7de42ae65f5a2a066133f2a16c9e08926818d553e16e1d590a75bad503a2f89c

Resubmissions

25/08/2026, 01:45

260825-b6rd4swbpg8

25/08/2026, 01:43

260825-b5g42s1ycz8

Analysis

user interaction
yes
max time kernel
899s
max time network
385s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/08/2026, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Zero_Setup_v1.0.0.exe
Size 52.0MB
Sample260825-b6rd4swbpg
SHA256 7de42ae65f5a2a066133f2a16c9e08926818d553e16e1d590a75bad503a2f89c
MD5 e8e388fb560b79ffe98060bb23f5f459
SHA1 2322129b0658b8931239d42289a05f497f1052e5
SHA512 c3078012b09da3ba1fabf3a8eec2d66b2251856c16db79dafb4aeea6cb4fa7b0baafa1722f088b262862b89b2d6ce23a392ecd163847f9ea2e1a012b7434cd1b
SSDEEP 786432:wvOP9gukWVCOeu9AEkE38msbQS4dPhxe2PYu3:TguYEkE38mAQSC3e2X
TLSH
T1E6C7D093F8A74C9DC3D585318521C1126B217E698F3713DB3E6CB638FAB26D25A36B40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4076	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4944	Zero.exe
2712	ZeroCore.exe
2312	ZeroCore.exe
236	ZeroCore.exe

Loads dropped DLL 49 IoCs

pid	Process
2712	ZeroCore.exe
2712	ZeroCore.exe
2712	ZeroCore.exe
2712	ZeroCore.exe
2712	ZeroCore.exe
2712	ZeroCore.exe
2712	ZeroCore.exe
2712	ZeroCore.exe
2712	ZeroCore.exe
2712	ZeroCore.exe
2712	ZeroCore.exe
2712	ZeroCore.exe
2712	ZeroCore.exe
2712	ZeroCore.exe
2712	ZeroCore.exe
2712	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
2312	ZeroCore.exe
236	ZeroCore.exe
236	ZeroCore.exe
236	ZeroCore.exe
236	ZeroCore.exe
236	ZeroCore.exe
236	ZeroCore.exe
236	ZeroCore.exe
236	ZeroCore.exe
236	ZeroCore.exe
236	ZeroCore.exe
236	ZeroCore.exe
236	ZeroCore.exe
236	ZeroCore.exe
236	ZeroCore.exe
236	ZeroCore.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
3636	taskkill.exe
3828	taskkill.exe
3336	taskkill.exe
1776	taskkill.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\.json\ = "json_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\ꬌ񾬀耀袨翺	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\ꬌ񾬀耀袨翺\ = "json_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\json_auto_file\shell\edit\command\ = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\Winword.exe\" /n \"%1\""	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\json_auto_file\shell\edit\ = "@C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Office16\\oregres.dll,-1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\json_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\.json	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\\ = "json_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\json_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\json_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\json_auto_file\shell\edit\command	OpenWith.exe

Modifies registry key 1 TTPs 8 IoCs

Modify Registry

T1112

pid	Process
3476	reg.exe
3584	reg.exe
5008	reg.exe
4856	reg.exe
5064	reg.exe
3928	reg.exe
4184	reg.exe
1896	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4820	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 11 IoCs

pid	Process
2712	ZeroCore.exe
2208	Winword.exe
2208	Winword.exe
1300	Winword.exe
1300	Winword.exe
2996	Winword.exe
2996	Winword.exe
2912	Winword.exe
2912	Winword.exe
2312	ZeroCore.exe
236	ZeroCore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4076	powershell.exe
4076	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3956	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3636	taskkill.exe
Token: SeDebugPrivilege	4076	powershell.exe
Token: 33	1576	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1576	AUDIODG.EXE
Token: SeDebugPrivilege	3828	taskkill.exe
Token: SeDebugPrivilege	3336	taskkill.exe
Token: SeDebugPrivilege	1776	taskkill.exe

