c99e58ebd883b03841ac41617a4151f4c0c7291b35076a4a28689a684275006a

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Size 5.0MB
Sample261015-pvb2yaaz3m
SHA256 c99e58ebd883b03841ac41617a4151f4c0c7291b35076a4a28689a684275006a
MD5 5e17993b7a375888b4f017ec8c728008
SHA1 adedb905bb81d6415de5a610a4df1c1699892f37
SHA512 77bdb29c5d27e9bee23a5b7b48035a35609b2e604922601e31e98c0b6128f2bcbe1520e648751659af1d345a1b7fe6ea705390d5b148793008f7926aeb14b62a
SSDEEP 98304:5blVO9dhgX8Z3dQ1W9ZbDTqgl2MLnLmbjGSfdJ:5LO9YX8Z62t2MLibj7D
TLSH
T1AE36A012B683C032E9920171687DBB7E487DAE30073488D7A3C52B6E9D715D36E3676B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

costura discovery packer

Malware Config

Signatures

Detects executables manipulated with Fody 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c55e-89.dat	INDICATOR_EXE_Packed_Fody
behavioral2/files/0x000d00000001c555-245.dat	INDICATOR_EXE_Packed_Fody

Executes dropped EXE 3 IoCs

pid	Process
2936	ZAService.exe
3140	ZAService.exe
932	agent.exe

Loads dropped DLL 1 IoCs

pid	Process
932	agent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Costura .NET executable packer 2 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000d00000001c55e-89.dat	costura
behavioral2/files/0x000d00000001c555-245.dat	costura

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\ClientSocket.dll	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\AgentTroubleshootingTool.exe	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\uems.ico	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_vi.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\ZAFileTransfer.exe	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\agent_ui.exe.config	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\Language\AgentApplicationResources_es_GT.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\sysmanager.dll	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_it.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Version.txt	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\Language\AgentApplicationResources_de.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\Language\AgentApplicationResources_es_MX.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_es_PE.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_pt_BR.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\rap.ico	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\ImageProcessor.dll	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\VPrinter.exe	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Tools\	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\AssistLogo_white_border_32.ico	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_es_CL.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_es_MX.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_ko.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\Language\AgentApplicationResources_es_BR.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_ja.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Settings.conf	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\dctoolshardware.exe	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_de.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\AssistLogo_transparent_48.ico	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\Language\AgentApplicationResources_pt_BR.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\ToolsIQ.exe	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_pl.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\ToolsIQ.exe	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RemComm.dll	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\Language\AgentApplicationResources_bg.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\ZohoMeeting.7z.parts\5	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\ZohoMeeting.7z	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\VideoProcessor.dll	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\AssistLogo_white_border_32.ico	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\Language\AgentApplicationResources_ko.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\Language\AgentApplicationResources_pt.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\ZAAudioClient.exe	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\ClientSocket.dll	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\Language\AgentApplicationResources_fr.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_es_AR.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\ZARTCHandler.dll	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_zh.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\cad.exe	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\Language\AgentApplicationResources_es_AR.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\Language\AgentApplicationResources_es_CO.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\ZAAudioClient.exe	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_nl.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\ZohoMeeting.7z.parts\2	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_es_BR.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\agent_ui.exe	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\Language\AgentApplicationResources_it.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\Language\AgentApplicationResources_vi.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\VirtualMonitor.dll	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\ZAFileTransfer.exe	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\Language\AgentApplicationResources_es.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\Language\AgentApplicationResources_ja.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Resource\Language\AgentApplicationResources_pl.properties	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Program Files (x86)\ZohoMeeting\Connect.exe	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	agent.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZAService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZAService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ZAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ZAService.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\zohoassistlaunchv2\Shell	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\zohoassistlaunchv2	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\zohoassistlaunchv2\ = "URL:zohoassistlaunchv2 Protocol"	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\zohoassistlaunchv2\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\ZohoMeeting\\Connect.exe"	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\zohoassistlaunchv2\Shell\Open	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\zohoassistlaunchv2\Shell\Open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\ZohoMeeting\\Connect.exe\" -LaunchAppArgs \"%1\""	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\zohoassistlaunchv2\URL Protocol	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\zohoassistlaunchv2\DefaultIcon	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\zohoassistlaunchv2\Shell\Open\command	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2936	ZAService.exe
2936	ZAService.exe
3140	ZAService.exe
3140	ZAService.exe
3140	ZAService.exe
3140	ZAService.exe
932	agent.exe
932	agent.exe
932	agent.exe
932	agent.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4688	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4688	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
2936	ZAService.exe
3140	ZAService.exe
932	agent.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 2936	4688	2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe	91
PID 3140 wrote to memory of 932	3140	ZAService.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_5e17993b7a375888b4f017ec8c728008_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Program Files (x86)\ZohoMeeting\ZAService.exe
  -silientinstall -productID 1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2936

C:\Program Files (x86)\ZohoMeeting\ZAService.exe
"C:\Program Files (x86)\ZohoMeeting\ZAService.exe" run -SessionType ASSIST -productID 1
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Program Files (x86)\ZohoMeeting\agent.exe
  "C:\Program Files (x86)\ZohoMeeting\agent.exe" -agent -k 5215103446 -dc jp -email elon87797%40gmail.com -SERVICEAGENT -demo_session false -ShowInit 0 -productID 1 -session_token zkms114400000000130150299726ac6bcda73d72d0a3a604f9500cfad39bf9f4426821d17ecf1d8674b96b44a56b7f84e058993ac7dbc6a7510c26491452d9e1cf2e6b01baea9becbe8cee5fc2824a37498c49dadb14b31fb9c7d780ff8f1059b7368064f1c65435e72b6101b
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AgentTroubleshootingTool.exe

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\AgentTroubleshootingTool.exe
Size 12.6MB
SHA256 59a14ea478444f7b77897e7aa000642807eb9ee379c068ad5e27d8903248280e
MD5 3ce72805c4307f96ccaf0460a12f0eb3
SHA1 cac6123413ce65327fa3e9497d851773fb5ad65f
SHA512 31ea04e58ac9a02304a44577dc625bbd3c5b833fed660af38521109cccffbb2700cf7ea0292b310b26736c4dbae0581e4b6c0af9793be04fdb652423e9c969f5
SSDEEP 98304:RFtsACKkhAS/KWr+WLkXFTQR0ZMjQtIEpt8vuahIOW1:bv46gjkCR0M0jHawOW
TLSH
T187D65B57ECA644E9C0AEC5708676A632BB317C490B3027D71B60F6382F72BD45EB9760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientSocket.dll

