d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe

d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe

IMPHASH 9be4f90f50c714bc00cc8beb2e137299
SHA256 d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07
MD5 1ec3ccb73ef98e16431612a7ad9f8900
SHA1 54d49c75f34cc832f08a553fd4c9663d61ee7531
SHA512 42747b0a30199e49737d5c9532667e3e0e7fd7513f24e61b12636ed3794ec9a4c80d69eb436d1bf972a34838dfe8ed8dba8d921ce70cce87a8adf4828e0de632
SSDEEP 12288:Jtg++Nmxxy6BhAEPrwaWkCQjSX/jr/c13aQRHWxOzJ8T6Ll6Cvy4fKSCci:JMNmnBhtdTjSXLr/cgbxOt46ZBySDi
TLSH
T182E41201EB86D8D8C53285B5E6F2E2F255307DECDA35661B16057F6EBC31BE0CA7A201
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

73:fd:cb:a6:27:41:54:ed:a7:5c:fe:1a:9b:e3:96:c6:bb:6a:30:bf

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=venerably,OU=Digtnings Queerer\ ,O=venerably,C=DE

Chains

Aug 6, 2026

CN=venerably,OU=Digtnings Queerer\ ,O=venerably,C=DE

Minor OS version

1

Major OS version

5

Entry point

17760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DeleteFileW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetCurrentProcess GetDiskFreeSpaceExW GetExitCodeProcess GetFileAttributesW GetFileSize GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDirectoryW GetTempFileNameW GetTempPathW GetTickCount GetUserDefaultUILanguage GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExW MoveFileExW MoveFileW MulDiv MultiByteToWideChar ReadFile RemoveDirectoryW SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFileTime Sleep WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpynW lstrlenA lstrlenW

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderW SHCLSIDFromString SHFileOperationW SHGetFileInfoW SHGetPathFromIDListW ShellExecuteExW

user32

AppendMenuW BeginPaint CallWindowProcW CharNextA CharNextW CharPrevW CheckDlgButton CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExW GetAsyncKeyState GetClassInfoW GetClientRect GetDC GetDlgItem GetDlgItemTextW GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongPtrW GetWindowRect InvalidateRect IsDlgButtonChecked IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MessageBoxIndirectW OpenClipboard PeekMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetClassLongPtrW SetClipboardData SetCursor SetDlgItemTextW SetForegroundWindow SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfW wvsprintfW

Name

.text

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

352B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

512B

Virtual Size

712KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/System.dll

IMPHASH cf8eee620b3371ff06e99c34f39ea84c
SHA256 c7dd8cc8323e295b8821b0e320de208a7e20c068a8be8d03857520451ce9ded7
MD5 4abf19a47044ec746aa8c600f0bc149f
SHA1 69da1e4f654b044d7b3c845c12a07c988bf26eb8
SHA512 65727cbe3f03e0dceba06d206054e60adba321d29159b4bfb690c30b2ccd1a0a05a08c2aa50ac270fcd28557f4b482f492c36b0d7b7b980b477cd8971559610e
SSDEEP 384:jZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvH81Q:jr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T1DEB24C07F38398BFC51BC17186EF5772AA32BE211B616F6F1220F5756E24EA0871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12726

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

916B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

179B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsDialogs.dll

IMPHASH 2a21171b63c0ee0261cd54df366503d2
SHA256 a0a6431feb4e09018d99acdc02f2139fbacd68420b0f84d4b22a9e091aaac707
MD5 48452d7f73a0e73b62a16b4c88068a60
SHA1 ef5a3edd25cf3cf664e93c38fbe9034ce652d117
SHA512 83dae4699678c2eb245bb3a5758b9decdae308042bf50a36266222a9c20f197503baad9f58f2522c6bfe32ad62b8af6ab6b8f99f2e51b72383f6c50d4d699274
SSDEEP 192:PZWhF6MuqMgfdPvg/YWkNLiY8vSKXS6Hn5gIIblaks8NHAHPEdeqe4KFz0:hWh4MFv1w/YWCLXASKi6nAlHJAl4KW
TLSH
T13852191B7B42962ACD0AE374D5EF573322F3F4551138370E0669DB49BFE1660DA39288
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8501

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

444B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

363B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Aluminiumfolien/Elregninger

SHA256 3825192ec6f5ffb09797cc1d4c04ddd304ae0fc1e8f94a5aea192be6b63dc19d
MD5 ad20b34cf0dc8c14c6018dff2c1ac200
SHA1 305583ae5bc9b7c5c712b74802108c04de7f06a5
SHA512 c4d7df7abdf5b3fb0615154f6acccb49abd75080a624a0231e35750865641ff07975446398f0eb9251d6489673bd107bf1952597073e8b1c18f9cff4b738035c
SSDEEP 768:uZLIPj6rYUE8U8wYHR7uovgJzMdf7fE767tzu4:BjfIjdyGtz1
TLSH
T16FF24E6035CD8AE0F61A5984EA78FFB111733973AFCA1C922224F5004EBE6553A8D95F
MD5 SHA1 SHA512 SSDEEP TLSH

