f3192c1121aa
SHA1 e3af8f9fbc9dc644ddc88310d7974a30bb61ce2b
SHA512 63cd97d7ef06fdc5e65431414d25462b0526d7b5aef82b487970418ccb443ec8e1bef2e51fe5f5d7321c7fef31a601e922251f3f7942d301aea3f23260f0e57b
SSDEEP 98304:vHXL8ejgEoMRoKfkkwdoYFXNf+CFI1GStVmhR9xNo:vHXL8+J25kdYFX3th/g
TLSH
T10536AF227683C072FD9201755879EF7A483DFE250B3488C7A7C02A6D59721D36B367AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HttpClient.dll

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\HttpClient.dll
Size 39KB
SHA256 207e1549f16533dcf249a4bb962a64930e05fe80ce170551217539d0e2431afa
MD5 d57c0a5bd52f1dfac97f920e3bba3853
SHA1 557152dd94fdafa886171f7372d184e92b3ed145
SHA512 c1b35b0100483871b9b20b4223edb7a37ccd213452fd983799b626987f1b2cc2adbfecc78937eecc8093f4fe6a3d98cf69027ffcb246f74de40d47131eb8edee
SSDEEP 768:MFp69eLBeiUa/tQ2NTNA/CgXIvHzalAPdr2MPbAZp5AL:qNejyJoCzHza+5JPb
TLSH
T1A8033A497BEC8D03EA2F5FB8A8E2C6010B71E5D69562D78F57CC90DE1A8E3C106543A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImageProcessor.dll

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ImageProcessor.dll
Size 2.2MB
SHA256 7dd50f7d95085e2bbd5caf159a4819a95e7bfc93152c18914cada4de5b0aee9f
MD5 15ce34271eca7741d35d5bfc865799cb
SHA1 0f23dc26f55e4bb6d07b66d7a8a5efe59752fb35
SHA512 c1a35d5e313a0d7e2cc3995ebb2a53de4256a0ff5303c18711a37a3e146dd09a04b8f25daaed00967ae329f9c6545fb97f0e5ef8c3d989bcba65fb7f84e2626f
SSDEEP 49152:vv4qEa5itKNTCS/oLOQpV5iy2CAv0+Bm4wrErQXoDZPMaGZwY/m3:vwqEa5lNTToLOQpV5v2C40+Bm4gErEow
TLSH
T160B59D2179AC4073E4ABD3B0556DBEE8E4ADA130073841DB4694DB2C29FD6C24A357FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RASilentUninstall.iss

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\RASilentUninstall.iss
Size 383B
SHA256 14a008eb87c34e50d5429051bf2f79b79a643af028e89eca2ceaf7f4126bd4e4
MD5 2b14d8e3da02da05a81b679b6d7d8d6e
SHA1 ea94b46668ba4b17423c84bae01ffc76d5a8dc10
SHA512 8505eac3c45f7256993968fc25dbc6ed21cef846711d025e3fae3a7d2df70d1506a3cd35ee4fb9cf73646d0be1ed658fb2845610f0a2e4c8a6f8a81a5b56ee0d
TLSH
T1A0E02BCDC31AED65DF417963071B13D93FA65A0D97E82418D9C994465D61464C44E048
MD5 SHA1 SHA512 TLSH

Submit Download

RTCUtil.dll

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\RTCUtil.dll
Size 3.7MB
SHA256 67ccd155ee6f791e0a7c28f70e66341b65f0b5fd7fed4f31e6bed6205bc6762d
MD5 de0d84cda535953d053cfac4d7cb8786
SHA1 3f9e8499d2b413582f39e31557b7e331fd9d9e3c
SHA512 501f05b6a873d6508f96bb6ce62bc5a7d1128499ea02953e70e0b84e911865e7c2f98c91a74b00e9a729de56eaf8b1b23ed272c334806675c5de99b972b0498a
SSDEEP 98304:h8nhHQrPfWUb5b2eZilh8R2QetzMvc/6ss1U:ihHQLfWUb5bjslh8RRetzhAU
TLSH
T18A06AF12B951C036E44E01706D2DFB7D89395B254B358AC7E7881E6EAF702E22F3674B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemComm.dll

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\RemComm.dll
Size 2.0MB
SHA256 696013145be2ecf8ae377b21b74d6301805b22097a1c0faf679f463c3ac0089e
MD5 d7e12b4ebcd92c12114850af8331e035
SHA1 513b37e1702ace294b65e185fed3e83220f3466a
SHA512 e061fc96c46422a0ab70c0bc964f0f41b711bce152f4af15c5167577a94c41e16d331bdd60d68d1f34c2c6caf3191bee2b72401fc72271c02b74b30d9c0d5995
SSDEEP 49152:VTy2EGVfIQa8IwE64ZEhG/fiSPQvoUGaVLSC3r:VTy2EGVfIud4imfibK
TLSH
T107A5D002FB828573E59E02B55176977F8E3AAD244730C5C787D06DB69C312C26B3B36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssistLogo_transparent_48.ico

