globeimposter | 80de97c40e0f1a1fe2577494fd58f950333f38429501a6a0091ac5073f04b841

Analysis

max time kernel
105s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
Size

53KB
MD5

c68fae1bc0f9c1258fa63c42401ef194
SHA1

e019a08ea29e2124a336bd9ba57ff34a0da10183
SHA256

80de97c40e0f1a1fe2577494fd58f950333f38429501a6a0091ac5073f04b841
SHA512

13d37fb9b01db9d44381ebbfa512a4f612d29ca403e266b453fc7e87fc4b7ff3bcd7ea745be0e4e57e6a4e1ca0a97ff6fd07818756585e9479da3641e2470725
SSDEEP

1536:KjkfV+KJolntwrbDSTWvTwhQMhmpdLZTh:K4fIKJolntGDT5qm3LZTh

Score

10^/10

globeimposter defense_evasion discovery persistence ransomware spyware stealer

Malware Config

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter
Globeimposter family
globeimposter
Renames multiple (9068) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe

Executes dropped EXE 1 IoCs

pid	Process
2020	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe"	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe

Drops desktop.ini file(s) 48 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1062200478-553497403-3857448183-1000\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1062200478-553497403-3857448183-1000\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1062200478-553497403-3857448183-1000\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\WebviewOffline.html	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-16.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\pages\wefgalleryonenoteinsertwinrt.htm	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XDocument.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\READ__ME.html	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\MedTile.scale-100.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_contrast-black.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_altform-unplated_contrast-black.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-cn\ui-strings.js	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_move_18.svg	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\Sticker.mp4	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_highcontrast.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square71x71Logo.scale-125.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\inline-error-2x.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Light.scale-400.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-256_altform-unplated_contrast-white.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-16.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\zlibwapi.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\ui-strings.js	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\new_icons.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\caution.svg	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-150.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xecd2.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-64.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\WorldClockLargeTile.contrast-black_scale-200.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\OneNoteFirstRunCarousel_Animation1.mp4	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-100_contrast-white.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-32_altform-unplated.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_altform-unplated_contrast-white.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\OnlineMediaComponent.winmd	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\READ__ME.html	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\READ__ME.html	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\2876_20x20x32.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailLargeTile.scale-400.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\done_listening.slk	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libvmem_plugin.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\ui-strings.js	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\mfc140enu.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteWideTile.scale-100.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\READ__ME.html	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-30_altform-unplated.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageMedTile.scale-125.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\30.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 6000 wrote to memory of 2020	6000	cmd.exe	88
PID 6000 wrote to memory of 2020	6000	cmd.exe	88
PID 6000 wrote to memory of 2020	6000	cmd.exe	88
PID 2020 wrote to memory of 1360	2020	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe	112
PID 2020 wrote to memory of 1360	2020	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe	112
PID 2020 wrote to memory of 1360	2020	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe	112
PID 2396 wrote to memory of 5912	2396	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe	111
PID 2396 wrote to memory of 5912	2396	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe	111
PID 2396 wrote to memory of 5912	2396	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe	111

C:\Users\Admin\AppData\Local\Temp\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:6000
- C:\Users\Admin\AppData\Local\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
  C:\Users\Admin\AppData\Local\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1062200478-553497403-3857448183-1000\desktop.ini

Filesize
1KB

MD5
9c40ae028afa85451485146cf67df19f

SHA1
4a3c1ee7a337efdf3d9b3c0871e1dbacf6cdb0fd

SHA256
883aeb33c835b6e9c0bf8009629b0892cd15b16692333cd72f0ad6f04968e08e

SHA512
c4feee66981d588d30d1a01c64e6acdddca9c4697fa1ef6180f878043673d38a41c9c2ed9ab5aa4ad6f44c2b05913a5437a21f429b075a2a66f2d524382dbced

