6c9d552d1045f7a18903f571524328af4f7d8f297ce9e9b1e43b2fba8bbf8977[.]exe

resource
unpack001/$PLUGINSDIR/BgImage.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
6c9d552d1045f7a18903f571524328af4f7d8f297ce9e9b1e43b2fba8bbf8977.exe

6c9d552d1045f7a18903f571524328af4f7d8f297ce9e9b1e43b2fba8bbf8977.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 6c9d552d1045f7a18903f571524328af4f7d8f297ce9e9b1e43b2fba8bbf8977
MD5 e284ccddd64249cfb245162695ce745e
SHA1 5cff20e7494330cf92982dbe4d919acccc982b74
SHA512 c95aea98c5080bcc03739460da98ef257d3a6bb3c2dded2967c6eeac635ce06283b126d01dda974bd662fa111ffd066391548aab9c141a072059f91dc603e1aa
SSDEEP 24576:IMwLwUUfyoKLT9aBVob8///jY7aKJ3Q/JJxiRskCocB8He:IMwLwPyoKLTiVA8MyAOB8He
TLSH
T1221512417B5C841FC1B405B694B2E29A6BB4ACF0147C93173E397A2F5C383939DAAF16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

03:be:7b:cc:05:c1:c0:79:f5:23:42:8d:05:30:ef:12:62:60:a6:18:bf:59:2f:a6:a9:84:86:03:62:de:ea:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Overassertively,O=Overassertively,L=Atmore,ST=Alabama,C=US

Chains

Aug 6, 2026

CN=Overassertively,O=Overassertively,L=Atmore,ST=Alabama,C=US

Minor OS version

0

Major OS version

4

Entry point

13455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/BgImage.dll

IMPHASH 32b0f5880a0efd258c6be2f7a14f4a9f
SHA256 73abbc57661987e7a0aa7e43f6d7dcff63a74615d3b731d94891b05e0e19adcb
MD5 e2834a37c23a5c487b6e3a55eb95dd8a
SHA1 2ebc683fe079a8b0081283fd4adfff82f52dfa4d
SHA512 c78edd37a46db20f56bffcc63358bde32b61552bc2e1e0960a41d36a84795e6d7fa4bb523ca1f1995ea62c60c8060cbadd5764d3a133de4ccac7501e68075e68
SSDEEP 96:8enk1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uTG4j7J3kWyy/:tkTJa2roqJyA2EN8diuT3je
TLSH
T1DAF12B337AC26073D3F582F42D92116DDBFA6D156324A59D0B3721E86D60AE3E84CB03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7202

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
TLSH
T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 5e62e8e248e7364886b604bd1fcf4c13
SHA256 933f93a30ce44df96cbc4ac0b56a8b02ee01da27e4ea665d1d846357a8fca8de
MD5 98ff85b635d9114a9f6a0cd7b9b649d0
SHA1 7a51b13aa86a445a2161fa1a567cdaecaa5c97c4
SHA512 562342532c437236d56054278d27195e5f8c7e59911fc006964149fc0420b1f9963d72a71ebf1cd3dfee42d991a4049a382f7e669863504c16f0fe7097a07a0a
TLSH
T1888164BB93E00DF3D0944B7B44A71CE762B5DD301762001F0A478A992590B67ED7E715
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
MD5 48f3e7860e1de2b4e63ec744a5e9582a
SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
TLSH
T19112F992E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39355B66E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Familiegrupperne192.ini

SHA256 94cba73531e23d5610c93c5de6f0b9b1c53b55abf21a1c14c6d7ec41eb8785df
MD5 bf020745b0538562e66625fe256f894f
SHA1 87e4c1d0a4368ad585205c28ca3e42b3d14c42d5
SHA512 7f3f05e9d1f31fa91a90e7fdd82c3844c8be163fc2a318e21e73eae5be2b8f904d71e366029b672e92dd3d8932038f4ae1642bf8ad7ced02993ba94e284164b2
TLSH
T1DCF00704DCC204A2AE120BC2ED9A8A8741004A24B90CA2AC28220A0B499AB90D2FCA1E
MD5 SHA1 SHA512 TLSH

Matico.Mor

SHA256 3ee975b45faacb946ad8c7f8cfc541ced5adeaf15712b7130694906aa445b188
MD5 bea9ad8c5a7490e6c4dc997fdc8d7652
SHA1 fca82f972da0ab1e30bd3faaec31ab8641f04718
SHA512 8efd9391bb1a67fc89688be1d39317de3cb05df16c760799c59c27cc4b4aaef8bb44fe23ec2d4432d1de1794e0c7558deb4cecc82af54492dab3d714d428c396
SSDEEP 384:3/+ORE6S6uUnV1pv13GgIwj8YQHMOAskx669ysdl5nCIegFQg:3/HGUnR1V9QspJx6Rcl5nr0g
TLSH
T1D3928DA3C7398CBEDD08C73CD5AE23E50B21382D770FD9AD617A941581853B263247EA
MD5 SHA1 SHA512 SSDEEP TLSH

Mdrenearv/Udvejningsvgte183.jpg

SHA256 23d31e566523fe45a7e1509241095e08938b56f1ce816f78451c8f00cd5b89ca
MD5 39aea4628605bf5f78978a1dbbe3acfd
SHA1 66947b6c314b782eaccc857eef12b8b23e4abef7
SHA512 b9ed9de5917284e827f6955995816cd7e79c3d22683f43104dbf7e30ea477902220b8d926b5ee4f88e5a6a9234fd4585952ff856176096d0550a89cba8be57e2
TLSH
T18D31E9B5AB5203084B4302FB0761117766CF8CC27A8C7BB179D1D9ACD900CF4644C6DC
MD5 SHA1 SHA512 TLSH

Mdrenearv/assidually.sag

SHA256 02fdf58d52e7700f19d7beec21f75c72eeb48444531ecb7f3b5de40a8755604d
MD5 009c112b4526e85d279e2afb4762a05b
SHA1 31055707761ef16efd723f0225df41f9ec221bfa
SHA512 6efde5fdb6e4f44177523234a6a02895cc8cda21f95b587f4fec8a87813f7ea358c1963eda7d7c6be1fcdf69afad041fa2c630bb22a29d82f88e6614aa12235f
SSDEEP 3072:Y8AY+Jf+G0ZaFaJZYpeR3Fac0r4t4wm3oNPit9ysFEjlRoIOMPaDtGHhwsEzQhmV:1F/KAS7VvWw5Gp8CMpLxx
TLSH
T11E741285AE719D01D643E4B2A3940B718D411469DF56AD707C9C7CC028EFEA63E5BE32
MD5 SHA1 SHA512 SSDEEP TLSH

Mdrenearv/autochemical.ini

SHA256 302bb57e029808e5c370d1fc960a1685d61f25623063996b60f2d8f7dda515ba
MD5 41a1ddeeb54921ccb8ab03743c3dc137
SHA1 b892a0e3032fd352c4a2c80ed5c3dc3e5330e381
SHA512 d46bfb92077fb4f33ab8f6e08b62d109a07bc319784c3d7cc3ef53d4055958893b0925b1dc37b2475301ed2fdef8423e4de48f28837f459d7322854688efaf33
TLSH
T1D4E02804F50445888D721C6864CB5CD30E21E1F21DB4E50DEFDB47CC51020CC51AB410
MD5 SHA1 SHA512 TLSH

Mdrenearv/behftelserne.ini

SHA256 aee873d48a10283aad56379394be41fca050eaf199b6ef2c7e00df4bcff33732
MD5 97a75277e4708546886469361406d8fc
SHA1 867d35a8f4c4d577abaca137bc113198201d26f0
SHA512 780852267138c96b0e39de0e6e00c63dd8d51273e4a69ed2bef99d5cf4bb3aa1881f5e9476c8f03660ef4fd7dca96bc0ca352758673d51100fcaab47baae065e
TLSH
T1F9C08CAF161A00C51A31019B34F815A4E25A31A0C402A4BC785A6B19B5D9C5CC804689
MD5 SHA1 SHA512 TLSH

Paxes.qua

SHA256 61cfc1a93c5026e28b68f29300fd03b3d8cbbad7e31da60ee1b08bfa189bde33
MD5 acd6e059aae0c7fa48482b1da4d086af
SHA1 09b21e57e570c5e200987f513bc421b419028100
SHA512 5fcc23339d4c9363ca02c973c8a1be7f2c4c42634584ebe1224892b36bc30faf9b15dad9d38b3308f22578e0c6ddea52dca419e519ed80efca94427620b2bd5d
SSDEEP 3072:2WVcTOLM6Y1uAGbGti/83jAKd9MN3ywpJLQb3Kigl:tVcQbAbiUMGMNJIo
TLSH
T1A6741280349A94670356D40CADB33F12EE7AD7A78A7E6F9370BED6F245444CADE261C0
MD5 SHA1 SHA512 SSDEEP TLSH

Snusks.Dru

SHA256 9db0f9b9383af10895b145e34dfb65db65f3683b1c19fd0ffad3d596f41bb73b
MD5 5657b2266a2224265b7f3b39f99c08e7
SHA1 16e04f6142aedfe527f0b0087d583b0ca2247f10
SHA512 629228a414fa6a4a8f4aec58cd7f8b9a36f02700f13470b7ad60ed64e3f73e4406d1afd01b394b3344ed761cb4b0786765ab48d14834d6829cca8a19cfbc5237
SSDEEP 6144:wMF+8iv+lhXUvNcCBeQ77pajeQS+mS3YZol6kYeo0ifX0eK6FknKhDs:w+MNcC371tf+mS3AE6kYJ0ifLK66Ks
TLSH
T1C964F1CA3EC669DACD5F3770B9058E8CA861F7304A5BC8F53C779994C8817FAA518342
MD5 SHA1 SHA512 SSDEEP TLSH

Woodward/Eebree/rosentrer.jpg

SHA256 6b78ff24fccfd3600c5436c84a4a9dd7a1f3f1e44e6eb8d0d3708e1a65ae00fe
MD5 45f8ca39c4c48aa15b7bd2f38a21e2dc
SHA1 4b42921b6f591529302544d7181d724d52c19ffc
SHA512 00135a4a4a5edc89798f6b7f29a78779a26b44eac46ab29f1222b32ad5a787d72946d86aff19f3232bda816ba8d9ff72e39aa615aae37f6c1f674d865fbae50a
SSDEEP 768:XtIeKhxYefpKqWPXg32dkrr2Acm0J7GAMf4Ai/Fdg:XtIXhxde432SryAcm0JKffcq
TLSH
T159C2D149252A0E21C87F63A2C5CEC7014D876B10D3D5F63949835866F126DBFF5A9FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Woodward/Eebree/teutons.txt

SHA256 0bf6fcb4ec1646233a73e3a6b2b30ac6ac75eef2e3811cb1b3bd94ecb842f8c3
MD5 65c96b1da5472a22e8cf32d9b9f91f8b
SHA1 cf5e8c8c043abc3ccb2b93abdba4a4271b046b2d
SHA512 8d1c43ad1b43687ede9cfda03917aebf69a0a126c4ccb713e472f597b6c05bd540dd0d2970aa0dea60d9570b2063568f2337cf4d24986ba64fd0298cdd728219
TLSH
T111F0C060F6465E00CD92A4BE9CC30B65409CD75D063206AAB95D834C89529BDFEB72DB
MD5 SHA1 SHA512 TLSH

Woodward/Eebree/troublemakers.txt

SHA256 e4932c2c9b7bb2f6a627368b21ec0571a889f8c307aaa84db50b2366c0ef6010
MD5 a9245936917ce28b3d7b9b3c1e5134b1
SHA1 ecd1114016507113f60212f836d188f2e2a3dcb4
SHA512 a045d0541a6639aa0714d9ced5dfff53a840c363dedd62772fc4109c4f0c38b566de39543758f6f9500bbf1b5e731b6bb7ebc33a6b9b5572e25ee260c3e9573b
TLSH
T125F0C032D93725FA060716285C4A9EAAE210C5E12195551FB305470B74819389B32B3E
MD5 SHA1 SHA512 TLSH

Woodward/bombardere.txt

SHA256 f4e3c8b87ca3411135fe1b146c7a989dad7edc184fcbe2decc06de3af840e1db
MD5 bb274465bd0c56d64a44251b0f6794c9
SHA1 f1c156514f615594f1d6629b0f13350c5bb276d8
SHA512 9367b0efc8925fad2df86e86e4f5cb679004be5c82682c8c2150a8e380624b684b578e0bb4ce622647d8da70b44f4abd13d2196592fe6eecd95bda4c6166430f
TLSH
T19EE02311A0BC36674F21DF699E93C436D2FC1202002F205880D46B1FC8D444FD054658
MD5 SHA1 SHA512 TLSH

Woodward/fasc.cos

SHA256 3479e14a8c722f036607daee6635275f1d2076f76996e91584e5af26f8b3ba98
MD5 c17b7f7bc939de01cd215f05ce7f70c7
SHA1 f9ccba06a2da9d097030c36ad5d6ad28dc664360
SHA512 b69c5d5b9c3f26746022134a8e2ceb411af380a98ba24b42a3398a697b96e51250b160947781747097f91431c65b6f40cbe1af3f65738e784d7590c69540ef5b
SSDEEP 768:OELxrTUqGG7DTt1ncOD6vbWQjf6ZQawE/NSD2gTb6/t4NdvDAfWlQ6MCKODF+3EI:NKqGGbc39bvMiBJR+3fS+3BMmd2o
TLSH
T105A3020BFE9A0213DC7A13E3A725214988782D6F1FD34F643C7ABAD6192412F6D22572
MD5 SHA1 SHA512 SSDEEP TLSH

Woodward/nonequivalence.ini

SHA256 37546d40ba96cedf0f6380b0bfb731fc3eff4d5fc3f92473bdc72c35a3cdf318
MD5 e538624c84173dca2fbd46fedd57a80b
SHA1 98a8a51735697016fdb88844115aea466654f2d8
SHA512 077144f19925ccadb124674db975866603353a0234851624b535c9530df60b571c21c64ae95c386a912aaeeb62f80756ac3b5bc8829e84957b4472ce2f142411
TLSH
T1E0E07D8C40E9DF390B469790FCB8BD0105AB4348E6E4565C78A588C345085DB573EA58
MD5 SHA1 SHA512 TLSH

Woodward/overcapitalise.una

SHA256 2ef2ef73c03f768810c6a6560aadaec7cb9777ed117fa0cb5c8fd69e5cd88c79
MD5 623bb121f626e515dc20c485393ecda5
SHA1 3811418805d475232b7935f9f6a1d0333afae123
SHA512 5bbd533ddd7026910510fbf5635599aa33051eccad9f9c54a819657d5cda227fdd00e082e5b6a5f409b13edca51a65ce07ba1ccd111e4bbde283f208c15565cd
SSDEEP 3072:qZX8v95SGyNgFbUU7lw1I1wrwusMdgjc3Gbf4U8s1wNoHoQQSm:MmXOFulII1wQMdMpjF1t+
TLSH
T1E46413D872C7940B3FCA118903700DDB6A611BFD67F2A6C8B551EC99E3F632679490B1
MD5 SHA1 SHA512 SSDEEP TLSH

Woodward/paedeutics.txt

SHA256 60681048d8b694f43e01fdc3c30fe4e7a4f61d779f8cd15036f445296ab3173a
MD5 93f585230185221df24358ebbf87bbb6
SHA1 45a9e595fce4cea822d1b7fff8c064464433a702
SHA512 f770d4dd29ed90b45881a747d43ba446b1129cad49378b547c0eae1305c4b70a06705e961f2b19a7cc21c9584bdc7806e808664b047c85935636ab94225e9857
TLSH
T118F00554E1453437597315167DD9988290EC5BCF043A0931B1F0110E30E2138D7FDD7C
MD5 SHA1 SHA512 TLSH

gastful/Thermit.jpg

SHA256 e2811decbe21848b6327b3370cbdd01e06af0db06fe210505230dbc4d20f72af
MD5 fc5772b3c4b88eff4bfe77d23b66a6fb
SHA1 370b50dd0540de534c3d2324f579afab4e2d4064
SHA512 2e7f68f73f16223b3809b9c17ef946be82caabfc1749d50bceac333cf282b7c112d463111c0c8d96bc7c50d7057d5205118c2e758a0df25a015f8d16dbf17941
SSDEEP 768:3V9gqPX7M09BWjbvjyL8/AhBsHQo4nLboG4EDLwXBSiTMMJ5in:3TgqP7M0HWj72mA/sHd4LboqDsgiTNG
TLSH
T17FF2F12EE60823477B46E7B94F413F4D9F31128849382E8C84AD25EB7770DB1BA46B47
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer

6c9d552d1045f7a18903f571524328af4f7d8f297ce9e9b1e43b2fba8bbf8977.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UserInfo.dll

advapi32

kernel32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Familiegrupperne192.ini

Matico.Mor

Mdrenearv/Udvejningsvgte183.jpg

Mdrenearv/assidually.sag

Mdrenearv/autochemical.ini

Mdrenearv/behftelserne.ini

Paxes.qua

Snusks.Dru

Woodward/Eebree/rosentrer.jpg

Woodward/Eebree/teutons.txt

Woodward/Eebree/troublemakers.txt

Woodward/bombardere.txt

Woodward/fasc.cos

Woodward/nonequivalence.ini

Woodward/overcapitalise.una

Woodward/paedeutics.txt

gastful/Thermit.jpg