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\AssistLogo_transparent_48.ico
Size 9KB
SHA256 009f00e8de35aa2b229975f2b2edf22990012f730120227231b865208ff3dc25
MD5 7f7890c4fa820b112a06860af9b2b14c
SHA1 2dec813af1bc678022a8ff6f7b228ef21f862f86
SHA512 ce8e215c9f539c6067508fb81dc7a7f9aab8f90d45399f304fb8f0bc42145c7d3aef7c623b6ae58f49594e1c200e3c0cdb1882f02f059ef67cf2995e443face7
SSDEEP 96:9EBCz3uzbTk5GMBmcxzAsx+sm+sxzgcwBLs6wbFvVRGCg2h:CBCz3uzbTk5nBmcxzNx+sm+sxzvuo
TLSH
T14312BB7FBE4A2034F8B6827BF2D2BF3D5404E9D74671D99508D1AE90DAA214347EE413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources.properties
Size 15KB
SHA256 730a7bb08434417e4c238e4f2b6c25c7ccda81b02392ebf99058a3f0902927c2
MD5 51a67c9a55212cc6566840c4130eab43
SHA1 cd809047cdac927210eb68c1e88de9475a820155
SHA512 9bcf4c619dd5df5bbee415948914bfd0b0f394ba9d752bde4680efcf164f70866354653b7a138f65320a7b3ff37acea43d1e388bef5b8954fce99c450d5904a8
SSDEEP 384:o1MXwzMj4IQZEqzOiRI7ttkyiQTIzJfUAEz:o1MX2O4IQ2qzOiRI7ttklQTI1fUAEz
TLSH
T17B62845E9699693E47C33503ECF21AA577FE948C9370B0755034D1B8229D388AADF2B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_de.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_de.properties
Size 17KB
SHA256 29222b5ccf1cdba61e882e7ecf5c3e02252e6fc3741b5a523a857b30d1fcc564
MD5 81eb5918516365f4c6f4be1b12fe6157
SHA1 b6fad821282f2662c92b041d51a31270effe900b
SHA512 ce9d88717a64d77ec2f1075320b52aed4832952e61b56ae56312c523207e2f0593c3455dd5db9a55913f82eaf16467e90badb6784160d86ddc13d585bdc01805
SSDEEP 384:WmkimFXAjiz1l64+2keGlN4VCXl3S4EkbWC8WLW5B/RpA:WmkiTjiz1l64+iGl+VCXl3S4xaFWyzXA
TLSH
T10182A29FAEE6653E63DB37026CF14AAEBBFE86489360F0185178C171924D39448ED532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_es.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_es.properties
Size 17KB
SHA256 937cd1afa365f63c0197754afc6eaea7b42c174ce3190a9ca37d0ea17c9e70b9
MD5 631d9acdfb51098290e64d75f997ddd1
SHA1 62af7c4f992d09e987a079fc35d567394821bbea
SHA512 cbdd6895643c1a6de89a661862d672a06334bf0e8c0d4296828802c0f091179b0c8cf19d17e5a91c04e90842ad6c40c8f7f50d17d15c67d142afb1f68f561622
SSDEEP 384:b/Iu0Ftc5886zG/h3Hcw6wzAbypo0kdf1ydrrolRjhJYBbdW4IhemdNdJ0bGuNKt:bo/zgHcw6wzAb+qJ1icjJY72906
TLSH
T1E98264ADA6F8A53E02D37201DCF3E68EA3FD84846224E4DA9135D1B560DCA84D5D7337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_es_AR.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_es_AR.properties
Size 17KB
SHA256 840d824ffeb9ae0888bdbe68592f2f9c4b78c9d96bd0cc9a33baf082d056b5a3
MD5 04e92add8ba61461a54e6e8da63e5e9f
SHA1 a6feabb20d68517713d080465618b1480be0cdd5
SHA512 1c031e120cdbf5aa361791e4220944a5d504dd1f1995cd0009684fd45c8e5beeb5a6c6db94bdc9adb6443cfad58a1c82f5417edddc0c463c5f794bd36c504ccb
SSDEEP 384:b/Uu0FtDmr6bza/0EHcw6wDAbyeo06KfCyhdFR+hzlJAkbdNUIQ3dNdJb7pJSKdc:bMXzkHcw6wDAbNYuCYR+vJAt3wh
TLSH
T1008284ADA6F8A53E02D37201DCF3EA9EE3FD84846220E4DA9135D1B5609CA84D5D7337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_es_BR.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_es_BR.properties
Size 16KB
SHA256 cc00ac76450c32b40fefc472f20309b7a1006f6e55ad68f8f7c2e3700af600b7
MD5 4ccec0a4595c84d41a827622f06e3cc7
SHA1 20c4b6f34cc76d45a7b51d7caaa701f96d25d409
SHA512 b58b7e04fbb559c83ab21024fe77f6403209ae16fdb9b55bd4b47b23ad988a89f62359a49270462e1558abbeb94379353af05fd0ab56ee166ec4fc8d201ecd56
SSDEEP 384:b5IA7ezu0RKiHcw6wDAb6KSCQ1i348Ln1tptj:bp7ezuQHcw6wDAbPSFi39LRl
TLSH
T1DD72835D9A98893E57D33302ECF2875AA3FE4884B221E0959175D1F561DC78CE8CB732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_es_CL.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_es_CL.properties
Size 17KB
SHA256 18d7f7d35420f5b5b291b7590fc63662be20a790e38985cb07f9f591abf77fd5
MD5 2d624d06b3b974cfbf80af67a6a15f2c
SHA1 8c94bb1dde82413d8725edca7636b4cb3917256e
SHA512 1458bbbcc0ddd2e0f8bdca0557db951dd4da54f17bb930528ee660494bf7afb82103d8e13adca8e90f6c6c3613a9b58c7f078edfe58b9febbd819b5d8d43b41b
SSDEEP 384:b/Uu0Wkc77Tbzpc8WHcw6wzAbyeo0jxdfCydGx7kvPolTf4JWkbF7DmqxYN3X7pV:bx5z+Hcw6wzAbVnJCGP4sJWmCqw
TLSH
T10382749DA6F8A53E02D37202DCF3EA8EE3FD84845224E4DA9135D1B5609C684E5D7337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_es_CO.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_es_CO.properties