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_ok.gif

Filesize
2KB

MD5
84f292df4245715d764c8a6c221e8447

SHA1
5678bac50e9060d4f72e274496118ffee53cba7b

SHA256
1b81b6eb9ee13f63c0b3b4bbc30f58f75803a08e8bdd95312e2da36bbe7d333a

SHA512
e84f3b452ece3f57f7cdb8c73ed7d1228461f34a78e6b46c5963ff6527a775e59705fc6339e4d76c82e18807a9f502cf741db75587007cd9b8c21641454014dc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\SearchEmail.png

Filesize
2KB

MD5
2395108f26c1d92f370e6b2c3e97b6a3

SHA1
f3dd495ebe912252d98813a3c0797e8098004473

SHA256
7da17bcfe7c16d2a998def30ca63ea460462ca2593fe4a03a6a8615047930999

SHA512
10c9eb09082347c6890eeee05f11a789e0bd848c9e09f3e70b7e3c7e3ca6a5ab19f6cdca70eac03292aa0ae95ab82a7637bef6dc07c594c1e7ec1477f5c1081d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js

Filesize
30KB

MD5
0a720d8c5ad9ac34144db92fb481f407

SHA1
193faeaaaefb22baa3a86508fdc1e88e12767900

SHA256
4bada7b4368d2ff02ad629d12800c013104af564b8fe353a4683f682b603ddc4

SHA512
2f200953e71f1ae5315561cdcfdbc1c0adc8e903ef9832b04a743eb9fede95af58d7bd36f41f5849c857e6bb6fd3c0269a3a900c6b8aff942cbc502bfbe2a2af

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\ui-strings.js

Filesize
4KB

MD5
e9298aae86c5e27f0f0cb6aa79bdfb0e

SHA1
385453b2cbc55f33b8c2674bd080ea5cafab9bc2

SHA256
8ff93345c86f2a69dad5d54e7197eef78ae666e04de9c5ad5d5688a4b753207a

SHA512
042e376b649c5611061d4d316e5519d06c95f57bd642fe85c183faad5b9a34c84cbeef020def07b745f9df6c183e15474145e765a676480f6433fda6c676feac

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\ui-strings.js

Filesize
2KB

MD5
6806dc8562c189fc7a59f301d7bf9af8

SHA1
2b08c9b62c25c934aeac197ce240b81a822da0c4

SHA256
c58358b444a7df566aa5352fcc339d7b5483dc0092c9eefae3165855d3860aad

SHA512
3657d6f7ee579870df9f04adf4315d6bb509614c2676b9b5b295b02f2a974a8bbd37b682208d03b476192a90822848ad50c37879633a236716d17015d2b7fc9d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
2KB

MD5
897c87a126e4a3c23337539f04d888bc

SHA1
1a42c0d301fbe288e5dbd5c8f29eb7b4836db75a

SHA256
ef9a414d1f19174fb0d820fa9d74e572f50ab6a762848ac5f98db5ed441cae46

SHA512
66b43fe7a6d656f166cb44cc909b7942f1fba20f4fc108e764c2171aca84c74a6f3fb635d3731ef86673d7823edbf2f129aa1d2ac78a4c21ca32421e345cc8a3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons.png

Filesize
9KB

MD5
47b25c6cbd35987b0c1ea1be1a6c1f29

SHA1
fd7c7d3a157afd33d9b4ef9269af2e7149ce9b08

SHA256
9f5a29817ed2c7d7d62c12f847939b907bdabd89e588cbecdd078ab6b8d8ee2c

SHA512
ae999f67f31a61d1e30c53a154070741025c68a539adacd3bfcbd55683a22ecad33ca9e3fa323a7c21ef70026d1806b8c844d055670bf68c9af7b8d39bca6c45

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\forms_poster.jpg

Filesize
65KB

MD5
165ee2029970b3aaaf76b594cf6eb320

SHA1
c2b2ba318ef08c8223e374914606d60a6a8bdfbe

SHA256
b2df95aaf6295b6f4fdbbd82b6ccf6eca55838a74bc9d0737300830799c36035

SHA512
cf467cf66b8288888dc2e94baba3de052b619f1a18e9c03202f72d38ccec38ee47a7ff628b6a483f1cfb59b6fde3949136692444308fe5f2966143a682af54f5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\az_get.svg

