b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe

b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe

IMPHASH 9be4f90f50c714bc00cc8beb2e137299
SHA256 b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724
MD5 eefaf56cee585252e5ba15622d118146
SHA1 b4a2ddde5fc7dd8ae5b1bd5a74dbc177dec2b437
SHA512 72f2c82ec4dcf4d92e953397cce7775bad25d3f66bf345b15a6aafda4f4e207af557bdb271850e71e2ad8393603a5e8984b1a068afd3d2580ad7eaae61cb2e26
SSDEEP 12288:170ZdexqurywS6jH5rAo3d3E/YaNC8Nb2Dnqnq5W:17QexbrZxjH5rA+d0/Gy2DnLW
TLSH
T114C4F147AB9217AEF8267CFCCDEBC92363617F565564524B0600DE2E78E7490C42BE32
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ef:6e:37:0b:90:dc:c7:2c:da:09:ad:52:26:0c:a9:75:76:92:f6:e6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Rumina,OU=recontracted Rephosphorises\ ,O=Rumina,C=FR

Chains

Aug 6, 2026

CN=Rumina,OU=recontracted Rephosphorises\ ,O=Rumina,C=FR

Minor OS version

1

Major OS version

5

Entry point

17331

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DeleteFileW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetCurrentProcess GetDiskFreeSpaceExW GetExitCodeProcess GetFileAttributesW GetFileSize GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDirectoryW GetTempFileNameW GetTempPathW GetTickCount GetUserDefaultUILanguage GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExW MoveFileExW MoveFileW MulDiv MultiByteToWideChar ReadFile RemoveDirectoryW SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFileTime Sleep WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpynW lstrlenA lstrlenW

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderW SHCLSIDFromString SHFileOperationW SHGetFileInfoW SHGetPathFromIDListW ShellExecuteExW

user32

AppendMenuW BeginPaint CallWindowProcW CharNextA CharNextW CharPrevW CheckDlgButton CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExW GetAsyncKeyState GetClassInfoW GetClientRect GetDC GetDlgItem GetDlgItemTextW GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongPtrW GetWindowRect InvalidateRect IsDlgButtonChecked IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MessageBoxIndirectW OpenClipboard PeekMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetClassLongPtrW SetClipboardData SetCursor SetDlgItemTextW SetForegroundWindow SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfW wvsprintfW

Name

.text

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

368B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

512B

Virtual Size

632KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/System.dll

IMPHASH cf8eee620b3371ff06e99c34f39ea84c
SHA256 c7dd8cc8323e295b8821b0e320de208a7e20c068a8be8d03857520451ce9ded7
MD5 4abf19a47044ec746aa8c600f0bc149f
SHA1 69da1e4f654b044d7b3c845c12a07c988bf26eb8
SHA512 65727cbe3f03e0dceba06d206054e60adba321d29159b4bfb690c30b2ccd1a0a05a08c2aa50ac270fcd28557f4b482f492c36b0d7b7b980b477cd8971559610e
SSDEEP 384:jZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvH81Q:jr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T1DEB24C07F38398BFC51BC17186EF5772AA32BE211B616F6F1220F5756E24EA0871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12726

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

916B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

179B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Ruinating/Farness.jpg

SHA256 7e659673ceb1c6d687e76c8bedc732979e1c3f2bb16061d3d1b4636bbb6d8ef4
MD5 4e131ab5756721853210aa561351e2cd
SHA1 77320918880e2c3f3a954e9a755b9516104f2a2f
SHA512 d9f065cc4908c63fecdcad8a8ab94fd832febbbdf88d7eb8dab4ff53c2ebf6a5bd10b856075e8d60a67b461827c8c6f9e19fade1a926d0fa44e0e4516002beb6
SSDEEP 768:qtrZC4Xf8Kqzj3QIKzlyLZSi13SQ8DLMz4q6fYrDrluVaIIN+kxRTI:q9/fczjgnqZuQkLMz4q6fYXQ7InT8
TLSH
T1DB13AD03E8458283952443B87E465EB95F8E2F0CAC91B7EE42395EE3BE11BB14C1B45D
MD5 SHA1 SHA512 SSDEEP TLSH

Ruinating/Maucherite

SHA256 657ac3a71dc30b4f140eeb3c9a35fc32067d21cbaa3a65e4b846c33182b690a4
MD5 55f4ee1c81ffac33fc112f1f4eeb12c1
SHA1 bc904283222b1fe721dcc6f3dcf0ac94c310134b
SHA512 c1635a2812dfd41a8ef2a81a3f789307cee7b2912d56907d6fa76699c7ad30f5b8a8371ba47a33cf7279f33364580b6c0dee6bcbf7275369429ef48d8a69fb05
SSDEEP 768:nLoJBq7GBESXsthezo67sjWTPhSEufq+mCC3f9wmHLuRhDF+Fi:nL+Qneznwj3MthHU+Y
TLSH
T1BFE21A6071C98AE0F21A5984BA78FF7211733973AFCA1CD22324F6014EBE5553A8D95F
MD5 SHA1 SHA512 SSDEEP TLSH

