Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

This sample is a 24.4 MB ZIP Archive classified as malicious by Malva.RE. Static analysis extracted 988 embedded or derived files. It matches 21 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
30e6f65380198bd4d49227d780f19a01d297aa8ed7ae643167e490f5e7b8fca5
MD5
9dfc29fcbae3f85a932141966378f274
Verdict
Malicious
File type
ZIP Archive · 24.4 MB

Cite this report: https://app.malva.re/sha256/30e6f65380198bd4d49227d780f19a01d297aa8ed7ae643167e490f5e7b8fca5

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
25.6 MB · 25,599,003 B
First seen
2026-11-01 00:15 · yesterday
Last seen
2026-11-01 00:15 · yesterday
Last analysis
2026-11-01 00:16 · yesterday
Hashes
MD5 9dfc29fcbae3f85a932141966378f274 Sha1 ba3b01c90d517eaa3b59c8ca730d94290ddefd4f Sha256 30e6f65380198bd4d49227d780f19a01d297aa8ed7ae643167e490f5e7b8fca5 Sha384 efbeb65156d512861157923763c702a5e90b7b457b757801ec32f8e1181331b996acf29fab9bdbec220efdeed8d8272b Sha512 d04186fb93bbd8f96761286e3f6a5d244ed01d86f8c2730522a408fb669712bd20f8fa2fbe628eb14db31eff5fca09c885814a3469fd9b15588a9b32e8269853 SSDeep 786432:qotJpzs4vIBOmJPj1j/FVs4vbRos4vzRJ:qo9nvsxRVnvbGnvzRJ TLSH 5C47236CB8B5B84AF5D0537BC6C52CBAEB2CE541D7E93C9B8E2440467D8310E4F6AC61

2 malicious · 772 files
ZIP9dfc29fcbae3f85a932141966378f274CVE-2019-9674
DLLcnhi8308.dll
BINControl
TXTPanelLCDControlFile.txt
BINlib
DLLapi-ms-win-core-console-l1-1-0.dll
Structure
P7B[Authenticode]_361a3a65.p7b
DLLapi-ms-win-core-datetime-l1-1-0.dll
Structure
P7B[Authenticode]_bf9ddaf0.p7b
DLLapi-ms-win-core-debug-l1-1-0.dll
Structure
P7B[Authenticode]_b4395dc3.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLapi-ms-win-core-errorhandling-l1-1-0.dll
Structure
P7B[Authenticode]_7c293739.p7b
DLLapi-ms-win-core-file-l1-1-0.dll
Structure
P7B[Authenticode]_1291a536.p7b
DLLapi-ms-win-core-file-l1-2-0.dll
Structure
P7B[Authenticode]_b627dea8.p7b
DLLapi-ms-win-core-file-l2-1-0.dll
Structure
P7B[Authenticode]_d094f353.p7b
DLLapi-ms-win-core-handle-l1-1-0.dll
Structure
P7B[Authenticode]_f16be850.p7b
DLLapi-ms-win-core-heap-l1-1-0.dll
Structure
P7B[Authenticode]_7c7dbb67.p7b
DLLapi-ms-win-core-interlocked-l1-1-0.dll
Structure
P7B[Authenticode]_533f44fd.p7b
DLLapi-ms-win-core-libraryloader-l1-1-0.dll
Structure
P7B[Authenticode]_f5ee820c.p7b
DLLapi-ms-win-core-localization-l1-2-0.dll
Structure
P7B[Authenticode]_508ca99d.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLapi-ms-win-core-memory-l1-1-0.dll
Structure
P7B[Authenticode]_b0101069.p7b
DLLapi-ms-win-core-namedpipe-l1-1-0.dll
Structure
P7B[Authenticode]_8dbca64e.p7b
DLLapi-ms-win-core-processenvironment-l1-1-0.dll
Structure
P7B[Authenticode]_e4e722da.p7b
DLLapi-ms-win-core-processthreads-l1-1-0.dll
Structure
P7B[Authenticode]_3e04d477.p7b
DLLapi-ms-win-core-processthreads-l1-1-1.dll
Structure
P7B[Authenticode]_28ce7627.p7b
DLLapi-ms-win-core-profile-l1-1-0.dll