Filesize
8KB

MD5
3d1ef86cd065b59cc55998d8a397a0c5

SHA1
e5d69e226a99ad37e11694fd6dd7a36f3d12e1b2

SHA256
601543188d969eea647a3a1ecbcf9ff6ce8bc1a38d094ce3e83cb9df6ca20b09

SHA512
375eeb9afc017c5655ee3a4e0406572d056a5387d27992a0b58332864b0a755df508127367f9661336760d0fef6fc4513197d0b7eb32e9e2416003c64a49e263

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\chrome-ext-2x.png

Filesize
29KB

MD5
5f1f0cd3b4c8a172c234bf8daf97e3d4

SHA1
57e8b9f56ecec4e175745905bf75981b4299e808

SHA256
af6af05eaaf994d6ef29b26fc2d5ef9c736414e6a4d6d0f51769f5c69b1b447c

SHA512
92a7f62a9f7369291992c7927ffcfaccefd633390f515d6f7fadf6d01fc86003b77042b0a3601193d70dd1058a1d54afe778300bdb45a929479b6fd13c0cdcb3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\ui-strings.js

Filesize
2KB

MD5
30bebec0379625e69f98016586cd455a

SHA1
ee1fe85cda573543b68fd021ef47cd064fe2ebc3

SHA256
12b1f429be00ebcd20d5fd3d8beadac49ffdb708af9b9beff1e34b589bb03a47

SHA512
87abec4e02bd49921f5349098733fd0f11a9f1a25a118239e2c689d9d8dbf6a003f818092bdb5e914a0670be62b673ffa7c3c37a7514f94c56b0c22c68a764e3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\adobe-old-logo.jpg

Filesize
36KB

MD5
735dbac75750bd42ef86c045db4de8e0

SHA1
d1d2d25c9df2b65253296df0abf69e0317e243dd

SHA256
5da1a2839fe6d95d8cd5193f8a481d8cd1db808de3a2c6cb4887160c958af9b6

SHA512
101838777299b6ebd78260d2cc6dccd33f90004e95c10ba3e43a09b8357a2cd353277deccf85d8e2d0a60f4881ef7589ddd672826dea78788d7a4c5cd18e6abb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo_2x.png

Filesize
3KB

MD5
504f1408adc032b7a0812a7ec1b95a79

SHA1
211328cd325fbdedc039369ff4e6d90a2421612f

SHA256
f8964a75a4f90b436228047e06fd3728ec11c8453927ad7b216c9c8d1e89a588

SHA512
a8cec170958f8fc26de6302acb8a2a669a1a10ffbaed6c5f4d76fde6051ec73202aec8101ed597a4c92ccc3ec1972cebb062a115872870063b7ae7de4b04b6dd

Download Submit
C:\Program Files\7-Zip\Lang\vi.txt

Filesize
9KB

MD5
904c2b06d844ff7175dfbe04b7af1519

SHA1
21ea200fef6f479daff64e047a727eb3e409bd36

SHA256
dfedfb3a10d2619a13412570dde68c47bb998b1b1fa988d25980e87d4c9ddca4

SHA512
3d8d7a403c0721560dd17f0a16c476bc4453284747208e974031d81b444e921b8c875189efaf845ef577864bd43d434630a2da18c4f69040a2c0bd14c1c62dab

Download Submit
C:\Program Files\7-Zip\Lang\zh-tw.txt

Filesize
9KB

MD5
6cb501424bb4f283dd87de3803e0fd80

SHA1
75cc7463674afb3be0ddb165b44c31c82be5ca12

SHA256
4de5a88ab83a84d4cfd7fd1678844791e03a863c8a2ee25843e2dad7ee1ecec4

SHA512
29f24839dc78077b0546ed0a6c7375c586f545f103b95748ab9c45a763fe66f9d8d0810936c96bd7e15c406685119396f8ba69960ba53dc81e0e3a67149f1307

