Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
ZIP archive
Size
20.23 MB · 20,227,273 B
First seen
2026-07-13 21:17 · 3 months ago
Last seen
2026-07-13 21:17 · 3 months ago
Last analysis
2026-07-13 21:21 · 3 months ago
Hashes
MD5 46106561962c79d6cfbc597f630ff9aa Sha1 1592e5fe3881646b3bbda9079b3f7bb327d66762 Sha256 b999fba4d4db5bdbfa86d6744ba53b4473f37b53d0fe74c47f7c8238350a11d8 Sha384 02adac0afc0c9a2ad114268179e9e5ab747428014bc9f406ae096e18310c6f656bbb52e0ae7135ce0905f6d658d560ee Sha512 629afae2f0bf9be5cd3c4ab8970a3447e3276df4a7a366490066d86ab968990638d0490a71f104baa3c83fd728feab0a57a8721b411cfa6fedcb101dc637ec0a SSDeep 393216:4voJYOm4PaJBjPvwL4835pf/9vV0LCqUMMeEHjtWehhfkiI7UXFDxiOk:4voJd5EtgL445ptvV0+sMLEgh9I7m6Ok TLSH 181723BCB4B5B95AF5D4433BC6C12CB2DB2CA540D7D93D9B8E2041927EC320E5F6A861
2 malicious · 1170 files
ZIP46106561962c79d6cfbc597f630ff9aaCVE-2019-9674
BINbrowser
DLLAccessibleMarshal.dll
Structure
BINResources
BINTYPELIB
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
DLLapi-ms-win-core-file-l1-2-0.dll
Structure
P7B[Authenticode]_488937e1.p7b
DLLapi-ms-win-core-file-l2-1-0.dll
Structure
P7B[Authenticode]_904e22f6.p7b
DLLapi-ms-win-core-localization-l1-2-0.dll
Structure
P7B[Authenticode]_e87b953d.p7b
DLLapi-ms-win-core-processthreads-l1-1-1.dll
Structure
P7B[Authenticode]_a25954c6.p7b
DLLapi-ms-win-core-synch-l1-2-0.dll
Structure
P7B[Authenticode]_450983df.p7b
DLLapi-ms-win-core-timezone-l1-1-0.dll
Structure
P7B[Authenticode]_500d09ed.p7b
DLLapi-ms-win-crt-conio-l1-1-0.dll
Structure
P7B[Authenticode]_fc9aa548.p7b
DLLapi-ms-win-crt-convert-l1-1-0.dll
Structure
P7B[Authenticode]_64e29d57.p7b
DLLapi-ms-win-crt-environment-l1-1-0.dll
Structure
P7B[Authenticode]_06d320e6.p7b
DLLapi-ms-win-crt-filesystem-l1-1-0.dll
Structure
P7B[Authenticode]_78374b25.p7b
DLLapi-ms-win-crt-heap-l1-1-0.dll
Structure
P7B[Authenticode]_bb8ef5bf.p7b
DLLapi-ms-win-crt-locale-l1-1-0.dll
Structure
P7B[Authenticode]_dd2655c4.p7b
DLLapi-ms-win-crt-math-l1-1-0.dll
Structure
P7B[Authenticode]_4421d511.p7b
DLLapi-ms-win-crt-multibyte-l1-1-0.dll
Structure
P7B[Authenticode]_4d55df76.p7b
DLLapi-ms-win-crt-private-l1-1-0.dll
Structure
P7B[Authenticode]_619b8dea.p7b
DLLapi-ms-win-crt-process-l1-1-0.dll
Structure
P7B[Authenticode]_b51ba3b5.p7b
DLLapi-ms-win-crt-runtime-l1-1-0.dll
Structure
P7B[Authenticode]_c688f0df.p7b
DLLapi-ms-win-crt-stdio-l1-1-0.dll
Structure
P7B[Authenticode]_fe5b36cc.p7b
DLLapi-ms-win-crt-string-l1-1-0.dll
Structure
P7B[Authenticode]_736f2d9a.p7b
DLLapi-ms-win-crt-time-l1-1-0.dll
Structure
P7B[Authenticode]_b5bcfa7b.p7b
DLLapi-ms-win-crt-utility-l1-1-0.dll
Structure
P7B[Authenticode]_d3069d88.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
INIapplication.ini
DLLd3dcompiler_47.dll
Structure
P7B[Authenticode]_38e2371a.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXEdefault-browser-agent.exe
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
INIdefaultagent.ini
INIdefaultagent_localized.ini
LISTdependentlibs.list
BINfeatures
ZIPfloorp-actions@floorp.ablaze.one.xpi
BINAPI
JSfloorpActions.js
JSONfloorpActions.json
JSbackground.js
JSONmanifest.json
ZIPfloorp-system@floorp.ablaze.one.xpi
BINAPI
JSBrowserInfo.js
JSONBrowserInfo.json
JSIOFile.js
JSONIOFile.json
JSaboutConfigPrefs.js
JSONaboutConfigPrefs.json
JSbrowserL10n.js
JSONbrowserL10n.json
JSdecompressZip.js
JSONdecompressZip.json
JSdownloadFile.js
JSONdownloadFile.json
JSsidebar.js
JSONsidebar.json
JSdownload-notification.js
BINgesturefy
JSbackground.js
JSgesturefy.js
BINicons
BINLICENSE
IMGfailed.png
IMGfailed.png-preview.png
IMGfloorp.png
IMGfloorp.png-preview.png
IMGlink-48-last.png
IMGlink-48-last.png-preview.png
JSONmanifest.json
JSua_data.js
JSupdate.js
BINwebcompat
JSbug-1004-youtube-com.js
CSSbug-894-twitter-com.css
JSwebcompat_inject.js
JSwebcompat_useragent.js
ZIPformautofill@mozilla.org.xpi
BINchrome.manifest
JSapi.js
BINar
BINlocale
BINar
BINformautofill.properties
JSbackground.js
BINchrome
BINcontent
JSautofillEditForms.js
JScustomElements.js
HTMeditAddress.xhtml
HTMeditCreditCard.xhtml
JSeditDialog.js
CSSformautofill.css
IMGformfill-anchor.svg
IMGicon-address-save.svg
IMGicon-address-update.svg
IMGicon-credit-card-generic.svg
IMGicon-credit-card.svg
HTMmanageAddresses.xhtml
HTMmanageCreditCards.xhtml
CSSmanageDialog.css
JSmanageDialog.js
BINskin
CSSautocomplete-item-shared.css
CSSautocomplete-item.css
CSSeditAddress.css
CSSeditCreditCard.css
CSSeditDialog-shared.css
CSSeditDialog.css
BINthird-party
IMGcc-logo-amex.png
IMGcc-logo-amex.png-preview.png
IMGcc-logo-amex@2x.png
IMGcc-logo-amex@2x.png-preview.png
IMGcc-logo-cartebancaire.png
IMGcc-logo-cartebancaire.png-preview.png
