8d869f72fa8076b1c43578e7672e2e8d2c16e40a86b72f9da3e64e5a8f817ea1[.]exe

resource
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
8d869f72fa8076b1c43578e7672e2e8d2c16e40a86b72f9da3e64e5a8f817ea1.exe

8d869f72fa8076b1c43578e7672e2e8d2c16e40a86b72f9da3e64e5a8f817ea1.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 8d869f72fa8076b1c43578e7672e2e8d2c16e40a86b72f9da3e64e5a8f817ea1
MD5 b0aeeec0740fafba4c8e2e0f21d51b5d
SHA1 f6ae26a193b4f1a15e27c768265db36b348feb08
SHA512 9ce42875b6c506033ad9b01a4ecef6fd0b80038fedc95f04349f6646e0c49512cc43cb8ec412d61e96c6bd5218fdbf8abe1edd7f18a9b21b43eacfba75220a00
SSDEEP 6144:SMm4CCEv3liZFEDwxQRy4Cm4k2WQ5s9Px5RzJEasQsd29yeTWrf16pRXxCLxkY3h:SMw3v3lisDpRfr4c6iPx5fojd29NTWr7
TLSH
T1457412A162D0D43AED798231C9734AFDA1E69E18D862894B73D1BF3139712D17E0FB60
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

00:03:64:d6:03:a9:c4:72:70:1e:cd:98:da:54:f9:f9:da:a0:f8:a0:15:c5:57:0f:ea:b5:21:4a:4e:37:f1:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Alpemotiver,OU=Falsummernes Eftermiddagskaffes Stander\ ,O=Alpemotiver,C=DE,1.2.840.113549.1.9.1=#0c154b6f6e736f6c7340426567796e646572656e2e436d

Chains

Aug 6, 2026

CN=Alpemotiver,OU=Falsummernes Eftermiddagskaffes Stander\ ,O=Alpemotiver,C=DE,1.2.840.113549.1.9.1=#0c154b6f6e736f6c7340426567796e646572656e2e436d

Minor OS version

0

Major OS version

4

Entry point

13455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8
MD5 014a3be4a7c1ccb217916dbf4f222bd1
SHA1 9b4c41eb0e84886beb5591d8357155e27f9c68ed
SHA512 0f3d1bf548e29a136150b699665a3f22c6ea2821701737363fa2920b51c391d735f1eae92dea8af655e7d07304bd3d06e4aff3f5a82fa22bcf5d1690013eb922
SSDEEP 48:S46+/iTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mMofjLl:zsuPbOBtWZBV8jAWiAJCdv2CmfL
TLSH
T143C19470F3C248B9C491413368E737D36612EE746784500F9B6311AA38209E7AD3EBC3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
TLSH
T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
MD5 48f3e7860e1de2b4e63ec744a5e9582a
SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
TLSH
T19112F992E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39355B66E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Ejendomsrettens.caf

SHA256 a73dfdbc524bd50143beb18e394ff2e833983519e6b768860c46bb904e5e5676
MD5 d915437f8bcde8bd81f777d75e20181d
SHA1 a1ec03fc0e56ff5902d879eb907dd691ca4a3638
SHA512 013293bdf08cfc73ec2210893f70023224dc2e0b0f8f72d6c1b7438de328af664085ac3d6468daf7d48104aeae11863d89aca2224fe1e61e632d094ee84ee99e
SSDEEP 12:ToTV4aGcTePMbQKaOh0TTlRcCMxqhzpX4/OOMx0ZJ:MxbFkPvvlRcChhzJ4/HMxA
TLSH
T1EB52ABE87A97581218CF9A38B57D9691BD17B8296EA80E1224880C06A666524C9E28C8
MD5 SHA1 SHA512 SSDEEP TLSH

Indictors

SHA256 13aa9c505b98538809ca12e332c001dfb794e9ca7477e6eda7fbd7a99cdd379f
MD5 3b8edea37bbfb36d8a353c214a7926c7
SHA1 ffac88c2e9a4e0ed88b67845d2d59545c40ef084
SHA512 4fecf6bc73afbb957f4ba0c510675e4a30e4f33d03cd0b4c0f9eb9b479a046dd1f2f1e71e553caffceeb91949d244f3837ede7d1e3d84e1384095d2585400177
SSDEEP 3072:NEmKwnn2nGnJ58oIQUkWWUjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjn:NEmdnFJaoIQbRwoQKJ1Vfg5
TLSH
T12434AFAD1D1A3137D9EB167879B1352339C089FFDB2343DCB863BA6988C0A7E8111975
MD5 SHA1 SHA512 SSDEEP TLSH