Download Submit
C:\Program Files\Java\jdk-1.8\bin\policytool.exe

Filesize
25KB

MD5
fc5dd55cf18eb5bc6aa83cc5af5808a3

SHA1
1a61ee49a9061ba9e1ecd9a63518fe1ed0f6835d

SHA256
96fe27b50f13b11ce64b7ab95a08b86cf6ffef6d10262007d4e43bf1670b3f5a

SHA512
62a37433b83b13c90d0477bffed3749b370a62e9433d31e69a95fb05683120762706104338c1c609c8c9bc0f487295fff454252d23d9a5e1a2d09ec05289f675

Download Submit
C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll

Filesize
13KB

MD5
aec986f139b32e2263f8e993450be864

SHA1
61d0ed65a8c43a1cf769be167a0db73f9982b449

SHA256
9971270021b63ea9ca529877832cdc34375fa37d35d84298ca33594dbec9b7f0

SHA512
45b3ba893d4560d97a8bdcc232465b42afeed48d3c1289c7357c1de866750b019359885a0638ccfc3caa40eabe3c95996abb31cbe7d8a8e0af5805c821108557

Download Submit
C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll

Filesize
32KB

MD5
50eca30830f78b5aa05bc1f629df207e

SHA1
7cefc13d6eeec2b0308a98e10d36db2233e1aa07

SHA256
1e1fd70f693eb8d5182b07dc0ac26c927868ad0abf9b102695fe88ab485d1332

SHA512
ab617c7cc0f9c1f5e92c61ec5e26d0fa7369034035a711cafc31e2c1bf86a0432f8bc4c3720361da66cfc32089c81036ed91701c119b7539e6f24f1b511817b8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
2KB

MD5
8314b732e956c7d1255766d4638aa3c3

SHA1
3e2e452e344ccced445f02481dab3dcd9532ff9d

SHA256
235de7b2c6b3e67a1f17053005f8931f8211b4f90e50fe271b8e6a0fa48570bb

SHA512
26b81c89164522bca12983edc92fe8f6d20da7c728c7c5f90545f5f773d4062d0203065644c8862ad28506921088c4293703405ee190d3d7cc56ca85ce259b91

Download Submit
C:\Program Files\Microsoft Office\Office16\SLERROR.XML

Filesize
37KB

MD5
4887c90889cc540b93d3eb3d5e059706

SHA1
a2c7ad0b50e2bc7dee2b78ac33b4783703ac3874

SHA256
a9a6b5c23a1bd015efff087c1ee9ecee540d12fb5a3ef50ee302d55b5529a9a8

SHA512
e7fa9e55218458f346319865799ebcad597fdb170d67da2ef3f95baa02e750570c368907ca55fc48473839081d9f9ad37dae6ce02919eaeab3bcd0dc4e467af0

Download Submit
C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll

Filesize
1.9MB

MD5
586c3f7db386efd40baa0a6a096493ad

SHA1
153f6015a4382bfa8bdafb72e2e1f456d08a4937

SHA256
4f629e16a36aea2577d487923545bcdbce4724132f81aba090dbca548fdf1ef3

SHA512
ea4f658a5fb45525a6f77135c0025432371f104e67f31274417642b9df31dc6d3b1379c8e9d44732177d472fd308c221145df8075b8e2d17fdc69fa05d95dc7a

Download Submit
C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll

Filesize
2.5MB

MD5
448fb60b657141f7e3ca35551c3ba9f4

SHA1
80e8f146a473e8c5f3d4dce2262fd4a8a4c62b44

SHA256
6f2f5e4c6d85420eebc94c5f5b8fdd012044a00362a4474fa1acae492477450c

SHA512
f10e62a3177a8e1add415df42671e219270026ae0d6cc7f36b601978d62132f5a1350adf3ee1eac32b4ba0cc93d3a286a490dd78df6dfeff40eb1d77bdcad06e