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\ClientSocket.dll
Size 3.2MB
SHA256 af21f43b03d2cd921d914a75348f85ee530448f14f0a8494bb701f150f5db4da
MD5 2745f7ff5f48397b771fa00797b4142f
SHA1 19c76c0fba629f2bc50dea7eae8434b18a651218
SHA512 e594b9564cf182d4f38af47044b70603b2ae645f4aaa6448ea2989c6382c975fac7e8cd94b9a36b796346535173e09fabd47806a687b2d711513480d19ef14ff
SSDEEP 49152:Bwus2ZiM8/qrBhXv27Pz7sX0LDodm1CPCsxlEv69IrvK3vh+:miiBQhWPzG0LDF1ZsTEvH
TLSH
T19CF5AE23BA83C172DD8D02B41476DBBB49399E10473584C397D46D6A9C731E2273BBAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Connect.exe

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Connect.exe
Size 5.0MB
SHA256 934089dc12d703bb6d1afe671f220fe001476802682f075e4cb2144346244be5
MD5 3cdbc85b901dcfddbe9ab0c26db48116
SHA1 83194a49c0f31bf4cb0417515099e2a126d0baf3
SHA512 91d22913661812e9e53483309939d89f577749a6e12f0877ddbec33cdd4e0c68e599b18b06331f725d7636466982b010ecd627733c6c5bfc60b1476c053fa986
SSDEEP 98304:+blVO9dhgX8Z3dQ1W9ZbDTqgl2MLnLmbjGSfd:+LO9YX8Z62t2MLibj7
TLSH
T1CB36AF12B683C032E9920171687DBB7E487DAE30173488D793C52B6E9C725D36E3676B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImageProcessor.dll

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\ImageProcessor.dll
Size 2.2MB
SHA256 4f024ebf99dccbf91b0442fdfecdcd3c80ded22db34ffa57e117655458d4cb95
MD5 030c7065c67a28b221ace18beb301305
SHA1 276d8258976523cd72e1af8b5f5a0511f8f6f63c
SHA512 4781f099f8858329e4ff0ba1b9b67928120947f2493e8b67e5b8040d5ea608613cbb4b2a7cb863be3316a3fd4af7fd65731d590fd2c9b4a2b9bd224cf3dcd6d3
SSDEEP 49152:aTZc/+eN+jbGcjMj42RYWTgP5wc6wCEIgS1uOSGIbKTg0Ly+cVOw:qeNaScjc42RVTgP5JdhIg0LSKTg0e7
TLSH
T1B6B57B213B9160F7F59A4230455DA2B9E6AF90340B3983C75250FFED2D315C2DA3B7AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemComm.dll

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\RemComm.dll
Size 2.0MB
SHA256 ad8925ed5c3e664e30c1cafe79e8c08527d86dc3dcf5e654ce7210775639ff40
MD5 7c6399501c76dc5df2e03c4b44835135
SHA1 013fa3692448f245a2964eaa897cda663f54080a
SHA512 a9a2bab63e40e0f5c8602595b5383fc37e6c8488ee8f0ea6d2f9fa9c93ccd4db9219f16fcc1494bc2fa73f5556afe6505f637c3287da7d158b7ca83443279c32
SSDEEP 49152:rREAzHvIL4UoN7xAHiSe8SNSPJKlYOrcti0:rREAzc4Uy74iCSN3k
TLSH
T17CA5D002FB8684B2E5DE02B551769B7F8F3AAA240730C5D3D7D06DBA9C311C1673A369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssistLogo_transparent_48.ico

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\AssistLogo_transparent_48.ico
Size 9KB
SHA256 009f00e8de35aa2b229975f2b2edf22990012f730120227231b865208ff3dc25
MD5 7f7890c4fa820b112a06860af9b2b14c
SHA1 2dec813af1bc678022a8ff6f7b228ef21f862f86
SHA512 ce8e215c9f539c6067508fb81dc7a7f9aab8f90d45399f304fb8f0bc42145c7d3aef7c623b6ae58f49594e1c200e3c0cdb1882f02f059ef67cf2995e443face7
SSDEEP 96:9EBCz3uzbTk5GMBmcxzAsx+sm+sxzgcwBLs6wbFvVRGCg2h:CBCz3uzbTk5nBmcxzNx+sm+sxzvuo
TLSH
T14312BB7FBE4A2034F8B6827BF2D2BF3D5404E9D74671D99508D1AE90DAA214347EE413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssistLogo_white_border_32.ico