IMGcc-logo-cartebancaire@2x.png
IMGcc-logo-cartebancaire@2x.png-preview.png
IMGcc-logo-diners.svg
IMGcc-logo-diners.svg-preview.jpg
IMGcc-logo-discover.png
IMGcc-logo-discover.png-preview.png
IMGcc-logo-discover@2x.png
IMGcc-logo-discover@2x.png-preview.png
IMGcc-logo-jcb.svg
IMGcc-logo-jcb.svg-preview.jpg
IMGcc-logo-mastercard.svg
IMGcc-logo-mastercard.svg-preview.jpg
IMGcc-logo-mir.svg
IMGcc-logo-mir.svg-preview.jpg
IMGcc-logo-unionpay.svg
IMGcc-logo-unionpay.svg-preview.jpg
IMGcc-logo-visa.svg
IMGcc-logo-visa.svg-preview.jpg
BINcs
BINlocale
BINcs
BINformautofill.properties
BINda
BINlocale
BINda
BINformautofill.properties
BINde
BINlocale
BINde
BINformautofill.properties
BINel
BINlocale
BINel
BINformautofill.properties
BINen-GB
BINlocale
BINen-GB
BINformautofill.properties
BINen-US
BINlocale
BINen-US
BINformautofill.properties
BINes-ES
BINlocale
BINes-ES
BINformautofill.properties
BINfr
BINlocale
BINfr
BINformautofill.properties
BINhu
BINlocale
BINhu
BINformautofill.properties
BINid
BINlocale
BINid
BINformautofill.properties
BINit
BINlocale
BINit
BINformautofill.properties
BINja
BINlocale
BINja
BINformautofill.properties
BINko
BINlocale
BINko
BINformautofill.properties
BINlt
BINlocale
BINlt
BINformautofill.properties
JSONmanifest.json
BINnl
BINlocale
BINnl
BINformautofill.properties
BINnn-NO
BINlocale
BINnn-NO
BINformautofill.properties
BINpl
BINlocale
BINpl
BINformautofill.properties
BINpt-BR
BINlocale
BINpt-BR
BINformautofill.properties
BINpt-PT
BINlocale
BINpt-PT
BINformautofill.properties
BINru
BINlocale
BINru
BINformautofill.properties
JSONschema.json
BINsv-SE
BINlocale
BINsv-SE
BINformautofill.properties
BINth
BINlocale
BINth
BINformautofill.properties
BINtr
BINlocale
BINtr
BINformautofill.properties
BINuk
BINlocale
BINuk
BINformautofill.properties
BINvi
BINlocale
BINvi
BINformautofill.properties
BINzh-CN
BINlocale
BINzh-CN
BINformautofill.properties
BINzh-TW
BINlocale
BINzh-TW
BINformautofill.properties
IMG0x0000FDB1.svg
IMG0x0000FDB1.svg-preview.jpg
IMG0x0001018B.svg
IMG0x0001018B.svg-preview.jpg
IMG0x00010565.svg
IMG0x00010565.svg-preview.jpg
IMG0x00010941.svg
IMG0x00010941.svg-preview.jpg
IMG0x00010C24.svg
IMG0x00010C24.svg-preview.jpg
ZIPofficial-site-ua@floorp.ablaze.one.xpi
BINAPIs
JSBrowserInfo.js
JSONBrowserInfo.json
JSbackground.js
JSONmanifest.json
ZIPpaxmod@numirias.xpi
HTMbackground.html
JSbackground.js
CSSbrowser.css
JSiconcolor.js
BINimg
IMGicon.png
IMGicon.png-preview.png
JSONmanifest.json
HTMLmissing_api.html
BINoptions
CSSoptions.css
HTMoptions.html
JSoptions.js
BINpaxmod-api-experiment
JSapi.js
JSONschema.json
BINstylesheet-api-experiment
JSapi.js
JSONschema.json
BINupdateAPIs
JSaboutConfigPrefs.js
JSONaboutConfigPrefs.json
JSw3color.js
ZIPpictureinpicture@mozilla.org.xpi
BINdata
JSpicture_in_picture_overrides.js
BINexperiment-apis
JSaboutConfigPipPrefs.js
JSONaboutConfigPipPrefs.json
JSpictureInPicture.js
JSONpictureInPicture.json
BINlib
JSpicture_in_picture_overrides.js
JSONmanifest.json
JSrun.js
BINvideo-wrappers
JSairmozilla.js
JSbbc.js
JScbc.js
JSdailymotion.js
JSdisneyplus.js
JSedx.js
JShbomax.js
JShotstar.js
JShulu.js
JSmock-wrapper.js
JSnetflix.js
JSnytimes.js
JSpiped.js
JSprimeVideo.js
JSradiocanada.js
JSsonyliv.js
JStubi.js
JStubilive.js
JStwitch.js
JSudemy.js
JSvideojsWrapper.js
JSvoot.js
JSwashingtonpost.js
JSyahoo.js
JSyoutube.js
ZIPscreenshots@mozilla.org.xpi
JSassertIsBlankDocument.js
JSassertIsTrusted.js
BINbackground
JSanalytics.js
JScommunication.js
JSdeviceInfo.js
JSmain.js
JSselectorLoader.js
JSsenderror.js
JSstartBackground.js
JStakeshot.js
HTMLblank.html
JSblobConverters.js
BINbuild
JSinlineSelectionCss.js
JSselection.js
JSshot.js
JSthumbnailGenerator.js
JScatcher.js
JSclipboard.js
JSdomainFromUrl.js
BINexperiments
BINscreenshots
JSapi.js
JSONschema.json
JSlog.js
JSONmanifest.json
BINmoz.build
JSrandomString.js
BINselector
JScallBackground.js
JSdocumentMetadata.js
JSshooter.js
JSui.js
JSuicontrol.js
JSutil.js
JSsitehelper.js
ZIPwebcompat-reporter@mozilla.org.xpi
BINchrome.manifest
BINar
BINlocale
BINar
BINwebcompat.properties
JSbackground.js
BINcs
BINlocale
BINcs
BINwebcompat.properties
BINda
BINlocale
BINda
BINwebcompat.properties
BINde
BINlocale
BINde
BINwebcompat.properties
BINel
BINlocale
BINel
BINwebcompat.properties
BINen-GB
BINlocale
BINen-GB
BINwebcompat.properties
BINes-ES
BINlocale
BINes-ES
BINwebcompat.properties
BINexperimentalAPIs
JSaboutConfigPrefs.js
JSONaboutConfigPrefs.json
BINactors
JSMtabExtrasActor.jsm
JSbrowserInfo.js
JSONbrowserInfo.json
JShelpMenu.js
JSONhelpMenu.json
JSl10n.js
JSONl10n.json
JStabExtras.js
JSONtabExtras.json
BINfr
BINlocale
BINfr
BINwebcompat.properties
BINhu
BINlocale
BINhu