Size 16KB
SHA256 c04626c6399125de9319ab88f02737a1a3156971a19ce8d4d2a75244ca9eef98
MD5 fa2cc44e48dd32fd8bcc9653db827e79
SHA1 d07a92e88359e0c73cb6c052cb16c67c25c25d03
SHA512 02a4ab24daaf32e51ccb6b14805a09dbb5db3e318bb81e005e95c5fb026c3c0c9c85fd09133376bba4653bbed54eb5c1e8082dc3edaddb99d3e7a7c4269e0830
SSDEEP 384:b42qze6jMpHcw6wDAb8oQzlxqeUhzYL9ubzKdlDA:bdqzqHcw6wDAbm4eUhcEp
TLSH
T15672736D9698993E52D33202ECF2C75AA3FD88847261E0999171D1F961DCB8CE4CB373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_es_GT.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_es_GT.properties
Size 17KB
SHA256 fdc804e8abc7513af082a0d71973a5bc56847e75e7db3b9e2b1279526aaf26bd
MD5 0abd93816432c491672bc22aef4ef283
SHA1 8736621ae9ffa74921036ea0c5d7692c2034d7eb
SHA512 676bec1d737a75885ea7ad6b7d1c8a29ff0af1d9d2fda69a098800c7a46ee08d644c5662e14e8583534b7fdf373e6608feaa474137508e0595a0221a4281986b
SSDEEP 384:b/T0STcM86IAz/nvHcw6wDA5y/o0QdUCys2laPoltzlJpdbFTZIWcdVd77psSKds:bzwA7Hcw6wDA5KyaCBPcrJpFkzX
TLSH
T1008264AD66F8A53E12D37202ECF3E69EE3FD84846220E4DA9135C1B5609C684E5D7337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_es_MX.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_es_MX.properties
Size 17KB
SHA256 253b6bfcae97ba5faaf9b2182a3e62849bf973708187f24f620a86b6b7d22e25
MD5 f0b49b34f3c0fd8528cd4065dc18e81d
SHA1 562e7f136bc15e87596b5bff2c455fa7f2f1aaea
SHA512 d16cd8b9f480530237453e3229c166a2476b0ab47f2986a513624856ce0562db25ce8996533c91091911c60d1f74f015bae4947e8da473cc358b3368dc22611c
SSDEEP 384:b/9u5cFrMoT/z+/03pcw6wzAbrEo0sxd+w1yz7D1QgzlJpdbxTUIH0LtN3M7psLh:bhdzzpcw6wzAbYoh1y1QGJpkOurh
TLSH
T1E782639DA6F8A53E12D37202DCF3EA8EE3FD84846220E4DA9135D1B5609C684E5D7337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_es_PE.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_es_PE.properties
Size 17KB
SHA256 6392fc7c3850a22a308a751731bb7fdc8e59b06e868b1f0f488c9b5078ab5029
MD5 bc36e6469fddfe4c64324e5d0cfadf12
SHA1 b2be3b5b6981809a4c80c1e2ff1055c68c5fc2f7
SHA512 45325ac6861f2cf9d5d955e2cbd485e7e546890054e0a85fcad05bc11aadf807ba606599f3790d4a176fd732d7c6011fbd17c0744dac899f08f0b46b363c5627
SSDEEP 384:b/Uu0eda786bze7/0EHcw6wzAbwzo0jxdTCyzaFqPdhzlDpdbdvfIVSxtV3J7pzL:bpEzUHcw6wzAbwndCyPdvDp3Cq5L
TLSH
T14E8264AD66F8A53E02D37202DCF3EA8EE3FD84846224E4DA9135D1B5609C684E5D7337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_fr.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_fr.properties
Size 18KB
SHA256 419854b79eda3a0409a5be1cba35a70c931d8a7d67921d2125a438afe7a9fe6e
MD5 0feaac56660e7c069997c19717d968ed
SHA1 2da358b748e6e51e8278243714439b5f3bbca645
SHA512 f3254d1aeaef42cb1bae7449288b32145fcbde0e85cd262005b9cbf5f60fa82bcf3192dd495b88fe38d1f5d01d64b636f8059ef23c36809aea7d89cd2af8ca82
SSDEEP 384:S02fssr1RK8+Oa8aNqPrOIlMbW73lf2ZDYr/N:SdEsr68+Oa8aNqPrOwMbkf2ZDeF
TLSH
T1BB924F8D93B81E3DA3C33152ECF259CA93BE8444E210F4645575D1BB229E5AC92FF2B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_fr_CA.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_fr_CA.properties
Size 17KB
SHA256 33f1ec15d3dcec32797b51764a88874635d460568dbc475da356e477c20c5fef
MD5 221de62357400d9e58d656c6597cbcde
SHA1 ebbc51622636d72776322796b3f374e55575e11c
SHA512 cee733e32c9278aedf6152f690219d4cbbdcaeb0c43d62ae784b4c4c1e403b9f78a8b1b34b4946af743e3df938fefe3d21a4f3a2d8e70d860252ec32aaa3c8ac
SSDEEP 192:AnZsQ8NkiHPMKs+y5V741tPvpiVYMrzbfskYwAkWPRtfnfQxrfClXcIoyITS2a:AnD8NkEMKa5V741tPvpidjUNRRn6rffe
TLSH
T19A82844E9298543D43C33612FCF29A86A3FD8844F221E1645576D1B8129EAE8D6CF3F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_it.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_it.properties
Size 16KB
SHA256 1b7e638222de0c301016ab95fe7e663e58519d232d700c5030d8169cccf63afb
MD5 95457252255be9d638b21e9b4d67c4b7
SHA1 5134734364ea01a52dc613b3ab7d62d8c204f382
SHA512 01e819cc796532dc860512de16ad51a6f36ed5bef1b99546db77803e4e9508a1f2d152ce931e6ccbcf88e3c742681debd9b0dab2f317a254c5aa4958243cc59d
SSDEEP 384:C9x+NKFSSGai47sMKsky4+Bqwb6APHSe6LV:CqozGh47sMKsky4Cb/sV
TLSH
T19572A66D66A5583E57D73242ECF2928DB3FD98C8BB30B1095171D279228D688B4CE337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_ja.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_ja.properties