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\AssistLogo_white_border_32.ico
Size 14KB
SHA256 dd72cc36c3e664913059cc64a852fe673a8b6eb264632fefae20649a27e999d4
MD5 d669e7bceff12a455fd097dedef847eb
SHA1 eba799a79331e06d412b8ed81bdacdf1f3a824bb
SHA512 23ca689e8b076440b9d255782649555d79d227b026ca737fb928a7181bb54b2f6d5331894f10e7e9b5b661e1d23815a4dae7a25918b86352e371f4781e197b42
SSDEEP 192:jVi4fDR6guVkGFWrktZqlXR/BRVjUXGGNGOF5cMZX4RvJYZ/:jR9xAFWr5lXR/fuL5cMZX4ZJc/
TLSH
T15562B5A43148C266E13902309C7BDCDA4326FCAB5E14D60DFE74B3EF6B76102A559CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources.properties
Size 14KB
SHA256 4d3dbc652a0fd4fb425b009267acc4b6936b2e304603e18c3e9cad38cbcfa885
MD5 5c4a3b1631815f64d20af2e41de46643
SHA1 7c67198fe31669b20c2abaaf3bfe031a87a56d2c
SHA512 7d2c5079cc90cb88a18bae0cb30c7a4bdfb64b3e1fbc3d07fe9903058478c685b541348944999c3955f1c9898095b1a4d656e971eb05b6c9afd61b710dc134cf
SSDEEP 192:IehM3FMnXnsfzM264IQZEqXb26ptO7WRJeEZA6nOES/eAz5kyiQEkkSlpJDUA4Vz:o1MXwzMj4IQZEqzOiRI7ttkyiQxfUAEz
TLSH
T12962935EA699693E47D33503ECF20AD563FE548C9370B0755130D1B8229D388AADF2B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_bg.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_bg.properties
Size 51KB
SHA256 b27c3638191be60b20a2265e2c87382f998e3ee49dc50b89338a14732d5a361a
MD5 3d1d3d8213e1a8228206b7263d9e7c57
SHA1 113345eef6cfc3b4d53e2d0d365e89b7ebecce13
SHA512 49160cd712b2174cd2ea1aa573bb855c45a2b0be35ec3d9115579f50df4b1544eff76c86bb90db3af401e49667c298bf41c701173dc2b694fdf07c09c7f41d61
SSDEEP 1536:OQ/Co4HKrEROY3OfvrtZBW305CYjwkoLnbO4E:OQ/Co4qQROY3OfvrtvW305CYjwkoLnbs
TLSH
T19B33DBE6D0E3062C28C839D7E7B1BCED39986840E128D77FDC7E6697D5147246AC072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_de.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_de.properties
Size 17KB
SHA256 9e976433fb1ddb94748c533fec87278b718b38aa2000e6cd22ac90f2549c5d98
MD5 bbbbd53b70ebadb5ac80e5719b5e6e96
SHA1 3d9a672a8f81d77d846572d1e6e8df3fafbb0d4c
SHA512 d48a148f10f46822f8abb5c9d3d0b685a510a873114d1f309801d7f5efe1ce354e7f4c33870ebbf1d4605dca4db33b4849a340f2d5d98ebc0c47b876d9efebcb
SSDEEP 384:WmkimFXAjiz1l64+2keGlN4VCXl3S4EkbWC8WLW5Bs:WmkiTjiz1l64+iGl+VCXl3S4xaFWyA
TLSH
T11972A29FAEE6643E63DB37026DF14AEEFBFE86489360B0185178C171924D39448ED532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_es.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_es.properties
Size 16KB
SHA256 a9c6ac9ba46a5e2ab3065e66f4d93d0dc81e160529884d26e682531b1dbeb7e1
MD5 2810928a10879bf239ca3bdd60a64bfa
SHA1 39080efcadec91736b223972f42762d4cf66566d
SHA512 77aa093037cb0f0c758dc3a2d89457e63c42970e19fbea4f7fa4c82a25f72606edc4cdfa1e92b58c64fcf5afee61d25cb6f07c56d1adb0f69853d4a9e0cecca7
SSDEEP 384:b/Iu0Ftc5886zG/h3Hcw6wzAbypo0kdf1ydrrolRjhJYBbdW4IhemdNdJ0bGufU:bo/zgHcw6wzAb+qJ1icjJY729h
TLSH
T1797275ADA6F8A53E12D37201DCF3E68EE3FD84446220E4DA9135D1B5609CA88E5D7337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_es_AR.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_es_AR.properties
Size 16KB
SHA256 a5dcda55bb85f74dbffb1602c196370f4874618c0b1ae049d7e85bacae45c164
MD5 78ead3e0a059183d14edf2cdbba3ea14
SHA1 897a2d599f3c8e3b7552154a0b969c766b6f7f27
SHA512 81a199afbe0bea718e0d305766d22d147f1e8eb48f52e96545473c242224e31af412d18ee95125adbe439413cf8ff00e1735666dea55a7d7ae81637349aedf96
SSDEEP 384:b/Uu0FtDmr6bza/0EHcw6wDAbyeo06KfCyhdFR+hzlJAkbdNUIQ3dNdJb7p77:bMXzkHcw6wDAbNYuCYR+vJAt3b
TLSH
T1987284ADA6F8A53E12D37201DCF3EA9EA3FD84446220E4DA9135C1B5609CA84E5D7337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_es_BR.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_es_BR.properties
Size 15KB
SHA256 5e05a9fa29fee5e6cd7255e471d52e5e6fda7ed0c72476f79c1d0cf849c7aaba
MD5 c17b704f49eb300956b0dc6aa590c5fd
SHA1 214ed8dd6bd73719138cf1c1de83e65dea429f68
SHA512 92a201d23b92dd424eb961c057db7716b43d2a6485a748a57f18cdacafbcbaf3d2178e634d6108dbdfb30b32d685153f09a79e1ae3955500ddb2258a8f153f34
SSDEEP 384:b5IA7ezu0RKiHcw6wDAb6KSCQ1i348Ln1tv:bp7ezuQHcw6wDAbPSFi39L3
TLSH
T19B72835D9A98893E57E33302ECF2875AA3FE4844B221E0959275D1F561DC78CE8CB732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_es_CL.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_es_CL.properties
Size 16KB
SHA256 d273bdb5f7cee39e457f60184fb8fa7ed949883c933c1e53ffa2a74420185c8e
MD5 6eb75ff67336599f51b3232048d3f270
SHA1 c6bf8782d866fdf65aed36283f2ed18c33edf2b6
SHA512 ce601170357d0272abed1a36bab030259faf3a136be26546c8c1a4a3253f640313d7fd0b8cb46087d2180e98dd8be92f1231d4c0b00081fd75e0cb9e6008648d
SSDEEP 384:b/Uu0Wkc77Tbzpc8WHcw6wzAbyeo0jxdfCydGx7kvPolTf4JWkbF7DmqxYN3X7pL:bx5z+Hcw6wzAbVnJCGP4sJWmCb
TLSH
T12E7285ADA6F8A53E12D37202DCF3EA9DE3FD84845220E4DA9135D1B5609C688E5C7337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_es_CO.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_es_CO.properties
Size 15KB
SHA256 7ef4c0d0afcd69da85fb89dcad8796c1150ab045a18a342558e430af848bafac
MD5 3354495b20243239a27c16ae8f971a4d
SHA1 a95b3d10d323d5a79f49f7c09abe70905a3785fe
SHA512 f757b3afc48725137a45ad78b97f494fb87b3c5fc2a3867a8e829fec8423e5266b62996a0ecf4c10614faf4f468a553d8c52c9e85f9316d3ebee2e2f590e83f6
SSDEEP 384:b42qze6jMpHcw6wDAb8oQzlxqeUhzYL9ubfA:bdqzqHcw6wDAbm4eUhc/
TLSH
T19172846D9698993E53D33202ECF2C75AA3FD88847261E0999571D1F961DCB8CE4CB233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_es_GT.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_es_GT.properties
Size 16KB
SHA256 ae9d37a9b541d139aa9e297f8a58669127987b8cba11fab96dbcb79d95e7ce6a
MD5 2d1151921a3a406f5f0f125b823ddcd0
SHA1 2c1a61e76ca9fcd73fa4e45190d010c14b9e44af
SHA512 d3ddf6e16fe6d072de69a207186d2c1b0c0060620cd01370dfb6d006d3b58ed9129c81c7d3737794d0741b332dc9d26bf8c787013fab8da19a4b9e91f2bb55ee
SSDEEP 384:b/T0STcM86IAz/nvHcw6wDA5y/o0QdUCys2laPoltzlJpdbFTZIWcdVd77pk9:bzwA7Hcw6wDA5KyaCBPcrJpFkW
TLSH
T14A7276AD66F8A53E12D37202ECF3EA9EE3FD84446220E4DA9135C1B5609C684E5D7337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_es_MX.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_es_MX.properties
Size 16KB
SHA256 8f462a0f814bfc3ccf59bcc25478bc35ee12a9645ee3168bcb0f9386b3775fae
MD5 b6447310ba75c994d5ac45fcf6ab95b4
SHA1 297f8181f5bda654d40b01d92e0b60277fa94eec
SHA512 4bd8898e9d041e1007a6faea998cf1321ab1f0cbac358f405f1e4cc4f592fccff3b175af6fc95da0abfbe53f3143dc83fce2efa21f1b96956c9a5257ff6b59a0
SSDEEP 384:b/9u5cFrMoT/z+/03pcw6wzAbrEo0sxd+w1yz7D1QgzlJpdbxTUIH0LtN3M7pkR:bhdzzpcw6wzAbYoh1y1QGJpkOuX
TLSH
T1A872859DA6F8A53E12D37202DCF3EA8EE3FD84846220E4DA9135D1B5609C684E5D7337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_es_PE.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_es_PE.properties
Size 16KB
SHA256 cfc06790b369468e3dd64378a8d7cf3d94f590c10d244bf6dade99af342d3c4d
MD5 396b618d3da452fac665aec0760370df
SHA1 564896f0276fbf4cddc9941377b6259067b36971
SHA512 2851f83c2e1542d23bae36720c8f8b8103fd806c516d48a03a2031de30c46829abb9a96b3bbd556952ba112a00486124f5c0c185d9e7ca4f0904b7cd475a2919
SSDEEP 384:b/Uu0eda786bze7/0EHcw6wzAbwzo0jxdTCyzaFqPdhzlDpdbdvfIVSxtV3J7p7Z:bpEzUHcw6wzAbwndCyPdvDp3CqP
TLSH
T18F7286AD66F8953E12D37202DCF3EA8EE3FD84446220E4DA9135D1B5609CA84E5D7337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_fr.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_fr.properties
Size 18KB
SHA256 04592ebdf1f863c12a48d61138308141f9373121936e4dae9251edb9fbbf06e1
MD5 32f5a9dfa13a350650bc1eff61a42169
SHA1 f22d8bf46f464fa007bb90847f0795652f57d68a