Structure
P7B[Authenticode]_37cbe8ad.p7b
DLLapi-ms-win-core-rtlsupport-l1-1-0.dll
Structure
P7B[Authenticode]_fd17a7f1.p7b
DLLapi-ms-win-core-string-l1-1-0.dll
Structure
P7B[Authenticode]_de758680.p7b
DLLapi-ms-win-core-synch-l1-1-0.dll
Structure
P7B[Authenticode]_708c5569.p7b
DLLapi-ms-win-core-synch-l1-2-0.dll
Structure
P7B[Authenticode]_e7ef77c4.p7b
DLLapi-ms-win-core-sysinfo-l1-1-0.dll
Structure
P7B[Authenticode]_e6b74754.p7b
DLLapi-ms-win-core-timezone-l1-1-0.dll
Structure
P7B[Authenticode]_3c111919.p7b
DLLapi-ms-win-core-util-l1-1-0.dll
Structure
P7B[Authenticode]_02e49996.p7b
DLLapi-ms-win-crt-conio-l1-1-0.dll
Structure
P7B[Authenticode]_1dfb57a9.p7b
DLLapi-ms-win-crt-convert-l1-1-0.dll
Structure
P7B[Authenticode]_88758dd7.p7b
DLLapi-ms-win-crt-environment-l1-1-0.dll
Structure
P7B[Authenticode]_b0a8837f.p7b
DLLapi-ms-win-crt-filesystem-l1-1-0.dll
Structure
P7B[Authenticode]_5c78d3ca.p7b
DLLapi-ms-win-crt-heap-l1-1-0.dll
Structure
P7B[Authenticode]_17749bcd.p7b
DLLapi-ms-win-crt-locale-l1-1-0.dll
Structure
P7B[Authenticode]_4cf32aae.p7b
DLLapi-ms-win-crt-math-l1-1-0.dll
Structure
P7B[Authenticode]_384560e4.p7b
DLLapi-ms-win-crt-multibyte-l1-1-0.dll
Structure
P7B[Authenticode]_dc106063.p7b
DLLapi-ms-win-crt-private-l1-1-0.dll
Structure
P7B[Authenticode]_aca72f06.p7b
DLLapi-ms-win-crt-process-l1-1-0.dll
Structure
P7B[Authenticode]_fb9e4c6b.p7b
DLLapi-ms-win-crt-runtime-l1-1-0.dll
Structure
P7B[Authenticode]_4ff319bb.p7b
DLLapi-ms-win-crt-stdio-l1-1-0.dll
Structure
P7B[Authenticode]_e16486bd.p7b
DLLapi-ms-win-crt-string-l1-1-0.dll
Structure
P7B[Authenticode]_e9281f4c.p7b
DLLapi-ms-win-crt-time-l1-1-0.dll
Structure
P7B[Authenticode]_7c588011.p7b
DLLapi-ms-win-crt-utility-l1-1-0.dll
Structure
P7B[Authenticode]_0d23ea81.p7b
BINaudio
DLLCr_PTP_IP.dll
Structure
P7B[Authenticode]_82a07e5e.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1041
DLLCr_PTP_USB.dll
Structure
P7B[Authenticode]_959f0632.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1041
BINRT_MANIFEST
BINID:0002
BINID:1033
DLLlibssh2.dll
Structure
P7B[Authenticode]_9ca5b199.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
DLLlibusb-1.0.dll
Structure
P7B[Authenticode]_1fbafb49.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLqtaudio_windows.dll
Structure
P7B[Authenticode]_272f635f.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINCommon
MCompoundAxes.m
MKnownAxes.m
MUnknownAxes.m
DLLconcrt140.dll
Structure
P7B[Authenticode]_dc2cd7d9.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLcpprest141_2_10.dll
Structure
P7B[Authenticode]_67152421.p7b
WCLformat.wcl
Minit.m
BINKernel
BINx64
BINData
MPSafiro.mps
PSAcan__229.psa
RUAcavity01.rua
CUAdwg961b.cua
MTXdwg961b.mtx
PSAdwt_1005.psa
BINExtraPackages
BINDifferentialEquations
MBoundaryRegionPlot.m
MInterpolatingFunctionAnatomy.m
MNDSolveProblems.m
MNDSolveUtilities.m
BINimageformats