Size 31KB
SHA256 1369cdbb3a5d41146e6fda00be5aa680f284835867934ad79301b69ea7e89fd3
MD5 714ca99edc4e89c237a6ce57575e57c2
SHA1 0f298f561508680a98a9d239a83e217537edc251
SHA512 9d2e9852fe6a51712c622204fa34658f74c5acc6ca1cd96f290fe1fed6bb21312ea297e72937e7c9967c6cdd66eb202693928e79be629e7b766f6590aea5fc25
SSDEEP 384:xsrt7bkcRIS+XeKE3eYjSEOqoOQWfXswJMKY4:2rt75RIS+Xed3eYj5OqoVWfXFMKY4
TLSH
T11FE2696FD904067F0DF7928C9DA66EF5A6F708090361E07BD3A872512E2062777EB624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_nl.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_nl.properties
Size 16KB
SHA256 10dcd6176241875e4bfb603bad5e5f9e6c84eb58c38531ba3646588d8e471ba4
MD5 c17d4887a87f6aa703f181c149c89c2e
SHA1 c63a848dd1aa4954ecf50d226b79d56a7d9cc0e6
SHA512 c71e5e70a0d5106a741657935f5e224fdf25fa3bd906c3c1ad38fbda0b6e1db47b1f48d69eb3470a39b717b5d53fbd21bc1093637b2383935a831388f3c62364
SSDEEP 384:yUGnnUvo+ukH9Nf+prslrWFvLvTCQxPuDA4P8xOUMg6n1D:yUGnnUvBuq9Nf+prslrU3hxP87U161D
TLSH
T13472841FA9D9583E57C73603FCF215C7A3FE924C83B1A0A86539D4B4218E648A4DE177
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_pl.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_pl.properties
Size 18KB
SHA256 2882879bd259bc73f2e1799f5c6a47e8826dd6e95bbc33dde55b6e0b9550722c
MD5 54e11cea232d50bab77797575b382308
SHA1 026812a3c628f967d4245eea14a652240749e978
SHA512 f3af7c955f8878ab0e9b31ea7e7ffe4f43ec445ce78dacdfd3da1873d5010e0e331d5701e4358c5e318f2f90774cbc65f0453937a3d7d4b4df0cecd343ada1c1
SSDEEP 384:mlo65BrronOyd7T031nwTZa4GyQsnUlEQ:mK65BnonOyd7T031nwT9G5snUSQ
TLSH
T1EC92528ED6B4A43D57DE7805BCFAE65C77EF04849237B09815FEC0B1A2881089DD927E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_pt.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_pt.properties
Size 17KB
SHA256 50561fb3434b4e23f8f6ad41c36c7aa1cb637d6fabdcc307859039b96ccbb0fc
MD5 65a2ce0806dbff0a6c300fd00fb9fb13
SHA1 16e4f496785a4e28c81a57e7a7d8b4fc81abcc41
SHA512 1e6a97ac5a9cf8a69bda81629fbced0081274d84763af9e65b3c768d67251c65a652c65b3cd00fc06bd1738223789eb76be083b19378b071bdb8ceb15d6c1d12
SSDEEP 384:ay5HDZHK9NjmQss1y0o+KYH476wghUu6S6NWVgiOPq+7ywV9X6S:amD5sYGH476wghUvS6wVgiOPq+7yI6S
TLSH
T1EB8283DD57F9093D07F73202EDF3968A63FD4A445221E488417AC6BB21CD2849AFB276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_pt_BR.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_pt_BR.properties
Size 17KB
SHA256 60d2cbfabaec095d31c3fd56af1f1832a490f19202c7c79032cc52ab96aa11de
MD5 bed85b1d65e64dacbd65bfb59d972c7d
SHA1 0898006166403acb4683aa6160e3dc9d4b8406db
SHA512 556b81578743137d321ba8eaa3af36c919f836e4239c1eb5a04ada65dccd6a645e61384968d431cb383e2af7458296b33cca587a5ef5d6c804d5212461cac170
SSDEEP 384:ae5HnZ/f/tjmQss1y0LtPdH476wgDUu6S1NKagii/T+m74eDpQw:aCn8sb3H476wgDUvS1oagii/T+m74UQw
TLSH
T1498273DD57F9493E07F73202EDF3968A23FD4A405221E489417AC5BB21CC6849AFB276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_tr.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_tr.properties
Size 19KB
SHA256 3bb28b321a5f9c0e4caba74a7c49503ed571da07e5cd34979c08934f5541fc31
MD5 1d94e9fcd55a840ed0ae50f8a52eb0f9
SHA1 ae260f17e9ac0b8fb28223d266120e848ff2116e
SHA512 cf357adbdedf4b0b16f1471bbaa60af085ab9b17fec54df6ff6611ab16a8532bdb91226e2cc72102ca6229a54c25cb739338ae0baded20803ff9baccc6ec98bb
SSDEEP 384:Bm9OWjZTnm7I+PtB25hvUpnpgc1Newa8KkKB2cQoKV:Bm9pjZDm7I+PtB25hvUpnSc1Newa8Kkf
TLSH
T1E7923F9E69F8883CD6DA364ADCF5478CA3FD88009738E0C13C30D1F6955D38956EA97A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_zh.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources_zh.properties
Size 20KB
SHA256 4fb6de9b85e709a9421f9a2f31e561e10f24c8baa56e22f10c4f49bdbb80bbbd
MD5 bc86f6deeb0051759ea8056ae6386346
SHA1 82ee30aaceae00c410f0cb07b3c889679e72dba9
SHA512 80f2e1494e795696d32c8ec503fd06f2f51f034b3a8206cfc6a63601519f9ccbb06525c275c9bb04c8cb358ec4465a18b1cfe802995e34074e6b409f1883476d
SSDEEP 384:0ezP11ZAP+PODyWQt8K9K0AbTN9A5vLIh8MWINIuvbPj:0e711ZAP4gQt59tAbTNG5vLIdNNvTj
TLSH
T163A253DE8B19003956FDB2C59CF02D4E8FFE0D2092B3E1B690F5C5A1329416C59DAD3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZohoAssistAgent.iss

