e9b9e9b3ba47548c9f0937837bf16550f573c25f7405e8cfbf45519d79ccde4e[.]exe

resource
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
e9b9e9b3ba47548c9f0937837bf16550f573c25f7405e8cfbf45519d79ccde4e.exe

e9b9e9b3ba47548c9f0937837bf16550f573c25f7405e8cfbf45519d79ccde4e.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 e9b9e9b3ba47548c9f0937837bf16550f573c25f7405e8cfbf45519d79ccde4e
MD5 b0e14b749d6ea74efedde6ca496b45d0
SHA1 a0a473dd0296e295d3802c77bbe5766ffb333b0b
SHA512 fb26816097636a316e215f8264f9b9786d0b4a8a12efd08865cc1bb2a1c392f875c0eb3bbc7b0d4fe990f8a6522a09405c7db5d2ad53ec87d7d04d2c465d348e
SSDEEP 6144:IMm4CCEv3liZFEDwxQRy4Cm4k2WQ5s9PxVVuVGNZJWG7JtmkfCTydOjkY3NAC:IMw3v3lisDpRfr4c6iPxVVuVG577mkfy
TLSH
T1E674126161E5D87AC9645731DC3A07FAA485FD1AC4B48A0B73C17E6939B13C2EE0EB24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5a:1b:f8:3d:0c:0c:b4:52:81:89:eb:5e:08:66:00:9b:3a:38:24:99:ba:c4:b9:43:33:c4:c1:7b:f9:26:76:17

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Exceptionably,OU=Ns Antigravity Semirhythm\ ,O=Exceptionably,C=DE,1.2.840.113549.1.9.1=#0c2053747562626f726e6c793339404f766572656d7074696e6573733130312e4169

Chains

Aug 6, 2026

CN=Exceptionably,OU=Ns Antigravity Semirhythm\ ,O=Exceptionably,C=DE,1.2.840.113549.1.9.1=#0c2053747562626f726e6c793339404f766572656d7074696e6573733130312e4169

Minor OS version

0

Major OS version

4

Entry point

13455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8
MD5 014a3be4a7c1ccb217916dbf4f222bd1
SHA1 9b4c41eb0e84886beb5591d8357155e27f9c68ed
SHA512 0f3d1bf548e29a136150b699665a3f22c6ea2821701737363fa2920b51c391d735f1eae92dea8af655e7d07304bd3d06e4aff3f5a82fa22bcf5d1690013eb922
SSDEEP 48:S46+/iTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mMofjLl:zsuPbOBtWZBV8jAWiAJCdv2CmfL
TLSH
T143C19470F3C248B9C491413368E737D36612EE746784500F9B6311AA38209E7AD3EBC3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
TLSH
T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
MD5 48f3e7860e1de2b4e63ec744a5e9582a
SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
TLSH
T19112F992E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39355B66E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Ejendomsrettens.caf

SHA256 a73dfdbc524bd50143beb18e394ff2e833983519e6b768860c46bb904e5e5676
MD5 d915437f8bcde8bd81f777d75e20181d
SHA1 a1ec03fc0e56ff5902d879eb907dd691ca4a3638
SHA512 013293bdf08cfc73ec2210893f70023224dc2e0b0f8f72d6c1b7438de328af664085ac3d6468daf7d48104aeae11863d89aca2224fe1e61e632d094ee84ee99e
SSDEEP 12:ToTV4aGcTePMbQKaOh0TTlRcCMxqhzpX4/OOMx0ZJ:MxbFkPvvlRcChhzJ4/HMxA
TLSH
T1EB52ABE87A97581218CF9A38B57D9691BD17B8296EA80E1224880C06A666524C9E28C8
MD5 SHA1 SHA512 SSDEEP TLSH

Frokostplattes255

SHA256 a58649e169a60ce0d526cc3e9eba3f8618d00a995233adb44e9e6ac68cf36b6f
MD5 cdce1d2139174ed4c32ebf5b7a133e3f
SHA1 f5a6a566b38aac399e4dcb15141e302c7501c53f
SHA512 289f84494faecaf8cef99a2ac64158e981da6c44178d6daac526ea3034f3d53ba35e180e7af41b2f4c3f225cc46795a7ce158fc3504f6d7e654cc3a3676b6ce4
SSDEEP 768:fTW+HpFcCfO1rPZ34F71lnmt5zYEzfZ+XQf6422ffJPzNehswz:fHpFH2ZahW5zR+A9bPp0swz
TLSH
T1F233C021C7969CFBCC0A8338E4AF51E6896D70121F8FD46FB0B69954C1A33D753249EA
MD5 SHA1 SHA512 SSDEEP TLSH