Download Submit
C:\Program Files\Microsoft Office\root\Client\C2R64.dll

Filesize
2.8MB

MD5
d765e825eba5a4c62e7a0b1e50ec4d77

SHA1
3da1c6ba3d2d43620f8642da4730ee5cb4f6bb19

SHA256
70c9b8d90c685df17796c5de9f8ba3ad1b66b8e205979c7572eb9cfe57e31b8e

SHA512
fedfb16c2fd79bbafd8b862e464b9ecd914591f0dde30cf7214ec0df756fdb06abe62e6bb4550329388b246b34a84f017ab625dab28046782c52a19904086469

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms

Filesize
11KB

MD5
f611895714dd181ff18164c123d8516f

SHA1
278cc099b753ba59bc44e9f86d244eda7c510473

SHA256
cfbd3adf89460839ea97194915a03ec86bdd774384d698b6f4c2fa9d8abe8148

SHA512
62af4bd7928b6d816b265b612a1d3d21fb2c8df847914249e933edcc6992f4d3fc4f42da66ec86abb09ecf02a26c291c650a003b19a64dedd5f03eeb7dd82290

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms

Filesize
13KB

MD5
cfdc739d4f0a002b65317a3e9cb993ce

SHA1
9fe4423b89b5bf638494798f1093ab68b6e6d55e

SHA256
9ad02fe2c0a91fe58625e64418db10238c0aaf5746c89ef75975c47ce654f231

SHA512
55843894c406c4e71589512da281e1e588648b5cff39ef7e95f6c9945908206e37cfe093a1826b79f38004251940d85553a1eb1030c459e57a67fc3aacc65327

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms

Filesize
13KB

MD5
ea5b00c55dc25d75161cf28b971f4696

SHA1
f3d823e31bc810eebfc217b73b435ff4e0f0078d

SHA256
7087e174bda033ae41b4d377c1a4d5c1c1f2fda0ff46f54598d5a31823ccf270

SHA512
15d3036413f879f0ce539a11196634867388ebebe3415211551f494f5aa29d533c481204caf055b91dbc28ce61693c5ab642f8a7ec229290fb6ffe09ebc8e0a8

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms

Filesize
27KB

MD5
7715c780b3b29264367182e4497e3a8c

SHA1
1df7e591c83814172697bdb40de3bfe6b775e2a2

SHA256
591b741c924c359a33d502ca54873c6383fa8cc856aab80ce735a75fbe323fac

SHA512
21a987e6764c6b02fc5c7939ef6b0dd18275a0372dedd2ecc3e17d3cb54db59186b4cf4105122b0dc7353f721b0dfbf8b8b033674d679264c86c54a1f4db71cd

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms

Filesize
13KB

MD5
d4d1e25bd607fdbe3e8a0f8dc44d6974

SHA1
c93488c07fb1c1f012e2fd010d29dc95e1fb8537

SHA256
d3b73acb8230fdece5c35e4bc987d4f4f5880fabed4396713ab2039b9adea37d

SHA512
e1d0f6d038859ade2f1cb2ecac7df200a8ace8de90fc8fb3630cb767ae1f37ffd3198963b82262643470f4c3739045b155f5d37b6a62f1b480abbd001b26d376

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt

Filesize
41KB

MD5
3cbc0b17ad7257cf45905319e8fcaa83

SHA1
15fe7606a71413cfd89fb12027696a4546d6b993

SHA256
ed21db94cf0563c27db8feb518114b5e62bcde46560d9915d7e32d601786d6f1

SHA512
481465cb202db1d7b1950bea553bddd9514036e2183aa3d314bc552c8abfb93ecc30fe9a1d9e4f212bbf27e537e1ac708c59cc2c43c6292de65c130633d5bc2f