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Tools\ZohoAssistAgent.iss
Size 158B
SHA256 7ce520389eac0c97b06c16044d5737cca19fdb6af336d20d15cc5d6a41cd11c9
MD5 3c8e3031274c60909fa8c9b76e238226
SHA1 f29dc42f9b7258adc7268637a736e955c30f6c58
SHA512 e377a043707d67f489b8d65294d1a7483aca2e4e0d0069aef7409294e72240c01cadcfd8040d4fe157ff02ceb8ab4b8044196f470da99bbedadee251cd14847b
TLSH
T184C08C80D94804E2BE008AC827064F69AA33870E1E5C810D98CB48AA1BA2C0A4D801AA
MD5 SHA1 SHA512 TLSH

Submit Download

rap.ico

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\rap.ico
Size 4KB
SHA256 21052ae75f8bb2c62688a57d44ff25d5007fe24a797ba58441d8e7afd90b5562
MD5 c741f113b6d8e4fe5922376aa73c7e06
SHA1 5228c943a09a3a5e45e9254a9ea275c5acbee51f
SHA512 5e8a2be7160630a3600de41d1aea4145bf6c970cd8586d2c544a5a68a46c4e86daaa0f0b46cff8fcc026cde031375baf4795e8c65d4f3fe9b6c80e969bc28c3d
SSDEEP 48:zu3OxX4t+4u0oVgNbNY7/S6X5K/SN9lM73TmD13kqOFXTNRKkMhAgfBlgGHY4o:zu4Mw0oomK6JIyHM7DM10LNRkh7ZCO
TLSH
T15D9142D36D35C5EDE9B846FCD39025721E807D2ADAB0506F8EB5749B05A38085F3B135
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uems.ico

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\uems.ico
Size 4KB
SHA256 3b811ac5f6c5c7a118b92cc66f796b31f46e1ba9f606e74d92dc8212926934ed
MD5 2c28e78a06543c3c937a7c9b0ce4e5ff
SHA1 bef52d126372c39e891706a59da80c02cb5649e7
SHA512 ab06fb852c3d6ff47c5d69456d1e27f168a694b3c14db466262085ecd6c491e0cd3212b411399b87d76cd9b9dc916952248bfa7a9d458f011af9ed8b391e8f04
SSDEEP 24:suwiIYEuL9+UykRcIw233333JKT/E8lhDBy+dB1PewEOKTBg9v/wcnDDt:nIYavlLT/2Ej4OKC9nDD
TLSH
T1DB91AF833D0988FDCFE6157E5B622A38770B8D34989390319AD87615179310DDDA5763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenCapturingModule.dll

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ScreenCapturingModule.dll
Size 2.3MB
SHA256 ebd865c3e3a699325a8eef03262908a84eb21bdc8e7bf8c332268d82107cd690
MD5 700cdc919789203f8c8de40812f2dfa6
SHA1 c3da59e6dcb3cfbe075faefa28a75a6fd437aed9
SHA512 b10a0a731899dbb93fc2313637798518d3f233d632a10a58bbba09e9061346bf274a0599a48a8d30e3b7c16238fbaede9833e84e083636d7ffa3046d4e48203c
SSDEEP 49152:GfCR2vMljJqeOaq2JZ3PKlUnUc3x8HMMUefzbNh42pQaD1Ku:GfCR2UhEeOaqE3PKlUUcB8HMMUefzbM
TLSH
T151B57C22BD920072F7AF01354A6BA76DE1ED9160073921E3D754CF19293A7C25A3C6BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenSharingUtils.dll