Suspicious use of SetWindowsHookEx 46 IoCs

pid	Process
2712	ZeroCore.exe
3748	OpenWith.exe
3956	OpenWith.exe
3956	OpenWith.exe
3956	OpenWith.exe
3956	OpenWith.exe
3956	OpenWith.exe
3956	OpenWith.exe
3956	OpenWith.exe
3956	OpenWith.exe
3956	OpenWith.exe
3956	OpenWith.exe
3956	OpenWith.exe
3956	OpenWith.exe
3956	OpenWith.exe
3956	OpenWith.exe
3956	OpenWith.exe
2208	Winword.exe
2208	Winword.exe
2208	Winword.exe
2208	Winword.exe
2208	Winword.exe
2208	Winword.exe
2208	Winword.exe
1300	Winword.exe
1300	Winword.exe
1300	Winword.exe
1300	Winword.exe
1300	Winword.exe
1300	Winword.exe
2996	Winword.exe
2996	Winword.exe
2996	Winword.exe
2996	Winword.exe
2996	Winword.exe
2996	Winword.exe
2996	Winword.exe
2912	Winword.exe
2912	Winword.exe
2912	Winword.exe
2912	Winword.exe
2912	Winword.exe
2912	Winword.exe
2912	Winword.exe
2312	ZeroCore.exe
236	ZeroCore.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 3636	3792	Zero_Setup_v1.0.0.exe	80
PID 3792 wrote to memory of 4076	3792	Zero_Setup_v1.0.0.exe	83
PID 3792 wrote to memory of 4856	3792	Zero_Setup_v1.0.0.exe	85
PID 3792 wrote to memory of 5064	3792	Zero_Setup_v1.0.0.exe	87
PID 3792 wrote to memory of 3928	3792	Zero_Setup_v1.0.0.exe	89
PID 3792 wrote to memory of 4184	3792	Zero_Setup_v1.0.0.exe	92
PID 3792 wrote to memory of 1896	3792	Zero_Setup_v1.0.0.exe	94
PID 3792 wrote to memory of 3476	3792	Zero_Setup_v1.0.0.exe	96
PID 3792 wrote to memory of 3584	3792	Zero_Setup_v1.0.0.exe	98
PID 3792 wrote to memory of 5008	3792	Zero_Setup_v1.0.0.exe	100
PID 4944 wrote to memory of 2712	4944	Zero.exe	107
PID 2712 wrote to memory of 3828	2712	ZeroCore.exe	108
PID 3956 wrote to memory of 2208	3956	OpenWith.exe	112
PID 2312 wrote to memory of 3336	2312	ZeroCore.exe	120
PID 236 wrote to memory of 1776	236	ZeroCore.exe	126

C:\Users\Admin\AppData\Local\Temp\Zero_Setup_v1.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\Zero_Setup_v1.0.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\system32\taskkill.exe
  taskkill.exe /IM Zero.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='Stop'; $ws=New-Object -ComObject WScript.Shell; $programs=[Environment]::GetFolderPath('Programs'); $folder=Join-Path $programs 'Zero.'; New-Item -ItemType Directory -Force -Path $folder | Out-Null; $s=$ws.CreateShortcut((Join-Path $folder 'Zero..lnk')); $s.TargetPath='C:\Users\Admin\AppData\Local\Zero\Zero.exe'; $s.WorkingDirectory='C:\Users\Admin\AppData\Local\Zero'; $s.IconLocation='C:\Users\Admin\AppData\Local\Zero\Zero.ico,0'; $s.Description='Zero. Rocket League customization launcher'; $s.Save(); $desktop=[Environment]::GetFolderPath('Desktop'); $d=$ws.CreateShortcut((Join-Path $desktop 'Zero..lnk')); $d.TargetPath='C:\Users\Admin\AppData\Local\Zero\Zero.exe'; $d.WorkingDirectory='C:\Users\Admin\AppData\Local\Zero'; $d.IconLocation='C:\Users\Admin\AppData\Local\Zero\Zero.ico,0'; $d.Description='Zero. Rocket League customization launcher'; $d.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4076
- C:\Windows\system32\reg.exe
  reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zero. /v DisplayName /t REG_SZ /d Zero. /f
  2⤵
  - Modifies registry key
  PID:4856
- C:\Windows\system32\reg.exe
  reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zero. /v DisplayVersion /t REG_SZ /d 1.2.3 /f
  2⤵
  - Modifies registry key
  PID:5064
- C:\Windows\system32\reg.exe
  reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zero. /v Publisher /t REG_SZ /d Zero. /f
  2⤵
  - Modifies registry key
  PID:3928
- C:\Windows\system32\reg.exe
  reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zero. /v InstallLocation /t REG_SZ /d C:\Users\Admin\AppData\Local\Zero /f
  2⤵
  - Modifies registry key
  PID:4184
- C:\Windows\system32\reg.exe
  reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zero. /v DisplayIcon /t REG_SZ /d C:\Users\Admin\AppData\Local\Zero\Zero.exe,0 /f
  2⤵
  - Modifies registry key
  PID:1896
- C:\Windows\system32\reg.exe
  reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zero. /v UninstallString /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Zero\ZeroUninstall.exe\" /f
  2⤵
  - Modifies registry key
  PID:3476
- C:\Windows\system32\reg.exe
  reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zero. /v NoModify /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:3584
- C:\Windows\system32\reg.exe
  reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zero. /v NoRepair /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:5008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:224

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Zero\README_ZERO.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4820

C:\Users\Admin\AppData\Local\Zero\Zero.exe
"C:\Users\Admin\AppData\Local\Zero\Zero.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\ZeroCore.exe
  C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\ZeroCore.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill.exe /F /T /IM ShiftBridge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3828

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3748

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\discord_cache.json"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2208

C:\Program Files\Microsoft Office\root\Office16\Winword.exe
"C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\items.json"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1300

