WSAPW0650867[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
WSAPW0650867.exe

WSAPW0650867.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 bb5fc7e49f6281fc8df937ee858b84bb283c589d4d5ef34c4591e095204fde1f
MD5 1d8dde3f6b8bea3329369c65ca22c7e2
SHA1 b2d15d5a6d91c71b3331f30f3bbf223061c519e4
SHA512 c6724634b69024ea39580f79991729a77c4cefaabb0a4ee267b60b33893efd9daa7bc53d9c25d120942cac0a06bdb168a73cce7e0f9a3c87fb90a06232921f2a
SSDEEP 24576:QMwSlTnK9XRBM9CEknM7Cc1fmP7khz1zuc7JM:QMwOnmX3MYVM7CgOP2z1X7JM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

PE Signature issue

Digest

27:97:06:8a:62:cd:3b:18:1b:94:51:91:36:17:17:ef:fa:37:5e:83:0c:a8:90:2c:31:7a:c2:87:77:22:b8:f5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Shirks,OU=Peist Shebeener Unsalubriousness\ ,O=Shirks,C=GB

Chains

Nov 4, 2025

Minor OS version

0

Major OS version

4

Entry point

13455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Ambystomidae208.ini

SHA256 4f4f8fa3a0a0d688856dd2bb92f736d289a2b12c78dbbb06bc783760eb4d661a
MD5 54afc6062b03d46a210fe29fd459717f
SHA1 b8f48cc736595faaadac4afee452b4747026a8f8
SHA512 3cb8f1728eacf567d19a12595e6f21e52a4da6a8fb94f26798a04cedec88259049d2485162800b5115a1681e9f67fc8dbb729d15bd0f28176137e2d4ba0de4f1
MD5 SHA1 SHA512

Datasegmenter52.Sko

SHA256 f0caba78f04079b9476d7847653dd3ad3adf59d7ac983ad7c1ea55791ed8ace9
MD5 edffbefcd8c7e59bc03a840c9d64cc2c
SHA1 ad03246daf565c9476146bb6989a24b325445435
SHA512 7107e12bb4610797de312ba7eb04501865c6043052db834311e9c0093932106c0940ad4127e340312c8af6204778857b1da6ae09527c92b1aa1cec2f997b80c3
SSDEEP 6144:fehFTnQJT9YqvQ+dpFqVgnfq92S1n/+MsVouVw:fa6X6Wnfk2s/lsSv
MD5 SHA1 SHA512 SSDEEP

Firkantede.kan

SHA256 07c0662883dc760c61c03e918efd74978b79726cf98446ed894285cc0c29a98f
MD5 92eb57e43f75336bb4d2c883b7814f56
SHA1 af9b09d514d94b619f1b8fd7797f4d4df2753876
SHA512 feda9fcf303528da7082bfce5aa5f6280ebd2abd704dda2ae91137c4d9b6b989e8ecfd9f0a6c9a5275f155bbafe8f76fde5f321b429e4bde5c84810b150fc332
SSDEEP 384:DHiEDPamHZ1UswpL3K0pwiCWcDM5N6riEQJ3aK:DHnimHZmRvCWXhEQp1
MD5 SHA1 SHA512 SSDEEP

Ironien/Kernerelations.gli

SHA256 9bb6d1b4d204f1f61a3cb571195cd30d1ff8dd4c499bbdb1cf997865f8a1d5c7
MD5 ac79f8ce5fcf219de777d627f65c11f8
SHA1 53b33d0c258edacce025f58ceaf6e8dc4affa8cc
SHA512 7df90bbca3d87b9dafddc80bf7cc0a13bbdb5416de731ab3605c35a43cb2b3ca41c31331193bfc75ec8cdd61911e09b10e7928b6bdbd41b0007d89bbb38d67aa
SSDEEP 192:n0ujWQHjzCplIEZ+14JUYC2/LlNL3A7130Ogg6TdGy4humGdVC:0yjzCplIe+qUy/0qPklR
MD5 SHA1 SHA512 SSDEEP