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ScreenSharingUtils.dll
Size 1.9MB
SHA256 3e2481d5a643ed87a6e67b05fd2aff185e4f2669275290a8ef95dd49f5356d32
MD5 51deecc7265d6ad2e29aa1a7400d504c
SHA1 edd425c5a1febb72e4a992492f5cbd3232c7fda4
SHA512 a49f82076500bc2b55b4d2284814af679d14aded2baf6d392ed25f4fb4b2253be50b1cfcfc1e90c10c19c89d25e19dd47749ce6e5a200b1a236b4bbf6775b77d
SSDEEP 49152:x0Hj/x3zKXRiFXPRCuMr9RAnCCo1+ktz:x0HbxjKXRiFXPR5Q9ynCCo
TLSH
T186955B327A905076E5EB32374558A6E8F5EDD5B3073902CF26D88B5D29231C24A3C7BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScriptLauncher.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ScriptLauncher.exe
Size 25KB
SHA256 8148704c48e9a6ac8f8c7d7c3ce0fde923bf242b2f4c71d42957b4afc1f413e6
MD5 c78f5e5637c9c59a9c039192579325ca
SHA1 8ed998dc1e3d94c0b13446d48bafc67a0dc5c1cf
SHA512 fe47f4a1904d737e66e0e3f0c204508ae9605e32fcc397a4fe04a36ee22523d14ffbc9d5404075e4ecb053f23f3cc7f753d8b82b8279b8646979c9c16007badb
SSDEEP 384:Ge2hSsCL+YEmmdZV7sJZmIsYMM4WhxzkRvCCX/uo6ki294HjPwigRC2By8RbmL4r:ahSNmd/7cavCdr2MPbAZB5AL
TLSH
T175C26B562FF84D0AEAFF4E3865F2C52119F1FAC79CB1C34E1B84815D292D7905BA432A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScriptLauncher.exe.config

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ScriptLauncher.exe.config
Size 178B
SHA256 04a430fd53fba154d3093d3e8ac76c31d3bff8d08a7e4dec14656e576a880830
MD5 ce2fdb3342350a65b4edbb8513967b2c
SHA1 b8ba944a1ee25235129982dd9dcd386d4e5a8178
SHA512 1755b18399dd8fb9aa43c93fabb07a679f52cb11403301a3f0c249739a3139d520b6e0f187f74c6882d6d2ffa2739d0cc007df6fd46a8c28144d95be4b290e55
TLSH
T150C08C8940A8BE3B4D124B43A350C126DFF032A3B024100CF02FEEA40B2054D420B376
MD5 SHA1 SHA512 TLSH

Submit Download

SessionAudit.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\SessionAudit.exe
Size 6.3MB
SHA256 118e4aaf7186f9759656db3f00802331ea4b22b6394d599f5be7941b1995f5cc
MD5 d7814de758938e176a1407613ab845aa
SHA1 49765853aea61139a386af0a752749ff72080404
SHA512 f3b6a91963459b43c1b0bafcd57da79e2dee6a27ec416a91ce63493e0f84fdf78d8eda87b2fc2d35135657557774237780cc6b2779a76622553cfe744ae27272
SSDEEP 196608:/R6+Z89N2w67pud8EveW0tUuOguDj55h3URmtpVtHk41B:8OJtUuOguTpw6kS
TLSH
T1D566BF12764EC072EC9201B15ABEFBBE547EAD210F3650D3A3885B2D9C325D31A3576B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Settings.conf

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Settings.conf
Size 60B
SHA256 fdd7b9237db53968ea67662b40be859718b4249593346bde3acbbe74f85b228a
MD5 d4bce2620089e1c7a7df20bb9d21ec77
SHA1 f46eabf525f1d80c2c2c6b9df677b3db119b1b39
SHA512 51f65e506600b153d13cb14232df190f6beec57f15030da45710cd598c29fc01b1f6326de52089b8064ba8ef53500392ad66a4d6f2dfbbb77f9b05f195938531
TLSH
T121A0026197878C2671CCF1694D44859557D49519D54148C3545D9E08F1C604861484C0
MD5 SHA1 SHA512 TLSH

Submit Download

ToolsIQ.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ToolsIQ.exe
Size 465KB
SHA256 3e8986d32870c26a6ce2f6c10c7be44b7efceafc143d7d2d788a5077fbc9cd24
MD5 417b8d0994bd11f34fa436b3f692b75d
SHA1 2a093e482cffc04647d6c4de5ffffc643724fda1
SHA512 3f5c2f6616bdd7c9f4b394bdc10563799463d76fb2e37ac66e0dd311889e46295cfdd96ace95413339ef1b05f9a36480a81a852894574a277c5031b12a6fcf4f
SSDEEP 6144:uFiehNFfcCTHgM3HPdu7I2pTSFN1cexxaD3sRSfZsI8inuGYBidfAOuupRmHPnJ+:uFieJfAEo7IYeOe492I0GY4w+RmHPE
TLSH
T11EA47C1036D2C435E5B256700E79CB66453EBA610F3189DF73C49ABE5E342C1AA32B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Toolsmanager.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Toolsmanager.exe
Size 11.7MB
SHA256 17010f65e2200eecf6e964c19f18b5e56c5b45de7cacd53715597377874b4a7c
MD5 6af37bb60fba18ab7bd92d70a8a67a87
SHA1 6458e114c98bcdf5d34f41d20f4c25974a1e4135
SHA512 91ef46e83c04d45eca0b79b65718002453992f82a05911de569af0c8c5e4fe57a3b30245a65af95675dbb4e48db6a6ce62f2368667459643be6989c0224ce0a3
SSDEEP 98304:ilycTTkGLW+aQ8huEiLTr20SFN9LRrLWMW8Rg7nW+zVttsTw3B0k+eqrEB4GBhaN:ip+Q/r2ZRrJEUt
TLSH
T1DFC63901FD9B85F1EA030531516BB22F23325D068B39CBD7EB14BF6AE877A915C36285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