Gandurah/stentrykkerierne.uns

SHA256 7201d65e91933aa3c3fbfd9a758cafbc374df47182dca8dc10ec3e5f351f8457
MD5 bb58ea6080fadb8adb305141f2ee8b8a
SHA1 7514ee216c4372005509aa31c58008885373ce56
SHA512 0fdac93bc7e408c7b42f16636b504d45c85ae3f88ac888bfa25b6ddc267da84e8a08492c39c41b94fbd8d628ed2da43db1168ab218318e20cf46bd539d2fdb80
SSDEEP 24:rjYt8gwh+yBEceF1cKFQU1Lmyqs3+bseRPvFoAgQGmTh2iATmG6kDnm3jw0MlSdC:fzgz94KmFyl+YSoTQrt+s4niBoaOzoG
TLSH
T1CC230BD332EB0C12E9BE0D838002B52CD90426EEB272BB5B4CDA3C1E0E486F491813D2
MD5 SHA1 SHA512 SSDEEP TLSH

Gandurah/talpine.reg

SHA256 a42b4c809384c5d5a31a4916a91bee832df6da871dc362eeeadebc396d1e3220
MD5 dda916a687efa9ebda89c658a4c9839d
SHA1 deed1e8cbbf9e04f5d4b664d05c212cd06fe7b40
SHA512 3332a88ddd27c23fc0a6e83458dfbd8fb65f69280538b0c88909dbd0fe55045c62a3bbdbfc92d90c406023896679834835249cd9b0ce203a4b8d6f44acc1a43b
SSDEEP 48:DUFSBCUIx1eNq0Irq7/2kotKdLlW5Iau9Clu+2M7n/FKJ8W:+fdxSxIrq72pYIIauEu+34J/
TLSH
T1F323947D5814F14096F9D8B2FB68C23950219FCF02F0622E74A3CEDFE98068704A0BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Loaning

SHA256 9bdeee345e8297d262c1fcb992a36346b26f86902af9f89fbe281cd954736dab
MD5 7aee1136ccd459f9655b789c3ed190b3
SHA1 c90a39824e4a62a7076bcb2a861a01d99458787b
SHA512 8a1b9d5044ba28b17acc5366b69c5f6417559f4b63c149c6dc82a20f0eed096b989ec0dd0a08cf9078198c7205ee953ed48d50daeea83c39f747800fcec30d90
SSDEEP 3072:0qppWHR4E9lIRnaZ/Ob25nbKJAkSYrLF5jpOQPPMN:R6HR/8odQs26
TLSH
T18E349F6085E7FCEEC7CA14067FE21788491B07EBC28A2BB5255C949E3F2D3B0D0B9655
MD5 SHA1 SHA512 SSDEEP TLSH

Orthoepic.mas

SHA256 59a1114c0e972ab34eb701be9fd598f5b22e893bea198059dc844398fbbc730a
MD5 6a88a8bb03fb355a26429fc3aa4485ac
SHA1 1b76740dd27126e0d6f2c6a1320fde2a226aa99d
SHA512 3a2e77ad8914b7da019ee12a47151d8d08d7c2760ceb18db598089a5f2311b92df8733e81ba3931783b85f6c001fa73d19c8b6614f3b0b7398079ec653855e70
SSDEEP 96:+hA4dEuMUzEtoPP0bk5Ethkm6CmNA9iEdMtH:yA4uuMcPkT9mltH
TLSH
T192835D9741DCCC774A8293592206976D7FB1AAA1335CE945E352043974ED63CC3651CB
MD5 SHA1 SHA512 SSDEEP TLSH

Overvandtes.aut

SHA256 f79695e267e2e247ce33207e1e8e1a4799c76246ac434ee56743aade079dabe7
MD5 a07a4684b7c2d0119f7b690fcb1f249e
SHA1 dedb340e3ed7e1bc177273edc9ee25ff66e8f6a2
SHA512 e46f20fac65e48dd2b600a9383ad9a94e6cba7e1ce4fa26133fa7b08ceb9329dac2785d831f0ddce3fd9ec57f493ae35cd2623f98962d43062f168ec4a6fd504
SSDEEP 48:gk38tEvNFCiqgq25DymECP7uIzv0hu9A5X82Tn9/YgpLNn1t+l4X7vubY64v7:98+vNMT0HEY71zv0LXnTnZpRnxvnpv7
TLSH
T151836DEFB9512F81C28D75C64EF02A5D4282E13F015E46C54EF6171277E65FA1509C9C
MD5 SHA1 SHA512 SSDEEP TLSH

bevaringsvrdigste.clo

SHA256 7e042aea2cfb10937502ba9232a36849f07d05a3106e18e0edd99e732be3f32d
MD5 be5152dffff110bc717ae6b32a3d6a5a
SHA1 789af059508b8b180aa716479e31b5d1cb26be96
SHA512 e2ba2c3014acd7395f8b956492ebb4ce54a26e0b78ce223e182192fbbda181515b03d15415b383dbff702bcb473fe19960fbfd69cf845e9e6fada97aa730ed96
SSDEEP 48:f3zcMbV66+uUNAlpyLyr6ze4uH+EvADaqzMSCb5:f3dZbUNAl0Tze4MeaqhCF
TLSH
T16623E9DC113A578E86419014C06E82C8CC9B87160FAD57BE27E582497E78D4DE7FF726
MD5 SHA1 SHA512 SSDEEP TLSH