C:\Program Files\Microsoft Office\root\Office16\Winword.exe
"C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\discord_cache.json"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2996

C:\Program Files\Microsoft Office\root\Office16\Winword.exe
"C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\game_sig.json"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2912

C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\ZeroCore.exe
"C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\ZeroCore.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /F /T /IM ShiftBridge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3336

C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\ZeroCore.exe
"C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\ZeroCore.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:236
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /F /T /IM ShiftBridge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
Size 1KB
SHA256 91014734d0647e7842b70113520894c8602777613e979ea98d229c527cf80c6d
MD5 4f1a6e98441e64ae559bf6771d1f52fa
SHA1 2a5112012e573018b40fddbccc43eca9eb7378c0
SHA512 44d0231ac03d301853b8cfecce4151eadd9230ec26088fa7a8af9a1284d7fa4eae0c06c831fa067b607fbef7e63d9b0c1527620a5efff585dd1f2968701d1219
TLSH
T10D312B02023965C2AD45BD4475D6ED133CB6B5C1EDD84C034A0D82702E37BEBF35881C
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 471B
SHA256 a97932dceb13435cf51ac8f61690be728c8ba5ba657317d21073e78fbefd14f3
MD5 fb2f70c9bab553f9aa26d6138f8e9a26
SHA1 83db3ba058e7a7c3834e5f36441df0264c86602d
SHA512 8549f4ba8b73295efceb4f918a1e7ac7f9eec8b3ea16986aa630f3fee9e87036662e0838e53564b1bf22f3c765ae1a02e2a8a7076969d1f6315ea6e94fac8bd8
TLSH
T1C3F0DC93D0DBA080AE9BC9EC37B81AB2783094AD12D4540A60AC50738C05FBAE52A07D
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
Size 426B
SHA256 7f36feb7926a8e60afa50d198dbf7b9e17dc43663c1fac2f1447fd8155002150
MD5 65246d3c107df982e1492007c9e4394e
SHA1 0908e54727e6f44f7c3427d48733c78f0f9902c7
SHA512 c6c13f557cb2adbde0c439febfdb2f5b24350a0c2c0b70b235d0eec9d4fff478bd66fc96e003a93260fd4b950d83cb329a89fafcbf0c8c1663830bd5e46a7f8a
TLSH
T179E0D8592AFE452CE3325E7C5BDD693E5B2DF21708049B78165051186656D900C22B33
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 8ef35d0efd149b890747778bb37e6c86f0821137c76449cc75cc8faba53b6b46
MD5 edec06ce94f1710aca1caf93dd682973
SHA1 cd60add06e171874933d781b2b195ec68164d62e
SHA512 d34608acfd9e0997479730f7ab89ad207a13bbf74a045e89611bee6d702f769d828b6d134952fb0d9215d4be1995bdf8efa7c9f0b6186bf79b913e875860e984
TLSH
T18DE0682415FB422CF5E095340BC96575945AF1220824A7BA1AD03704AA06B00DC12D30
MD5 SHA1 SHA512 TLSH

Submit Download

Word.CampaignStates.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json
Size 21B
SHA256 138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c
MD5 f1b59332b953b3c99b3c95a44249c0d2
SHA1 1b16a2ca32bf8481e18ff8b7365229b598908991
SHA512 3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4
MD5 SHA1 SHA512

Submit Download

Word.GovernedChannelStates.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json
Size 417B
SHA256 200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c
MD5 c56ff60fbd601e84edd5a0ff1010d584
SHA1 342abb130dabeacde1d8ced806d67a3aef00a749
SHA512 acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e
TLSH
T1B1E03758D5B8D45DE94325026BB173960D329691F9DAE03C2D3DC00EB5DC2BF4A1C20F
MD5 SHA1 SHA512 TLSH

Submit Download

Word.Settings.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json
Size 87B
SHA256 6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31
MD5 e4e83f8123e9740b8aa3c3dfa77c1c04
SHA1 5281eae96efde7b0e16a1d977f005f0d3bd7aad0
SHA512 bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9
TLSH
T10FB01206089401BD405D500084445A5B035470510144241853046206107E9E20368C33
MD5 SHA1 SHA512 TLSH

Submit Download

Word.SurveyEventActivityStats.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyEventActivityStats.json
Size 14B
SHA256 88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3
MD5 6ca4960355e4951c72aa5f6364e459d5
SHA1 2fd90b4ec32804dff7a41b6e63c8b0a40b592113
SHA512 8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d
MD5 SHA1 SHA512