BINwebcompat.properties
BINicons
IMGlightbulb.svg
BINid
BINlocale
BINid
BINwebcompat.properties
BINit
BINlocale
BINit
BINwebcompat.properties
BINja
BINlocale
BINja
BINwebcompat.properties
BINko
BINlocale
BINko
BINwebcompat.properties
BINlt
BINlocale
BINlt
BINwebcompat.properties
JSONmanifest.json
BINnl
BINlocale
BINnl
BINwebcompat.properties
BINnn-NO
BINlocale
BINnn-NO
BINwebcompat.properties
BINpl
BINlocale
BINpl
BINwebcompat.properties
BINpt-BR
BINlocale
BINpt-BR
BINwebcompat.properties
BINpt-PT
BINlocale
BINpt-PT
BINwebcompat.properties
BINru
BINlocale
BINru
BINwebcompat.properties
BINsv-SE
BINlocale
BINsv-SE
BINwebcompat.properties
BINth
BINlocale
BINth
BINwebcompat.properties
BINtr
BINlocale
BINtr
BINwebcompat.properties
BINuk
BINlocale
BINuk
BINwebcompat.properties
BINvi
BINlocale
BINvi
BINwebcompat.properties
BINzh-CN
BINlocale
BINzh-CN
BINwebcompat.properties
BINzh-TW
BINlocale
BINzh-TW
BINwebcompat.properties
IMG0x000074FA.svg
IMG0x000074FA.svg-preview.jpg
VBSwebcompat@mozilla.org.xpi
BINabout-compat
MJSAboutCompat.sys.mjs
CSSaboutCompat.css
HTMaboutCompat.html
JSaboutCompat.js
JSaboutPage.js
JSONaboutPage.json
JSaboutPageProcessScript.js
BINdata
JSinjections.js
JSshims.js
JSua_overrides.js
BINexperiment-apis
JSaboutConfigPrefs.js
JSONaboutConfigPrefs.json
JSaboutConfigPrefsChild.js
JSappConstants.js
JSONappConstants.json
JSmatchPatterns.js
JSONmatchPatterns.json
JSsystemManufacturer.js
JSONsystemManufacturer.json
JStrackingProtection.js
JSONtrackingProtection.json
BINinjections
BINcss
CSSbug0000000-testbed-css-injection.css
CSSbug1575000-apply.lloydsbank.co.uk-radio-buttons-fix.css
CSSbug1610344-directv.com.co-hide-unsupported-message.css
CSSbug1644830-missingmail.usps.com-checkboxes-not-visible.css
CSSbug1651917-teletrader.com.body-transform-origin.css
CSSbug1653075-livescience.com-scrollbar-width.css
CSSbug1654877-preev.com-moz-appearance-fix.css
CSSbug1654907-reactine.ca-hide-unsupported.css
CSSbug1694470-myvidster.com-content-not-shown.css
CSSbug1707795-office365-sheets-overscroll-disable.css
CSSbug1712833-buskocchi.desuca.co.jp-fix-map-height.css
CSSbug1741234-patient.alphalabs.ca-height-fix.css
CSSbug1765947-veniceincoming.com-left-fix.css
CSSbug1770962-coldwellbankerhomes.com-image-height.css
CSSbug1774490-rainews.it-gallery-fix.css
CSSbug1784141-aveeno.com-acuvue.com-unsupported.css
CSSbug1784199-entrata-platform-unsupported.css
CSSbug1819678-nppes.cms.hhs.gov-unsupported-banner.css
CSSbug1829949-tomshardware.com-scrollbar-width.css
CSSbug1830747-babbel.com-page-height.css
CSSbug1830752-afisha.ru-slider-pointer-events.css
CSSbug1830761-91mobiles.com-content-height.css
CSSbug1830796-copyleaks.com-hide-unsupported.css
CSSbug1830810-interceramic.com-hide-unsupported.css
CSSbug1830813-page.onstove.com-hide-unsupported.css
CSSbug1836103-autostar-novoross.ru-make-map-taller.css
CSSbug1836105-cnn.com-fix-blank-pages-when-printing.css
CSSbug1848711-vio.com-page-height.css
CSSbug1848713-cleanrider.com-slider.css
CSSbug1848716-elal.com-unsupported-banner.css
CSSbug1848849-theaa.com-printing-mode-fix.css
CSSbug1849019-axa-assistance.pl-datepicker-fix.css
CSSbug1849388-kucharkaprodceru.cz-scroll-fix.css
CSSbug1868345-tvmovie.de-scroll-fix.css
BINjs
JSbug0000000-testbed-js-injection.js
JSbug1448747-fastclick-shim.js
JSbug1452707-window.controllers-shim-ib.absa.co.za.js
JSbug1457335-histography.io-ua-change.js
JSbug1472075-bankofamerica.com-ua-change.js
JSbug1579159-m.tailieu.vn-pdfjs-worker-disable.js
JSbug1631811-datastudio.google.com-indexedDB.js
JSbug1722955-frontgate.com-ua-override.js
JSbug1724868-news.yahoo.co.jp-ua-override.js
JSbug1739489-draftjs-beforeinput.js
JSbug1769762-tiktok.com-plugins-shim.js
JSbug1774005-installtrigger-shim.js
JSbug1799968-www.samsung.com-appVersion-linux-fix.js
VBSbug1799980-healow.com-infinite-loop-fix.js
JSbug1818818-fastclick-legacy-shim.js
JSbug1819450-cmbchina.com-ua-change.js
JSbug1819476-axisbank.com-webkitSpeechRecognition-shim.js
JSbug1819678-free4talk.com-window-chrome-shim.js
JSbug1830776-blueshieldca.com-unsupported.js
JSbug1831007-nintendo-window-OnetrustActiveGroups.js
JSbug1836157-thai-masszazs-niceScroll-disable.js
JSbug1842437-www.youtube.com-performance-now-precision.js
JSbug1849058-nicochannel.jp-picture-in-picture-shim.js
JSbug1855014-eksiseyler.com.js
JSbug1855071-www.meteoam.it.js
JSbug1859617-installtrigger-removal-shim.js
JSbug1864564-esri-transfrom-names-shim.js
BINlib
JSabout_compat_broker.js
JScustom_functions.js
JSinjections.js
JSintervention_helpers.js
JSmessaging_helper.js
JSmodule_shim.js
JSrequestStorageAccess_helper.js
JSshim_messaging_helper.js
JSshims.js
JSua_helpers.js
JSua_overrides.js