Ironien/Melanippe230.ini

SHA256 5e58bcb4bb8b45fcc624e0d631d29dceffddbd568f36db80a4f6abc02daf3d6d
MD5 78da7b03c714f0ee4bd0dfe3d3252d2d
SHA1 eb6d7a0664b68cc9f5a104b0069397ba02422edf
SHA512 f13dcd9ae22e4eb4207c284a060e97a646eda5f25729fd7e685dfa6cf4de06315784d87fddfcf13a14710c179e50304d111c14cc5f75700baa56b11cabbeb941
MD5 SHA1 SHA512

Ironien/Portugisers/Devalueringstidspunkts/Udplyndrende.udn

SHA256 9494d9ec6f18598f52f23ba0c88c882b1c7732edcafbe7d94554449b1528bae9
MD5 fddae18c325443357d33fabf8daac04c
SHA1 c41d7e21e6f148b22512502b678652b0fff3d2d1
SHA512 9c0ef896121893e9dd2e581326fe93a4de838ab7fa231ef4d50f33ddbdd559c2c22466e4032d864d9f642a26d0d5627101f24620a2d5f5804cd9630d08461459
SSDEEP 384:FehUh00A3A00AxrOFX5QOMmCba7pG177SVJoRzCxF1uy2:FeN3PPFO5KOMVbaI17uMQcN
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/Ventriloquously.non

SHA256 71f874163287b5208774d019cec25b3ae1a840f1e598156ba10711130099fe53
MD5 2c7f6f64f30b53a02aa23898d6ec843b
SHA1 4d78fa18cee9f49c650327ae6641f1363791fe61
SHA512 6d65c14a00d95c4c72a2f7e38b8bd6832df5e79927d846931caeaf69b105237c2001d2e9c6ae8813db52eaf4f4bfcb85066373b4b70ebfdc9584a1b1dd1df5d0
SSDEEP 192:W8C0RD4Niw9/XE65sNEWfZ0UCxqf1xHAJS9Lrtue4Iy:dWNiQ/zsWIKJxqP7l6
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/Viljestyrkers46.ges

SHA256 1f9d4889c22631c52daa17a13b496f14a4767ef4ee77cae4fda47d08405c3a91
MD5 84fe7369791c5e5165bc9a8d94440e74
SHA1 6b7275d5d425de504fbcff3b986c4242e7ac42dd
SHA512 1fd0b619365ef11057957b6767ee6c8256d5537101cdb74f03f3f78c38b3337bbb3545505c23eabdf3b2a024024f7ec93535c771ddc6384bdcf5d52c6068e5b0
SSDEEP 96:HDatu2zSSPWG66q3f6utV6cmDplzt4kb3/ELSbsF9V9RWgIkz/g6JwH+N2I0Gmza:HGoGCVsDnzGiah3JjNz8WfWQ
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/Wela.kns

SHA256 58bb223b1996feee8971d1f565dbf61a3b26d89280d38bd4745810f2b53e1e81
MD5 4f8d10b484b8b414394ad3390780d138
SHA1 c39dc26f7938080a87b9a5d5e276ec2301459407
SHA512 e2da5e9a0357cbd969ee0d445de4b226f8367c4c6707fc9e14c3f13d80d58390cf4427563a9d4e7617dfa051fe1e3a0a5fef31b474e1203b4c3d96cb0d7b6429
SSDEEP 768:4KeOJtOwe22zdBmhOtC1jLeih4d0/3GjK4Kguos:PJ
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/achrodextrinase.gst

SHA256 08c41c1ef5a359bbade286a4e8490cf3401e5455b1d1e47efb249ecea7abad41
MD5 93daccc58cc80f5081c401c29688a1a6
SHA1 d1be3bd966e4f6fe14dad33a6d8287caeeb11bb5
SHA512 372de5d1f406fa1c8e082a1efe47321e27d67b2b6616e25813dc0ac4e8edc3ffbc4f6ceb18e826cd0ea67f7b224b29e3a069889b7db543226efb8171661b46d0
SSDEEP 192:rBZ0sI0ogLrJa58BQlbYjuHwtrx2aci2LTkKFFNVMHAdUOI3AuV:tZSi6E5+FuHaf+
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/actifier.phl