earthpeas.com

SHA256 ace9185e1eccd2ab2038e0f722ca2a234a35ae7bfb732dc8a6534ac57c37abee
MD5 110232d85146372234b94ff18b6ca936
SHA1 7a668c4387095ec91c3c336766db1dfb17e575a5
SHA512 3676132117a8b69d7865d85dd93db0ca6ef96010418a787277079a5c6b3699e2f4490badfbda33460b5e50af28d98b04a2a3c51e47097743fbbeefff975a5bd0
SSDEEP 96:tfe2zfpZMOjwZ9AyX7yww9sePY5w5Fts0UQd2TFTw:NBH2It
TLSH
T1BA835BD3B5F06CA64A6CF3C2944AF55042991517FC0CA14E28989C476DB73213A1DBCA
MD5 SHA1 SHA512 SSDEEP TLSH

forgrundsfigurerne.kon

SHA256 03e26a0aaec07b8ababe7bbdd854c97f2dabe3f365166f07439e746d8b062c49
MD5 aeb052b8f53860e54e5c41d48dc4a529
SHA1 7689290c87dac1b28b8af6168221f3ad6a20991d
SHA512 1712b98fe32a8251b394c49bb3a9bfea32509de1ad12a270d0ba086a5ac284c4f3165b32d9ffaf9f5fdce344b470585b066938fff288f201544bf905d7c36caa
SSDEEP 24:MJYH+/+oWjpeR3S4SCiwJ61fKqtaJhv8SdgqGxSjL/CTJ:1VjIJSmJ6VKQchgNxS6TJ
TLSH
T18FC24186D4475AF639B39836A427E9228A6043BE6C9085EE5CEB4DEC3C394548816B33
MD5 SHA1 SHA512 SSDEEP TLSH

oplivning.sam

SHA256 942c2db7284aaa2cf7c939330266455947ea1a8784332969cdd35aa7e0903ba6
MD5 21cef1fa904162b3bcdd7cc31e8d52c9
SHA1 20d75a82049b7d9837573891d80d9d6cecc491f7
SHA512 85958c0e95fa9849a5b64382ca82634f5af6f2e27ffc8846c133cb61284763f3f505f643493a6dafad500d1aea7e6ee4f5f749d59ff58b748d15808eb78840d9
SSDEEP 24:BS2AuwiAWr0M1K4+lWXR1GfJKIv+RNY9sfYQkjsrziPjOydq1j9n+G6eGF:BS2miAwGykJKIIi9vsrzQKyO1rGF
TLSH
T1C4F2B62B382EC028370BE0B95708FE1A040694354015AABBAAE142C4B034CBA9640A3C
MD5 SHA1 SHA512 SSDEEP TLSH

ravnekrogens.uko

SHA256 f6acdda3cbd0eb899d91e969734525f374d9c07911bf5e56b9396b6bdb80dacd
MD5 a4eb22381b673d410e41805fb3c0dc72
SHA1 77185148a1720a1a678aa4b71c9bdaf8698ff971
SHA512 d2b534e06500e33583debd4b0873daa271ec9a6f2121adc01a6350e985791d9bfd3757cd9b458e30961a37d92e927947059f6cdf3fa4cf71a045e6d481b7fa33
SSDEEP 24:bWyEjgFNbJJRVdO/Ged2aEe7uJsQsXdKAvdiXXyQqU:qjEJrXledniOQsXslyQH
TLSH
T106A2620082845B0719F1E743EC0259FD019AC9F6040D0E30E3BF46D886A84F73D91877
MD5 SHA1 SHA512 SSDEEP TLSH

e9b9e9b3ba47548c9f0937837bf16550f573c25f7405e8cfbf45519d79ccde4e.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Ejendomsrettens.caf

Frokostplattes255

Gandurah/stentrykkerierne.uns

Gandurah/talpine.reg

Loaning

Orthoepic.mas

Overvandtes.aut

bevaringsvrdigste.clo

earthpeas.com

forgrundsfigurerne.kon

oplivning.sam

ravnekrogens.uko

Sharing

General

Malware Config

Signatures

File Explorer

e9b9e9b3ba47548c9f0937837bf16550f573c25f7405e8cfbf45519d79ccde4e.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Ejendomsrettens.caf

Frokostplattes255

Gandurah/stentrykkerierne.uns

Gandurah/talpine.reg

Loaning

Orthoepic.mas

Overvandtes.aut

bevaringsvrdigste.clo

earthpeas.com

forgrundsfigurerne.kon

oplivning.sam

ravnekrogens.uko