JSONmanifest.json
JSrun.js
BINshims
JSaddthis-angular.js
JSadform.js
JSadnexus-ast.js
JSadnexus-prebid.js
JSadsafeprotected-ima.js
JSapstag.js
JSblogger.js
JSbloggerAccount.js
JSbmauth.js
JSbranch.js
JSchartbeat.js
JScrave-ca.js
JScriteo.js
JScxense.js
JSdoubleverify.js
JSeluminate.js
JSempty-script.js
TXTempty-shim.txt
JSeverest.js
JSfacebook-sdk.js
IMGfacebook.svg
JSfastclick.js
JSfirebase.js
JSgoogle-ads.js
JSgoogle-analytics-and-tag-manager.js
JSgoogle-analytics-ecommerce-plugin.js
JSgoogle-analytics-legacy.js
JSgoogle-ima.js
JSgoogle-page-ad.js
JSgoogle-publisher-tags.js
HTMgoogle-safeframe.html
JShistory.js
JSiam.js
JSiaspet.js
JSinstagram.js
JSkinja.js
JSlive-test-shim.js
JSmaxmind-geoip.js
JSmicrosoftLogin.js
JSmicrosoftVirtualAssistant.js
JSmoat.js
JSmochitest-shim-1.js
JSmochitest-shim-2.js
JSmochitest-shim-3.js
JSnielsen.js
JSoptimizely.js
SVGplay.svg
JSprivate-browsing-web-api-fixes.js
JSrambler-authenticator.js
JSrich-relevance.js
JSsalesforce.js
JSspotify-embed.js
IMGtracking-pixel.png
IMGtracking-pixel.png-preview.png
JStsn-ca.js
XMLvast2.xml
XMLvast3.xml
JSvidible.js
XMLvmad.xml
JSwebtrends.js
IMG0x0004D3A8.svg
IMG0x0004D3A8.svg-preview.jpg
IMG0x0005E68D.svg
IMG0x0005E68D.svg-preview.jpg
ZIPwebpanel-ua@floorp.ablaze.one.xpi
BINAPIs
JSwebRequestExt.js
JSONwebRequestExt.json
JSbackground.js
IMGlink-48.png
IMGlink-48.png-preview.png
JSONmanifest.json
EXEfloorp.exe
Structure
BINResources
BINRT_ICON
BINID:0001
IMGID:1033
BINID:0002
IMGID:1033
IMGID:1033-preview.png
BINID:0003
IMGID:1033
IMGID:1033-preview.png
BINID:0004
IMGID:1033
IMGID:1033-preview.png
BINID:0005
IMGID:1033
IMGID:1033-preview.png
BINID:0006
IMGID:1033
IMGID:1033-preview.png
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINID:000E
BINID:1033
BINID:000F
BINID:1033
BINID:0011
IMGID:1033
IMGID:1033-preview.png
BINID:0012
IMGID:1033
IMGID:1033-preview.png
BINID:0013
IMGID:1033
IMGID:1033-preview.png
BINID:0014
IMGID:1033
IMGID:1033-preview.png
BINID:0015
IMGID:1033
IMGID:1033-preview.png
BINID:0016
BINID:1033
BINID:0017
BINID:1033
BINID:0018
BINID:1033
BINID:0019
BINID:1033
BINRT_STRING
BINID:0007
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:7F00
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
XMLfloorp.VisualElementsManifest.xml
DLLfreebl3.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
LOGinstall.log
JSONinstallation_telemetry.json
DLLipcclientcerts.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLlgpllibs.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLlibEGL.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLlibGLESv2.dll
Structure
BINResources
BINRT_DIALOG
BINID:0065
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
INIlocale.ini
DLLmozavcodec.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLmozavutil.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLmozglue.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
DLLmsvcp140.dll
Structure
P7B[Authenticode]_14172093.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLnotificationserver.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLnss3.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLnssckbi.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLosclientcerts.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXEpingsender.exe
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
INIplatform.ini
EXEplugin-container.exe
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
BINprecomplete
EXEprivate_browsing.exe
Structure
BINResources
BINRT_ICON
BINID:0001
IMGID:1033
IMGID:1033-preview.png
BINRT_GROUP_CURSOR4
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
XMLprivate_browsing.VisualElementsManifest.xml
DLLqipcap.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINremoved-files
VBSsoftokn3.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLucrtbase.dll
Structure
P7B[Authenticode]_b7e1f48b.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
INIupdate-settings.ini
EXEupdater.exe
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINRT_DIALOG
BINID:0065
BINID:1033
BINRT_STRING
BINID:003F
BINID:1033
BINRT_GROUP_CURSOR4
BINID:03EB
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
BINID:0011
BINID:1033
INIupdater.ini
DLLvcruntime140.dll
Structure
P7B[Authenticode]_308ff424.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINVisualElements
IMGPrivateBrowsing_150.png
EXIFPrivateBrowsing_150.png.exif
IMGPrivateBrowsing_150.png-preview.png
IMGVisualElements_150.png
IMGVisualElements_150.png-preview.png
IMGVisualElements_70.png
IMGVisualElements_70.png-preview.png
DLLdbadapt.dll
Structure
P7B[Authenticode]_e1a6bc02.p7b
BINResources
BINTYPELIB
BINID:0001
BINID:1033