SHA256 d44513e76c42b5adb95b661823bb8375cf91c292d3da2e6147ba8c9a5973b043
MD5 9be9ad638a73c7f639ca408f31b3cb4f
SHA1 eb152c9f3da1a3101afaf33a83791e8ad4507ace
SHA512 2bbde930ae081a922c823643318a950f64ff296e628b1b0087982a8d64bc59aa33172c4a54a5f5fca12e03ec9e58dd35fd649e9a5ea518542b3456e02bd52f88
SSDEEP 384:Wydl/ehJ0mhD3B3DAiWLSMX6Qy02NDIgsw06XU/5RtpMfe5:DMXfhtzOLdXX/w/U70fe5
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/antikominternpagtens.lab

SHA256 8539f07ee2c2cb4fd7d1ded91229d060225be26c5e75c3774cb10eaac29c136c
MD5 3ddaaf0cb65e34dc4ef3dbaf18063211
SHA1 3856f6735d8d64cb9b9d7103b71809d4ed90ef67
SHA512 253c90ab7d9e2e4d7caf4688e03943cebd9cb4d79acdccbd8181f38f6cc90c300510527a6bbe9148e1c05ee7943308362a19c9ee8d41ce3ed154990858800f62
SSDEEP 768:QObaqOe2dlpf/r02uiwdvnjhhjnoDe6FsNs/hWHGwP0l+xUrjg+MPw8B3:QOPh2d7HrEdvUPFsNwhiGZl+GPb8B3
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/bladmaves.for

SHA256 5907a43645bd1c12f5077166420f447b1c2b9855b8ad090f823883bf6c041b67
MD5 f2c211eed346fa3794e4d19e17db4972
SHA1 4d64464e952ed1b197ba8b7816d83ea978cd816c
SHA512 33d8b75cc3442adca353669db00459b5e4bb079f9777bea9813f6ad920decb66cd56090ba2765788f8129773eada3e0c82d7529df644ddb37e09c49cce757292
SSDEEP 384:qQhQuME8FU5sD0Gc7W90vH0RaHt1s4dImtxwzVEqiKfsGFuccbQL9KBUZFFUBw54:IfE5sDDysYXxgrUc7L9bvOS4
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/daggerman.jpg

SHA256 46d37954d8e2ccb785f4a3bfe1176d90e8f49acda6bdb37f643e3bf04e2776bf
MD5 e677b4d508291b54c1f7a96d6c3e9660
SHA1 6fdcc975e26fa07e2ba628ff7507b7a92d862480
SHA512 06e57b7c5637793b26f3c6f3088272eb8797c2f9b30be778a2ab25bb0389a4eed19f124428d703ed0a8a32eae013fc7659944ecf8114b7b676e4c35faa05c144
SSDEEP 96:RheE5vVsTBFNn/u60BbMgYC47SeuBiifAjAgZN6Y4kT:Le5n/ujbMCkggi+AItLT
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/farmoder.ini

SHA256 5a991d328875a91a5d706cdd5b4239e96228616f3c9e7b4138e3b54cc657de64
MD5 eceae36f7d1904a3de5d9c57e5b61b34
SHA1 8ac910a6d27d124acdf620087c01b7643141932a
SHA512 52c28b154a5b044d9396754f84432ee842849d1cf9cd92003c93ac82a40dc1b6921ef9c406592ae15c1b97e4835df6615b62399d19b9d6a244c042a746e98cf2
MD5 SHA1 SHA512