URSCredentialProvider32.dll

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\URSCredentialProvider32.dll
Size 451KB
SHA256 b365cd5e1b0722c749f59690f1b945ddf0014db9a1bdc2616d5310b28c70dbbc
MD5 a2e927531f93ac73c92cef2e967b82d6
SHA1 8702e9ef9c77be47a576fc9cedc260fa81742598
SHA512 3fdd450b83045fc481dcb7d346e40db32e0fce237bd96ac55efe0c4c75104aff9041e93e43023d855c7167657b3a44dd0d211e64e9279433f001b14958c554a6
SSDEEP 6144:Y3zYXumAsjJvKPvyIHonMg4+/t7umP5X++mGmkLAfAOldPMQimHbJ:6YtAssPvNHonMg4WumhXfmGVe7FH
TLSH
T10AA4165077E68476F5BF1A357C7486694E7ABC620AB0C9DF1384122E0A78BC19E30F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

URSCredentialProvider64.dll

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\URSCredentialProvider64.dll
Size 548KB
SHA256 393f699b9432549a2d92d653bd4aadfee092f695f8a8a76815046df8b6dde7a6
MD5 f43f810926ea8be82d2e6dbc1e1cd81f
SHA1 9c403e0fa6e5b64932122416ea8df7f899864ee7
SHA512 5798986b9d902de869f25edc74820a53cffaf5bc79bddd5d06a3d750192369caf89126c705a4e3000233cb6a84482662d5dce1fac0ed1f116d6dddd08b947ac3
SSDEEP 6144:mX5xlCh2IExYAIWIuhS79F0PAW71TX8zh0+dCJGohok2bhek/Jl:iCh2IEUWIWR1QzboOkuX
TLSH
T1CEC4081577E94AA8F0B38A349C728516DA76BC511B71DE9F2380061E1E37FD09E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Version.txt

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Version.txt
Size 16B
SHA256 efb7ba13600a9667df3aa051b838b176105311452ff9b392f67e8a6057af8e40
MD5 e58d0ab87a0a311e27139964d3bb332d
SHA1 f766020ae8c59d2024bf9a8f77ec7c08ad914779
SHA512 64cba7e04743f687b0fa5840f3d415242cffdbac82453d5a18c60766482f413b290122b39e4515bfc134df6d176aab62efca52a123837da33e7cf406b3864490
MD5 SHA1 SHA512

Submit Download

VideoProcessor.dll

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\VideoProcessor.dll
Size 2.4MB
SHA256 5da3e31f15ff4e145a8a50d0b88b3e3dd417cce258e30926b42d276cd1add66e
MD5 6849838478b2f5f056d971f73ae60ceb
SHA1 ea8943141c8fafdc5f6894540426c1f8cc8e0190
SHA512 fce6d1ee1b0a178c3511dc3985128c1934d99ee898e2978fa4e238a0957a75eabc01d38c78e052ce22f74b15d6745eae3603c16db2d788e9c233126aa84fee52
SSDEEP 49152:hSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwJ:hSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSr
TLSH
T12AB529E163613239D85E8CB18A7E5CE7152C2577A3248BEF59EC1A7605319C27B38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\agent.exe
Size 13.6MB
SHA256 5ced420d9ac71c515ea8886abede0f91e66e0f7655a962dc262f4927805120df
MD5 88ccfbfcabc28c20b2ad5e88d754121e
SHA1 8438c728c605fda3d2190f689fe34bf95d6bcf46
SHA512 c1115b5825bf422310cf203ead71e259ef593d3986c90d53a0caf75a3f7fb55cc3c3253abd4352273d6055511bf7421761808693da3970340a1ab25db52f6fa4
SSDEEP 196608:Hh1UUu1IddktM0/e4g6W1JEKR89g3BNFAQigTp78kNkc9NusfYr8Zuga:amOe53jgQh8kNkzr8Zja
TLSH
T151E62830A795C06BE3632930A92C97B64019AC34E73865CF1246BBAD65316E315BDF3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_ui.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\agent_ui.exe
Size 1.4MB
SHA256 1e10b830b5b982d7481b8ef39c576b6efc6233b34678ea4f6d606389a3ff22e3
MD5 c2b146bcb5674819161228c8ff1929bd
SHA1 4fc9aa78f83657b58ee4264982e9cfc710b1ed87
SHA512 665b29d4d4ff0d136590b4226792a59b1a72816fed44a80e6b4b06ad187a5861663f3b1932e3a81d5cabf34f2c8dc96e2cb97aeca41df18fd9cc43c01b77ac42
SSDEEP 24576:H+8PwhKWfZydu3juyItDk4Zp2Rs6fIyFoBkkAM:sKYZyuCyItDx6J5anJ
TLSH
T11565F10172A80427E1AF477584B29941A7367C439BA1DBDF669871BD2E333C09E32777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_ui.exe.config

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\agent_ui.exe.config
Size 890B
SHA256 68c7ac4e52b1ae590e0711c8ad0f209b797e634b44b67d0e0d4849df0d1b2db3
MD5 9993268b645291c3d0d1dcf8f2cd28b6
SHA1 c600b97158a3d4c95323705dd99a7eaacfa4c240
SHA512 611c9084c7628e121a7648700dbee98cfb27ca0329d8f20ed02f65f4b22138de4638db3c74075dfb0415b3b9c5fc63469293852033baca8a7ce0202a52076bc6
TLSH
T1A011482091C8FB594F725AA33E7B6418CB6903B3288C048CB0EE6E578B2259A5207173
MD5 SHA1 SHA512 TLSH