BINRT_STRING
BINID:003F
BINID:1033
BINID:09C5
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINdefaults
BINpref
JSchannel-prefs.js
BINfonts
BINFontSizer
EXEFontSizer.exe
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
IMGID:0
IMGID:0-preview.png
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINFontSizer.FrmFontSizer.resources
ICON$this.Icon
BINFontSizer.Properties.Resources.resources
BINAlternateTools2k16
DATA[NBF]root.Data
BINFontSizer_Icon
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINimg_confirmation_icon
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINimg_error_icon
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINimg_information_icon
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINimg_warning_icon
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINFontSizer.exe.config
INIFontSizer_Languages.ini
INIFontSizer_Language_Arabic.ini
INIFontSizer_Language_Danish.ini
INIFontSizer_Language_English.ini
INIFontSizer_Language_French.ini
INIFontSizer_Language_German.ini
INIFontSizer_Language_Greek.ini
INIFontSizer_Language_Hungarian.ini
INIFontSizer_Language_Japanese.ini
INIFontSizer_Language_Russian.ini
INIFontSizer_Language_Spanish.ini
INIFontSizer_Language_Turkish.ini
TXTFontSizer_License.txt
VBSFontSizer_Readme.txt
INISavePath.ini
BINSource
BINFontSizer
BINapp.manifest
CSClassFontSettings.cs
CSClassFormColors.cs
CSClassInit.cs
PS1ClassLogFont.cs
CSClassLogFontStruct.cs
CSClassOptions.cs
CSClassRegistry.cs
CSClassTable.cs
BINFontSizer.csproj
USERFontSizer.csproj.user
ICOFontSizer.ico
CSFrmEdit.cs
CSFrmEdit.Designer.cs
VBSFrmFontSizer.cs
CSFrmFontSizer.Designer.cs
RESXFrmFontSizer.resx
CSFrmHelp.cs
CSFrmHelp.Designer.cs
RESXFrmHelp.resx
CSFrmInfo.cs
CSFrmInfo.Designer.cs
RESXFrmInfo.resx
CSFrmLanguage.cs
CSFrmLanguage.Designer.cs
VBSFrmMessageBox.cs
CSFrmMessageBox.Designer.cs
RESXFrmMessageBox.resx
CSFrmOptions.cs
CSFrmOptions.Designer.cs
RESXFrmOptions.resx
CSFrmPreview.cs
CSFrmPreview.Designer.cs
RESXFrmPreview.resx
CSProgram.cs
BINProperties
CSAssemblyInfo.cs
CSResources.Designer.cs
RESXResources.resx
CSSettings.Designer.cs
BINSettings.settings
BINResources
BMPAlternateTools2k16.bmp
IMGimg_confirmation_icon.png
IMGimg_confirmation_icon.png-preview.png
IMGimg_error_icon.png
IMGimg_error_icon.png-preview.png
IMGimg_information_icon.png
IMGimg_information_icon.png-preview.png
IMGimg_warning_icon.png
IMGimg_warning_icon.png-preview.png
SLNFontSizer.sln
BINImages
XCFFontSizer.xcf
BMPFontSizer_InstallLarge.bmp
BMPFontSizer_InstallSmall.bmp
ICOFontSizer_Install_Icon.ico
XCFMessageBoxIcons.xcf
BINInstall
ISSFontSizer.iss
BINScripts
INIFontSizer_Languages.ini
TXTFontSizer_License_Arabic.txt
TXTFontSizer_License_Danish.txt
TXTFontSizer_License_French.txt
TXTFontSizer_License_German.txt
TXTFontSizer_License_Greek.txt
TXTFontSizer_License_Hungarian.txt
TXTFontSizer_License_Japanese.txt
TXTFontSizer_License_Russian.txt
TXTFontSizer_License_Spanish.txt
TXTFontSizer_License_Turkish.txt
INIUnInstCleanup_Arabic.ini
INIUnInstCleanup_Danish.ini
INIUnInstCleanup_English.ini
INIUnInstCleanup_French.ini
INIUnInstCleanup_German.ini
INIUnInstCleanup_Greek.ini
INIUnInstCleanup_Hungarian.ini
INIUnInstCleanup_Japanese.ini
INIUnInstCleanup_Russian.ini
INIUnInstCleanup_Spanish.ini
INIUnInstCleanup_Turkish.ini
DATunins000.dat
VBSunins000.exe
Structure
BINOverlay_17475b42.bin
BINResources
BINRT_CURSOR
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINRT_BITMAP
BINID:0000
BINID:0
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINRT_STRING
BINID:0FE9
BINID:0
BINID:0FEA
BINID:0
BINID:0FEB
BINID:0
BINID:0FEC
BINID:0
BINID:0FED
BINID:0
BINID:0FEE
BINID:0
BINID:0FEF
BINID:0
BINID:0FF0
BINID:0
BINID:0FF1
BINID:0
BINID:0FF2
BINID:0
BINID:0FF3
BINID:0
BINID:0FF4
BINID:0
BINID:0FF5
BINID:0
BINID:0FF6
BINID:0
BINID:0FF7
BINID:0
BINID:0FF8
BINID:0
BINID:0FF9
BINID:0
BINID:0FFA
BINID:0
BINID:0FFB
BINID:0
BINID:0FFC
BINID:0
BINID:0FFD
BINID:0
BINID:0FFE
BINID:0
BINID:0FFF
BINID:0
BINID:1000
BINID:0
BINRT_RCDATA
BINID:0000
BINID:0
EXEID:1033
Structure
BINResources
BINRT_MANIFEST
BINID:0001
BINID:1033
BINRT_GROUP_CURSOR2
BINID:7FF9
BINID:1033
BINID:7FFA
BINID:1033
BINID:7FFB
BINID:1033
BINID:7FFC
BINID:1033
BINID:7FFD
BINID:1033
BINID:7FFE
BINID:1033
BINID:7FFF
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0000
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
EXEUnInstCleanup.exe
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINUnInstCleanup.FrmInfo.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINUnInstCleanup.FrmMessageBox.resources
BINUnInstCleanup.Properties.Resources.resources
BINUnInstCleanupDlg