Ironien/Portugisers/Devalueringstidspunkts/forvrngende.jpg

SHA256 94cbac500a9a10ae7ecd567e0432261a0a09af11b6839bf711e9d299225c0c5c
MD5 52d8bd63771e77309fdb5f73a6908570
SHA1 930a2d7f0889d7b84d23210c47a690eba79b460c
SHA512 8e1548d529d60e35eb8b19ffd592f66d6879907d953d7c16dcdd06d1c09adfc31d0e711fe3a9db77c5c85ae5872a6b9662c52f28c0c722726e1558fd73585382
SSDEEP 192:LhBKd3ZEMLiYwrDU0Nae1iXFANHsj9Mf72ifGA/wZ:l4zis0NaeUXFApse72Ic
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/haandboldens.sal

SHA256 16014906c519fbe9192f837f562306ced8a2af3dc88ed0c19a4b5e9b5849b4fa
MD5 b6adecab182cc67852195f726c035ebc
SHA1 f349686c1ed9f82e66897a91626077b9bc5fa474
SHA512 10df1231a0c4f11074360b003032e2a80097c54bcaf065d0620575e638f6dd3c90ba50959f5e164b0f1453aef4c46c302c937f9824392e4755612d1a1f770f35
SSDEEP 768:S5ouQyiNOnlaNYfI38wkAhXDGFtf6ADehOTK0VT:t3W
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/knyes.udh

SHA256 5d19410d996a7ca18ab4011b0a9787b30a31c2beda897c1758175b2c43df8cac
MD5 89aaef4c796aa5cd2c9dc9347863e228
SHA1 80352c90f06464edf7c6f7e5932f9b4f6af27d73
SHA512 ee36ab8d5e74b66567575eee5c49aa438b75d76cea47af4bc429997458b32cd35ec05cde8867e0f501adb119210e99e6145e8d2fcb26594c56cc2e369d8a3ec0
SSDEEP 192:+e5txMNfPeVORbS7i7oR7V0eIP9svspb6JikG/vwmCSuB:+e5txWeV8SOY0xAO6G8B
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/kommpressorernes.uni

SHA256 bbb2954b796ddd89d14b66137a133fc03181d79c84fb4cb1ec1603d7a700dccc
MD5 a9a7313b878741457b1559f27480df81
SHA1 793eb467fc0a084c42be0c1287e5440552a7d4e1
SHA512 bf20e7f3381eb180e3b700b41bc501158dfe7405c95594e1ff4787eda29419508cdfa51861ffa8a9fb11070fa6328061d1a110f55c369291ba23723b247f2290
SSDEEP 96:/PPVhfcxZJj2iQDY+NVpBlSmRUUpz3dvQLLEIInVO4/46Bk:/PPXfcxZJqiQDFtvS5UGLEIIVO4/46Bk
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/millwrights.pri

SHA256 c3a71fbba09d8b50b1a7dc97f8f2b212b6d8c989269f8ef24bd6f6b8962606a6
MD5 8d1cde9edc4839e7387d34e403b77a5b
SHA1 f9f6190ed1111b414819587d11f0807497c88bbf
SHA512 7bedc5c532ff3b0c6d146acf27c553b7a959c39c494bac03c3f48e63ff0fab675ca20d4ca30b4a630c279abcadc112492987ecf9810c7d0a9a0e48bb63731b76
SSDEEP 6144:7UlfPpYmtx5d97drOCxTl4/bXgR4rRn/HAA:J
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/mlede.lej

SHA256 938a68ce239e4e917952ecfedbd1e94e92a3efa3dc4c546c0a76b4d57cc32110
MD5 7d7abe4ffb9f9ce6b9dcc62914ad29fc
SHA1 e618d28688bb3527c99f48f93e34791a598c2791
SHA512 c97291a4b8f125b443b9cd53c98e2a7f0143169d54708b84d131123d1105eb5b298b1015cebde54e91f87316f1e562631f8f9a3ff5156cf023a357319bf8738c
SSDEEP 192:AV/2TaOC0hha1JaA+llRYs3m4t21SktLVNk0iP3dysxy/Gdb48/:yy4Uha1JaYumOGGHtysaGdN
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/pantelaaner.txt

SHA256 3c60955c74d2e582bc67b5889527aba1df318cc13e0a38bddeeb2095f753c155
MD5 fd2b65af31df4299929b3a23b50fba8a
SHA1 44c9acff073f4234033afd1e41b9dd5229bef659
SHA512 6ba86ecfaaedad2e6c17afc4fc88cb923fd0cf7b2dbc6f27e016d3059c26283ee29e3fb8fcbf02678fbc6d636ee7a1c443fe727fef3fbd1ecf7f051a26baa613
MD5 SHA1 SHA512

Ironien/Portugisers/Devalueringstidspunkts/pararosaniline.haw

SHA256 c250c9d6f0397b4f63b2d138a49e33139a1ca05b81ec68dc0db6d4e1ef646cc1
MD5 4afe55c6df4f15b8ef9af72d2a8fbba3
SHA1 60aa8708e7669ac2eafc7977561896b17e4c3385
SHA512 f71d8f0979a1284a02e527ac32020f4f68073ceb3e56f5a74f9d7735cc48391d61c4608dceb1780fd9f488199932003a654aafcc711182708b0d6f58348af6d7
SSDEEP 384:0dNehq9mqzb7lgHUqntQGxaQ8GpQfcpPl6pBK8Lm7PnC3:0dKq9m6PlgHUqnnxF8060PsBK7Pe
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/precisionism.for

SHA256 c90cc70c03192a12ad367061ac74b6893de35bad05aa00e64ed3c04e90909d53
MD5 c57e80de6db425b3cad3cea0d5f11b8d
SHA1 10b081e101b259166321f43ed1d61652de46823e
SHA512 e9fc1f19ef8c9cb054a5653c200b68cc3c11c50ac29be88c330a501db6ba5a2d29dc2e5fd4022872d2eab4cc0cb74c84930a1cd5cd7d90b4eddaa14134b9e518
SSDEEP 96:wd0op2SsGkff4TPIHw9a8GHjGBDcPZsJMP6/Fz8agXHf+nhnrujW023S9:wdVFM+PCw966BDcPZsLyRXbS023e
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/pyriform.lok

SHA256 c54c91e82d8f7cb119db3b062b8d91d5db212ce4cf7b5acf688ea5bf0128aef8
MD5 3d04a00b5799aa9faf0aa115aee8700f
SHA1 46423119f8e68febf05dc6f98dce14a49e0763de
SHA512 34abd6020221f6728c2d5ae0c0bb76ac9ed202fcc6e6cf13c1c48c1f12e5b50cca23c3ef5f5b5b2375c91972965ce58cdf464c67843ac4a71a661072daf3e667
SSDEEP 1536:LFdBoqEAg0fX7Cvcse7zpnTrI7SvN5kdWtOdF609IV17XFukAl20yx:LniqEAlfllNTrIWSdWwF609IgQ0o
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/slruglers.kaf

SHA256 2328f694a02c19939378ca1daa5498e3bd552c4fe003ffde39e9639cf9b3b72b
MD5 e90c0093d3dbad42025c6f0384653b05
SHA1 760ddaea66fc14d3d86991edbafac5a630058bfa
SHA512 e5842288b6e42169d5432c0e913f83ec9cf22a92f919f8bd73f3482f730b33779615b0c3f949b00911fe13e5b3b403a65384d8d54da95bf3c8460d3d4dcb089a
SSDEEP 192:9VcI8A5WQPjkMI12jOKByK32XwVhQ+33qRPm+j1EFvYNus7oiC7KuHxfFZM3UDl2:9mPqYRQ5Tn6t4sORG8E/GVf8z
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/smldere.sli

SHA256 a1f056b34e73d7a1763e841387de1a2e02a34c406e161f0c1b2f6265d433a2e8
MD5 a4050ab223666cd9f38b78d220096e3a
SHA1 2c5ff9b91540ec4c4f9d642ca2b2ec178881a1dd
SHA512 cfa875a7dac1cbae756514180a75237abb8bb174a252730b7335d01d83d913e621a087114aae72cd46c724319b02723706d018c7cc9ca9a5021963f2c8df9ba1
SSDEEP 96:qnVJnHuYIuuUcXB6jLugL6wscTBlWZ1QSOS:2VhrIuuUcXiugTTbVS
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/traerester.gla

SHA256 9263851ff03b00a9037a22e0c7f1a91727a71a7734ff42ad15ad294bc4181d85
MD5 1802d82e5343f7e4a2dc9c8be5a54a05
SHA1 e64e1ba638ce9be321d078c8d37a766d57286e3c
SHA512 cf2c2bbdff3462d9e9a18eec6c9ec6432c373cc57b6bdd3368420a6c61a31f6062322abb2fd43c27a0c6edf3f7f9824187346b444ac546524b0a781e6075ae5c
SSDEEP 192:ogMFIKaSAppBtWuKzzhO/wpf3+rZf9FsjXwoP0D/MyPA3s0EEFR:ov9CWuKv+asfUjHIkyP6sXS
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/unwarrantableness.ant

SHA256 851ea6664bc22d672ac213f05a162039ed001a444d9a9bc22b7acc9c80481133
MD5 4d58d64fdeacb7490bdfd98c70fe91e7
SHA1 c8852e9bd193336cf6553c1f558f47908c8ba29e
SHA512 3a50009f363f861c5b65dbdbcef21686ac2c2a10321eaf5bb60c10cd23eed6efd9cd8137bb9f645bf48feb585ce1256c236ef12b34040876c1e49be6a0650c53
SSDEEP 96:1KOcPbiscf+letpqIgDLfvNgdX4hNAqjmeas0+QSAoqBdJD:KyVmFtKfDJD
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Devalueringstidspunkts/usurping.sub

SHA256 36b794ddae613e4dbe8197bdd307eace37512850f7f012a95bffdd172dbff259
MD5 220a2198805f585b9f7b1330dfd904b3
SHA1 663fe5e41d37d6f88dcbd26575faafdb152b352e
SHA512 c7d73750a0f90e8b7df384c7ed77210e09f1848d1d1f94967edb79afab7d8aafa388c7eb80ef197f1087587b45914fc72175f3916ae86094e8bce3e5aa519199
MD5 SHA1 SHA512

Ironien/Portugisers/Devalueringstidspunkts/viderebringelsers.yan

SHA256 dc674b8848043a774892e0ab4b5b7bbe81265c2d117c89f451563abebc7f98fd
MD5 5c3872f737bcf3f038ab66d6af6f7bd5
SHA1 a0a320f910d94206e80cde7313e5fdccc351dcae
SHA512 f22c45920278bad57520c299a3939b77deca223a78445cf5280d9b665a1284bc1ad295330de94104e43b794bc902e3fc4255383d4e9aea7e4902bd26bebe3b94
SSDEEP 768:QrYJQqRc9QIh54WW77e8CS+fVMTcJU0RCTh:QrYJQqRc9QIh54WW77e8CS+fVMTcJYTh
MD5 SHA1 SHA512 SSDEEP

Ironien/Portugisers/Subassociation95.moo

SHA256 3a8417400b24fa1e72fa25dba4b44841f582e41ab197eb16f46ce157d2dc73f0
MD5 50ef43ebc2e508dd6a6fc09749540f3e
SHA1 00d8ead06fb0f0a25d2b9c3cc9afd39df7bc6244
SHA512 e00c3550b616cc6f1ff60c65dcf636cd03466d894aaa084fe4d7c242214e89b6c533ad172f888e9d03696390de90c2d8eb7d12b0f9035ec8089b2402d0357c97
SSDEEP 192:YT7IQ5kCZYzL74AN5xXIHlQGUsFDaDyOEPzTOJY5tJfwavDvi4yC2qjsvF3LrV:YnIz8eXIHlQyamnP/53s5LrV
MD5 SHA1 SHA512 SSDEEP

Ironien/Rejicere227.jpg

SHA256 5ef88666380d4a8f1cda7865925f11e3a7801f9af682f4f09acce6009c7a852d
MD5 e064fc8a1763291ad3dd3c8ba4a85477
SHA1 4ba8e2f5d096df0843990b5a10fdbc5bed86c8db
SHA512 d813a9cd6cc0f76f56ffd86992a2c4cdddacc714f91e397232e6e488518b206faa4ffb482e8ba4fe35019460dbb71dbf896b59a2d935ae6132fc3ad185c19ae0
MD5 SHA1 SHA512

Ironien/Retsiders162.jpg

SHA256 6c32c28e7933bc8cec5ed0948635a5fef222d5ab542776d6eab98ee9df53d846
MD5 280d9a7c9b8dc83d626dd266f222313d
SHA1 c60fb841ecce8c1180e567ba89e09e5e4c200483
SHA512 c65438a92ed10e765b87c244ba654c640edfcf5a14775dc6c1e2e8482997e74cddab60e64360f9ccb590637d48a07c50526b2cb7c81009e4125229439fcae701
SSDEEP 1536:XNamogMJYZWIYGstSN4bKudQNIvebs3ISfEBzI:lfwYs64LeIYs3INI
MD5 SHA1 SHA512 SSDEEP

Ironien/Stormestrene35.vin

SHA256 27c950fb6e1fc57083ff13a548797ce300f689c4184d6015ecc377f974f857df
MD5 cd2d71700128aec7488eefc05e5caf24
SHA1 769018b22dd62510476aeafcdebaa7532eab914f
SHA512 bc90e6c75e84205800f727a503e9a1d3fb399bfed0b6856c5a91af48a7f6c7bc1fc00156caea1a5ebec6e2dd72a07f6b64450cf67b2da227de608fddb6b24fd5
SSDEEP 384:pSl9bIWStdHlU9USKoPKHsNOy8ft26B/d:0lFIWStdUUSfP8AOy4tj
MD5 SHA1 SHA512 SSDEEP

Michoacan/Hvirvelsjlers.ind

SHA256 9d593560de9853c03c8c0f7a2357486d4a5278de532b7d25685d5e6819afe7cb
MD5 49362adeb0c27884566b0e3d4bdc2c6f
SHA1 b279133263aae01dfb1746850e46097e7287ff02
SHA512 db6ffce0affea817c4478512e89bbeced8e93009c409d47f4b8024fba46c71259af83aa72b1dbd38ab4cdbadfdaa9be71a81e5f32f87860a37fe0d1b7afbe1a4
SSDEEP 768:nKIiDTZyD3oYmEP81OP0oEq2LU8v0I0TGgepw+3myilUohaufkG0ddg/1tCN/gy2:B
MD5 SHA1 SHA512 SSDEEP

Slvsmeds.Fds

SHA256 4283657770ad9c2a530a2542731c8e4aa043e5af27cb8ae1ef10e04f5ddb5e1f
MD5 b01507baab9030d8ec35ee877de0dcbe
SHA1 cb673630c91e9d48d2fa3d28e8f7792548c80048
SHA512 e41cb0627c439da2c825ff48343030772db6a44663313200f2d5e72faf657c7191f82b7caa9ab9a4e8c51f34cf0b3f34dcdf90b10f1cdd1eef22b770509ea681
SSDEEP 1536:c4zLSIAclOvFTd+1MHUyArmklZmDYy0sJE1jyYaXs/qV4pxgrWePzM6:c4zPlOvFw1XpzlYgruYas/qV4rgii
MD5 SHA1 SHA512 SSDEEP