DLLqgif4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLqjpeg4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLqmng4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLqsvg4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLqtiff4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINIntegration
MNIntegrateUtilities.m
BINLinearAlgebraExamples
BINData
RSAgr_30_30.rsa
MTXnos6.mtx
DATsimplematrix.dat
MTXwest0381.mtx
RRAwm1.rra
BINStatisticsExamples
BINData
DATiris.dat
BINUtilities
MCleanSlate.m
MURLTools.m
MPSganges.mps
MPSshell.mps
MPSstandmps.mps
DLLRapid_Upgrade.dll
Structure
P7B[Authenticode]_52bd14f9.p7b
BINResources
BINZIPFILE
BINID:0066
ZIPID:1042
BINRT_VERSION
BINID:0001
BINID:1033
DLLKillProcess.dll
Structure
P7B[Authenticode]_f128924e.p7b
BINResources
BINRT_CURSOR
BINID:0001
BINID:1042
BINID:0002
BINID:1042
BINRT_BITMAP
BINID:67C7
BINID:1042
BINID:7912
BINID:1042
BINID:7913
BINID:1042
BINID:7914
BINID:1042
BINRT_DIALOG
BINID:7801
BINID:1042
BINRT_STRING
BINID:0F01
BINID:1042
BINID:0F02
BINID:1042
BINID:0F03
BINID:1042
BINID:0F11
BINID:1042
BINID:0F12
BINID:1042
BINID:0F13
BINID:1042
BINID:0F19
BINID:1042
BINID:0F1A
BINID:1042
BINID:0F1B
BINID:1042
BINID:0F1C
BINID:1042
BINID:0F1D
BINID:1042
BINRT_GROUP_CURSOR2
BINID:7901
BINID:1042
BINRT_VERSION
BINID:0001
BINID:1042
DLLlibeay32.dll
Structure
P7B[Authenticode]_a8a455ca.p7b
TXTlog_20251011_MIG-SVC.txt
TXTlog_20251012_MIG-SVC.txt
TXTlog_20251013_MIG-SVC.txt
TXTlog_20251014_MIG-SVC.txt
TXTlog_20251015_MIG-SVC.txt
TXTlog_20251016_MIG-SVC.txt
TXTlog_20251017_MIG-SVC.txt
TXTlog_20251018_MIG-SVC.txt
TXTlog_20251019_MIG-SVC.txt
TXTlog_20251020_MIG-SVC.txt
TXTlog_20251021_MIG-SVC.txt
TXTlog_20251022_MIG-SVC.txt
TXTlog_20251023_MIG-SVC.txt
TXTlog_20251024_MIG-SVC.txt
TXTlog_20251025_MIG-SVC.txt
TXTlog_20251026_MIG-SVC.txt
TXTlog_20251027_MIG-SVC.txt
TXTlog_20251028_MIG-SVC.txt
TXTlog_20251029_MIG-SVC.txt
TXTlog_20251030_MIG-SVC.txt
TXTlog_20251031_MIG-SVC.txt
TXTlog_20251101_MIG-SVC.txt
TXTlog_20251102_MIG-SVC.txt
TXTlog_20251107_MIG-SVC.txt
TXTlog_20251108_MIG-SVC.txt
TXTlog_20251109_MIG-SVC.txt
TXTlog_20251110_MIG-SVC.txt
TXTlog_20251111_MIG-SVC.txt
TXTlog_20251112_MIG-SVC.txt
TXTlog_20251113_MIG-SVC.txt
TXTlog_20251114_MIG-SVC.txt
TXTlog_20251115_MIG-SVC.txt
TXTlog_20251116_MIG-SVC.txt
TXTlog_20251117_MIG-SVC.txt
TXTlog_20251118_MIG-SVC.txt
TXTlog_20251119_MIG-SVC.txt
TXTlog_20251120_MIG-SVC.txt
TXTlog_20251121_MIG-SVC.txt
TXTlog_20251122_MIG-SVC.txt
TXTlog_20251123_MIG-SVC.txt
TXTlog_20251124_MIG-SVC.txt
TXTlog_20251125_MIG-SVC.txt
TXTlog_20251126_MIG-SVC.txt
TXTlog_20251127_MIG-SVC.txt
TXTlog_20251128_MIG-SVC.txt
TXTlog_20251129_MIG-SVC.txt
TXTlog_20251130_MIG-SVC.txt
TXTlog_20251201_MIG-SVC.txt
TXTlog_20251202_MIG-SVC.txt
TXTlog_20251203_MIG-SVC.txt
TXTlog_20251204_MIG-SVC.txt
TXTlog_20251205_MIG-SVC.txt
TXTlog_20251206_MIG-SVC.txt
TXTlog_20251207_MIG-SVC.txt
TXTlog_20251208_MIG-SVC.txt
TXTlog_20251209_MIG-SVC.txt