Submit Download

55B5030E-9ED0-4968-A8B4-34689882A1A4

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\55B5030E-9ED0-4968-A8B4-34689882A1A4
Size 192KB
SHA256 5d9831d34d97843bc8339821b3676d18f423c0ec238378b401903716431a6d6a
MD5 0df4afa5ed00d3c00dee67c7100c8ba7
SHA1 b006ab9eb5564455adbfd9b62a2c725ed556bd06
SHA512 8fc67c09caa9aaf6fb38eb9f83881c4e98ce4f8bbe1cc83aae9fc9714dea8ec0e9df5fe8a6953d8d5bb2ec1ff5d94e0f33ef23b223e879b9461737a95064ac6b
SSDEEP 1536:+rVe3b3yFK6pb8xsghEa8e7HWsDXjj/mblcAZl1p5ihs7VXXBEKD0aO7qamZdGVm:Dke7HWsDXjj/EX257cV
TLSH
T1811412A6B2C75C628B33049D5B57A094FE6E12A708D5202873FAF3578FF2E1CB547291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mip_sdk.miplog

Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
Size 14KB
SHA256 ae23c6de6b1b1fb71361aa4254c68c0e5dec61587ef4f936f4de2b35e851295d
MD5 a1f7f2508d306971f8280dec4e65febf
SHA1 72b82f7d5e20052d92fc3591e88a771124d4bad9
SHA512 82068efb4a93ca9626338b26ee35f1c8b792a7cbc3514dfb0f56fb722c5c9ea54e927f9de4af337788faadf948ae5e7beccce1dcc513cf4ed124bfba85b25391
SSDEEP 192:WjPF9plzU0ZFqjI29f+zQkZBEjtL9BVzYaZ3CxFjqM97IzbbZ0LIjD19HDz+QZlf:qli+eVsxNIoEDP
TLSH
T1FB62F0A383AEC9EB98367F12A3C627915505756B26CB6409661C034932CBF184FFBB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winword.exe.db

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db
Size 24KB
SHA256 b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f
MD5 8665de22b67e46648a5a147c1ed296ca
SHA1 b289a96fee9fa77dd8e045ae8fd161debd376f48
SHA512 bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da
SSDEEP 12:TCmqtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:TDqt8VtbDBtDi4kZERDEe
TLSH
T183B24CC26A786161E05A51B7C9B313661779D1A90433936329F254A19CC288A98355FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winword.exe.db

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db
Size 24KB
SHA256 b8411fe8ec499074fca9047f6983d920279e84ddf3b02b2dd5c08cf07ec44687
MD5 085ebd119f5fc6b8f63720fac1166ff5
SHA1 af066018aadec31b8e70a124a158736aca897306
SHA512 adb0522830db26123347cb485c43b156f5c888510e52091ba0fafc22b650ad29630c027746c920321905c28259dce7ff63dded93a79efddd5567c68312117875
SSDEEP 12:TgeywqtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:TTqt8VtbDBtDi4kZERDEe
TLSH
T12AB24CC26A786161E05A51B7C9B213661779D1A90433936329F254A19CC288A98355FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ljvmno44.odt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ljvmno44.odt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

README_ZERO.txt

Path C:\Users\Admin\AppData\Local\Zero\README_ZERO.txt
Size 351B
SHA256 7c0b5266b430a2ab13a4b804d776e843df5994c4d51cf0b989c325c935ebafee
MD5 81871544cf668bfe5af2a1b0d0f40f2a
SHA1 3076c940996c451a2b3d6b9c3944e1670f39ffa1
SHA512 6256e047159eb39ccf66b4a91e5bbe2a7f25c51fdade3e34954c00d3df381f4bb486a4a6b4121b6aeb2cbe7e3d2c2aea62ae74f2c70e96dbfd5f2a5ff3d1dc98
TLSH
T17EE068225387C3F15B3237490B690340BE5E55315E520080540F04394A7C01D76370AA
MD5 SHA1 SHA512 TLSH

Submit Download

Zero.exe

Path C:\Users\Admin\AppData\Local\Zero\Zero.exe
Size 48.3MB
SHA256 818130e8accf37cd1222ed69ed1a161cd92b76fa841e72b6538f622b226fd4ce
MD5 4252d1d5f7823811bdb34ceb2b6d9236
SHA1 979c906ba24786fcceea752567d400835421af7c
SHA512 8dfe7343cebe81b00c981e22d76245ae28e9e7907e1815eb5b3c8bfa97ef5219594c014001d59a258ee2d2e7d7c7ffdfa33531eb279f1306f2242371d248ae47
SSDEEP 786432:ovOP9gukWVCOeu9AEkE38msbQS4dPhxe2PYu3:LguYEkE38mAQSC3e2X
TLSH
T142B7DF93F9AB4D9DC3D595308511C1112B257FB98F3712DB3E6CB628FAB22C21A36B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZeroUpdateURL.txt

Path C:\Users\Admin\AppData\Local\Zero\ZeroUpdateURL.txt
Size 131B
SHA256 24b3a4334be87c7fc74b59cfa0256619f2508d1e13cc6354920c923099f3a7b5
MD5 c5d740a68801432a4decc8bd6878e009
SHA1 ac8c81c51af1a73c2810377b1356e06623c1cb67
SHA512 554581cf8f1bc07d3a9c4c08bca53f73f23ded357e1277655d708040a1a520ec7787f5b1ee0ee4ec85af696ad0e0c42a6c1c9a864ffef857c553047b91cf60f3
TLSH
T1CEC02B414F0842E10331038A013802997C0443082087CF028CB310C11CD4F332918BFC
MD5 SHA1 SHA512 TLSH