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINimg_confirmation_icon
DATA[NBF]root.Data
BINimg_error_icon
DATA[NBF]root.Data
BINimg_information_icon
DATA[NBF]root.Data
BINimg_warning_icon
DATA[NBF]root.Data
TTFTwemojiMozilla.ttf
BINgmp-clearkey
BIN0.1
DLLclearkey.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
JSONmanifest.json
DLLpython37.dll
Structure
BINOverlay_b998d9f5.bin
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
IMGID:0
IMGID:0-preview.png
BINID:0005
IMGID:0
IMGID:0-preview.png
BINRT_DIALOG
BINID:0067
BINID:1033
BINID:0068
BINID:1033
BINRT_RCDATA
BINID:0000
EXEID:1033
Structure
BINResources
BINDATAFILERESOURCE
BINID:0065
BINID:1033
BINID:0066
BINID:1033
BINID:0067
BINID:1033
BINID:0068
BINID:1033
BINID:0069
BINID:1033
BINID:006A
BINID:1033
BINID:006C
BINID:1033
BINID:006D
BINID:1033
BINID:006E
BINID:1033
BINID:00C9
BINID:1033
BINID:00CA
BINID:1033
BINID:00CB
BINID:1033
BINID:00CC
BINID:1033
BINID:00CD
BINID:1033
BINRT_STRING
BINID:000D
BINID:1033
BINID:000E
BINID:1033
BINID:000F
BINID:1033
BINID:0010
BINID:1033
BINID:0011
BINID:1033
BINID:0012
BINID:1033
BINID:0013
BINID:1033
BINID:0014
BINID:1033
BINID:0015
BINID:1033
BINID:0016
BINID:1033
BINID:0017
BINID:1033
BINID:0018
BINID:1033
BINID:0019
BINID:1033
BINID:0020
BINID:1033
BINID:0021
BINID:1033
BINID:0022
BINID:1033
EXEID:0
Structure
P7B[Authenticode]_422276a4.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Diagnostics.TraceSource.SR.resources
XMLILLink.Substitutions.xml
BINRT_GROUP_CURSOR4
BINID:03E9
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
EXESetup.exe
Structure
P7B[Authenticode]_8a74c34a.p7b
BINResources
BINRT_ICON
BINID:0001
IMGID:1033
IMGID:1033-preview.png
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
BINuninstall
BINF-Rename
INIde.ini
PDFde.pdf
BINText (Preview)
TXTPage #1
TXTPage #2
TXTPage #3
TXTPage #4
TXTPage #5
TXTPage #6
TXTPage #7
TXTPage #8
TXTPage #9
TXTPage #10
TXTPage #11
TXTPage #12
TXTPage #13
TXTPage #14
TXTPage #15
TXTPage #16
TXTPage #17
TXTPage #18
TXTPage #19
TXTPage #20
TXTPage #21
TXTPage #22
TXTPage #23
TXTPage #24
TXTPage #25
BIN#Stream obj 5 0
BIN#Stream obj 6 0
BIN#Stream obj 8 0
BIN#Stream obj 10 0
BIN#Stream obj 31 0
BIN#Stream obj 34 0
BIN#Stream obj 40 0
BIN#Stream obj 44 0
BIN#Stream obj 48 0
BIN#Stream obj 54 0
BIN#Stream obj 58 0
BIN#Stream obj 68 0
BIN#Stream obj 25 0
BIN#Stream obj 27 0
BIN#Stream obj 36 0
BIN#Stream obj 38 0
BIN#Stream obj 42 0
BIN#Stream obj 46 0
BIN#Stream obj 50 0
BIN#Stream obj 52 0
BIN#Stream obj 56 0
BIN#Stream obj 60 0
BIN#Stream obj 62 0
BIN#Stream obj 64 0
BIN#Stream obj 66 0
BIN#Stream obj 70 0
BIN#Stream obj 132 0
INIen.ini
PDFen.pdf
BINText (Preview)
TXTPage #1
TXTPage #2
TXTPage #3
TXTPage #4
TXTPage #5
TXTPage #6
TXTPage #7
TXTPage #8
TXTPage #9
TXTPage #10
TXTPage #11
TXTPage #12
TXTPage #13
TXTPage #14
TXTPage #15
TXTPage #16
TXTPage #17
TXTPage #18
TXTPage #19
TXTPage #20
TXTPage #21
TXTPage #22
TXTPage #23
TXTPage #24
BIN#Stream obj 6 0
BIN#Stream obj 8 0
BIN#Stream obj 10 0
BIN#Stream obj 31 0
BIN#Stream obj 34 0
BIN#Stream obj 38 0
BIN#Stream obj 42 0
BIN#Stream obj 46 0
BIN#Stream obj 52 0
BIN#Stream obj 56 0
BIN#Stream obj 66 0
BIN#Stream obj 25 0
BIN#Stream obj 27 0
BIN#Stream obj 36 0
BIN#Stream obj 40 0
BIN#Stream obj 44 0
BIN#Stream obj 48 0
BIN#Stream obj 50 0
BIN#Stream obj 54 0
BIN#Stream obj 58 0
BIN#Stream obj 60 0
BIN#Stream obj 62 0
BIN#Stream obj 64 0
BIN#Stream obj 68 0
BIN#Stream obj 129 0
INIes.ini
INIfr.ini
INIit.ini
INIko.ini
INInl.ini
INIpl.ini
INIro.ini
INIru.ini
INItr.ini
PDFtr.pdf
BINText (Preview)
TXTPage #1
TXTPage #2
TXTPage #3
TXTPage #4
TXTPage #5
TXTPage #6
TXTPage #7
TXTPage #8
TXTPage #9
TXTPage #10
TXTPage #11
TXTPage #12
TXTPage #13
TXTPage #14
TXTPage #15
TXTPage #16
TXTPage #17
TXTPage #18
TXTPage #19
TXTPage #20
TXTPage #21
TXTPage #22
TXTPage #23
TXTPage #24
BIN#Stream obj 5 0
BIN#Stream obj 40 0
BIN#Stream obj 42 0
BIN#Stream obj 43 0
BIN#Stream obj 45 0
BIN#Stream obj 60 0
BIN#Stream obj 62 0
BIN#Stream obj 66 0
BIN#Stream obj 79 0
BIN#Stream obj 82 0
BIN#Stream obj 84 0
BIN#Stream obj 86 0
BIN#Stream obj 88 0
BIN#Stream obj 90 0
BIN#Stream obj 92 0
BIN#Stream obj 94 0
BIN#Stream obj 96 0
BIN#Stream obj 98 0
BIN#Stream obj 100 0
BIN#Stream obj 102 0
BIN#Stream obj 104 0
BIN#Stream obj 106 0
BIN#Stream obj 108 0
BIN#Stream obj 110 0
BIN#Stream obj 112 0
BIN#Stream obj 114 0
BIN#Stream obj 116 0
BIN#Stream obj 138 0
BIN#Stream obj 147 0
BIN#Stream obj 151 0
BIN#Stream obj 3 0
BIN#Stream obj 153 0
BIN#Stream obj 155 0
BIN#Stream obj 157 0
BIN#Stream obj 160 0
BIN#Stream obj 168 0
BIN#Stream obj 170 0
BIN#Stream obj 172 0
BIN#Stream obj 174 0
BIN#Stream obj 176 0