vkkelsesprdikanter.ech

SHA256 850103856aa8bff7097a9ceb4b0125dabb00d381f3b10ed3252c369d0259a790
MD5 3d0c2f9139ffc81ba6013ce061733880
SHA1 413f0e7feebfb41462d09c1d15025de2050c22e4
SHA512 a6adff707bf0804d8d63477c8a94f39fe9f8222c58e301c339792eb96c4f9bf5aec561d51846ca9f7ff37f1ab2926bec0538f832f1e07b5deca00055464a8693
SSDEEP 384:XQPhqrQIkNJG7dzh6EFlizkHfD2XZXZJT042PG0R5riIpI8H7fwStn7DD1oJk1T6:+vEeAfwpJo/3GItNe+1KB
MD5 SHA1 SHA512 SSDEEP

yeldrine.obs

SHA256 bd150544f8ff560eb551eb6ed14cc2611cae0bfd8ef13fa1e88b3a5e041f107b
MD5 e8e8913035182684d6712b1ff0d4fdca
SHA1 347e29ca3e48cac4a9d3fd63b5116e09217cbf66
SHA512 2e2128ee6bc32adc3c0987c95cfb2686ce9dff4d251a257cd446c88e5e98f23ae7b8199dfe2a470e3132e7f61546a730c33236749cd6015cc3eb3fab56570d20
SSDEEP 192:tdiN34QMClQlrZ6bjHR5uHHdazn3SVhkHqUkfo60ufJyihB6YmRZLZMlOsvGXLEv:zS5e6yWJCY8GbduQHQ
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

WSAPW0650867.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ambystomidae208.ini

Datasegmenter52.Sko

Firkantede.kan

Ironien/Kernerelations.gli

Ironien/Melanippe230.ini

Ironien/Portugisers/Devalueringstidspunkts/Udplyndrende.udn

Ironien/Portugisers/Devalueringstidspunkts/Ventriloquously.non

Ironien/Portugisers/Devalueringstidspunkts/Viljestyrkers46.ges

Ironien/Portugisers/Devalueringstidspunkts/Wela.kns

Ironien/Portugisers/Devalueringstidspunkts/achrodextrinase.gst

Ironien/Portugisers/Devalueringstidspunkts/actifier.phl

Ironien/Portugisers/Devalueringstidspunkts/antikominternpagtens.lab

Ironien/Portugisers/Devalueringstidspunkts/bladmaves.for

Ironien/Portugisers/Devalueringstidspunkts/daggerman.jpg

Ironien/Portugisers/Devalueringstidspunkts/farmoder.ini

Ironien/Portugisers/Devalueringstidspunkts/forvrngende.jpg

Ironien/Portugisers/Devalueringstidspunkts/haandboldens.sal

Ironien/Portugisers/Devalueringstidspunkts/knyes.udh

Ironien/Portugisers/Devalueringstidspunkts/kommpressorernes.uni

Ironien/Portugisers/Devalueringstidspunkts/millwrights.pri

Ironien/Portugisers/Devalueringstidspunkts/mlede.lej

Ironien/Portugisers/Devalueringstidspunkts/pantelaaner.txt

Ironien/Portugisers/Devalueringstidspunkts/pararosaniline.haw

Ironien/Portugisers/Devalueringstidspunkts/precisionism.for

Ironien/Portugisers/Devalueringstidspunkts/pyriform.lok

Ironien/Portugisers/Devalueringstidspunkts/slruglers.kaf

Ironien/Portugisers/Devalueringstidspunkts/smldere.sli

Ironien/Portugisers/Devalueringstidspunkts/traerester.gla

Ironien/Portugisers/Devalueringstidspunkts/unwarrantableness.ant

Ironien/Portugisers/Devalueringstidspunkts/usurping.sub

Ironien/Portugisers/Devalueringstidspunkts/viderebringelsers.yan

Ironien/Portugisers/Subassociation95.moo

Ironien/Rejicere227.jpg

Ironien/Retsiders162.jpg

Ironien/Stormestrene35.vin

Michoacan/Hvirvelsjlers.ind

Slvsmeds.Fds

vkkelsesprdikanter.ech

yeldrine.obs