Formnds[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
Formnds.exe

Formnds.exe

IMPHASH c05041e01f84e1ccca9c4451f3b6a383
SHA256 e7b859fec462d1d13f2d288e9a8f53ca6c2231b4c6124d7ac8ee2b6d2e86a048
MD5 0a9ee60f6469aec7fc265e4693b9a666
SHA1 7b70d5e3e9a4852bc7524f4169ac1afa3fbac2f3
SHA512 cc6ae04d4afcc2f6ad617f677462c6d993876f97b73c0195f50130b5d53c4e62febf1ae88013c23d9bdf97a8b67fb3225210769bbe86b919b9f940a68f84cb6c
SSDEEP 6144:tgORajLs0zTaSNYdoM8WfN0/ZDmjbAvO3Nqd/8JJBg2nHQTqoxXG5XtwhUVvlDYI:tg/Lsi4yM8WfN0pAeOfg1jXatwhuYFQP
TLSH
T14B8422917BC8C924E2BB47705E7A4736B9F3C8BA485D475B37A0AF4E3560A41CE1C392
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

35:a0:b1:88:52:4a:79:10:9a:92:7a:bd:1b:24:0b:29:e4:f4:e2:94:7d:cf:02:fd:85:eb:00:0b:c7:a6:eb:bd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Brnemishandlingers,OU=Narwhalian Absolverer\ ,O=Brnemishandlingers,L=Corona,ST=California,C=US

Chains

May 20, 2026

CN=Brnemishandlingers,OU=Narwhalian Absolverer\ ,O=Brnemishandlingers,L=Corona,ST=California,C=US

PE Signature issue

Digest

77:21:2e:d3:a5:8d:d1:5d:39:1d:4b:51:da:1d:cc:46:f9:2e:a9:00

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Brnemishandlingers,OU=Narwhalian Absolverer\ ,O=Brnemishandlingers,L=Corona,ST=California,C=US

Chains

May 20, 2026

CN=Brnemishandlingers,OU=Narwhalian Absolverer\ ,O=Brnemishandlingers,L=Corona,ST=California,C=US

Minor OS version

0

Major OS version

4

Entry point

13784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
TLSH
T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
MD5 48f3e7860e1de2b4e63ec744a5e9582a
SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
TLSH
T19112F992E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39355B66E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Embows.Ned

SHA256 074a5be755435249822a0d7a9483e21f100aac6936842d4c7cf98c6ffb7250fd
MD5 ac4ec967c709794d3c6b6b5a32bff7e9
SHA1 fc62739157ef85b26cb41cabbe1b463bb027897b
SHA512 b115926fb4ccf5d8e2e9ba4136be2fb235c478ed26b7558d93e6b8a970df1c91835cb44320ae9df705c0973b834728c4b006675b64db5310f60819d0ffbcaf71
SSDEEP 6144:2EaWZtSvOnZYPmnv1UxONwrxl0NkwGmfAbB37cKS6pKmz19JUzmDTR6:2EaEQvOnZZ9Mrsz7AbB30EznHTR6
TLSH
T1ED74F1FBE2A50661C59A64EA3F4DB5EA32D03DA24930A3C521B2F44EE17DF3544938DC
MD5 SHA1 SHA512 SSDEEP TLSH

Ozonlamper19.App

SHA256 08af48339420250ac352b1686963ec59572245ad70f398a94e3a1f3cb47b3eb2
MD5 04acf12a861540c16201f121ab19ec5b
SHA1 e1e344c2e4604d3e18db6e8409c2f4fe8316b3b8
SHA512 b403e666d88d15becbb59e5ee0908a03d9ee47d7a99742fc862230ec06564e9542afb0cf1da2ca1c809e5c356403d481d877514c743eebaddaf70b2f261b0668
SSDEEP 768:Qtl+i7dMnaf8oREWHivi67Cu1GbQW0SjrwwoZ+7xdjAM:klb+afjEWu/euwcW0krUGdjAM
TLSH
T178239E81CB56DCFBD903DA38D4AE11D758ACA0164B0FD0AFA171E819C45B3E39724AF9
MD5 SHA1 SHA512 SSDEEP TLSH

macos

comings.sit

SHA256 90c79acd45693c343c88b09069bb525ad0cdf925cae5a41477a5c3948b3cdf1f
MD5 3fe0200f2436888fd7870b9029b0bde8
SHA1 b502751390d74c512b87c4022c7776598502f2eb
SHA512 663ba3f5d37cb2ae847f649e4938d61656f307379c7ffcfb24fd3f5e8b1860c542ff13fcacca42de0cddd437ef3ed774a46caffbcc03b32804d3bdbd220c962a
SSDEEP 48:ehTipCrszIc5Il4u8bqZQEWQgtOj8eRKu3c9jvWL4/i:FvIgDhjPQgURKuMOc/i
TLSH
T181834ADC12D03D3D166E215BE628E4D4A18D3073CA462B7D049833D2C74EBE2475CAA1
MD5 SHA1 SHA512 SSDEEP TLSH

ensilation.sal

SHA256 abbe89887877e0623b16fed09fc9ef79579c1bcbaf89ed4d1d4c328280f324e1
MD5 aa48a94af9ec6004ace3770619373bef
SHA1 116ca04a35508fdebcdb4c9ab1b0f415eefc48bf
SHA512 a9c610360fa90ee1ee34c7e25427fda1ae0db64b039ebf530c1d067607182cbddb9d54785fd5f86a934304e31a35e7441b53b07ef62658ad7f9e49bb41395d8e
SSDEEP 12:uQA8q4iuIp8D2YY2WLdLwLYzNrGR8l28WoEvSSofZLCOmG8of:u9Zj9Hd0LQNNl2N1gdDcof
TLSH
T19852A3425353528E57F4ECF71379B13644ABD104C805184816F17574D890C1FA263767
MD5 SHA1 SHA512 SSDEEP TLSH

Formnds.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Embows.Ned

Ozonlamper19.App

comings.sit

ensilation.sal

Sharing

General

Malware Config

Signatures

File Explorer

Formnds.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Embows.Ned

Ozonlamper19.App

comings.sit

ensilation.sal