SHA512 70a2689af7f2e122e3a5ca6e2a186a6313135f61ee7e1265336f7d53d399c3ac63c3c215df3c66b03f9ea34072407c553ecf3bde3d7ad8ff969701896ff4bc05
SSDEEP 384:S02fssr1RK8+Oa8aNqPrOIlMbW73lf2ZDY8:SdEsr68+Oa8aNqPrOwMbkf2ZDj
TLSH
T11382409D93B81E3DA3C33142EDF249CE93BE8444E210E4645575D1BB229D5ACA2FF2B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_fr_CA.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_fr_CA.properties
Size 16KB
SHA256 08c3668a5f7a8b3323314749a9b920ebd5fcce70539ec0260fb1ebd4457650f3
MD5 ca4bb70dc285f9078e3ac08fa6c00cc4
SHA1 556c304972d2691a0e87986fcf5cb9d3f79b9e85
SHA512 4bb1b98c85c7ff4f84cdeaa060b55f7fe33147a08a83d5718139d649cda848df51d6b308d7ab2bc2e6bd66445cccfa651af53eb5747a2d790c40d3e40dd4e5f8
SSDEEP 192:AnZsQ8NkiHPMKs+y5V741tPvpiVYMrzbfskYwAkWPRtfnfQxrfCluyITS2a:AnD8NkEMKa5V741tPvpidjUNRRn6rfo
TLSH
T11E72854E92D8543D43C33513FCF29A86A3FD8844F220E1645576D5B8129EAE8E6CF3B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_it.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_it.properties
Size 16KB
SHA256 8ea466277c5808bf49bdd22b2fa3cbc944dc66bb3a11943efb3f0c66a2c6b001
MD5 3b3afb6d8d1e0d4da27c241e79c2846b
SHA1 a544a11251d5e44eb988bc9d606a38d68789e9db
SHA512 7da469670a612761745f328051a36bc1b675181fe7b1a94e216324ef33d72dc3238abf48277e94a10a042323ad504bd7a22da5576ae903bdea207aeb8259812a
SSDEEP 384:C9x+NKFSSGai47sMKsky4+Bqwb6APHSeP:CqozGh47sMKsky4Cb/P
TLSH
T16672A66D56A5583E57D73242ECF2928DB3FD98C8BB30B1185231D279228D688B4CE377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_ja.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_ja.properties
Size 29KB
SHA256 cef9f9bcc832bdc7cf873f22416b6e3c96049f2ad69acf7c096389fcdef59a5a
MD5 0dc6b6ee50bdb1cbd69f56eff4529bcc
SHA1 9f1300d02fe73e0e070bc15fb2635596cb527dbc
SHA512 96e6025728554490f6823d106feebb4cbe9a79372ab96746b2c37886d4a989097adc058bc6c7998dea05a2cfad511900dd7306a0865102470ed62a776322ca7a
SSDEEP 384:xsrt7bkcRIS+XeKE3eYjSEOqoOQWf2JMKY4:2rt75RIS+Xed3eYj5OqoVWfoMKY4
TLSH
T162D26A6FE904067F0DE7528C5DE66EF5A6F708090360E07BD3A972512E306277BEB624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_ko.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_ko.properties
Size 24KB
SHA256 9aa0130e1bb302d9d140f341b08afda92b4c60555f3d68969b8d8d3c210c0a0d
MD5 45620504e552f7d82f0ac7bf54060489
SHA1 b8a995c88d0f3ec90272d3151f9f9cf5c5b23e16
SHA512 95b3867bb6f3cbee07181418c88169cbf6162375d37641a8af252edd8bca7548b39e811afb3ba2e8d3b87a73411035a426a386951f8f223b23f9e8209983526a
SSDEEP 384:zpR4xQfsupjvmU/WVekdufaalqIIRhqBI2:zpR4xQfnxv1/WVekdufaoqIIRhqBI2
TLSH
T145B2BD9EC33101F502D2684B6DF672FCF78A5795408CA5B3C6BEEA643B1D03CA196A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_nl.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_nl.properties
Size 15KB
SHA256 08381d51d0c017427f8e9f2b23f5329aeb40462e9648f5ef8e2a44fa3387e707
MD5 51431a30634a978e3a3bdbc872062907
SHA1 ae1230982b16e5fc569c159f9c290271e2ca80d5
SHA512 bcf2515e9de07449ffd6dc0004cc08227f950fc82974d22bebf759a2ad91d4e4cd022aa15c20242d1a7fdf8d178acd6bf6cfc12b9ae58ae89b5bf849781cb91f
SSDEEP 384:yUGnnUvo+ukH9Nf+prslrWFvLvTCQxPuDA4P8xOUMgh:yUGnnUvBuq9Nf+prslrU3hxP87U1h
TLSH
T11772951FA9D9583D57CB3603FCF216D7A3EE924C83B1A0A87539D4B4218E648A4DE173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_pl.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_pl.properties
Size 18KB
SHA256 0263d603daa67030aa4d7dc380204780d5cecce641be4821e9fb2f6337368cab
MD5 1a5bd8acba370f3fd7747125ce351ef6
SHA1 4aae7bf5f2c50b976bec910703b3ea625ef3eca3
SHA512 ad06576c502cb9ef1d632d54a3199ec59372bc3eb6714c6c24034075bf0042f83b4231b60932d7c196af2c420fcc851ddd8553fb2ad82d3f3c1a65672027cebb
SSDEEP 192:All3Ypa/5bF53lDnC2r2nOyd7T03zqonwCMhnRGHcWn4GtiisQ4eVvSyQ+KKfnRf:mlo65BrronOyd7T031nwTZa4GyQsnUlH
TLSH
T19A82538ED6B4943D53DE7805BCFAE65C77EF08849237B09815FEC4B1A2881089DD927E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_pt.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_pt.properties
Size 16KB
SHA256 d97ac90e593ea2f94b4d81a04376b5fe3d1232a8774370cf3c67968d9cc5c85c
MD5 69df3a37d038a5b4eb71cb164b394593
SHA1 c4f9bf849b87fe17ad46c51053a3e967d269c96d
SHA512 b5c7e1454b76394d8c4f58686b6226365e97eb5817c73aa1bcd78a4ab7349bb30ebfee2676eedfa9a217395c71e8174d255a1da5dcfe1f4871e4416775ccf920
SSDEEP 384:ay5HDZHK9NjmQss1y0o+KYH476wghUu6S6NWVgiOPq+7ywV9XH:amD5sYGH476wghUvS6wVgiOPq+7yIH
TLSH
T1ED7272DD57F9093D07F73202EDF3968A63FD4A445221E488417EC5BB21CD2849AEB2B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_pt_BR.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_pt_BR.properties
Size 16KB
SHA256 e365fb2d0242bd955dd1439b58fdd36542700f0f3648b2ac38e3ec759d1e963c
MD5 a165c9131b138c284d7ac5a86eb5b7d7
SHA1 45736362c72cb32641584dff7c7774368adfb70b
SHA512 960fe78239444f204d0bf3f7344db8e73586589353dcacc308e0209a155bef5d853360bdc173fa96487e7aeef21b58362218acc9e0b1ae2a242b8ede687069f5
SSDEEP 384:ae5HnZ/f/tjmQss1y0LtPdH476wgDUu6S1NKagii/T+m74eDpJ:aCn8sb3H476wgDUvS1oagii/T+m74UJ
TLSH
T1B27262DD57F9493E07F73202EDF3968A23FD4A405221E489417AC5BB21CD2849AFB276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_sv.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_sv.properties
Size 16KB
SHA256 aab14d6838efcf1eae43653a8c0082e9e3d27225e10571ec4c0b4978774267cc
MD5 c5288f909995c685ca0646d96833daa2
SHA1 94b2a169db5afc7b0fd8d44a1d9a56543375a4e3
SHA512 234bd327792357df3ebc4df467e3efa0fd7894e72fc1f60cddae745113585fb7ce818471bc2ba5d5e0533b1639a0e8efe05dd9a8eebe5a351c2806581ecb46c9
SSDEEP 192:MI4lbW4XN2z/UJ7Qeg6S8ysTIqMCVY3qErolWyijto+xqFtBBQKbycuAntVQf6OS:MIZacz/gQeDGsMqMCVY3PRqFBMSMVS
TLSH
T1797282ADFB78443C5AD23552BDF1428DDBFE19E85320E4A02178D57BA1AC34819FA273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_th.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_th.properties
Size 44KB
SHA256 4bdc4532198d5b285302cb2944b6af1a04d88b47f20787c720c4d70fe8e7860e
MD5 12c77243e01b062d53ec31390e763494
SHA1 c1911a6856437b3e775310a50ad381fffdd93d5b
SHA512 807149b5dff731934e5ef927a03c15ef4afba8a6e9669c1a5651fd18790cf8bbd0525181174de2a57b7039292acfd094d96329019e3a5da452ec3c961f9ec9c1
SSDEEP 768:comjZ0YIIMkx7hW6OQslXZ7fXUiCVAOITnTDxBD/99vdVfDkKDQvVZzl26ZtYtXX:cNjZ0YIIMkx7hW6OPlXZ7fXUiCVAOITZ
TLSH
T1382375EFB3B6091C0889F6B9CABEFD9D2989CFD40070E1AA4FFA959FC20125615C4315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_tr.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_tr.properties
Size 18KB
SHA256 3bd2365029e74e98fdc61ee94ce5b94c697d28528eaa03c77e80fc28754d5a0f
MD5 76c2950699193cf7577c1a8b91463c6c
SHA1 a58ae406dcc53c796ca6aaa4a741763361b76ea7
SHA512 0d230c183bc3e7b4f52f26e9b6b2be2bb9bf4f76e1dacd45bbe23058ecbc8933a169b17fd492779b596ffae11b18a696b9531a20324024999557cd6adce71913
SSDEEP 384:Bm9OWjZTnm7I+PtB25hvUpnpgc1Newa8/cQoKV:Bm9pjZDm7I+PtB25hvUpnSc1Newa80Q1
TLSH
T159823E9E69F8883CD2DA364ADDF5478CA3FD88009738E0C13C30D1F6955D38956EA97A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_vi.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_vi.properties
Size 17KB
SHA256 cea0e3a5142584145a66466f1777d89a9c4682ef624950e591a6f1b29447c4c3
MD5 b492a1228b47dd0d59ab131eaf4ba920
SHA1 c7cd7b3b7e2b7e78c54a3d36fcc1d6071e2e6c73
SHA512 d6601cde0d6088ad84fdf8879d193677080ffedb90a2bc4aea7b4e310cd820ed234e77aaa071d61c30e7ea76adf5cac5932a620a614cdfad888d4845a6faeeff
SSDEEP 384:3GES0vWKEBGzKDp9AhRdRx1n5Oo41e9NxWA+MktY+3yW/4i8ZZK3F:3e0vmBnDp9AL3x1n5OoiePxWCqX3yUi6
TLSH
T14C82869D0294A43E51FD391DDCF94448BFFED88CE350AA903AB0D4B465A62A02DCD77B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources_zh.properties

