6b677975321dd37920a79dcc2a74ac2c574e45df4b486a3b6a601faea0f87fe0[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
6b677975321dd37920a79dcc2a74ac2c574e45df4b486a3b6a601faea0f87fe0.exe

6b677975321dd37920a79dcc2a74ac2c574e45df4b486a3b6a601faea0f87fe0.exe

IMPHASH 9be4f90f50c714bc00cc8beb2e137299
SHA256 6b677975321dd37920a79dcc2a74ac2c574e45df4b486a3b6a601faea0f87fe0
MD5 708d1cd8756302eaf8d4e45abe91fd35
SHA1 c57eaf6a7f28343dfbe49dc8c0f37c8a7115d19c
SHA512 efcfebc5d22d6dcf8d81dcc9d0c460a30369c878b6b6b0a3c1a923e159fecdaa5ab8ffca9096a3a916d164b8286a7968289c38148826e5bf5957132e09653623
SSDEEP 12288:h70ZoSPUOxCVuyzKcGmQJt0tqJepNRtM7ypCLD77EPnA2/6IdFFtCXuHb:h7qPUOxCsbcGmWt4qsxpCk1SMHtCXYb
TLSH
T12905DF81A40CA8EEE4648C71797ACCB324727EB51DC8614E32CCF77A9972272553EF85
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

47:9e:75:6d:33:d1:92:13:26:4b:85:bd:8f:8e:cb:7e:8e:94:ed:94

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nonfeverishness,OU=Tromlerevolver Cymbling larisa\ ,O=Nonfeverishness,C=FR

Chains

Sep 4, 2026

CN=Nonfeverishness,OU=Tromlerevolver Cymbling larisa\ ,O=Nonfeverishness,C=FR

Minor OS version

1

Major OS version

5

Entry point

17331

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DeleteFileW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetCurrentProcess GetDiskFreeSpaceExW GetExitCodeProcess GetFileAttributesW GetFileSize GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDirectoryW GetTempFileNameW GetTempPathW GetTickCount GetUserDefaultUILanguage GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExW MoveFileExW MoveFileW MulDiv MultiByteToWideChar ReadFile RemoveDirectoryW SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFileTime Sleep WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpynW lstrlenA lstrlenW

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderW SHCLSIDFromString SHFileOperationW SHGetFileInfoW SHGetPathFromIDListW ShellExecuteExW

user32

AppendMenuW BeginPaint CallWindowProcW CharNextA CharNextW CharPrevW CheckDlgButton CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExW GetAsyncKeyState GetClassInfoW GetClientRect GetDC GetDlgItem GetDlgItemTextW GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongPtrW GetWindowRect InvalidateRect IsDlgButtonChecked IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MessageBoxIndirectW OpenClipboard PeekMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetClassLongPtrW SetClipboardData SetCursor SetDlgItemTextW SetForegroundWindow SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfW wvsprintfW

Name

.text

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

368B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

512B

Virtual Size

680KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

279KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/System.dll

IMPHASH cf8eee620b3371ff06e99c34f39ea84c
SHA256 c7dd8cc8323e295b8821b0e320de208a7e20c068a8be8d03857520451ce9ded7
MD5 4abf19a47044ec746aa8c600f0bc149f
SHA1 69da1e4f654b044d7b3c845c12a07c988bf26eb8
SHA512 65727cbe3f03e0dceba06d206054e60adba321d29159b4bfb690c30b2ccd1a0a05a08c2aa50ac270fcd28557f4b482f492c36b0d7b7b980b477cd8971559610e
SSDEEP 384:jZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvH81Q:jr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T1DEB24C07F38398BFC51BC17186EF5772AA32BE211B616F6F1220F5756E24EA0871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12726