Submit Download

cad.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\cad.exe
Size 20KB
SHA256 14011eee4209dc996cabc7e698ed15a0ad399e31bf6ec8c14de15f1bce6ba451
MD5 fc894f4c78d6c643711528892cab7fc8
SHA1 d931b140299c54ec9917852f929b9e45529d295b
SHA512 26a85c76a5e53ed9e0552c986c931975e0c2f8d64ac6994c2f9392935a32454e047c954bfbe1970fb168d117ace8e22f2e0cc83684b40d7adc74742af3876c98
SSDEEP 384:/tFkvkdpej168i0/uo6ki294HjPwigR0DCy8RbmL4nNyYsNg:/7ykPuyVr2MPbA2C5ALpy
TLSH
T1BA929E5399081803DB838DB0B5E9CD1B5DB523932FED60D37075C2166F853D22FAA19E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dctoolshardware.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\dctoolshardware.exe
Size 77KB
SHA256 488cfd48d1fe69a52453cdffcd724e2602ff1a2820b112a389c3ca4bd1d77f3d
MD5 5ec93a219be168f56cc356cfe2f890f5
SHA1 4b32f193a66b2eedb930edbceb337d895870b4d8
SHA512 01c05606c1170086ef4aaaf4a065a60a9ea369eaba67474abf2d8b28d2f32c56af1e000b9f9c98947969a5f60b6fc4e2a87b0efae4875a8b5d78be01041d07ef
SSDEEP 1536:DCdQ/OXj7wMG/fxYJx2TA2bFRbFACmvwKc7yNpdeEHw5yzF/L7tRearjKLJPbe:DWQ/OXjcMG/fxYn2TAgnACgwKc7yNpsd
TLSH
T112739594B3FA4804E17EDD306CB1E25614B66EDF8B22E20D2C8B145C1B71797BD69F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dctoolshardware.exe.config

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\dctoolshardware.exe.config
Size 197B
SHA256 ed7fc8ce34110c21643624bc0ba3463b060255d183938a7f677eec0ea851d406
MD5 f4fa5aaffdc3ee801f06ed23cc7f4f97
SHA1 7c15059fc28228d5e2a0cd24991bda4134d4e31f
SHA512 936b6b3eef692448bc62832eca88e37333dcd210fce336844759747b5da92b3404829d655f755290cca9ba18bc6365cc2e730a773edaf49a7b354a058db642cc
TLSH
T14ED08045C57CF52F9C031F436710064ABF70C2D565A4100CE2CF3D40071118DC717356
MD5 SHA1 SHA512 TLSH

Submit Download

sysmanager.dll

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\sysmanager.dll
Size 2.6MB
SHA256 e3e93b4e453e79224f909183e92c3d7ede4f7bb38d852bfd625b9766d0543a93
MD5 eb9e8490438ef471ba692b14e325fa9a
SHA1 ecfce425ec7e8053fbefb882a7575d74ac7f46bf
SHA512 5981e3d79daca8ad4358498226a6ea6e171d4dc78db5b6aaa23f578f63f71b52f4e7271a7754fbf830e5484f4e34fb12960747b1898e252bd32bbdf84bd77646
SSDEEP 49152:gB32sRpyW1H6F3Kz8hQ20vzzByHkgTusaPSP1kwG9sL:gssR0W1aFM8htO2NaPi3
TLSH
T19BC5C012BBC28031E89E4175617AD77E8D3ABB745B30C0D793C49D6A98705C16B3BB2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\license.rtf
Size 51KB
SHA256 6e29c59f8e107b61d26eca465ea8eaa421998af223496253bacd0c761bb99222
MD5 645d5ed804598110498214c5193f4202
SHA1 2048418ec4f159f1dc7b62dd6e969b6219ae779e
SHA512 f4f750d4a75b3c6839c51a131d7c60a0fdc9362bf54e0ad704c751bdd17e7f384da1ffe906c1b08f25b2b8548770692337edf76785437f252588e974277f25c5
SSDEEP 768:q1VjB1zmiWut0nN6zEscKHZE8oVojrc9YX:qPzmBnN9+HPoWPcKX
TLSH
T1883320EC114422AAD3A322E1AF1AF0847A2BF92814F1D4E474DFD3BD61BF5ACD172521
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 da0d7d1e45ba19afea3eedce98ce21be524416ab4c890078b6e72b0eb1241e61
MD5 01e3cba47442b5ff51a6d7aa5428f69b
SHA1 9826f011c2e8f0aab58ab0e7c08357ded8dd87e5
SHA512 53c9a1f89ff93e6dcfbf08618fe8cff42f3455e36a810b4553245b7835b9f0319b91d040b7890cc1654eac2f75602bd33845c609bc318d0d2143f0e0c203a24d
SSDEEP 24576:jFo3DMPqdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+S:gHU
TLSH
T10457B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{e23618bb-6fa4-4306-b770-e7680ecc9f0e}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{e23618bb-6fa4-4306-b770-e7680ecc9f0e}_OnDiskSnapshotProp
Size 6KB
SHA256 a26707df75229dd9439b00b37101cc8a23ed49e3a1c177f02ecf1b425db9f241
MD5 05c0d1ec1bad2ec8dd3be482caa5c4e2
SHA1 a8b1284661dc7473f4889068f59b26a205d863e7
SHA512 c4b92e65cdafcfb0892460f67236e9ae5b9573863e5537263840f3fcde99c7aaf26d5223457eb7c27e3a4adac8a05821809035aa159f87b252656a3560f81e48
SSDEEP 96:Fud75Cvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:M3eb++uVmN
TLSH
T120D189085AF54311E2B3AB7129F14557A877B911EF33CB8E0198238E2631A10F936F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download