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Language\AgentApplicationResources_zh.properties
Size 19KB
SHA256 4f645e856a3796a5102835efd32f575c7125b590184c80720a8480d1ca9765ff
MD5 2fd812c02646e8b32efbf52edcf67fd7
SHA1 1ee22f54080d59ee0c72e0ba3371634a77502710
SHA512 bcc0c2032c0d92e9110f969ea458f8ff110f6a6877fbcdb17842b649ac3ee08114be6ecd6078ed1902814feb2b73a88b55c12e24f4ec8f6ffc6682e07e13027b
SSDEEP 384:0ezP11ZAP+PODyWQt8K9K0AbTNKvLIh8MWINIuvbPj:0e711ZAP4gQt59tAbTNKvLIdNNvTj
TLSH
T1B19232DE8B19003956FEB6C59CF02D4E9FFE4D2092B3E0B690F5C5A0329416C59DAD3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZohoAssistAgent.iss

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\Tools\ZohoAssistAgent.iss
Size 158B
SHA256 7ce520389eac0c97b06c16044d5737cca19fdb6af336d20d15cc5d6a41cd11c9
MD5 3c8e3031274c60909fa8c9b76e238226
SHA1 f29dc42f9b7258adc7268637a736e955c30f6c58
SHA512 e377a043707d67f489b8d65294d1a7483aca2e4e0d0069aef7409294e72240c01cadcfd8040d4fe157ff02ceb8ab4b8044196f470da99bbedadee251cd14847b
TLSH
T184C08C80D94804E2BE008AC827064F69AA33870E1E5C810D98CB48AA1BA2C0A4D801AA
MD5 SHA1 SHA512 TLSH

Submit Download

rap.ico

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\rap.ico
Size 4KB
SHA256 21052ae75f8bb2c62688a57d44ff25d5007fe24a797ba58441d8e7afd90b5562
MD5 c741f113b6d8e4fe5922376aa73c7e06
SHA1 5228c943a09a3a5e45e9254a9ea275c5acbee51f
SHA512 5e8a2be7160630a3600de41d1aea4145bf6c970cd8586d2c544a5a68a46c4e86daaa0f0b46cff8fcc026cde031375baf4795e8c65d4f3fe9b6c80e969bc28c3d
SSDEEP 48:zu3OxX4t+4u0oVgNbNY7/S6X5K/SN9lM73TmD13kqOFXTNRKkMhAgfBlgGHY4o:zu4Mw0oomK6JIyHM7DM10LNRkh7ZCO
TLSH
T15D9142D36D35C5EDE9B846FCD39025721E807D2ADAB0506F8EB5749B05A38085F3B135
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uems.ico

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Resource\uems.ico
Size 4KB
SHA256 3b811ac5f6c5c7a118b92cc66f796b31f46e1ba9f606e74d92dc8212926934ed
MD5 2c28e78a06543c3c937a7c9b0ce4e5ff
SHA1 bef52d126372c39e891706a59da80c02cb5649e7
SHA512 ab06fb852c3d6ff47c5d69456d1e27f168a694b3c14db466262085ecd6c491e0cd3212b411399b87d76cd9b9dc916952248bfa7a9d458f011af9ed8b391e8f04
SSDEEP 24:suwiIYEuL9+UykRcIw233333JKT/E8lhDBy+dB1PewEOKTBg9v/wcnDDt:nIYavlLT/2Ej4OKC9nDD
TLSH
T1DB91AF833D0988FDCFE6157E5B622A38770B8D34989390319AD87615179310DDDA5763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenCapturingModule.dll

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\ScreenCapturingModule.dll
Size 4.3MB
SHA256 ac5ddef304479b0ffb3164701f1a7a131204855f9cf2814d532b9863f35bb875
MD5 0c11d608a50199d33d039028d8d8bb7f
SHA1 636e9deeb78f134109fad9376a66b4441a54da8b
SHA512 6b5749fcd26a7b2d69ee7b8ee3d6675dc331711f00b2499245a21628b87fdc3f0a99718c92136fc15a647ef26219394578bdeb6703abf5f8aa67ecddf6057ddb
SSDEEP 98304:DSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwS:wsrSjUs+ILK0NhWFBFvsHXipc4Bi48wG
TLSH
T1F8268D6273603035E85ECDF14B6EA9E6916D1132433582EBE1E8DBB516318C2AB74F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenSharingUtils.dll

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\ScreenSharingUtils.dll
Size 1.9MB
SHA256 e1f7412d96f363bef6fa5a260f2200728f321f500b2df1453c0432d08dc73ea8
MD5 12a295021948033964445df6f1349747
SHA1 cb8da1cbac8cc20e4566990cf17dece8b86969c9
SHA512 cb75c59d605614204e07a3795e56058b792ec48abbf571c4e58e8886348e3b5272e027cf1dbb35e4abda0a6a58d28ea3e32972548fc3756ef853e9c4045708c7
SSDEEP 49152:P8/sZBeyeyfFGkJ/lNMZiKBpaoGBvDA8Lw/YDCihuE3xKJjcn6YbD:P8/wBeyeydGkJ/lNMZiKBpaoG1DVwgDV
TLSH
T1A6957D11BEA01072E35B03375E6DEA68F1AD91B30B3903C35DD49B5D25750E26E387AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SessionAudit.exe

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\SessionAudit.exe
Size 6.1MB
SHA256 ca3eeb4092502dd39b378af5507a8aee4279f6ee995941111ebcb471679e900a
MD5 629a060190629584e29cc75cc66dbd33
SHA1 9c25c65413345997cc5f9045aa2ed715c234e71a
SHA512 c027ac8277e673cf11d81f367e021ab1397ab05cac8314bd406cc95a2559ab607962d0a8562d6f5cd77c2c4b54ec81b968953c8b239c637c412ad0794d4f6cad
SSDEEP 196608:12in6rN3OUKFYaG2KoNEkoZy5mgUQMSkT9+lK:1tVGaN4Zy5mgzl
TLSH
T13656AF117542C0B2D89202B06E7DEB7A917DAD310B7988D393E16E3D9D321F21B3676B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Settings.conf

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Settings.conf
Size 60B
SHA256 fdd7b9237db53968ea67662b40be859718b4249593346bde3acbbe74f85b228a
MD5 d4bce2620089e1c7a7df20bb9d21ec77
SHA1 f46eabf525f1d80c2c2c6b9df677b3db119b1b39
SHA512 51f65e506600b153d13cb14232df190f6beec57f15030da45710cd598c29fc01b1f6326de52089b8064ba8ef53500392ad66a4d6f2dfbbb77f9b05f195938531
TLSH
T121A0026197878C2671CCF1694D44859557D49519D54148C3545D9E08F1C604861484C0
MD5 SHA1 SHA512 TLSH

Submit Download

ToolsIQ.exe

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\ToolsIQ.exe
Size 464KB
SHA256 a5783740552886ba5d0d643e307ce9ae341a650746974f6ed0770aa69890bab9
MD5 fd49113e480cb2a8a886a19a12a6cfed
SHA1 695edf35f3553fec5db9c6d9cce1ec9a2d96c6e8
SHA512 04cd05d86433ab71c3d833080a3021c4a16c27979e1339674261423d4c5b8a355a8507de5063765bc2542fd0e5d73e0face8b3fe53722626ebcb63e85223362a
SSDEEP 6144:86e8Dl02jK5oPot6GaamzfoXEActacJRSrpM1N9ZhWGARYwPItd0dB+AOlMP8l78:863Dl3umzfoXEActaG0MIu9dQ+0ElVC
TLSH
T157A47B2076D6C031E5726A704E79DB6A4A3DBA600F7185DFB3C4997D9D306C09B32B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Toolsmanager.exe

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Toolsmanager.exe
Size 14.3MB
SHA256 45fabf2a80694f8555d3bba019d3ee1a4a4115d5bebf5ff4fba37416981d67dd
MD5 4ba59497fa962044cc7b3c62d41b9983
SHA1 58707801305bda691375cf98d1e98244a91e31ef
SHA512 facbd832226bcb50afe2a7d4d6dd0724113e4af3222c08b5e80eda88b45e1d21074796948ccd3df4e1494375f2cc0af5aa45f2fb721beea39dd0f0db0ea13116
SSDEEP 196608:L5fM10tik9Awre4o4r78fPmSP3P1qtfXo:lfF4Ir78fPmSFqtY
TLSH
T1C1E64901FDAB45F9EA03043125A7B22F23755D058B39CBDBDB5CBA2AFA772D10836245
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VPrinter.exe

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\VPrinter.exe
Size 672KB
SHA256 ca2438f3bfdfa4098463a679159ec2ff68162d237b8f73530924e9efb0da51a3
MD5 c3ee6b1f96e109c517df198dec517022
SHA1 ee66258e7fa9945c8437586dd7336fa86f981c43
SHA512 f9a2c0e97f6e927eec71c6375fda4f8bee689172174790e9196bfab377fde8c5d9a9072da95817b6fb51b7983d1998dff02753c67c7fca5ec56bdbd0f7ab06fb
SSDEEP 12288:QypVrwjoX+dU7pioncaB2cbIVFhtWseI418w6yFot2wkda7EGgoii:1pVrw8OecIvIDuklyFoBkkAu
TLSH
T1D2E412816BF84E46E66F3B7964B061010FB5B757A832FB9E05A4A18D1A137C5CB103F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Version.txt

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\Version.txt
Size 16B
SHA256 efb7ba13600a9667df3aa051b838b176105311452ff9b392f67e8a6057af8e40
MD5 e58d0ab87a0a311e27139964d3bb332d
SHA1 f766020ae8c59d2024bf9a8f77ec7c08ad914779
SHA512 64cba7e04743f687b0fa5840f3d415242cffdbac82453d5a18c60766482f413b290122b39e4515bfc134df6d176aab62efca52a123837da33e7cf406b3864490
MD5 SHA1 SHA512

Submit Download

VideoProcessor.dll

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\VideoProcessor.dll
Size 2.2MB
SHA256 04eccff70541e57fbb47469ed074543a77121ecc80e148ced7f81d2480a05e6e
MD5 358239c4c2b888f886ef2a55ba3fcb38
SHA1 7da301db3c12d1a91a5bdba853d7e4165676de0e
SHA512 e6757ad7149ffec3316ba2a7b9197484e6130d1b895847d68f562e697a17ae329d9a7a40bc49cce59a5424f59d72d3da6a5dd2b73b4aadc08c4f932e135b1309
SSDEEP 49152:KOwESSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwX:/SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSL
TLSH
T17DB528E163613239D85E8CB14ABE5DE3181C217BA3249BEF59EC197615319C27B38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VirtualMonitor.dll

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\VirtualMonitor.dll
Size 1.9MB
SHA256 02ea20d89ca96ab3a35d38c3a2330061dce6b509bcf7e90a094e03c083edb4c5
MD5 1ee45b1812bd2f9244469aa6c711eeb1
SHA1 64fc09e96acd45ccfe86248435b10f3e903153d1
SHA512 6b36f3526a7472df20e82225a782546ea13c3115dd927383deb619c54ebe89abab7e8854abbdf03aeeaf5b53addc78250351899bfd1bcdbca1b2289527b6335a
SSDEEP 49152:WX+v7yFdT4D9ZNiz4S/PYM2/gMm5MfgzPk+jpvb86VW:WXY7odT4ZZNiz4S/7SgJPk+jpvA6s
TLSH
T1BB956D323650646AD95B1B305919F328F2BC51A7C7BD42C73ED4A67C29E2CC287247AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZAAudioClient.exe

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\ZAAudioClient.exe
Size 4.8MB
SHA256 69e5afd94684fbe9ad9e7adf9d17180d9d8058cdeaac3934ac230937230a8573
MD5 f02ca781d7234e390d96adfcae4202b0
SHA1 4e7b08b6954af48d57604d1f26e9915675fa736d
SHA512 2a7f2821fedc516287a1bf3a891fb49f68f0258471092f70a5dde92b0d6c96f61e76aeceb9d9ba80b9170274703a4ae3f129dd97022e5e75e1fccaa4720351f5
SSDEEP 98304:avdK6c+4jkkHSu+o9LBHemRCKa2qEHq+qwsCPUTmXt6s:a1K6c+4jklu+o9LJAIqwsEUCXt
TLSH
T1AF36BF137643C072ED4201B05869EFBF497DAE210B7584D3A3C42F6E99715D32B3A7AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZAConnectionManager.dll

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\ZAConnectionManager.dll
Size 3.1MB
SHA256 ae05cdf59b414abf5bf247356a7165874e8c50214e3e131fc9f6f17b2bedffd0
MD5 6d816888b61cc5d71252dd9edc1a9a47
SHA1 16ce72fb5cc11d7b6b066106cd111a0f86a0cffd
SHA512 38649e790f49dac3797ade3f44ca5e7e1124ae13e9acae239f7c15275b1dbee9047f35fd25af1b0c9faedc0c0456bb7c51168685385181e288d1b888e56ae929
SSDEEP 49152:5Rl3ImkZ01Zfyz/6g3xa9rQsllj0sBtp2to9IFubgJjCPp+gqy42CG2Um:+mkK6zN3Xi0S22GFubkjG+hy
TLSH
T17FE5AF13B683C072ED8E0174547ADBBF893A9E10473488D3D7E06969AD731D22B3A76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZAFileTransfer.exe

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\ZAFileTransfer.exe
Size 12.4MB
SHA256 9070318c422a7aef3778dd41817a4676288eea2659a0f953d3544144223dbd0b
MD5 e9c0391aed23ab92de6566ef155ab8a4
SHA1 24b498e0b23e97f380372a1d6e59993cd23fae24
SHA512 9745c86583091832a746e8fa72b49589cdd931e3c7ebfb819d5944985d1eb4f632866b16244dc2f1383c1d091b98e98af58dadc5cfa562c0161177b73c1bd9de
SSDEEP 196608:/JTQCaEAR5ZNJ+sKa03VEUQY5AO6xGWhhkXp/z/jP2WdQ+l9n5tBjqbn5wRoeQVd://nAOwxhm9/NPnLBj5olHSBlWt
TLSH
T1AED61830A684E0ABE3531A30943C96F24119AC35E73865CF1186BEAD39752E355BDF3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZARTCHandler.dll

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\ZARTCHandler.dll
Size 3.5MB
SHA256 990fdc5b7bc191de800b321dfee97a5e59743a873945c5cd4222219b1a715e86
MD5 917722a0525b6345cad296d358717991
SHA1 76ddfe93c0e0b9833d241c2a666d6376ee4bdf3e
SHA512 e8545988889a21979212afbc6d54e798a9b4e8cba9e623fd37b81736535e904fc3ac1a14d0809dfaf62e3164b4a3d2168de9db44c421688723d27e9064ace5f5
SSDEEP 98304:86j4D8qQwGf8zVHl8Glsnce/qQM9hvPLc+JZU:83QqQLf8zVHl5yncRj9hvPLc42
TLSH
T104F5AF027950D032E44F01B1692DFB7D9BB85B214BA5CAC3EBC45E6A5BB06D13B3A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZAService.exe