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll

Filesize
56KB

MD5
8e0c01bdcf4b5a75795b484fb90829a6

SHA1
be1b6e8b810bb678820286b957153d5c544dca05

SHA256
ee52cc663b3c8474a95e2946f161e8fc16b7ab14f51b90903e3aa3a2b6163c9d

SHA512
60957220ca27035ee967f0a907b1cad8427581fb5c7f3aaf7a4b36ff1e4704992662c519cf7d6f03b8e5c482f63cb03f330f55b2e40c31c2b7ad91459e3e566d

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL

Filesize
47KB

MD5
89578f2627c37e5bf03ed9dd212751db

SHA1
209569d981e47c05c7604cc1ce1850a34212ace1

SHA256
af446faf8caa0aa9ea007af29f0dc430e5a7ed0a438989b41f495f57cc9849a3

SHA512
18e1c87df3b83fdcf11461d3391129f5c260386f143a848d614d58b4ffb5d025744e12132dc0dd0291daea74ce977698feeccbadd590e2f22db884d131706a12

Download Submit
C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html

Filesize
3KB

MD5
18e7ac82a33e45a8c4004e1653df58ce

SHA1
101eecece8af5f686f4a1d65e3854b6150a0c327

SHA256
c62cdc824885072d4ff918093fee5a878b4f6f11016db915eb14c0f4cdb8908d

SHA512
e5b880723e291306a3f3d8810a56de9e6b32166983f8b59140612b2266b53a38811662a969a8dce0ac11e9e1a712d9c9d2376c9cde609472205db6620151f37e

Download Submit
C:\Program Files\VideoLAN\VLC\lua\http\view.html

Filesize
4KB

MD5
b13fa1e2604886fe7a69a88c8ab54307

SHA1
3ca331c8f6c209e0f18bd67d307fcaa113d30ca8

SHA256
b9a9714b99383c9d46955b192e61826eb093b562fbcf85bba1182080789b4b31

SHA512
e988a86acd464da2dafe040361e83118db3be1267670de0a1d74039fb0798faea456788d8a1b3a889863364b70314c0f133196e0f378ec6676ced617b786abfd

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll

Filesize
50KB

MD5
a6021898d4161649e5970b059bffcc7a

SHA1
18407f2a4669b618bf38c4729fd9d2da3851e1cf

SHA256
b024ca293c165155fe26b1a32d774e3243f843c2975d03485e5d4b1f642d45a6

SHA512
ef8df3d290c814eb3f1cf75b38fb91e4f9c30456c2ff77d1ed0ae2caa9aa37adb737507b354fb071f6797770cd0f99f3185fcc8772ce719aa92b001669ccceeb

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll

Filesize
51KB

MD5
4432d15bf7a864448fc198bb935c5ab4

SHA1
e431814df1b1639776fa662f738ef9c22c4e7b99

SHA256
ea2e44c2b3d33fdaf64faa76a6f8b607aafee2e199ba3fc12a70bb80af688b51

SHA512
33459e2f348d8695ed4904dac6be052878bb842a731c65b71ce871b620941033c1ff8022b4f91a56bb27d960e501bc005dd9e89fa765aad1368e22bda927e918

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll

Filesize
24KB

MD5
4a18bf265bbbd97f3ef5b0a61b638b5e

SHA1
3774b2f8f4ff7dc6f0c01f0c07344bd84f1d4fd7

SHA256
6afa08ed5b52a7cc9cbc8b3e3b8fbd79f8bdc3ae56da619926393e443a21849c

SHA512
e43307ed872df09c92d87c23ceff7c1d5ea54e744f4b31a0e6db6e03ad137c79743094a4598f903880e7a0cbea022ea9464a43c0322c6d665431e454dfce7735

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll

Filesize
17KB

MD5
70b95ce03f0e004223d171374c1ce2f0

SHA1
321a069e9092ec7e5b0c4457cc24dbc5c21d5915

SHA256
6ebb480afd8545e339c2f2b9c0770bee19d1db39d630516051f2c8d7e746955d

SHA512
be0949f71c1d8ca98b3204efd19f150df459a5ba5013fd456f94b6d45c341f23c0932f1c85283d0ae051e06200261c2b9b7d16d4b4ca820caa1b7b6ba99fe044