BIN#Stream obj 179 0
BIN#Stream obj 181 0
BIN#Stream obj 183 0
BIN#Stream obj 185 0
BIN#Stream obj 187 0
BIN#Stream obj 189 0
BIN#Stream obj 191 0
BIN#Stream obj 193 0
BIN#Stream obj 195 0
BIN#Stream obj 237 0
BIN#Stream obj 238 0
BIN#Stream obj 239 0
BIN#Stream obj 240 0
BIN#Stream obj 241 0
BIN#Stream obj 242 0
BIN#Stream obj 243 0
BIN#Stream obj 244 0
BIN#Stream obj 245 0
BIN#Stream obj 246 0
BIN#Stream obj 247 0
BIN#Stream obj 248 0
BIN#Stream obj 249 0
BIN#Stream obj 250 0
BIN#Stream obj 251 0
BIN#Stream obj 252 0
BIN#Stream obj 253 0
BIN#Stream obj 254 0
BIN#Stream obj 255 0
BIN#Stream obj 256 0
BIN#Stream obj 200 0
BIN#Stream obj 257 0
TXTStructure
INIua.ini
DATunins000.dat
INIzh.ini
EXEhelper.exe
Structure
BIN[NSIS Installer] @ #0000FA08
DLLSystem.dll
Structure
BINOverlay_6682b84b.bin
DLLUAC.dll
Structure
BINOverlay_5cf0bcaf.bin
BINResources
BINRT_DIALOG
BINID:0065
BINID:1033
DLLCityHash.dll
Structure
BINOverlay_3ec4b0a0.bin
DLLShellLink.dll
Structure
BINOverlay_9cc012db.bin
DLLApplicationID.dll
Structure
BINOverlay_f762724b.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
DLLAppAssocReg.dll
Structure
BINOverlay_2cfc1aa3.bin
DLLInvokeShellVerb.dll
Structure
BINOverlay_e546613c.bin
DLLPinToTaskbar.dll
Structure
DLLliteFirewallW.dll
Structure
BINOverlay_0b364189.bin
DLLAccessControl.dll
Structure
BINOverlay_267fb1dc.bin
BMPmodern-header.bmp
NSI][SETUP_DECOMPILED.NSI]
BIN[NSIS Uninstaller] @ #0008F660
DLLInstallOptions.dll
Structure
BINOverlay_92d84623.bin
BINResources
BINRT_DIALOG
BINID:0065
BINID:1033
DLLHttpPostFile.dll
Structure
BINOverlay_b09633dd.bin
DLLBitsUtils.dll
Structure
BINOverlay_0ed6dc30.bin
INIioSpecial.ini
BMPmodern-wizard.bmp
DLLBanner.dll
Structure
BINOverlay_2e9caef1.bin
DLLExecInExplorer.dll
Structure
BINOverlay_05b9399d.bin
BINResources
BINRT_MANIFEST
BINID:0002
BINID:1033
NSI][SETUP_DECOMPILED.NSI]
BINOverlay_87c94f14.bin
BINResources
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINRT_DIALOG
BINID:0069
BINID:1033
BINID:006A
BINID:1033
BINID:006F
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0067
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
INIshortcuts_log.ini
LOGuninstall.log
DLLvcruntime140.dll
Structure
P7B[Authenticode]_fcfc5664.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
26 / 26
Path arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
Shape arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
malicious 6 nodes
Path arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
Shape arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
malicious 6 nodes
Config. Field Value
URL #1 http:/huhuhuhuhuhuhuhuhuhuhu
URL #2 http:/huhuhuhuhuhuhuhuhuhuhu
URL #3 http:/huhuhuhuhuhuhu
URL #4 http:/huhuhuhuhuhuhuhuhuhuhu
URL #5 http:/huhuhuhuhuhuhuhuhuhuhu
URL #6 http:/huhuhuhuhuhuhuhuhuhuhu
URL #7 http:/huhuhuhuhuhuhu
URL #8 http:/huhuhuhuhuhuhu
URL #9 http:/huhuhuhuhuhuhu
URL #10 http:/huhuhuhuhuhuhuhuhuhuhu
URL #11 http:/huhuhuhuhuhuhuhuhuhuhu
URL #12 http:/huhuhuhuhuhuhu
URL #13 http:/huhuhuhuhuhuhuhuhuhuhu
URL #14 http:/huhuhuhuhuhuhuhuhuhuhu
URL #15 http:/huhuhuhuhuhuhuhuhuhuhu
URL #16 http:/huhuhuhuhuhuhuhuhuhuhu
URL #17 http:/huhuhuhuhuhuhuhuhuhuhu
URL #18 http:/huhuhuhuhuhuhu
URL #19 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL #1 http:/huhuhuhuhuhuhuhuhuhuhu
URL #2 http:/huhuhuhuhuhuhuhuhuhuhu
URL #3 http:/huhuhuhuhuhuhu
URL #4 http:/huhuhuhuhuhuhuhuhuhuhu
URL #5 http:/huhuhuhuhuhuhuhuhuhuhu
URL #6 http:/huhuhuhuhuhuhuhuhuhuhu
URL #7 http:/huhuhuhuhuhuhuhuhuhuhu
URL #8 http:/huhuhuhuhuhuhuhuhuhuhu
URL #9 http:/huhuhuhuhuhuhuhuhuhuhu
URL #10 http:/huhuhuhuhuhuhuhuhuhuhu
URL #11 http:/huhuhuhuhuhuhuhuhuhuhu
URL #12 http:/huhuhuhuhuhuhuhuhuhuhu
URL #13 http:/huhuhuhuhuhuhuhuhuhuhu
URL #14 http:/huhuhuhuhuhuhuhuhuhuhu
URL #15 http:/huhuhuhuhuhuhuhuhuhuhu
URL #16 http:/huhuhuhuhuhuhuhuhuhuhu
URL #17 http:/huhuhuhuhuhuhuhuhuhuhu
URL #18 http:/huhuhuhuhuhuhuhuhuhuhu
URL #19 http:/huhuhuhuhuhuhuhuhuhuhu
URL #20 http:/huhuhuhuhuhuhuhuhuhuhu
URL #21 http:/huhuhuhuhuhuhuhuhuhuhu
URL #22 http:/huhuhuhuhuhuhuhuhuhuhu
URL #23 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL #1 http:/huhuhuhuhuhuhuhuhuhuhu
URL #2 http:/huhuhuhuhuhuhuhuhuhuhu
URL #3 http:/huhuhuhuhuhuhuhuhuhuhu
URL #4 http:/huhuhuhuhuhuhuhuhuhuhu
URL #5 http:/huhuhuhuhuhuhuhuhuhuhu
URL #6 http:/huhuhuhuhuhuhuhuhuhuhu
URL #7 http:/huhuhuhuhuhuhuhuhuhuhu
URL #8 http:/huhuhuhuhuhuhuhuhuhuhu
URL #9 http:/huhuhuhuhuhuhuhuhuhuhu
URL #10 http:/huhuhuhuhuhuhuhuhuhuhu
URL #11 http:/huhuhuhuhuhuhuhuhuhuhu
URL #12 http:/huhuhuhuhuhuhuhuhuhuhu
URL #13 http:/huhuhuhuhuhuhuhuhuhuhu
URL #14 http:/huhuhuhuhuhuhuhuhuhuhu