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\ZAService.exe
Size 7.6MB
SHA256 dd401e9623ec487c34d4067f979852a45f1d8b13455303b4621d1b8bb3bbb036
MD5 8e14a5cca897d45fdcf7448498c13f54
SHA1 fccfb33a35572b18e318957eb9fc4fd07d04377a
SHA512 a5fba68bc4171d5a94245f9eac669b57424ed419b2b2987fedd9c955cb616750c746f3a4a3f0d3d04d9f576d812f7ff193e7b0f93c8a76ca8732a1b67c7732d5
SSDEEP 196608:iUmC+4hmDABJ2E77x1MfB96eAkg81wM1e9LzDhKcMQe7JjnlLcC8YKnXH9uz:JmCco1kQe96NfhKcMQe7JjnlLcLH9m
TLSH
T18886BF217682C1B1E98742715C6CFBBDA5BDA930073A80D367D06B2E6D351C23B3976B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.exe

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\agent.exe
Size 14.1MB
SHA256 83c50f9a7d4e63fa43ac9c9cbd58e4ec7278babb92738beee7ea61b521510869
MD5 587d5f7c7e1d3744aa0f3c1d8c2894a4
SHA1 04af3bf92df148e111171629f04595a82975a0b7
SHA512 f8e27c162c1539690c94bdd81b6676989107ca8f5662c8318ac2e7b3353d345491d4d2b9a3635c52d17ed0db9ff6fc93b2a54ee15eaaaeff27c141da88ea4a7e
SSDEEP 196608:tusXyek0E0KlMMRn+N0LrGSM5Ynk1ScUD9Jjt59EjdDemxMnaxBokVhxXbr7GMSw:3SWxqaRemCaxBdhx8/MAn+
TLSH
T10CE62931A7C1D06BE3531A30983D96B24519AC34E738A1CF5185BFAD24B56E216BCF3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_ui.exe

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\agent_ui.exe
Size 1.4MB
SHA256 c486132b53ce401f7ab5eff9f97dd2d3d5bec40392b55ec3b6713d19b4208d9f
MD5 017bb628ad6d781710e2481ab96e3bfe
SHA1 8733e6df93c193fc0461f6595f13bc66411133aa
SHA512 67c9f1f0f347b203dde7dc0776308ed4f2fb3fb5b37b3b067ab4e60e0cdd5bba916b0c1a2595b282e32346ae50ff0eec13749b0b3a8a34f824e98b8bff74711d
SSDEEP 24576:jUthYhKWIrlydu3juyItDk4Zp2Rs6fIyFoBkkAACrS:jtKBlyuCyItDx6J5anUS
TLSH
T11565F10172E80426D1AF477584B29941AB367C439BA1CBDF2A9871BD2E733C09E36777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_ui.exe.config

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\agent_ui.exe.config
Size 890B
SHA256 68c7ac4e52b1ae590e0711c8ad0f209b797e634b44b67d0e0d4849df0d1b2db3
MD5 9993268b645291c3d0d1dcf8f2cd28b6
SHA1 c600b97158a3d4c95323705dd99a7eaacfa4c240
SHA512 611c9084c7628e121a7648700dbee98cfb27ca0329d8f20ed02f65f4b22138de4638db3c74075dfb0415b3b9c5fc63469293852033baca8a7ce0202a52076bc6
TLSH
T1A011482091C8FB594F725AA33E7B6418CB6903B3288C048CB0EE6E578B2259A5207173
MD5 SHA1 SHA512 TLSH

Submit Download

cad.exe

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\cad.exe
Size 20KB
SHA256 8fce723c38a921ffa9c6507005da4f2adb189abd29b1f0b4b50661ded8b26273
MD5 87bd9e1f37d29ebc3d5e950922c76550
SHA1 afca1214cdc30aa8ae2f268be9443a089d5e1704
SHA512 5adfe36c572c9d11ded75c31ad970c8c5eeecb221383cdedd76448aef92d15fcb9585893c99341b67d776eb2a3b7703e7de6c18cd17828d73d240f4593c88bb2
SSDEEP 384:ytFkvkdpej168i0/uo6ki2/viR1NuVrA+gmL4nNypNTTY:y7ykPuyVr2yRruVrA+hL9TTY
TLSH
T159926C6358181853DB878DB079F9C9275EB533532BEC90D37526C2061B843C23FAB19D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dctoolshardware.exe

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\dctoolshardware.exe
Size 77KB
SHA256 054eeff235c71de866dc21879df9eb3a2ec2e1cd31fad6cfe7cbe861305d3301
MD5 688729b4fe1744637a1a5896fc0ec6a2
SHA1 b25d7c868b61a16aae9bb6765b2b059961f3273c
SHA512 e719846c294c06f41c2d0a46cdf4abbbe4ee16e60d10e419443179a9a04b79480bd5a6901ab0d47c88bf9ba0ff2aad21e2fcce15eef9ec99a7d0a954c32d9ee9
SSDEEP 1536:ZCdQ/OXj7wMG/fxYJx2TA2bFRbFACmvwKc7yNpdeEHw5yzF/LflReaCjbl/Rx:ZWQ/OXjcMG/fxYn2TAgnACgwKc7yNpsL
TLSH
T178739494B3EA4804E17EDE306CB1E25614B67EDF8B22D20D2C8B145C1B71797BD69F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysmanager.dll

Path C:\Program Files (x86)\ZohoMeeting\RSTemp\ZohoMeeting\sysmanager.dll
Size 2.6MB
SHA256 441ea1515f11828476061ee65f0f571f78f53af5488381e3d818ce1a54a7135e
MD5 76627fc54caf94faa363533f9f8e2d66
SHA1 deaa29ec17e13b4e0a5abe72f30ba62c977a9fed
SHA512 277b00f6eee5599284fdd74b581d4c54c07409b794c21ee9d54765c91445ebd1c450854979bf3e5e2a581496729343ecabc3902b0e9e668806e54a0cdce79d4f
SSDEEP 49152:LaUJF8wmIbQG7/IWyBvm8a2HylnNVgXT3RmtSP3i/xpstemjd6e3:LbF8wmIbQI/IWyB+eAnNVOmtMSxp
TLSH
T1E5C5CF12B7C68031E99E02B091BADB7E4939BB745B30D5C793D06D7A88705C1673BF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZohoMeeting.7z

Path C:\Program Files (x86)\ZohoMeeting\ZohoMeeting.7z
Size 25.6MB
SHA256 47a9ce390ad78be43224db9c1786b85a1e9346d3a591ec5db80e994fd42d7441
MD5 6929802a133efc8d3c5300ca0c80fe4c
SHA1 930575d6266702ffdb3dc7fe1a60e6044678834f
SHA512 6328356f2d516b7a422d46597bd887b6d5ff7df6f0c80ac69202d507110440973d990e8b0b69f8888f5a046981ad333067891576813d65af1159725c69ce7267
SSDEEP 393216:QLdM+8fTpBEEBwwfPil4yGZY3uDCRecivK53c69XBUAR3XQAKhYaVMP8Ms3OyN4:QLdmXBwwf04pcsQyAR3gJNo8Ms3O1
TLSH
T1E74733C9949A058752B77D6F06F4A1E65FFA00EC8DB3E07EA4BCBC781D003562DB9891
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download