Submit Download

Qt6Core.dll

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\Qt6Core.dll
Size 5.8MB
SHA256 f0ccc66f9496c6ad1075fc08466bb0ccd7b9f3ee014292dd5036c8fcc2018e72
MD5 96960fb6d837c99adf1d60ced65188e2
SHA1 c78102a5af8930637e2d5db9d0cb266d170ab159
SHA512 46f776a32bc97f8bf95fe230d3571bc438b6a96bf990f55df6c24b558409d2070e496d402d3c4eba905b6c99d4ef8b8b33e0d4b7f2213bbea2989de6e0012fe7
SSDEEP 98304:WhWbW1bkIeu8q9tpKFdu9CwJsv6t+JG/3X:uXpKFdu9CwJsv6t+Y/3X
TLSH
T189567D1762F60095D8FAC139CB5B9603EBB278154321ABEF01A466196F73BF5193F328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Gui.dll

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\Qt6Gui.dll
Size 8.8MB
SHA256 7bf2863d491430da8d08e396f6b255afd7696166697b5d089137bc63cb46faac
MD5 ed7751b773b9064edbadd261936c3e4c
SHA1 9ae5291942e45698b0bb4bfc98efacd18877bf80
SHA512 6c152a41e132579b6638435dcb5837ae1113eb88d5fca9b07cca393b0bb0d26e92ba25c5860f062a995b84d9caa11d8eb70e009b162ba0b44d99f5d2e0fc5d09
SSDEEP 98304:o76EDXaVcB0KE9a2MUXKKE3uA9jOREz+72cY:ek00KEVFXKKYW7M
TLSH
T103969E57A2EA11D9C57BD13C8B5B9517E7B270050322DBEB02A08A592F33BF16A7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Network.dll

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\Qt6Network.dll
Size 1.7MB
SHA256 6da1755bf7ffeef5d42da0a0b7b32d088b5b947288698a9e19f90faf218918b8
MD5 961d809618d67a7ab3282fccb934bce5
SHA1 021dfa08944271c1dfcad6411f08323c4ac8916c
SHA512 13527c22f58bd808ec67e296d45d3672ab7412bd5395fcbc0881a1d8ab4d1eb7dc4e89e86b352aefe748eef5b76ee33dab3e879fc258f0459e0d89cffed3f6e8
SSDEEP 24576:5fVj9becG6dtACoau5WGqDkuvbZxylwrWL915lpljVVl:59j9becPtYaucGqDkS6llpL
TLSH
T113856C57A3E44296D86EC139C74B8A0BFA72700453669BDF42658F152F73BE21B3E360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Svg.dll

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\Qt6Svg.dll
Size 503KB
SHA256 1228eb1cd6bce4b0c1703b1e2dad4c4cfe814f4f0d4c92e5a78010c4e45dcada
MD5 9c0f9bbadbd94c224b46979a0a1af70c
SHA1 c38d1085a1190a35e55212f47f8f927139b9ca4d
SHA512 8bf3ab05f0fea716d87a7027d65dc3acc913d38e7c8b73b56caef832092acd1f796da201f3a2cbe819b36828abf969dccc6c9cc58cacd7fde18747e255974bc8
SSDEEP 6144:P3hdrthZ/gOCEeHbTtU9nLIc6QkcaKhAeacqrwjh4s7ZAwg4ClAPKvlrFaB:7r9/jCPb29nEc4caKieacgOgFaB
TLSH
T132B46D67F3A20286E46FD13CCA6B8816E7B370041392D7EF41658E542F237E16A7E791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Widgets.dll

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\Qt6Widgets.dll
Size 6.2MB
SHA256 413b6fee48a2a6c7b864057ce172308189a8a4e74642a03dbf7a64d0e7548e7c
MD5 8803d0678108f47324b2ecb7151db985
SHA1 2be071b4027d224c899a4952fe2efa7eae637227
SHA512 09ca694703d98a51c86ae713e2f4e11782bbb90054a36599b6295c1f91b35906b3dfae8f251ebedb4cdbb8914a3352ff73124fbc205bd26fe088096d3e71ea20
SSDEEP 98304:wYzxCqFXsBKcrrtp6jg0rhtaasJ0hSy2q:wYzxCqFXh4Rp6jg0rhtvEC8q
TLSH
T1FB667B5777EA0185C9ABD23DCB5B8A07EAB2B04443229BCF11658E152F737E12E7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZeroCore.exe