Orthoepic.mas

SHA256 59a1114c0e972ab34eb701be9fd598f5b22e893bea198059dc844398fbbc730a
MD5 6a88a8bb03fb355a26429fc3aa4485ac
SHA1 1b76740dd27126e0d6f2c6a1320fde2a226aa99d
SHA512 3a2e77ad8914b7da019ee12a47151d8d08d7c2760ceb18db598089a5f2311b92df8733e81ba3931783b85f6c001fa73d19c8b6614f3b0b7398079ec653855e70
SSDEEP 96:+hA4dEuMUzEtoPP0bk5Ethkm6CmNA9iEdMtH:yA4uuMcPkT9mltH
TLSH
T192835D9741DCCC774A8293592206976D7FB1AAA1335CE945E352043974ED63CC3651CB
MD5 SHA1 SHA512 SSDEEP TLSH

Overelegantness

SHA256 edc84e1bc9680f35a0484f3a47ecf1e061c54dfcd8793dd52fbc958e28e39d5f
MD5 f3a03a14eec08905a71cfeeeed347c29
SHA1 dda8c128905a966c70954294fb54e1ec2598eca4
SHA512 3114909f805c2210818a39ebb91b60299d44c6785711042cc37d510e5443ddafab19da54be3aafa4d006bc2fc5072c48bcfecdd429da08c5ce11705f9088f896
SSDEEP 384:MgENT4ReMlq7NL/hR89fN/JGFlwyz4yPdtERzMIzuKKiJcIBblRTaHfgSX5cG1xe:Mg14kqZ4/ZyzjCRzCKFbl8/flxMQjbKT
TLSH
T1E6E29E52DB6E0D79CD1AD63CC0AF686254E9B403974F80ADA136E51AC1923E377342FA
MD5 SHA1 SHA512 SSDEEP TLSH

Overvandtes.aut

SHA256 f79695e267e2e247ce33207e1e8e1a4799c76246ac434ee56743aade079dabe7
MD5 a07a4684b7c2d0119f7b690fcb1f249e
SHA1 dedb340e3ed7e1bc177273edc9ee25ff66e8f6a2
SHA512 e46f20fac65e48dd2b600a9383ad9a94e6cba7e1ce4fa26133fa7b08ceb9329dac2785d831f0ddce3fd9ec57f493ae35cd2623f98962d43062f168ec4a6fd504
SSDEEP 48:gk38tEvNFCiqgq25DymECP7uIzv0hu9A5X82Tn9/YgpLNn1t+l4X7vubY64v7:98+vNMT0HEY71zv0LXnTnZpRnxvnpv7
TLSH
T151836DEFB9512F81C28D75C64EF02A5D4282E13F015E46C54EF6171277E65FA1509C9C
MD5 SHA1 SHA512 SSDEEP TLSH

bevaringsvrdigste.clo

SHA256 7e042aea2cfb10937502ba9232a36849f07d05a3106e18e0edd99e732be3f32d
MD5 be5152dffff110bc717ae6b32a3d6a5a
SHA1 789af059508b8b180aa716479e31b5d1cb26be96
SHA512 e2ba2c3014acd7395f8b956492ebb4ce54a26e0b78ce223e182192fbbda181515b03d15415b383dbff702bcb473fe19960fbfd69cf845e9e6fada97aa730ed96
SSDEEP 48:f3zcMbV66+uUNAlpyLyr6ze4uH+EvADaqzMSCb5:f3dZbUNAl0Tze4MeaqhCF
TLSH
T16623E9DC113A578E86419014C06E82C8CC9B87160FAD57BE27E582497E78D4DE7FF726
MD5 SHA1 SHA512 SSDEEP TLSH

earthpeas.com

SHA256 ace9185e1eccd2ab2038e0f722ca2a234a35ae7bfb732dc8a6534ac57c37abee
MD5 110232d85146372234b94ff18b6ca936
SHA1 7a668c4387095ec91c3c336766db1dfb17e575a5
SHA512 3676132117a8b69d7865d85dd93db0ca6ef96010418a787277079a5c6b3699e2f4490badfbda33460b5e50af28d98b04a2a3c51e47097743fbbeefff975a5bd0
SSDEEP 96:tfe2zfpZMOjwZ9AyX7yww9sePY5w5Fts0UQd2TFTw:NBH2It
TLSH
T1BA835BD3B5F06CA64A6CF3C2944AF55042991517FC0CA14E28989C476DB73213A1DBCA
MD5 SHA1 SHA512 SSDEEP TLSH

forgrundsfigurerne.kon

SHA256 03e26a0aaec07b8ababe7bbdd854c97f2dabe3f365166f07439e746d8b062c49
MD5 aeb052b8f53860e54e5c41d48dc4a529
SHA1 7689290c87dac1b28b8af6168221f3ad6a20991d
SHA512 1712b98fe32a8251b394c49bb3a9bfea32509de1ad12a270d0ba086a5ac284c4f3165b32d9ffaf9f5fdce344b470585b066938fff288f201544bf905d7c36caa
SSDEEP 24:MJYH+/+oWjpeR3S4SCiwJ61fKqtaJhv8SdgqGxSjL/CTJ:1VjIJSmJ6VKQchgNxS6TJ
TLSH
T18FC24186D4475AF639B39836A427E9228A6043BE6C9085EE5CEB4DEC3C394548816B33
MD5 SHA1 SHA512 SSDEEP TLSH

