Malware Analysis Report

2024-10-18 23:00

Sample ID 220305-xa3m6aafal
Target 157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c
SHA256 157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c
Tags
globeimposter persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c

Threat Level: Known bad

The file 157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c was found to be: Known bad.

Malicious Activity Summary

globeimposter persistence ransomware spyware stealer

GlobeImposter

Modifies extensions of user files

Reads user/profile data of web browsers

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in Program Files directory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-03-05 18:39

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-03-05 18:39

Reported

2022-03-05 18:42

Platform

win7-en-20211208

Max time kernel

151s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe"

Signatures

GlobeImposter

ransomware globeimposter

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\ExpandImport.crw => C:\Users\Admin\Pictures\ExpandImport.crw.crypt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File renamed C:\Users\Admin\Pictures\ExportUnblock.png => C:\Users\Admin\Pictures\ExportUnblock.png.crypt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File renamed C:\Users\Admin\Pictures\MergeReset.crw => C:\Users\Admin\Pictures\MergeReset.crw.crypt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File renamed C:\Users\Admin\Pictures\ProtectEnable.png => C:\Users\Admin\Pictures\ProtectEnable.png.crypt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File renamed C:\Users\Admin\Pictures\SetMove.png => C:\Users\Admin\Pictures\SetMove.png.crypt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File renamed C:\Users\Admin\Pictures\SkipBackup.tif => C:\Users\Admin\Pictures\SkipBackup.tif.crypt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File renamed C:\Users\Admin\Pictures\CopyCheckpoint.raw => C:\Users\Admin\Pictures\CopyCheckpoint.raw.crypt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File renamed C:\Users\Admin\Pictures\DenyAssert.crw => C:\Users\Admin\Pictures\DenyAssert.crw.crypt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe" C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\PAWPRINT.HTM C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\TWSTRUCT.DLL C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.MY.XML C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0297551.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABELHM.POC C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01058_.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OutSyncPC.ico C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_K_COL.HXK C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239965.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL065.XML C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_hyperlink.gif C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24ImagesMask.bmp C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Essential.xml C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR32F.GIF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01618_.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105288.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152722.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0238983.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File created C:\Program Files (x86)\how_to_back_files.html C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\LAUNCH.GIF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\background.gif C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\TAB_ON.GIF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293240.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apex.xml C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\TAB_OFF.GIF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImagesMask.bmp C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\GostName.XSL C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101856.BMP C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106208.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\StaticText.jpg C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME15.CSS C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME25.CSS C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\TAB_OFF.GIF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10265_.GIF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Slipstream.xml C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00419_.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0160590.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL077.XML C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left_over.gif C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Dialog.accdt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\VelvetRose.css C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\QuizShow.potx C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\HEADER.GIF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\HEADER.GIF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15132_.GIF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01138_.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00919_.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART3.BDR C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\BUTTON.GIF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00957_.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\how_to_back_files.html C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\how_to_back_files.html C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBrowserUpgrade.html C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE_COL.HXT C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21413_.GIF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02068_.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107192.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0136865.WMF C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe

"C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe"

Network

N/A

Files

memory/1932-55-0x0000000076511000-0x0000000076513000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-03-05 18:39

Reported

2022-03-05 18:42

Platform

win10v2004-en-20220112

Max time kernel

152s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe"

Signatures

GlobeImposter

ransomware globeimposter

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\JoinStart.crw => C:\Users\Admin\Pictures\JoinStart.crw.crypt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File renamed C:\Users\Admin\Pictures\OpenCheckpoint.raw => C:\Users\Admin\Pictures\OpenCheckpoint.raw.crypt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File renamed C:\Users\Admin\Pictures\RepairEnter.tif => C:\Users\Admin\Pictures\RepairEnter.tif.crypt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File renamed C:\Users\Admin\Pictures\ResetRead.tif => C:\Users\Admin\Pictures\ResetRead.tif.crypt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File renamed C:\Users\Admin\Pictures\StartConvertFrom.tif => C:\Users\Admin\Pictures\StartConvertFrom.tif.crypt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File renamed C:\Users\Admin\Pictures\ClearStart.crw => C:\Users\Admin\Pictures\ClearStart.crw.crypt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File renamed C:\Users\Admin\Pictures\GroupWatch.png => C:\Users\Admin\Pictures\GroupWatch.png.crypt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File renamed C:\Users\Admin\Pictures\HideJoin.tif => C:\Users\Admin\Pictures\HideJoin.tif.crypt C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe" C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-72_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\x.cur C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\ui-strings.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\ui-strings.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_ca.dll C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\ui-strings.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ui-strings.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\how_to_back_files.html C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_checkbox_unselected_18.svg C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-96_contrast-white.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare71x71Logo.scale-200.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\ui-strings.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-48.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\ui-strings.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\skin_beeps.lua C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pt-br\ui-strings.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\main.css C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\ui-strings.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\MoviesAnywhereLogoWithTextDark.scale-200.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBarTasks.winmd C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main-selector.css C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner_dark.gif C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LargeTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-16_contrast-black.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\how_to_back_files.html C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close2x.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\it-it\ui-strings.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\ui-strings.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter_18.svg C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\how_to_back_files.html C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_pt-BR.dll C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\AddRestart.ex_ C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-24_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-72.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\how_to_back_files.html C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\how_to_back_files.html C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\exportpdfupsell-app-tool-view.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-72.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\how_to_back_files.html C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-si\ui-strings.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\share_icons.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black_devicefamily-colorfulunplated.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\en-US\webviewCore.min.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\how_to_back_files.html C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_hover.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\how_to_back_files.html C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\plugin.js C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\how_to_back_files.html C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\how_to_back_files.html C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\how_to_back_files.html C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe

"C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 geo.prod.do.dsp.mp.microsoft.com udp
US 52.184.212.181:443 geo.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 kv801.prod.do.dsp.mp.microsoft.com udp
NL 184.29.205.60:443 kv801.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 cp801.prod.do.dsp.mp.microsoft.com udp
NL 184.29.205.60:443 cp801.prod.do.dsp.mp.microsoft.com tcp
NL 184.29.205.60:443 cp801.prod.do.dsp.mp.microsoft.com tcp

Files

N/A