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Csp.dll

Filesize
16KB

MD5
dbe5ac7e6c888665860007192051af3a

SHA1
b3afc36f82569d626ada1c0f79fbdb9870373168

SHA256
15c1b80b8d5450e1a55b297251cd2a43384b42642b6c0a816a930617ea7450ad

SHA512
8456a4fbd2eacbe26ef50dfb6a0b5f58bff7313080fe53f0c1920d68ed6b387cfad52c5712e77deb140460a20b0a194b539c894d413bbc871872c70d697d0876

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll

Filesize
17KB

MD5
e4eae20f09e61843131ca44658854621

SHA1
332b162b14782d01bf0448ce4993a55dbbb4f86f

SHA256
132d3f0eab53bbdde9640a1a27f6eaa63a4859630d6c9cd07712b8c6419e6ef2

SHA512
17127e03ccd8861658243727eeb4dda1b433878c322ca2fab70894d7beab2639c7cdb9b75c9fad051b9f86d716edc5ecd8e268ab50c76236f048fcdb2cb5567d

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json

Filesize
2KB

MD5
424dff56c4d83c9a24a55c40f1bd55b1

SHA1
564517a96ed4051cfcfc0cf6d2ef0b542ef58eb3

SHA256
14ba4cc10f76806887e746aeebe39f19069bea080b1b4fb46a4266f934c8649a

SHA512
5592d2d56d3adca8bd77bd49f543a0d2e6a75876dc46ac73fa5996efbbe3fe1fe91c407a6bf5fabc4c904dccfa065473c47596a1a9bc0bb66b7551ca1a4d1be5

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll

Filesize
22KB

MD5
058027df0e1018fe60dd562719c278d2

SHA1
3f7afe85b6caa39ad8750f83135db7fe03985fbc

SHA256
cfb26c2564615531957f146ff7a0fa18c0cde5678b0c4c876e6737fd1df6344e

SHA512
0494d30c34a1e76f750b0a3b6a2821b857a666c5757b2e10228489339ed4a3a42be0384c07b4f5cf6ee0553ab431e4315850b298cf38bd8abd4ffe643c4f2057

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll

Filesize
39KB

MD5
ba39f7104b6dc6cc92ac7adc039ddf32

SHA1
8344cced66384ac2c9863f7dd4ec32542f3a3953

SHA256
95b1be6a4c4c5e6b781444f3c2064035f4cfd4416d26a3281b88c477c11c2a8f

SHA512
eed922dce20f6fcb62314cbb2d3d88e8a85d7a98da71c537af8cec49a4545685116e25b7519a2209389df1b0e2208756bbade5f6f5b12b4bf395006674cba9c1

Download Submit
C:\Users\Admin\AppData\Local\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe

Filesize
53KB

MD5
c68fae1bc0f9c1258fa63c42401ef194

SHA1
e019a08ea29e2124a336bd9ba57ff34a0da10183

SHA256
80de97c40e0f1a1fe2577494fd58f950333f38429501a6a0091ac5073f04b841

SHA512
13d37fb9b01db9d44381ebbfa512a4f612d29ca403e266b453fc7e87fc4b7ff3bcd7ea745be0e4e57e6a4e1ca0a97ff6fd07818756585e9479da3641e2470725

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat

Filesize
9KB

MD5
65cde233c9fb1e2238e076e8d06f984b

SHA1
825b55e3f980ee47734c1a105985d844a16c2eb7

SHA256
29ab5a6e223603985aea16e034326a00c969868c2ef535dc0e963bfc03c93368

SHA512
121f63e37372dd7f8fca5be4deb31888fef9caa69e039767865add7df41da6f10b40acc9384fac05e8a0b79769273bc557bec43ecf4531a16c9fd0f80585ecdd