Aluminiumfolien/Pillories204.rem

SHA256 8b207be3ea1d6cfc4c40b8c67b6d804c7883207c39de5ecc3f8880fef39b7806
MD5 f38e955dba4306340d489532984afebd
SHA1 0f3e2d1f98079a4a117dabb831c2b978ecaf2d21
SHA512 26dc3a6e1316aadffabef6c0d70d92ac14c6d0d2aa152dfd66977cf7c3b9ecec28f9026c1b93f3cdfce986b11a789e0a9f58815c4f34f80d521f14bf11405e7d
SSDEEP 1536:LE6WSmomLZhZ8X3vNlVXtfdczzR39kKTzKV9a1+kieeIHtBpNEhDl8FRX75:hG
TLSH
T18955F1E5713B6D9B0797282D33C80F36A459CE7775CB23E6443867755098F8846C26D3
MD5 SHA1 SHA512 SSDEEP TLSH

Aluminiumfolien/Quixotically.jpg

SHA256 26663a15c99b90019a565653a523217e59a29c2a9b7e46fc02112da51826aebe
MD5 4e6f752a0ac96acce020b61cb941b528
SHA1 50a58d5b60b8587894beb819cf85f4c8ca79a205
SHA512 1612a4f86b606ce219c6c9cba9095afc1638c384b07436d14cbcfa2ca8ae74c639996bde20a1379be9275121af97fa45611f0d2a5e95a718f4113a0c2b3a6846
SSDEEP 384:3pCmOoQBpx7wdG6/mdSyLespeUzx08IBiZE34MYdRPEkd/qy17lOXOSiBZ:3AmOvBrMdG6/mdSyUiZE/YdRPEkhD1wg
TLSH
T180B2E0188A434F1AE366C56E5914D468F9B5BC8F72E9094E04AF48FC50D2D730DFA9EC
MD5 SHA1 SHA512 SSDEEP TLSH

Aluminiumfolien/Taaledets.jpg

SHA256 6beff9f9c2f2bec8292bf7e029a58bc4798b556683bafb73eb958c72955742d1
MD5 f0d1d6c9236e4e117e5a1f5a1bed396d
SHA1 a2df4158f07261a83d8171169d07bdd0cddd3e72
SHA512 5f08e86296b8ca26dc59de8b07556c6f7116c1c97f42c7a5494d04bd2f82f4f00c8f8968f8c51e02a79e3c85a53767dfc3b61b80b9e4c57c26195483f22edf7e
TLSH
T19F412B38FB7A1095FF3DA6F68D09277681E2CF81EE61E532454140CC9220DB5944968C
MD5 SHA1 SHA512 TLSH

Aluminiumfolien/Vebogen

SHA256 c9a50e56e44313193b96224b57977bc809f23692384224bfbb23a76495350811
MD5 b3fe163ca7f1489c79c7f5bd6759a416
SHA1 1b65eccc865d67ab6870835ffdbc3479cd615095
SHA512 ba7ca4649f8aad8342fc36ef1c9f7a57b2ddc208ad69bfccedc481859843758fcfc6809276dc6c33ff5f6d887b029c37e9355835a1fc8c7f5a883f19e4d2186f
SSDEEP 12288:im6A1hTZE4CKgORpqRIvy5bVWzQSEQeFCgrna6ctREw5h:iC1TNhnqSvObRSBehTvctN
TLSH
T12594AD1829433500E80579F98390A2D969B5FFC83A25EC7BC9EA7487D47CD4F3B72A58
MD5 SHA1 SHA512 SSDEEP TLSH

Aluminiumfolien/gnomonic.ini

SHA256 cbf522ff072977ac7b82de077de16d1ead125932b05dfee4170a80e469eb07e8
MD5 64340ae11c0022bb3ea28408f8a65b55
SHA1 f2f4ea1c59789ed5d1360926849e95504663d0cd
SHA512 c24f490a813e85de7b4868da5ccc30a8b6a69c93fcfe7b3f6a488bf439afa4f28e6bd20544486f70be5c4a4adac41208848684b0e8274a4b0f937888edd19277
TLSH
T10C014E81E895174E92C326522ED61A08D3A89004A4B909FCB289820FBE02C3CD77D929
MD5 SHA1 SHA512 TLSH

Aluminiumfolien/rigsarkiverne.jpg

SHA256 074a8fc226e43e999845587b06f186f0f3a34e007f8350ba74d12f632c8cc98a
MD5 c565bf38341eb0d90a56d45e431e3586
SHA1 72ea9dcc3b512508fab186da259b080cf2e06ab3
SHA512 c37f5cf7139c37dbe557932fa95e450bd066a73a032d7b643e116d300495f5f48520b9fe60fa068aa489d32af995686a26e51f47d3671c8adb07f6b33f07b832
SSDEEP 384:KswJlnBI48AG4pv1qh+7rsD8Hf3Cb1bmY7WG5qcXzNHpa0MSBeewKgE+L:K5JlnBIaGAv1qM7rsD0f3C43IqcXpDMV
TLSH
T189A2E099F3832A52D72F1FE636463AFB0539A0B8CF50B2E60D7A49A754D0DB1C113B20
MD5 SHA1 SHA512 SSDEEP TLSH