URL #15 http:/huhuhuhuhuhuhuhuhuhuhu
URL #16 http:/huhuhuhuhuhuhuhuhuhuhu
URL #17 http:/huhuhuhuhuhuhuhuhuhuhu
URL #18 http:/huhuhuhuhuhuhuhuhuhuhu
URL #19 http:/huhuhuhuhuhuhuhuhuhuhu
URL #20 http:/huhuhuhuhuhuhuhuhuhuhu
URL #21 http:/huhuhuhuhuhuhuhuhuhuhu
URL #22 http:/huhuhuhuhuhuhuhuhuhuhu
URL #23 http:/huhuhuhuhuhuhuhuhuhuhu
URL #24 http:/huhuhuhuhuhuhuhuhuhuhu
URL #25 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Version
1.7
CreationDate
D:20201128161048
Creator
http://www.helpandmanual.com
ModifiedDate
D:20210218152739+03'00'
Title
F-Rename - Hilfesystem
Producer
wPDF3 by WPCubed GmbH
/CreationDate
D:20201128161048
/Creator
http://www.helpandmanual.com
/ModDate
D:20210218152739+03'00'
/Producer
wPDF3 by WPCubed GmbH
/Title
F-Rename - Hilfesystem
Version
1.2
CreationDate
D:20260423010135
Creator
http://www.helpandmanual.com
ModifiedDate
D:20260423010135
Title
F-Rename - Hilfesystem
Producer
wPDF3 by WPCubed GmbH
/Creator
http://www.helpandmanual.com
/Title
F-Rename - Hilfesystem
/CreationDate
D:20260423010135
/ModDate
D:20260423010135
/Producer
wPDF3 by WPCubed GmbH
Version
1.2
CreationDate
D:20260423010058
Creator
http://www.helpandmanual.com
ModifiedDate
D:20260423010058
Title
F-Rename - Hilfesystem
Producer
wPDF3 by WPCubed GmbH
/Creator
http://www.helpandmanual.com
/Title
F-Rename - Hilfesystem
/CreationDate
D:20260423010058
/ModDate
D:20260423010058
/Producer
wPDF3 by WPCubed GmbH
URI URI
https:huhuhuhuhuhuhuhuhuhuhu
URI URI
mailtohuhuhuhuhuhuhuhuhuhuhu
URI URI
https:huhuhuhuhuhuhuhuhuhuhu
URI URI
mailtohuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
2 malicious · 1170 files
ZIP46106561962c79d6cfbc597f630ff9aaCVE-2019-9674
DLLpython37.dll
Structure
BINOverlay_b998d9f5.bin
Config. Field Value
URL #1 http:/huhuhuhuhuhuhuhuhuhuhu
URL #2 http:/huhuhuhuhuhuhuhuhuhuhu
URL #3 http:/huhuhuhuhuhuhu
URL #4 http:/huhuhuhuhuhuhuhuhuhuhu
URL #5 http:/huhuhuhuhuhuhuhuhuhuhu
URL #6 http:/huhuhuhuhuhuhuhuhuhuhu
URL #7 http:/huhuhuhuhuhuhu
URL #8 http:/huhuhuhuhuhuhu
URL #9 http:/huhuhuhuhuhuhu
URL #10 http:/huhuhuhuhuhuhuhuhuhuhu
URL #11 http:/huhuhuhuhuhuhuhuhuhuhu
URL #12 http:/huhuhuhuhuhuhu
URL #13 http:/huhuhuhuhuhuhuhuhuhuhu
URL #14 http:/huhuhuhuhuhuhuhuhuhuhu
URL #15 http:/huhuhuhuhuhuhuhuhuhuhu
URL #16 http:/huhuhuhuhuhuhuhuhuhuhu
URL #17 http:/huhuhuhuhuhuhuhuhuhuhu
URL #18 http:/huhuhuhuhuhuhu
URL #19 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL #1 http:/huhuhuhuhuhuhuhuhuhuhu
URL #2 http:/huhuhuhuhuhuhuhuhuhuhu
URL #3 http:/huhuhuhuhuhuhu
URL #4 http:/huhuhuhuhuhuhuhuhuhuhu
URL #5 http:/huhuhuhuhuhuhuhuhuhuhu
URL #6 http:/huhuhuhuhuhuhuhuhuhuhu
URL #7 http:/huhuhuhuhuhuhuhuhuhuhu
URL #8 http:/huhuhuhuhuhuhuhuhuhuhu
URL #9 http:/huhuhuhuhuhuhuhuhuhuhu
URL #10 http:/huhuhuhuhuhuhuhuhuhuhu
URL #11 http:/huhuhuhuhuhuhuhuhuhuhu
URL #12 http:/huhuhuhuhuhuhuhuhuhuhu
URL #13 http:/huhuhuhuhuhuhuhuhuhuhu
URL #14 http:/huhuhuhuhuhuhuhuhuhuhu
URL #15 http:/huhuhuhuhuhuhuhuhuhuhu
URL #16 http:/huhuhuhuhuhuhuhuhuhuhu
URL #17 http:/huhuhuhuhuhuhuhuhuhuhu
URL #18 http:/huhuhuhuhuhuhuhuhuhuhu
URL #19 http:/huhuhuhuhuhuhuhuhuhuhu
URL #20 http:/huhuhuhuhuhuhuhuhuhuhu
URL #21 http:/huhuhuhuhuhuhuhuhuhuhu
URL #22 http:/huhuhuhuhuhuhuhuhuhuhu
URL #23 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL #1 http:/huhuhuhuhuhuhuhuhuhuhu
URL #2 http:/huhuhuhuhuhuhuhuhuhuhu
URL #3 http:/huhuhuhuhuhuhuhuhuhuhu
URL #4 http:/huhuhuhuhuhuhuhuhuhuhu
URL #5 http:/huhuhuhuhuhuhuhuhuhuhu
URL #6 http:/huhuhuhuhuhuhuhuhuhuhu
URL #7 http:/huhuhuhuhuhuhuhuhuhuhu
URL #8 http:/huhuhuhuhuhuhuhuhuhuhu
URL #9 http:/huhuhuhuhuhuhuhuhuhuhu
URL #10 http:/huhuhuhuhuhuhuhuhuhuhu
URL #11 http:/huhuhuhuhuhuhuhuhuhuhu
URL #12 http:/huhuhuhuhuhuhuhuhuhuhu
URL #13 http:/huhuhuhuhuhuhuhuhuhuhu
URL #14 http:/huhuhuhuhuhuhuhuhuhuhu
URL #15 http:/huhuhuhuhuhuhuhuhuhuhu
URL #16 http:/huhuhuhuhuhuhuhuhuhuhu
URL #17 http:/huhuhuhuhuhuhuhuhuhuhu
URL #18 http:/huhuhuhuhuhuhuhuhuhuhu
URL #19 http:/huhuhuhuhuhuhuhuhuhuhu
URL #20 http:/huhuhuhuhuhuhuhuhuhuhu
URL #21 http:/huhuhuhuhuhuhuhuhuhuhu
URL #22 http:/huhuhuhuhuhuhuhuhuhuhu
URL #23 http:/huhuhuhuhuhuhuhuhuhuhu
URL #24 http:/huhuhuhuhuhuhuhuhuhuhu
URL #25 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URI URI
https:huhuhuhuhuhuhuhuhuhuhu
46106561962c79d6cfbc597f630ff9aa › uninstall › F-Rename › en.pdf
URI URI
mailtohuhuhuhuhuhuhuhuhuhuhu
46106561962c79d6cfbc597f630ff9aa › uninstall › F-Rename › en.pdf
URI URI
https:huhuhuhuhuhuhuhuhuhuhu
46106561962c79d6cfbc597f630ff9aa › uninstall › F-Rename › de.pdf
URI URI
mailtohuhuhuhuhuhuhu
46106561962c79d6cfbc597f630ff9aa › uninstall › F-Rename › de.pdf
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