Download Submit
C:\Users\Admin\Downloads\ResolveRestore.dwg

Filesize
445KB

MD5
90be7d6a7fd76fcf48bdddb0b5ccbf4e

SHA1
d5a630ad2330d1cd2d1adc29f04abaa860699f53

SHA256
2802c393ccdd88e8653abb4cd923569517b1539dd09386dc4490de2291815ba3

SHA512
7c3272b4a40891720c6cab1efbd6b976e7d7e8f264cc51c9d61d64198ab24ca6ba6cf2354916c523748d069573ccadb9a32cb7fea54ca7c6025589d2ee4a0d1a

Download Submit
C:\Users\Admin\Links\Downloads.lnk

Filesize
1KB

MD5
ff0145d2898f85f3491457a899133cc0

SHA1
79af1dbf620c889cf2b78851b4aeeabf30668fdb

SHA256
f51d75b6ba925e7a2f76a54b231a4961b8f96e2ee3f3ceb1dee748238c01365a

SHA512
06f42b250508956f1c91a329c98723dd7f9892835c7c5d9c4b518c13d43d8d94369156cd2418fcd26795a3ddf02c55bdb9202eff58c3286cf2901d65965299dd

Download Submit
C:\Users\Admin\Pictures\MeasureMount.ico

Filesize
481KB

MD5
4707378e051a3891753c895e65a6d405

SHA1
45fe1747b1c589aec335af0791ffcbd600d20b5e

SHA256
9bed6d1220e831518248cd7a2a82387fa95bb9ae466a16a80bee8c82760d9633

SHA512
37a37f421df9b921eac737e192d8a56b762b7bc51c3b1090fa33dcfd646fb8994dd565cc8fef8e3908bb6043b153523a24b554941e0f0ffaa11f066d3b97a421

Download Submit
C:\Users\Admin\Searches\Indexed Locations.search-ms

Filesize
1KB

MD5
4df25591d584d5a206e035528d5d1065

SHA1
e12a64de281789e82231d1a0150e6338cc0a71b9

SHA256
f82f2b4722c58e435019aaa8a563dfa6166adedf01fc2d39324b455cf2afa906

SHA512
48962279165a10f810247cce552f697b90e47072c90c4fd0817771cf40f33afbe963a3dfbe6767fd9be4f7f2af6635f88a445b2e97253fa8576f51533b427910

Download Submit
C:\Users\Public\4293265C6816E1A702A69D5E1BB5D263CA16B95AB563D3FC9E90545FD7ACE20B

Filesize
1KB

MD5
63d57371cee82033c6fb99b7d0ec84e8

SHA1
13b6079424430272938fae73c2d96b65df529933

SHA256
bc8358d8e57c9da514cbec68e336366d151a63f3c708a482c1ef900a63b5ccc1

SHA512
290a9ab9709f8cc111f22a2743390697ef95265e3c67e623b005410cea9c3e38f1bc312c5e2372307b3cbf345ae0f8084cfee142fc0309c44f1f5849565a21db

Download Submit
C:\Users\Public\Videos\READ__ME.html

Filesize
2KB

MD5
a99eff9772083dd6ac0a04366cc3d966

SHA1
8e2b7f42a884b8dc0f84ed16c8bf422252ebb1ac

SHA256
1a29d80369909be634500d84a7d60163ecbc5ff6054238a3168a85b6c863799e

SHA512
e7fd07ae0d57e40992db47fb916ea3c06dfda555facfc5919805a7a24cb88bc6ac5a22860c4890b486ff2c593893703588921d3da1c6783a22d08710c0b8c96b

Download Submit
memory/2020-1474-0x0000000000400000-0x000000000040E200-memory.dmp

Filesize
56KB

Download
memory/2396-1227-0x0000000000400000-0x000000000040E200-memory.dmp

Filesize
56KB

Download
memory/2396-0-0x0000000000400000-0x000000000040E200-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads