3ddab1377aabbda1e90775da1b6bbe034562ba6aad56f587fe081d95c3d9e6a1

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Jan-27 12:38:08
Detected languages English - United States
Hungarian - Hungary
Process Default Language
CompanyName NNG Kft
FileDescription Toolbox Agent
FileVersion 5.28.2026041167
InternalName agent.exe
LegalCopyright Copyright (C) 2004-2016 NNG Kft.
OriginalFilename agent.exe
ProductName Toolbox
ProductVersion 5.28.2026041167

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
MASM/TASM - sig1(h)
Info Interesting strings found in the binary: Contains domain names:
  • http://zippy.naviextras.com
  • http://zippy.naviextras.com/services/index/rest
  • http://zippy.naviextras.com/services/selfie/rest/1/update
  • naviextras.com
  • zippy.naviextras.com
Info Cryptographic algorithms detected in the binary: Uses constants related to Blowfish
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryW
Can access the registry:
  • RegCloseKey
  • RegCreateKeyExA
  • RegOpenKeyExA
  • RegSetValueExA
  • RegQueryValueExA
Possibly launches other programs:
  • ShellExecuteA
Can create temporary files:
  • CreateFileW
  • GetTempPathW
Has Internet access capabilities:
  • WinHttpGetIEProxyConfigForCurrentUser
  • WinHttpGetProxyForUrl
  • WinHttpQueryHeaders
  • WinHttpReceiveResponse
  • WinHttpQueryAuthSchemes
  • WinHttpSetCredentials
  • WinHttpSendRequest
  • WinHttpAddRequestHeaders
  • WinHttpOpenRequest
  • WinHttpSetTimeouts
  • WinHttpSetOption
  • WinHttpQueryDataAvailable
  • WinHttpReadData
  • WinHttpConnect
  • WinHttpCloseHandle
  • WinHttpOpen
  • WinHttpSetStatusCallback
  • WinHttpCrackUrl
Info The PE is digitally signed. Signer: NNG Software Developing and Commercial LLC
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Safe VirusTotal score: 0/39 (Scanned on 2026-08-12 04:57:29) All the AVs think this file is safe.

Hashes

MD5 a44517ccb0546659771ef0106dbc6911 🔍
SHA1 b4d039b87df73f345a8a974989e2051a2913d837 🔍
SHA256 3ddab1377aabbda1e90775da1b6bbe034562ba6aad56f587fe081d95c3d9e6a1 🔍
SHA3 03b313d2d6870eb97ba539fc0d1b498a3401183da7eedc74e0ffff0a8ee2105f 🔍
SSDeep 12288:4BIeRcL8So//ECSWoVQs0gZ6puX5Eb8TH/LMUvt82W6BbePcJXOBMWKE5BhiNEUL:4BISc4SwoWlnGc2W6qiKUAr6JPv 🔍
Imports Hash 884a6afe7a9b9485594f9d43225bba84 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x128

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2026-Jan-27 12:38:08
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x77e00
SizeOfInitializedData 0x2c400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00059565 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x79000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xa7000
SizeOfHeaders 0x400
Checksum 0xaf42c
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 8eb2a13e6230f01fee5e6b774128030a 🔍
SHA1 4dd11110e19c20327be4a2382d6dca40e8a756ba 🔍
SHA256 3be736da97c96340a4c30f21cf0aa278b1f48bb7b9d4676483a8a1ddcd939852 🔍
SHA3 65041a0f57499e5a8d969aa7bcba0391cc0dc2ac280d7b369e3683df7ff23180 🔍
VirtualSize 0x77c96
VirtualAddress 0x1000
SizeOfRawData 0x77e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.50575

.rdata

MD5 43a77863f15ad617a72ec25eafb50916 🔍
SHA1 8e467666cb80548bf884299e0d1ff1e26d87b43c 🔍
SHA256 bb7109a59e1bd11cd26a6b2d5eb6ae9866172552999513ea41267b503e448d25 🔍
SHA3 59ff892ecfe0afc5ed4801ce531360b451509b2a76db5bee8c40a9119b733152 🔍
VirtualSize 0x154f0
VirtualAddress 0x79000
SizeOfRawData 0x15600
PointerToRawData 0x78200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.8643

.data

MD5 bbbcf071b4211be4e8f5555713382b8f 🔍
SHA1 ff090361d3fda36990a16743a5e553552c696aff 🔍
SHA256 1709a0523790f5f10ba31da0aee6b17cb5a42a547bd777e9b776315ded56e023 🔍
SHA3 f1bf6e2e0464ab0f47a3a09e1360a7a7310b8234f826dfbc0f01b4071e4e5d8e 🔍
VirtualSize 0x261c
VirtualAddress 0x8f000
SizeOfRawData 0x1400
PointerToRawData 0x8d800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.48653

.rsrc

MD5 66db87daeb29ce2eb49316c3212c52ed 🔍
SHA1 7994436f11a2703c11622820b040e7ef01097443 🔍
SHA256 49d51dae90874524e9cdee09d56d3ebacfa4875e2c3f0123bc5162599992c628 🔍
SHA3 a46b6b0c84aac05cf3ab4a6df0f79c8ddb5e3df613d3d864a104d34508b75b25 🔍
VirtualSize 0xec10
VirtualAddress 0x92000
SizeOfRawData 0xee00
PointerToRawData 0x8ec00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.59157

.reloc

MD5 636f62b3c5fb47981f35f0ec30c917e5 🔍
SHA1 ee7b2d260da531bf44b48546202a1793e7e5ea2d 🔍
SHA256 0ce2deff1e4ac7a57efae5e9a0adf8f36d744c4d5ea35ee74ae45c183025423b 🔍
SHA3 5ddf99d0befc4fdb995c404a3ec5468cbcc924ef9b0f96b75911f08cbcf8d435 🔍
VirtualSize 0x571c
VirtualAddress 0xa1000
SizeOfRawData 0x5800
PointerToRawData 0x9da00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.65257

Imports

nngine.dll NngineSuspendTransfer
NngineFireEvent
NngineAttachConfig
NngineAttachHmi
NngineAttachLogger
NngineStop
NngineStart
NngineDisconnectDevice
NngineConnectDevice
NngineResumeTransfer
NngineRestartWorkflow
libcef.dll cef_string_utf16_clear
cef_string_multimap_free
cef_string_multimap_alloc
cef_string_map_free
cef_string_map_alloc
cef_string_multimap_append
cef_string_multimap_value
cef_string_multimap_key
cef_string_multimap_size
cef_string_map_append
cef_string_map_value
cef_string_map_key
cef_string_map_size
cef_string_list_append
cef_string_list_value
cef_string_list_size
cef_uriencode
cef_base64encode
cef_quit_message_loop
cef_run_message_loop
cef_shutdown
cef_initialize
cef_post_task
cef_currently_on
cef_string_userfree_utf16_free
cef_cookie_manager_get_global_manager
cef_log
cef_browser_host_create_browser
cef_string_list_free
cef_string_list_alloc
cef_enable_highdpi_support
cef_api_hash
cef_string_utf16_to_utf8
cef_string_utf16_cmp
cef_string_utf8_clear
cef_string_utf16_set
cef_string_utf8_to_utf16
SHLWAPI.dll PathFileExistsA
PathRemoveFileSpecA
PathAddBackslashA
KERNEL32.dll IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
DeleteFileW
GetTimeZoneInformation
CreateFileW
GetFileAttributesExW
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
HeapFree
HeapAlloc
WriteFile
GetStdHandle
GetModuleFileNameW
ExitProcess
GetTempPathW
GetCommandLineW
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetOEMCP
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
GetModuleHandleExW
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
InitOnceComplete
InitOnceBeginInitialize
RaiseException
GetExitCodeThread
WaitForSingleObjectEx
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
SetEndOfFile
HeapSize
GetACP
GetStringTypeW
WriteConsoleW
WideCharToMultiByte
MultiByteToWideChar
GetFileAttributesA
FindNextFileA
FindFirstFileA
FindClose
GetCurrentDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
SetEvent
WaitForSingleObject
CreateEventW
GetModuleFileNameA
GetModuleHandleW
SetThreadExecutionState
GetLastError
CreateMutexA
GetDiskFreeSpaceExA
GetConsoleWindow
SetErrorMode
LoadLibraryW
VerSetConditionMask
VerifyVersionInfoW
SetLastError
FormatMessageA
ResetEvent
GetCurrentThreadId
GetModuleHandleA
GlobalFree
LocalFree
lstrlenW
GetLocaleInfoA
GetGeoInfoA
GetUserGeoID
GetUserDefaultLangID
GetEnvironmentVariableA
USER32.dll LoadImageW
GetMessageW
TranslateMessage
DispatchMessageW
PostMessageW
RegisterClassW
UnregisterClassW
CreateWindowExW
DestroyWindow
SetWindowTextW
MessageBoxW
DefWindowProcW
PostQuitMessage
RegisterClassExW
SetWindowPos
SendDlgItemMessageW
EnableWindow
GetSystemMenu
EnableMenuItem
UpdateWindow
GetClientRect
GetWindowLongW
SetWindowLongW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
LoadCursorW
GetSystemMetrics
SendMessageW
ReleaseDC
GetDC
ShowWindow
GDI32.dll GetDeviceCaps
GetStockObject
SHELL32.dll SHCreateDirectoryExA
ShellExecuteExA
ShellExecuteA
SHGetPathFromIDListW
#2
#4
SHGetFolderPathA
ADVAPI32.dll RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
credui.dll CredUIPromptForCredentialsW
COMCTL32.dll InitCommonControlsEx
WINHTTP.dll WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpQueryAuthSchemes
WinHttpSetCredentials
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetTimeouts
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpSetStatusCallback
WinHttpCrackUrl