oplivning.sam

SHA256 942c2db7284aaa2cf7c939330266455947ea1a8784332969cdd35aa7e0903ba6
MD5 21cef1fa904162b3bcdd7cc31e8d52c9
SHA1 20d75a82049b7d9837573891d80d9d6cecc491f7
SHA512 85958c0e95fa9849a5b64382ca82634f5af6f2e27ffc8846c133cb61284763f3f505f643493a6dafad500d1aea7e6ee4f5f749d59ff58b748d15808eb78840d9
SSDEEP 24:BS2AuwiAWr0M1K4+lWXR1GfJKIv+RNY9sfYQkjsrziPjOydq1j9n+G6eGF:BS2miAwGykJKIIi9vsrzQKyO1rGF
TLSH
T1C4F2B62B382EC028370BE0B95708FE1A040694354015AABBAAE142C4B034CBA9640A3C
MD5 SHA1 SHA512 SSDEEP TLSH

ravnekrogens.uko

SHA256 f6acdda3cbd0eb899d91e969734525f374d9c07911bf5e56b9396b6bdb80dacd
MD5 a4eb22381b673d410e41805fb3c0dc72
SHA1 77185148a1720a1a678aa4b71c9bdaf8698ff971
SHA512 d2b534e06500e33583debd4b0873daa271ec9a6f2121adc01a6350e985791d9bfd3757cd9b458e30961a37d92e927947059f6cdf3fa4cf71a045e6d481b7fa33
SSDEEP 24:bWyEjgFNbJJRVdO/Ged2aEe7uJsQsXdKAvdiXXyQqU:qjEJrXledniOQsXslyQH
TLSH
T106A2620082845B0719F1E743EC0259FD019AC9F6040D0E30E3BF46D886A84F73D91877
MD5 SHA1 SHA512 SSDEEP TLSH

stentrykkerierne.uns

SHA256 7201d65e91933aa3c3fbfd9a758cafbc374df47182dca8dc10ec3e5f351f8457
MD5 bb58ea6080fadb8adb305141f2ee8b8a
SHA1 7514ee216c4372005509aa31c58008885373ce56
SHA512 0fdac93bc7e408c7b42f16636b504d45c85ae3f88ac888bfa25b6ddc267da84e8a08492c39c41b94fbd8d628ed2da43db1168ab218318e20cf46bd539d2fdb80
SSDEEP 24:rjYt8gwh+yBEceF1cKFQU1Lmyqs3+bseRPvFoAgQGmTh2iATmG6kDnm3jw0MlSdC:fzgz94KmFyl+YSoTQrt+s4niBoaOzoG
TLSH
T1CC230BD332EB0C12E9BE0D838002B52CD90426EEB272BB5B4CDA3C1E0E486F491813D2
MD5 SHA1 SHA512 SSDEEP TLSH

talpine.reg

SHA256 a42b4c809384c5d5a31a4916a91bee832df6da871dc362eeeadebc396d1e3220
MD5 dda916a687efa9ebda89c658a4c9839d
SHA1 deed1e8cbbf9e04f5d4b664d05c212cd06fe7b40
SHA512 3332a88ddd27c23fc0a6e83458dfbd8fb65f69280538b0c88909dbd0fe55045c62a3bbdbfc92d90c406023896679834835249cd9b0ce203a4b8d6f44acc1a43b
SSDEEP 48:DUFSBCUIx1eNq0Irq7/2kotKdLlW5Iau9Clu+2M7n/FKJ8W:+fdxSxIrq72pYIIauEu+34J/
TLSH
T1F323947D5814F14096F9D8B2FB68C23950219FCF02F0622E74A3CEDFE98068704A0BC9
MD5 SHA1 SHA512 SSDEEP TLSH

8d869f72fa8076b1c43578e7672e2e8d2c16e40a86b72f9da3e64e5a8f817ea1.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Ejendomsrettens.caf

Indictors

Orthoepic.mas

Overelegantness

Overvandtes.aut

bevaringsvrdigste.clo

earthpeas.com

forgrundsfigurerne.kon

oplivning.sam

ravnekrogens.uko

stentrykkerierne.uns

talpine.reg

Sharing

General

Malware Config

Signatures

File Explorer

8d869f72fa8076b1c43578e7672e2e8d2c16e40a86b72f9da3e64e5a8f817ea1.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Ejendomsrettens.caf

Indictors

Orthoepic.mas

Overelegantness

Overvandtes.aut

bevaringsvrdigste.clo

earthpeas.com

forgrundsfigurerne.kon

oplivning.sam

ravnekrogens.uko

stentrykkerierne.uns

talpine.reg