TXTlog_20251210_MIG-SVC.txt
TXTlog_20251211_MIG-SVC.txt
TXTlog_20251212_MIG-SVC.txt
TXTlog_20251213_MIG-SVC.txt
TXTlog_20251214_MIG-SVC.txt
TXTlog_20251215_MIG-SVC.txt
TXTlog_20251216_MIG-SVC.txt
TXTlog_20251217_MIG-SVC.txt
TXTlog_20251218_MIG-SVC.txt
TXTlog_20251219_MIG-SVC.txt
TXTlog_20251220_MIG-SVC.txt
TXTlog_20251221_MIG-SVC.txt
TXTlog_20251222_MIG-SVC.txt
TXTlog_20251223_MIG-SVC.txt
TXTlog_20251224_MIG-SVC.txt
TXTlog_20251225_MIG-SVC.txt
TXTlog_20251226_MIG-SVC.txt
TXTlog_20251227_MIG-SVC.txt
TXTlog_20251228_MIG-SVC.txt
TXTlog_20251229_MIG-SVC.txt
TXTlog_20251230_MIG-SVC.txt
TXTlog_20251231_MIG-SVC.txt
TXTlog_20260101_MIG-SVC.txt
TXTlog_20260102_MIG-SVC.txt
TXTlog_20260103_MIG-SVC.txt
TXTlog_20260104_MIG-SVC.txt
TXTlog_20260105_MIG-SVC.txt
TXTlog_20260106_MIG-SVC.txt
TXTlog_20260107_MIG-SVC.txt
TXTlog_20260108_MIG-SVC.txt
TXTlog_20260109_MIG-SVC.txt
TXTlog_20260110_MIG-SVC.txt
TXTlog_20260111_MIG-SVC.txt
TXTlog_20260112_MIG-SVC.txt
TXTlog_20260113_MIG-SVC.txt
TXTlog_20260114_MIG-SVC.txt
TXTlog_20260115_MIG-SVC.txt
TXTlog_20260116_MIG-SVC.txt
TXTlog_20260117_MIG-SVC.txt
TXTlog_20260118_MIG-SVC.txt
TXTlog_20260119_MIG-SVC.txt
TXTlog_20260120_MIG-SVC.txt
TXTlog_20260121_MIG-SVC.txt
TXTlog_20260122_MIG-SVC.txt
TXTlog_20260123_MIG-SVC.txt
TXTlog_20260124_MIG-SVC.txt
TXTlog_20260125_MIG-SVC.txt
TXTlog_20260126_MIG-SVC.txt
TXTlog_20260127_MIG-SVC.txt
TXTlog_20260128_MIG-SVC.txt
TXTlog_20260129_MIG-SVC.txt
TXTlog_20260130_MIG-SVC.txt
TXTlog_20260131_MIG-SVC.txt
TXTlog_20260201_MIG-SVC.txt
TXTlog_20260202_MIG-SVC.txt
TXTlog_20260203_MIG-SVC.txt
TXTlog_20260204_MIG-SVC.txt
TXTlog_20260205_MIG-SVC.txt
TXTlog_20260206_MIG-SVC.txt
TXTlog_20260207_MIG-SVC.txt
TXTlog_20260208_MIG-SVC.txt
TXTlog_20260209_MIG-SVC.txt
TXTlog_20260210_MIG-SVC.txt
TXTlog_20260211_MIG-SVC.txt
TXTlog_20260212_MIG-SVC.txt
TXTlog_20260213_MIG-SVC.txt
TXTlog_20260214_MIG-SVC.txt
TXTlog_20260215_MIG-SVC.txt
TXTlog_20260216_MIG-SVC.txt
TXTlog_20260217_MIG-SVC.txt
TXTlog_20260218_MIG-SVC.txt
TXTlog_20260219_MIG-SVC.txt
TXTlog_20260220_MIG-SVC.txt
TXTlog_20260221_MIG-SVC.txt
TXTlog_20260222_MIG-SVC.txt
TXTlog_20260223_MIG-SVC.txt
TXTlog_20260224_MIG-SVC.txt
TXTlog_20260225_MIG-SVC.txt
TXTlog_20260226_MIG-SVC.txt
TXTlog_20260227_MIG-SVC.txt
TXTlog_20260228_MIG-SVC.txt
TXTlog_20260301_MIG-SVC.txt
TXTlog_20260302_MIG-SVC.txt
TXTlog_20260303_MIG-SVC.txt
TXTlog_20260304_MIG-SVC.txt
TXTlog_20260305_MIG-SVC.txt
TXTlog_20260306_MIG-SVC.txt
TXTlog_20260307_MIG-SVC.txt
TXTlog_20260308_MIG-SVC.txt
TXTlog_20260309_MIG-SVC.txt
TXTlog_20260310_MIG-SVC.txt
TXTlog_20260311_MIG-SVC.txt
TXTlog_20260312_MIG-SVC.txt
TXTlog_20260313_MIG-SVC.txt
TXTlog_20260314_MIG-SVC.txt
TXTlog_20260315_MIG-SVC.txt
TXTlog_20260316_MIG-SVC.txt
TXTlog_20260317_MIG-SVC.txt
TXTlog_20260318_MIG-SVC.txt
TXTlog_20260319_MIG-SVC.txt
TXTlog_20260320_MIG-SVC.txt
TXTlog_20260321_MIG-SVC.txt
TXTlog_20260322_MIG-SVC.txt
TXTlog_20260323_MIG-SVC.txt
TXTlog_20260324_MIG-SVC.txt
TXTlog_20260325_MIG-SVC.txt
TXTlog_20260326_MIG-SVC.txt
TXTlog_20260327_MIG-SVC.txt
TXTlog_20260328_MIG-SVC.txt
TXTlog_20260329_MIG-SVC.txt
TXTlog_20260330_MIG-SVC.txt
TXTlog_20260331_MIG-SVC.txt
TXTlog_20260401_MIG-SVC.txt
TXTlog_20260402_MIG-SVC.txt
TXTlog_20260403_MIG-SVC.txt
TXTlog_20260404_MIG-SVC.txt
TXTlog_20260405_MIG-SVC.txt
TXTlog_20260406_MIG-SVC.txt
TXTlog_20260407_MIG-SVC.txt
TXTlog_20260408_MIG-SVC.txt
TXTlog_20260409_MIG-SVC.txt
TXTlog_20260410_MIG-SVC.txt
TXTlog_20260411_MIG-SVC.txt
TXTlog_20260412_MIG-SVC.txt
TXTlog_20260413_MIG-SVC.txt
TXTlog_20260414_MIG-SVC.txt
TXTlog_20260415_MIG-SVC.txt
TXTlog_20260416_MIG-SVC.txt
TXTlog_20260417_MIG-SVC.txt
TXTlog_20260420_MIG-SVC.txt
TXTlog_20260421_MIG-SVC.txt
TXTlog_20260422_MIG-SVC.txt
TXTlog_20260423_MIG-SVC.txt
TXTlog_20260424_MIG-SVC.txt
TXTlog_20260425_MIG-SVC.txt
TXTlog_20260426_MIG-SVC.txt
TXTlog_20260427_MIG-SVC.txt
TXTlog_20260428_MIG-SVC.txt
TXTlog_20260429_MIG-SVC.txt
TXTlog_20260430_MIG-SVC.txt
TXTlog_20260501_MIG-SVC.txt
TXTlog_20260502_MIG-SVC.txt
TXTlog_20260503_MIG-SVC.txt
TXTlog_20260504_MIG-SVC.txt
TXTlog_20260505_MIG-SVC.txt
TXTlog_20260506_MIG-SVC.txt
TXTlog_20260507_MIG-SVC.txt
TXTlog_20260508_MIG-SVC.txt
TXTlog_20260509_MIG-SVC.txt
TXTlog_20260510_MIG-SVC.txt
TXTlog_20260511_MIG-SVC.txt
TXTlog_20260512_MIG-SVC.txt
TXTlog_20260513_MIG-SVC.txt
TXTlog_20260514_MIG-SVC.txt
TXTlog_20260515_MIG-SVC.txt
TXTlog_20260516_MIG-SVC.txt
TXTlog_20260517_MIG-SVC.txt
TXTlog_20260518_MIG-SVC.txt
TXTlog_20260519_MIG-SVC.txt
TXTlog_20260520_MIG-SVC.txt
TXTlog_20260521_MIG-SVC.txt
TXTlog_20260522_MIG-SVC.txt
TXTlog_20260523_MIG-SVC.txt
TXTlog_20260524_MIG-SVC.txt
TXTlog_20260525_MIG-SVC.txt
TXTlog_20260526_MIG-SVC.txt
TXTlog_20260527_MIG-SVC.txt
TXTlog_20260528_MIG-SVC.txt
TXTlog_20260529_MIG-SVC.txt
TXTlog_20260530_MIG-SVC.txt
TXTlog_20260531_MIG-SVC.txt
TXTlog_20260601_MIG-SVC.txt
TXTlog_20260602_MIG-SVC.txt
TXTlog_20260603_MIG-SVC.txt
TXTlog_20260604_MIG-SVC.txt
TXTlog_20260605_MIG-SVC.txt
TXTlog_20260606_MIG-SVC.txt
TXTlog_20260607_MIG-SVC.txt
TXTlog_20260608_MIG-SVC.txt
TXTlog_20260609_MIG-SVC.txt
TXTlog_20260610_MIG-SVC.txt
TXTlog_20260611_MIG-SVC.txt
TXTlog_20260612_MIG-SVC.txt
TXTlog_20260613_MIG-SVC.txt
TXTlog_20260614_MIG-SVC.txt
TXTlog_20260615_MIG-SVC.txt
TXTlog_20260616_MIG-SVC.txt
TXTlog_20260617_MIG-SVC.txt
TXTlog_20260618_MIG-SVC.txt
TXTlog_20260619_MIG-SVC.txt
TXTlog_20260620_MIG-SVC.txt
TXTlog_20260621_MIG-SVC.txt
TXTlog_20260622_MIG-SVC.txt
TXTlog_20260623_MIG-SVC.txt
TXTlog_20260624_MIG-SVC.txt
TXTlog_20260625_MIG-SVC.txt
TXTlog_20260626_MIG-SVC.txt
TXTlog_20260627_MIG-SVC.txt
TXTlog_20260628_MIG-SVC.txt
TXTlog_20260629_MIG-SVC.txt
TXTlog_20260630_MIG-SVC.txt
TXTlog_20260701_MIG-SVC.txt
TXTlog_20260702_MIG-SVC.txt
TXTlog_20260703_MIG-SVC.txt
TXTlog_20260704_MIG-SVC.txt
TXTlog_20260705_MIG-SVC.txt
TXTlog_20260706_MIG-SVC.txt
TXTlog_20260707_MIG-SVC.txt
TXTlog_20260708_MIG-SVC.txt
TXTlog_20260709_MIG-SVC.txt
TXTlog_20260710_MIG-SVC.txt
TXTlog_20260711_MIG-SVC.txt
TXTlog_20260712_MIG-SVC.txt
TXTlog_20260713_MIG-SVC.txt
TXTlog_20260714_MIG-SVC.txt
TXTlog_20260715_MIG-SVC.txt
TXTlog_20260716_MIG-SVC.txt
TXTlog_20260717_MIG-SVC.txt
TXTlog_20260718_MIG-SVC.txt
TXTlog_20260719_MIG-SVC.txt
TXTlog_20260720_MIG-SVC.txt
TXTlog_20260721_MIG-SVC.txt
TXTlog_20260722_MIG-SVC.txt
TXTlog_20260723_MIG-SVC.txt
TXTlog_20260724_MIG-SVC.txt
TXTlog_20260725_MIG-SVC.txt
TXTlog_20260726_MIG-SVC.txt
TXTlog_20260727_MIG-SVC.txt
TXTlog_20260728_MIG-SVC.txt
TXTlog_20260729_MIG-SVC.txt
TXTlog_20260730_MIG-SVC.txt
TXTlog_20260731_MIG-SVC.txt
TXTlog_20260801_MIG-SVC.txt
TXTlog_20260802_MIG-SVC.txt
TXTlog_20260803_MIG-SVC.txt
TXTlog_20260804_MIG-SVC.txt
TXTlog_20260805_MIG-SVC.txt
TXTlog_20260806_MIG-SVC.txt
TXTlog_20260807_MIG-SVC.txt
TXTlog_20260808_MIG-SVC.txt
TXTlog_20260809_MIG-SVC.txt
TXTlog_20260810_MIG-SVC.txt
TXTlog_20260811_MIG-SVC.txt
TXTlog_20260812_MIG-SVC.txt
TXTlog_20260813_MIG-SVC.txt
TXTlog_20260814_MIG-SVC.txt
TXTlog_20260815_MIG-SVC.txt
TXTlog_20260816_MIG-SVC.txt
TXTlog_20260817_MIG-SVC.txt
TXTlog_20260818_MIG-SVC.txt
TXTlog_20260819_MIG-SVC.txt
TXTlog_20260820_MIG-SVC.txt
TXTlog_20260821_MIG-SVC.txt
TXTlog_20260822_MIG-SVC.txt
TXTlog_20260823_MIG-SVC.txt
TXTlog_20260824_MIG-SVC.txt
TXTlog_20260825_MIG-SVC.txt
TXTlog_20260826_MIG-SVC.txt
TXTlog_20260827_MIG-SVC.txt
TXTlog_20260828_MIG-SVC.txt
TXTlog_20260829_MIG-SVC.txt
TXTlog_20260830_MIG-SVC.txt
TXTlog_20260831_MIG-SVC.txt
TXTlog_20260901_MIG-SVC.txt
TXTlog_20260902_MIG-SVC.txt
TXTlog_20260903_MIG-SVC.txt
TXTlog_20260904_MIG-SVC.txt
TXTlog_20260905_MIG-SVC.txt
TXTlog_20260906_MIG-SVC.txt
TXTlog_20260907_MIG-SVC.txt
TXTlog_20260908_MIG-SVC.txt
TXTlog_20260909_MIG-SVC.txt
TXTlog_20260910_MIG-SVC.txt
TXTlog_20260911_MIG-SVC.txt
TXTlog_20260912_MIG-SVC.txt
TXTlog_20260913_MIG-SVC.txt
TXTlog_20260914_MIG-SVC.txt
TXTlog_20260915_MIG-SVC.txt
TXTlog_20260916_MIG-SVC.txt
TXTlog_20260917_MIG-SVC.txt
TXTlog_20260918_MIG-SVC.txt
TXTlog_20260919_MIG-SVC.txt
TXTlog_20260920_MIG-SVC.txt
TXTlog_20260921_MIG-SVC.txt
TXTlog_20260922_MIG-SVC.txt
TXTlog_20260923_MIG-SVC.txt
TXTlog_20260924_MIG-SVC.txt
TXTlog_20260925_MIG-SVC.txt
TXTlog_20260926_MIG-SVC.txt
TXTlog_20260927_MIG-SVC.txt
TXTlog_20260928_MIG-SVC.txt
TXTlog_20260929_MIG-SVC.txt
TXTlog_20260930_MIG-SVC.txt
TXTlog_20261001_MIG-SVC.txt
TXTlog_20261002_MIG-SVC.txt
TXTlog_20261003_MIG-SVC.txt
TXTlog_20261004_MIG-SVC.txt
TXTlog_20261005_MIG-SVC.txt
TXTlog_20261006_MIG-SVC.txt
TXTlog_20261007_MIG-SVC.txt
TXTlog_20261008_MIG-SVC.txt
TXTlog_20261009_MIG-SVC.txt
TXTlog_20261010_MIG-SVC.txt
TXTlog_20261011_MIG-SVC.txt
TXTlog_20261012_MIG-SVC.txt
TXTlog_20261013_MIG-SVC.txt
TXTlog_20261014_MIG-SVC.txt
DLLMigDLL.dll
Structure
P7B[Authenticode]_05df3f99.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1042
EXEMigrationService.exe
Structure
P7B[Authenticode]_6c626bfc.p7b
BINResources
BINRT_ICON
BINID:0001
BINID:1042
BINID:0002
BINID:1042
BINID:0003
BINID:1042
BINID:0004
BINID:1042
BINID:0005
BINID:1042
BINID:0006
BINID:1042
BINID:0007
BINID:1042
BINID:0008
BINID:1042
BINID:0009
IMGID:1042
IMGID:1042-preview.png
BINRT_GROUP_CURSOR4
BINID:0065
BINID:1042
BINRT_VERSION
BINID:0001
BINID:1042
LOGMigrationService.log
DLLmsvcp140.dll
Structure
P7B[Authenticode]_ceba6b55.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLmsvcr100.dll
Structure
P7B[Authenticode]_af6d2f8f.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLSSDInfo.dll
Structure
P7B[Authenticode]_7c18b810.p7b
BINResources
BINRT_CURSOR
BINID:0003
BINID:2052
BINID:0004
BINID:2052
BINID:0005
BINID:2052
BINID:0006
BINID:2052
BINID:0007
BINID:2052
BINID:0008
BINID:2052
BINID:0009
BINID:2052
BINID:000A
BINID:2052
BINID:000B
BINID:2052
BINID:000C
BINID:2052
BINID:000D
BINID:2052
BINID:000E
BINID:2052
BINID:000F
BINID:2052
BINID:0010
BINID:2052
BINRT_DIALOG
BINID:7801
BINID:2052
BINID:780E
BINID:2052
BINRT_STRING
BINID:0F01
BINID:2052
BINID:0F02
BINID:2052
BINID:0F03
BINID:2052
BINID:0F11
BINID:2052
BINID:0F12
BINID:2052
BINID:0F13
BINID:2052
BINID:0F14
BINID:2052
BINID:0F19
BINID:2052
BINID:0F1A
BINID:2052
BINID:0F1B
BINID:2052
BINID:0F1C
BINID:2052
BINID:0F1D
BINID:2052
BINID:0F2F
BINID:2052
BINRT_GROUP_CURSOR2
BINID:7916
BINID:2052
BINID:7917
BINID:2052
BINID:7918
BINID:2052
BINID:7919
BINID:2052
BINID:791A
BINID:2052
BINID:791B
BINID:2052
BINID:791C
BINID:2052
BINID:791D
BINID:2052
BINID:791E
BINID:2052
BINID:791F
BINID:2052
BINID:7920
BINID:2052
BINID:7921
BINID:2052
BINID:7922
BINID:2052
BINID:7923
BINID:2052
BINRT_VERSION
BINID:0001
BINID:2052
DLLssleay32.dll
Structure
P7B[Authenticode]_118387f7.p7b
BINstats
BINDevices
BIN3Dconnexion
MNavigator.m
MTraveler.m
BINEnglish
TXTdictionary.txt
BINFonts
BINType1
PFAc0632bt_.pfa
PFAc0633bt_.pfa
PFAc0648bt_.pfa
PFAc0649bt_.pfa
PFAcour.pfa
PFAcourb.pfa
PFAcourbi.pfa
PFAcouri.pfa
BINfonts.alias
DIRfonts.dir
UPRPSres.upr
PFASwiss721BT-Bold.pfa
PFASwiss721BT-BoldItalic.pfa
PFASwiss721BT-Italic.pfa
PFASwiss721BT-Roman.pfa
PFAUTBI____.pfa
PFAUTB_____.pfa
PFAUTI_____.pfa
PFAUTRG____.pfa
BINLogitech
MDualAction.m
MFreedom.m
MRumblePad.m
BINOther
MAftershock.m
MAirflo.m
MAppleIR.m
MOmni.m
MUSBJoystick.m
MXBox.m
BINSaitek
MP880.m
BINUserGameStatsSchema_3240220.bin
BINUserGameStatsSchema_578080.bin
BINUserGameStatsSchema_622590.bin
BINUserGameStats_1133266792_3240220.bin
BINUserGameStats_1133266792_578080.bin
BINUserGameStats_483107600_578080.bin
DLLucrtbase.dll
Structure
P7B[Authenticode]_a20b3360.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLvcomp140.dll
Structure
P7B[Authenticode]_1bf986db.p7b
BINResources
BINRT_STRING
BINID:003F
BINID:1033
BINID:007E
BINID:1033
BINID:007F
BINID:1033
BINID:00BC
BINID:1033
BINID:00BD
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
DLLvcruntime140.dll
Structure
P7B[Authenticode]_2a069b33.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXEWinClon64i.exe
Structure
P7B[Authenticode]_11c56b0c.p7b
BINResources
BINRT_ICON
BINID:0001
BINID:1042
BINID:0002
BINID:1042
BINID:0003
BINID:1042
BINID:0004
BINID:1042
BINID:0005
BINID:1042
BINID:0006
BINID:1042
BINID:0007
BINID:1042
BINID:0008
BINID:1042
BINRT_MENU
BINID:006D
BINID:1042
BINRT_DIALOG
BINID:0067
BINID:1042
BINRT_STRING
BINID:0007
BINID:1042
BINRT_ACCELERATOR
BINID:006D
BINID:1042
BINRT_GROUP_CURSOR4
BINID:006B
BINID:1042
BINID:006C
BINID:1042
BINRT_MANIFEST
BINID:0001
BINID:1033
EXEWinClon64x.exe
Structure
P7B[Authenticode]_cbbec8a3.p7b
DLLWinVI64.dll
Structure
P7B[Authenticode]_107f77fc.p7b
DLLWinVV32.dll
Structure
P7B[Authenticode]_ffd7d3a3.p7b
DLLWinVX32.dll
Structure
P7B[Authenticode]_80d6f9d0.p7b
DLLWinVX64.dll
Structure
P7B[Authenticode]_fdc28a8b.p7b
BINWinXP.bin
HTMpython37.dll
Structure
BINOverlay_84d60e2c.bin
BINResources
BINRT_CURSOR
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINID:0007
BINID:0
BINID:0008
BINID:0
BINID:0009
BINID:0
BINID:000A
BINID:0
BINID:000B
BINID:0
BINID:000C
BINID:0
BINID:000D
BINID:0
BINID:000E
BINID:0
BINID:000F
BINID:0
BINID:001F
BINID:0
BINID:0020
BINID:0
BINID:0021
BINID:0
BINID:0022
BINID:0
BINID:0023
BINID:0
BINID:0024
BINID:0
BINID:0025
BINID:0
BINID:0026
BINID:0
BINID:0027
BINID:0
BINID:0028
BINID:0
BINID:0029
BINID:0
BINID:002A
BINID:0
BINID:002B
BINID:0
BINID:002C
BINID:0
BINID:002D
BINID:0
BINID:002E
BINID:0
BINID:002F
BINID:0
BINID:0030
BINID:0
BINID:0031
BINID:0
BINID:0032
BINID:0
BINID:0036
BINID:0
BINID:0037
BINID:0
BINID:0038
BINID:0
BINRT_BITMAP
BINID:0000
BINID:4105
BINID:1036
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINID:0007
BINID:0
BINID:0008
BINID:0
BINRT_DIALOG
BINID:0000
BINID:0
BINRT_RCDATA
BINID:0000
BINID:0
IMGID:0-preview.png
EXEID:1033
Structure
P7B[Authenticode]_27b59470.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINID:0
BINRT_MANIFEST
BINID:0002
BINID:1033
P7B[Authenticode]_896dc375.p7b
BINRT_GROUP_CURSOR2
BINID:0000
BINID:0
BINRT_GROUP_CURSOR4
BINID:0000
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:1033
EXESetup.exe
Structure
P7B[Authenticode]_8a74c34a.p7b
BINResources
BINRT_ICON
BINID:0001
IMGID:1033
IMGID:1033-preview.png
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
DLLvcruntime140.dll
Structure
P7B[Authenticode]_71d478a4.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
10 / 10
Path arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
Shape arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
malicious 6 nodes
Path arc:zip>pe:dll>pe:rsrc>pe:dll>bin
Shape arc:zip>pe:dll>pe:rsrc>pe:dll>bin
malicious 5 nodes

2 malicious · 772 files
ZIP9dfc29fcbae3f85a932141966378f274CVE-2019-9674
DLLcnhi8308.dll
HTMpython37.dll
Structure
BINOverlay_84d60e2c.bin
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