Delayed Imports

1

Type RT_ICON
Language Hungarian - Hungary
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.22486
MD5 9bea6c622a8051b740a0514b3a0d4a3b 🔍
SHA1 13681f79c10a1c4959f5bb88d77240b32e078e1f 🔍
SHA256 d4e896f075c21adbee344e669c29c908aaa2a52fa129863cdcfd8b313893d857 🔍
SHA3 f83089c07c5aa002471593fa7b06ea5bdd2ff7f5ba612f42b8a4538a45abc544 🔍

2

Type RT_ICON
Language Hungarian - Hungary
Codepage UNKNOWN
Size 0x5da2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.97473
Detected Filetype PNG graphic file
MD5 563d2c3ad9cfe10eb4346768329b0cbb 🔍
SHA1 139a2772c89ab6b13f0773e920a6f2dace4e8e8c 🔍
SHA256 d85073e2033726ed1089300c519ba14f958df1dc308e0611de49b77e44ef9d5f 🔍
SHA3 7542ce1eabbf42d3644b1189af99f4b5ce2b70e438c6c64e8141b0f5fbf2f19d 🔍

3

Type RT_ICON
Language Hungarian - Hungary
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.87006
MD5 6d7e4b601beb3c85dedfb522c2a2dc16 🔍
SHA1 1e29ea9f3e0eff7c248986bac7206366c4d56232 🔍
SHA256 3cf7092e0d87a257fbf7de9edbc09bc312ea1cdc652efec7fec58d7b103ffcd6 🔍
SHA3 736765364d3f610769ef76dc1b756dbe266964f6da7175867642c23576e92430 🔍

4

Type RT_ICON
Language Hungarian - Hungary
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.56272
MD5 7f7802518b1e96b6bcfda19a89d70be5 🔍
SHA1 9604b0e4d6c8e535e64c79994fe4b67a9d79245b 🔍
SHA256 706507863d8ebf21e8b3b652ea4a4156e247fbd9fe662b6ac0be81920018c539 🔍
SHA3 2fbb644e607211a786795b1e76fab2c95a85834425c21ee1dd281a7b2c9d9de9 🔍

5

Type RT_ICON
Language Hungarian - Hungary
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.45413
MD5 dceb0e413d1305a44e885578ab80645c 🔍
SHA1 667fb3ca6cf89916ee8417fdcb22c9f365dab5f9 🔍
SHA256 34e3a8b9b7908b77e694f59fcde7ea1732db7dddd23780b05386d8f2bdf65e26 🔍
SHA3 efcfbb8b755fb464ab6c7db3efe812817e54b76d860481b82a38d37608314c8b 🔍

126

Type RT_STRING
Language Hungarian - Hungary
Codepage UNKNOWN
Size 0x3a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.57841
MD5 de7c41c71d4c7857b59ab79090771fc2 🔍
SHA1 15625e54b76225761e41e40cb1a8bb3004f8ba4a 🔍
SHA256 66e2ddb6dfd74823f47a1ad5510f864db2697948a4b658b73c5ae893fe190322 🔍
SHA3 3394aeefac9879a131c2655bfa005c09b51255e51e9b485a7c042824fe57ee5d 🔍

2002

Type RT_GROUP_ICON
Language Hungarian - Hungary
Codepage UNKNOWN
Size 0x4c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.64638
Detected Filetype Icon file
MD5 638182e8ef226fb71aa41e160e1b7209 🔍
SHA1 3237184b87afac98ec5bfefe179d0f3f5a985359 🔍
SHA256 18127d745285c1ca8144acb925f8430e5c85a2ad10aa443c5834f637f52deb1c 🔍
SHA3 1520ce4e183d97d488362227029a86c899b39e53f652a8ab9538b1dfedd352fc 🔍

1 (#2)

Type RT_VERSION
Language Hungarian - Hungary
Codepage UNKNOWN
Size 0x2dc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.40804
MD5 1bade4fabe719f18a8cf151f90973cb2 🔍
SHA1 d206914dcc3ce6dd53c50feda69841fbd2f000c0 🔍
SHA256 e5dbf3e74b4d65e06e2eb4900ba63335c95a2bf4a7c1231e001329e258b278b6 🔍
SHA3 e52cf752c38521551a043d3c2b606dca7070f54488609153cad10d28d8631b68 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x76e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.18299
MD5 f06d1373fab8e3038603a5d10c28832a 🔍
SHA1 d5db143d1896f0d8bb0639e30d859dba190d325b 🔍
SHA256 a792bcdf2eb6d969a7804835e3f5a146a8b5859288640f0704cd6392809cf91d 🔍
SHA3 6f15fe3a2ce1e671c997fdc477fa2eae37ef8701c2cb2d773881bd438333332a 🔍

1 (#4)

Type RT_MANIFEST
Language Hungarian - Hungary
Codepage UNKNOWN
Size 0x458
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.9406
MD5 6bfdc51d0c497bb9ad0175d9546de82d 🔍
SHA1 5a5d8434ab4f4bb7e0988572991602ddd1afd485 🔍
SHA256 f1c322b832365380df7eef3ec7f498dafc130b94e56b9ffbf94039a32190291a 🔍
SHA3 d91000e9ce17a5612c5719fb9daa9eae5ae85382d49ddc507b308e4e3819f283 🔍

String Table contents

ToolboxWindow

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.1
ProductVersion 1.0.0.1
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_UNKNOWN
Language Process Default Language
CompanyName NNG Kft
FileDescription Toolbox Agent
FileVersion (#2) 5.28.2026041167
InternalName agent.exe
LegalCopyright Copyright (C) 2004-2016 NNG Kft.
OriginalFilename agent.exe
ProductName Toolbox
ProductVersion (#2) 5.28.2026041167
Resource LangID Hungarian - Hungary

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Jan-27 12:38:08
Version 0.0
SizeofData 964
AddressOfRawData 0x8bc84
PointerToRawData 0x8ae84

TLS Callbacks

StartAddressOfRawData 0x48c058
EndAddressOfRawData 0x48c060
AddressOfIndex 0x490b10
AddressOfCallbacks 0x47948c
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0xbc
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x48f2dc
SEHandlerTable 0x48bb84
SEHandlerCount 14

RICH Header

XOR Key 0xdac5f01f
Unmarked objects 0
ASM objects (26213) 14
C++ objects (26213) 184
C objects (26213) 22
C objects (30034) 18
ASM objects (30034) 22
C++ objects (30034) 89
253 (23601) 2
Imports (26213) 18
Unmarked objects (#2) 2
Imports (VS2019 Update 11 (16.11.16-17) compiler 30146) 3
Total imports 369
C++ objects (VS2019 Update 11 (16.11.16-17) compiler 30146) 161
Resource objects (VS2019 Update 11 (16.11.16-17) compiler 30146) 1
151 1
Linker (VS2019 Update 11 (16.11.16-17) compiler 30146) 1

Errors

Leave a comment

No comments yet.