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

916B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

179B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Brandalarmens

SHA256 820f5925a621be22d100b8957e8ec9b52f332838fa7fb5e6702e70113f9b0b20
MD5 ee6453fd6ddd3e9bc93b9b451ba02998
SHA1 a42c488ed21f10535f08f26a52d98ebc32da42f6
SHA512 b9ea2c702ed54d072e0f23ca3ebebdddc26e7f775636fdce0cec036957190288c8fe63223ae296d818839c02108bb273fbc96e4d0d60e99d4e4540002992d2db
SSDEEP 6144:9u34pYnVVn5RyY0eKSQ1wEzf0t1ioCz8yRXgAZUHkuo8R/T8JVr:YLnVVn5BXEzfKi/AyppNKT8br
TLSH
T11B949E8925FDEA875EE16D6A223049B47CCDC0A8319CA0763827793571E33C951F72EB
MD5 SHA1 SHA512 SSDEEP TLSH

Fugtskadernes

SHA256 850a4762d9e770d64ab8fd2f710ee11e3bfb084a0e2508fa73840f8072d0fa7f
MD5 f197979467f279d3780751383b7a08d3
SHA1 9b2cdece22f1d57e55faab209e60bef9b7ff3037
SHA512 4e01ed187da44e651ad66fefc711bbaeee200ecbece961d5955b580505d13f77351411dd5cbcdf55f1d4528049db98daed00239a85efd66b63bf07c35dba335b
SSDEEP 768:pd2WN3rfutcogC+4zvIREhOOUZDmmsNtITDeyNBGepx5RF+yNpy94:TN3QmTKG95PHf
TLSH
T119E25C5071CD8AE0F60A5988EA78FFB201333973EFCA1DD22224F5414ABF5553A4DA5E
MD5 SHA1 SHA512 SSDEEP TLSH

badevandsforholdets.dam

SHA256 99da4d79aae54d072e65c3f3283e776850c55579956b915a52121f61566d9eed
MD5 9ff20ada27b126515fc1a4e444e64aa1
SHA1 f70ac1ae0bdbea8212fe563be9013826156e4acc
SHA512 fa62c355a1f9d44531ca40535041eb17b9a54ac7ea2dcd7a82a2c751d37dc71bf36a905a0abd1fc6e3a3a016ad366d54f764821cfc4504f95c9da6c023890220
SSDEEP 768:nv6EWIQtK4tkPFFHvuhrVv5+yJR41q8dzUGQeQCBpLq48lLXj17Y+86+WYBpGdMv:D
TLSH
T192950283EA6793D05AC8191CF2B3A2AD1C159675159FD09FB7BCC8F874EA8D21D3B102
MD5 SHA1 SHA512 SSDEEP TLSH

storkundesalget.jpg

SHA256 a61602b6a816e2d217fbd98e1a8ed99980dbf87f98afd878100436d8dd88b7d7
MD5 28f2302b916a5257215ccac4e4bd785c
SHA1 1e21829771ae9f16e511f4e89e3c1227db68e4e6
SHA512 88658fb65509d35328e603d6d13a8a0853a7a53cf316a4ea95350d972256f532f3a3d65dfabe7b7f3dc925b1a8ac71e3ad41b3512880e071a9078698e4d25634
SSDEEP 384:RP/CdEs6xVpUb4kl5oIHkJB1NaUsq9c/AnITy56RW0CkCdE/jQWISI0d8doCFE41:RP/gELVpUb4kjoIH4zNb9Ws66kfsVYZs
TLSH
T193B2E280473D46090B6A0855758B788FC11DF47E2B906A724AB8CE1755E5F359CE9FC2
MD5 SHA1 SHA512 SSDEEP TLSH

swingeing.jpg

SHA256 58520cd743195e85f16a9354495453cff179675cbbcb0fbbe849bbe9ee267176
MD5 05fdc732bfa50790eaeb839d556160df
SHA1 18cf69befbe9150ea619067a9226d9945a41f4a4
SHA512 03e3b6a1759f8c68477e7d6766b7dad33604f056c7b93e1364175a7236624bd984dee504f87618ebdd1d28e4931d424202df11fcbb6b714f3f588a5c0f544129
SSDEEP 384:PQ9YE3R0euiPkvZOUG1J9towEIjAxLt9HynDUZn:PKoeHPkvIUG195EIjAxQUp
TLSH
T11392D0CCA7D3DD88531BA9F9BA6728E6615108553F1C8F7F5E06A29EC0A0CDB1C1D2C9
MD5 SHA1 SHA512 SSDEEP TLSH