Ruinating/Stivnakkers

SHA256 a610e9d5d9c8452b023d1fd242d9007d13b010efda32b1598fcc1cb2ebda11d2
MD5 c0925a6e8e50475a3e91202bdc3582b1
SHA1 5670dcd88da021a8ed2f1e79539f96f9b76f5937
SHA512 58ee3f93998e0c7be062632068d144227fb89d69cab3a3b51f3f233f20ab9d5e263c5459bee614527449706bb6f5626780ca0d2a00a4d4c6415936ea5805e9ae
SSDEEP 12288:MnxmJjQROe/hjG7tCbWkZE6qLy1t3JhVfZiK4oxA:MIHeRWkZhqS3Jz4r
TLSH
T1DF949D288E708ED5CFD9942E4FB75E4FBD4E10EB25AE03E48D6F289641063237D67429
MD5 SHA1 SHA512 SSDEEP TLSH

Ruinating/agerdyrkerens.jpg

SHA256 9cd8a14b0b95cc31267361c134ede67877eae6caeed4009732190cb079a3fbb2
MD5 68eccc8a2479a6fbdb7228f91d09cdb1
SHA1 e9493f13d89a070d8e42c797b6d98d23e4a28905
SHA512 44a554b0e7b8fe5069f7ebf4e9d48dc1734d955292efb2b57ef7d72c2a05c26a25e48f32e2decf05576ace24526c656cd6f6108e2767781238174a73aac130dd
SSDEEP 384:AMSGIcae6cEhEVG51VGtPZeMyaSq/Oj9VdehBaFf2RP7d4s+dT63uWXYde9yEQkA:AMSGLayy0tPZZyag7PFf4Ss+p6+WykA
TLSH
T1A4D2E14FAA694E50FFCF3A69F5A816730DB84302378076394B52DAA99E84D7EF0044D6
MD5 SHA1 SHA512 SSDEEP TLSH

Ruinating/doblon.ini

SHA256 bcc89f29164f97052147ef9e03aa2d8e73fc0ffbbd7d7b690741cf1ed74a921e
MD5 184b8e292b062ad138c82a8a746d73cf
SHA1 dd56884e08e7a25b373c0482ef412fa568156cec
SHA512 0c0d4ae75b42e54b6aa35e0dfbe6e5694b65ecf3a06e43b70adc44d3c9b5cdc4c5a83cdd562f0add6ac1138e4c368e93d7c2b18a572c76b49653f345abb7c106
TLSH
T19BC08C28DE83A928C84963A70924ADE2AB10DF143C64A767E20503EBE178C89D10C76B
MD5 SHA1 SHA512 TLSH

Ruinating/ekspertliniers.jpg

SHA256 d0abc33a905cbcdcf380ed5ed8f4e57a6873dedee8bbda319a56f88f09a8bdca
MD5 f4e510322606035b656a7aca19b06260
SHA1 e3b9ec500304e5b3aa2e00c793ae7522f679d5f3
SHA512 bdf7db928ea3da0f4d95c598c5d98c6e8d52b9c50524ad53e331682d97c35d7400431b910fac799d0acb4a93759aeba00f82f974e2227632fad89cac41fe2627
TLSH
T16121B96E67535617CF02A0F9AA0B2252F0C7D5C27E24233197F4C2A7A960DF4428092C
MD5 SHA1 SHA512 TLSH

Ruinating/fartbegrnsnings.ini

SHA256 80df89a13ee2c56f8123b42ad658ff0814e923ea6ffedd921471b2333f8393f7
MD5 31dcb48cf07df42eb1f5e932723f8624
SHA1 8bf6647cc00d5a1300852b51045bfc6c87830748
SHA512 39738041cd8a13d5a3c6ad1a57f7668ece8ca1b8411b032e5f9062e243b3e681c4d9f07d4653a68e43bbfa76d382102a647bd2e12c9fe5959b185f0687fa62db
TLSH
T11CF002104A282E2438C2427BF8E2F1609BEC044D1E7E71DB76491E9C35A94CDC306F08
MD5 SHA1 SHA512 TLSH

Ruinating/fravalgs.txt

SHA256 734b7f4fd5aca1db6ebecd275f44328fefa06a59a3f351f7d39978b4f06efc37
MD5 1b6e549f7b84294e0d3855c926bddcd7
SHA1 ab0e99d99ccd5ceb25bbced6fcf1aa16e94ce4c5
SHA512 ce02e09d5904e9719b7553fb893c6f3e645c99ac4124c7d71572d9d67e6171008e342dd5e108d626ba80a12c538edf53bbc6b30386c95e9afc2764c90a8c9e46
TLSH
T1CBF00514A97F33284F5697FCE9406535543F4A0E05231859ADD5838D07D104CC17AEAD
MD5 SHA1 SHA512 TLSH

Ruinating/jenbetndelsens.ini

SHA256 bfdec21fe98edc7ab54933c10e44954350aa25915406a7444302293d67cfbe1f
MD5 acb6e2f06372af318c41d57b007caafd
SHA1 12e773dae8cef7ea76316c080b00bf3b33c850de
SHA512 8d3fbb3f3b3b2d102fcf29a5e3836793ff382e89488ae4fd8e251cae8961a9881b9b9195c2f4739b72a81c119799dcedb92ce5f052884e72e214fc300fa85ca0
TLSH
T156E0ABA5E69411997BC32C0CB8B28591796C46A9C2724066AA68378E368423AC17C13D
MD5 SHA1 SHA512 TLSH