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\ZeroCore.exe
Size 4.4MB
SHA256 a032eb5109e3c4b0acff70fc735f76bd48c3f524704440d39ddfdf8f2ed7fa22
MD5 4f2190d33e8ffa5a085b6995fc3b7996
SHA1 d0b401b3caad1ea681a056a097e03a05b744bd82
SHA512 0dd0b6324bdcfacfb94071d15004fbf66ee65e0f3e027bb3033a9e08f24a0fae5ea094a9f920259a2aa917d8768df7d66abacc2bf348e9bc93c77a2a15ef81cb
SSDEEP 49152:naoz1PIsAKrnecMzjAdaRdO95q61v7mnqFadZK1l2BlLKvwrq6IJdvvQPtxL1KcL:/icaHY6GWVxBK3Ku7IB
TLSH
T15926BF1BA3A401E8D0BAC17DCB5B9903E773741503719AFB06908E626F2B7E15E7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bz2.dll

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\bz2.dll
Size 75KB
SHA256 34be99c2ff6b26dcd6bca0573c77cf09c8b524b4ff2f2347f8ae3327c52bd990
MD5 e9ad27c1b0126f619780359fc6846232
SHA1 53150d7a6ef429a43fbd45253edb9383f3605097
SHA512 bfdde2bc4910e74b9a3ce071caa0f62595807516da2f63bd3168150d5e7c33b8c86183237a082db95df6a6ef87408f28467fc0e91a7df55edc0cd74482d6a0a7
SSDEEP 1536:7cBVUJqOj5DitWl2WUyLM3i8k/ZR/EQD8nhHHSyFi8:7H5waVBIRHSyFV
TLSH
T1EE734C00B6A3FBBDCAABC0395663074BFB35FD680B1117BF3560C67A2B22A910D75516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord_cache.json

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\discord_cache.json
Size 82B
SHA256 fe1451650da4c8f01a64ac8d486b6b6e734ea27a3a9bdd0b915d4e6b21f48059
MD5 800b80b336939b47f07b9e7bcea5be28
SHA1 8290e87c1b1604f498105f30470487b1fa7f33b1
SHA512 8d0670643f26295ace2853e9fcd43f47d105d6ea0df83d567c8852706d0bc11e23bd17b1589879bee9896d197af4f97db0056de3b87fb73b8e2f21be7fd6ac6c
TLSH
T131A011AB0202082AA03202E080800B0222B80F28802AEC0A22B3BA030A022022202B33
MD5 SHA1 SHA512 TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\iconengines\qsvgicon.dll
Size 76KB
SHA256 bc2193ee257c345d1c31133bae4d27b7a3df0137275d32bafdcfb51cd9c79358
MD5 2383a4113857e6b42c1c83b4d61e1c02
SHA1 7379ae1fde4989ecba24465f178f6876c1ae05e5
SHA512 8829120e5acab5a76e2c3d1de870b243dd390758d8c2d7d5cce02891450b339847945618936744afa7ec93a13087eb99f3da920d265c3dee6a19c1696c82a750
SSDEEP 1536:h36D4u/Lxye8AlGr/HAltgy3/gmKUR9zu1bGY41jxWdmgZgKxngGzl:d6DXdft9JKURtu1bGYixWdmgmKHl
TLSH
T189735B532BA92219DC5AC93DC327C647EE7AF1107362ABDF125144326E237C16EB5B30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qgif.dll

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\imageformats\qgif.dll
Size 46KB
SHA256 ed0e28a910d0e03073da287ed33cae5a7d06cb6f82cb5bf9df5adf49d6ae6894
MD5 b5a9bc1c735289e55750ba1c2b5094c6
SHA1 0a26690e59efbd9953e95a22a276f054d31b7b32
SHA512 1bedafbbc5367683334156f8f11abd3ac7eeb8d4de8d1ac2f0405adb3c362895f53a6b77ec42003f6d0f0435c12197df9721e464ab9c63725ff3d9d5cc429836
SSDEEP 768:abTuQPwX6wCIohpGt0U5DnEZZ3CfUFEXW9bcgKxnVbGYJdEZNhX:mTuQPtwXozLUaZ3CfUFEXW9bcgKxngGA
TLSH
T170237C465BB541E4E1E7C238D1878A2BDBB5B670A743CBEF0011857D1E633E13A38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qico.dll

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\imageformats\qico.dll
Size 45KB
SHA256 a58f59a6b7f95c3902f738e56e8f72fc72fb48cf76d220e97dd067dbcf2d3199
MD5 a22216c967a04aedc2c3fecbab279eeb
SHA1 f4ef832a1d33a82c6246d660af53c5ad1ace3be9
SHA512 8988b9b6b56642e06b65313d9507913f86e89288f1e8edb709fab0f3eb0dbd50aab8111ab02560caadaf73d6c49085d8639bee016332303937552dff82042dbf
SSDEEP 768:nnYTPBPUkJ4R6tTpS/u2NwyEXhdu8qzugKxnVbGYJdW0lNW:AP9UkJntkW2NwyEXhdu8qzugKxngGTq
TLSH
T15D237D9AA37902D1F5AAC63895478B23DE71F160B713CBDF0222456A1E333E27E38755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjpeg.dll

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\imageformats\qjpeg.dll
Size 560KB
SHA256 2863940aba4c0e4908d3893d7d8b0ffa43539d1ed463fd5b7f6bc62b04282f8c
MD5 d7d47d716f51459b215270b9ee2e5b42
SHA1 3c3a88601f80ebadad496547598bc8c77affb5cd
SHA512 1a2e9f7b9fa4b551a1ec46ac4b924942ed0b932d0a65555d9b0f8875f9c66e4a5eae3869d73e7df542cbcf17135e8b0df3ccf37263f9bc557d0a6ea003e7c3f2
SSDEEP 6144:T+mVmz0nDiUQ1n+6Iq39kifk61daofCGzs+C9crsbc4SFSkG0wWTh/EDh5r3Sw1h:TgnkSFSGgK1BxgyM
TLSH
T14DC42942F6B51841C7E68838DF5AC956DB91781D03F68AF7B1D1CBE53B1BAA07A36300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\imageformats\qsvg.dll
Size 38KB
SHA256 0af40394be65d34e8853ecc1d0a829c083378f3b3bdfaa3f143b3f4abf1951cb
MD5 350f4ad25ef27352e37219de4435e42f
SHA1 a2b49d1907aafc3ed7bb2b5f1091191c5f8f9071
SHA512 981bcc5a21b77ba13901886949ea7c6830dbdbbfb79e606be79d32f04f2c5aad0c562bba396e8f45d6e62ed76fcc900f06358f3619c9dde25621675dfa505c21
SSDEEP 768:pfVYvNicMKbxPemMwQWIQgKxnVbGYJ956N0:E1ic1xmmMwQWIQgKxngG9
TLSH
T1CB038D0B9B6A49A2F0BAC63895878B27D932F160A38397CF1162427D5D733D17C7C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

items.json

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\items.json
Size 2.1MB
SHA256 9f6fc242a94ece974e3d24af56399b96bb339b6414c4de37e855c1ae070891bf
MD5 cad7b54ce37a4d74955cb153b91d5a21
SHA1 11ef0b4624652cfd9c55bd3ed464a0717315746f
SHA512 4bf8203bbcd4e0c5890f10afa02c82278eafae14507226a2e7611216f54393a6f9296871b02dc4c134e247546145ce77e4dab45d986c3b9cca2df867015451a3
SSDEEP 24576:1PRwCAVZJufD8gMTWV6u+/HZWt9Kq72bW:1PRwCAjJufD8gMTWV6u+/HZWt9Kq72i
TLSH
T11CA5992798B788DB55DFCF6C3D6F42D116843311672688DBFCEBB224814E934EA4B849
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\platforms\qwindows.dll
Size 889KB
SHA256 eeecf7a66e66fe8c846f6b4f541ceb9f4e643699cae4ff565240bced693da19d
MD5 1bb5c96d5b48058fa0ef19e0156f9661
SHA1 32d2ff54afbb19762e4e4ce0fcc3c1258108c71d
SHA512 da58a419ea533fa5369d84b2b69ccba3f1b962ba2e3561ce465d2f438b65631aa1d9952137b20fb1ceef3b3a39074e5932f39d8d3eafcf41f7eb26c967a233bb
SSDEEP 12288:JsmILQifd3Sn984F+zSTe1yQ1+hp1RkB1vcOmjNgt+J:cQSd3E98u+zSTe1N1+X1ezv2RJ
TLSH
T167154B17A7A40285D47FC13D878B8A13EBB2701213A2DBCB4161C9597F377F22A79B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\settings.json
Size 234B
SHA256 79af34aa42a6820bd3ac0ef7593630779388cd072f9d670f8e88fc812af0add6
MD5 f6714242e098b331a5f8b5fab108f8b0
SHA1 254ab6697f213371ff4489afe38e508cdd0a5ade
SHA512 c81d5b75997f50c90e40e0fbc79b63711d9796823a082d47de179ebb7b96c8e782512105ca98cf3c895aa27039506ba0ef6f39a9a1045d4161d0417bf4de79af
TLSH
T1B2D0A712FE7088B71675059075282B5233545A5D47743C29F673460E09E3D26213AF90
MD5 SHA1 SHA512 TLSH

Submit Download

qmodernwindowsstyle.dll

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\styles\qmodernwindowsstyle.dll
Size 207KB
SHA256 35c0cba7e7a5ed5b8d7cfa6c9fb9b78aa9e7cb2d3c92c5cf8a3548a835b84e11
MD5 0ef9514ff7a1442a97ed61362c421374
SHA1 9d1bc320cb3d996b980503db053240fb0eeeb5a7
SHA512 f488829383ad52d067bafce4eb3cb02087fb1705289f1e1f0f37ac816ca8e307a9ff397f8fa33d7450b26678cfec90c8fae2cee49efae3ce79ca911d2e541bfb
SSDEEP 6144:nyKjHTcpL6KuNR/MCB30bQFHSuFJaGQNgYR7Q:nnj4pLgNFMPQ
TLSH
T11B24380333A613D6C567D2B8C52F1613F573706413229AEF0066CAB42F672E3BE7AA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\zip.dll
Size 111KB
SHA256 6f7413b59d18f4c08e2405c0e3709cff276952a41992897ccc05362625c90926
MD5 9a0f750a4f802cafe358bfb201910e29
SHA1 b4538bfd928f69e26a0600a983cd39aa826d8b51
SHA512 dec3c61154c92c8f1431a75835ab9f6662467deddc26c5a1f7d6a49e5a505af97bca2f15be37b97f290711ee2c1d161111d3b44b7d75f048eac35338262d7378
SSDEEP 1536:2vI1SCBEPmU/CC9ivcNcxvMnvvZKWfK9C+nGhd5FlA8huVoi1+:R1SIEn9hNVnZKs1da8huVo
TLSH
T10BB33AAB37D411B6E2ABD27C85C2250BD3B2B041176697CF1790876A1F33ED96E7A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Zero\runtime-2026.08.23.clean2-iconfix\zlib1.dll
Size 88KB
SHA256 9d79b6986a615689e40e8ad9c95a3e3fe906f641551c1e353d0547bdf526b6f5
MD5 0ad639ad0da326a91e0a71700bef5f1e
SHA1 e8f363b1be9647fa59a19cfbe4dbc2f4c127105c
SHA512 aaa63898c1c445b7592e0f850e6eab914c491012c5c70021260c14ed5d761751ae2930fd496b52b080054dda64de3e0f5be38f89268db264c5fb1d51f5106783
SSDEEP 1536:nvUiKm+qRDDqL6B/SOjRppvPYiU6Dmzl6nqaIOcIOZigtG9GUQp:M9m+qNTlRppn6AqoSZigk9GUQp
TLSH
T1B8936B4A6AB412A5D6F781B4D8D20B9DC331B01407A55BDF5288A35A1F23EE41F363FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

splash04.bmp

Path C:\Users\Admin\AppData\Local\Zero\splash04.bmp
Size 885KB
SHA256 0240e92a40c3348d74f9c004f3251b03eef07cb85c1376febfd92bd28a71dfcb
MD5 9f8db43bb5ce7d82b93e862f7b91220e
SHA1 78a8d267edde97b6ffea79bc234dfc412803f9a4
SHA512 70d65f75df4ddd6cd3c16cfa9446fd1dcd69c913e3b73ee56b07d856610fec53410e591e59be9d72cccc261f03418047ca5f71840ceb8066e16ff56a0f196737
SSDEEP 384:tWLZVHGMuIuyGOGj7hR89rHy7G39gQrHt/J2zcDBlPrRnHkoOnJwpGnWqa9rVHJZ:afdO3
TLSH
T12C15CE93FECD5AD2E6806A7AC455C6140756780C9E920BA779787A3DCD3A3C10F3BB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-336-0x00007FFACDAB0000-0x00007FFACE0E4000-memory.dmp

Download

memory/2208-229-0x00007FFAAEC70000-0x00007FFAAEC80000-memory.dmp

Download

memory/2208-226-0x00007FFAAEC70000-0x00007FFAAEC80000-memory.dmp

Download

memory/2208-202-0x00007FFAAEC70000-0x00007FFAAEC80000-memory.dmp

Download

memory/2208-199-0x00007FFAAEC70000-0x00007FFAAEC80000-memory.dmp

Download

memory/2208-198-0x00007FFAAEC70000-0x00007FFAAEC80000-memory.dmp

Download

memory/2208-200-0x00007FFAAEC70000-0x00007FFAAEC80000-memory.dmp

Download

memory/2208-201-0x00007FFAAEC70000-0x00007FFAAEC80000-memory.dmp

Download

memory/2208-227-0x00007FFAAEC70000-0x00007FFAAEC80000-memory.dmp

Download

memory/2208-203-0x00007FFAAC690000-0x00007FFAAC6A0000-memory.dmp

Download

memory/2208-228-0x00007FFAAEC70000-0x00007FFAAEC80000-memory.dmp

Download

memory/2208-204-0x00007FFAAC690000-0x00007FFAAC6A0000-memory.dmp

Download

memory/2312-328-0x000001CD5E5C0000-0x000001CD5EBF4000-memory.dmp

Download

memory/2312-335-0x000001CD5E5C0000-0x000001CD5EBF4000-memory.dmp

Download

memory/2712-175-0x00007FFACC540000-0x00007FFACCB74000-memory.dmp

Download

memory/4076-17-0x0000018C360A0000-0x0000018C360C2000-memory.dmp

Download

memory/4076-11-0x0000018C33FF0000-0x0000018C34000000-memory.dmp

Download

memory/4076-10-0x0000018C33FF0000-0x0000018C34000000-memory.dmp

Download