globeimposter | 80de97c40e0f1a1fe2577494fd58f950333f38429501a6a0091ac5073f04b841

Analysis

max time kernel
104s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
Size

53KB
MD5

c68fae1bc0f9c1258fa63c42401ef194
SHA1

e019a08ea29e2124a336bd9ba57ff34a0da10183
SHA256

80de97c40e0f1a1fe2577494fd58f950333f38429501a6a0091ac5073f04b841
SHA512

13d37fb9b01db9d44381ebbfa512a4f612d29ca403e266b453fc7e87fc4b7ff3bcd7ea745be0e4e57e6a4e1ca0a97ff6fd07818756585e9479da3641e2470725
SSDEEP

1536:KjkfV+KJolntwrbDSTWvTwhQMhmpdLZTh:K4fIKJolntGDT5qm3LZTh

Score

10^/10

globeimposter defense_evasion discovery persistence ransomware spyware stealer

Malware Config

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter
Globeimposter family
globeimposter
Renames multiple (9147) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe

Executes dropped EXE 1 IoCs

pid	Process
2992	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe"	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe

Drops desktop.ini file(s) 46 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-446031748-3036493239-2009529691-1000\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-446031748-3036493239-2009529691-1000\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-446031748-3036493239-2009529691-1000\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\ui-strings.js	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-16_altform-unplated.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-125_contrast-black.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\LargeTile.scale-200.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\MedTile.scale-125.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\SmallTile.scale-100.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_download_18.svg	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_TileWide.scale-200.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\CopySelect.css	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerWideTile.contrast-white_scale-100.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-left-pressed.gif	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-white_scale-200.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradient_plugin.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\quickreplysend.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jawt.h	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\WideTile.scale-200.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-200_contrast-black.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSmallTile.scale-200.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\MedTile.scale-125.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\s_agreement_filetype.svg	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageWideTile.scale-150.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.altform-unplated_targetsize-32.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hu-hu\ui-strings.js	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\ui-strings.js	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-60_altform-lightunplated.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\hero.jpg	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_altform-unplated_contrast-black.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-100_contrast-white.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_altform-unplated_contrast-black.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-64_contrast-black.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\adobe_sign_tag_retina.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\cs-cz\ui-strings.js	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_removeme-default_18.svg	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\stopwords.ENU	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.boot.tree.dat	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-default_32.svg	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-dark-focus_32.svg	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\39.jpg	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\next-arrow-hover.svg	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-48_altform-fullcolor.png	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\READ__ME.html	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\HAMMER.WAV	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5740 wrote to memory of 2992	5740	cmd.exe	87
PID 5740 wrote to memory of 2992	5740	cmd.exe	87
PID 5740 wrote to memory of 2992	5740	cmd.exe	87
PID 2992 wrote to memory of 3248	2992	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe	106
PID 2992 wrote to memory of 3248	2992	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe	106
PID 2992 wrote to memory of 3248	2992	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe	106
PID 2936 wrote to memory of 5908	2936	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe	107
PID 2936 wrote to memory of 5908	2936	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe	107
PID 2936 wrote to memory of 5908	2936	2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe	107

C:\Users\Admin\AppData\Local\Temp\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5740
- C:\Users\Admin\AppData\Local\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
  C:\Users\Admin\AppData\Local\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_all.gif

Filesize
3KB

MD5
d85cb31a0a1c258be1a964d94bf9cb9b

SHA1
83debf146bd583c676e058e9cf48381d3c25b574

SHA256
388edf74a1e0fe65789fa69c3b8f4842516a959293a7af35ac05804a0d3b3321

SHA512
b7456fdbecb274d7dcc36031a38f6f6952258357c845cbec8094fa342afa985b025556ac53f31a75215bf0561b38b7e7bc6c3f39d1c5896e29b23a9e31fa1e78

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\organize.svg

Filesize
2KB

MD5
d9eac06bec1d2c5080e5b2045eda1f73

SHA1
0618e64ea778d186bee070e0dbc9d14167d22c1d

SHA256
cacece71ba27020b8c69c0062afe348a6f20d16c837c148e3366497cbb7ea5a0

SHA512
f4b3231a6dd7f0ee65025c982d5c5ec4314c6c22d2d0a8b04cdf1004e206241073d79b1359a0c9b0546786d3329e9007792ad2d8da9c2164e9cd9e844a69a844

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_editpdf_18.svg

Filesize
3KB

MD5
cb1ec02d972d20e5f9e65929c5fba599

SHA1
0db38557e15ad40dfb48d34d75d6575ae9222483

SHA256
49d3ab5f1beda0df115b96598018cd6fda77788a01d4f56e9b42b859b60e14aa

SHA512
69ce2b59fed88a7eae4e761908b7078f0adb3aef224418a4411dc8688ea25acf5e0bd28daf10f3b39ff63ee6c212dc8bf2977ccc8025d38d39e2aacdc7a369d9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-disabled_32.svg

Filesize
2KB

MD5
07df29f20fdcff1489c4122c4f9342c9

SHA1
be3df19f7439f69a526d7ad75b82d5db42ed087a

SHA256
da21f0388a1290f8911551eaf0b5e187e74e3eb870ece11226002e45a278bc7e

SHA512
c1b326848909e562901f12671ee0c8f629076fc0c9fba6e886605c86dfe966cdd015acbcf1d7c7dd3fe0091b72d507dec61ccca8c29b8bc65b2a12844783674a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\Toast.svg

Filesize
2KB

MD5
b9567d4c436875007eddc5f2378328e5

SHA1
81090b2a0ad5494efb9a697e39549bc38167f558

SHA256
5acf25ed99881b0a349bfcc64ac55c660dcbc582e19bdd0a8817414b7d2e13cb

SHA512
a9eef3e56ae2cffe3c215c44cbf16f4962e40447bbaa7051bdd510409744c69cce8a6472f2d4f28ec49f1aad8083cb64886f5745f8a814dea725ad64d19f3712

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses-hover.svg

Filesize
2KB

MD5
30b170e3f38620929fcd989d1901391a

SHA1
95c314434840d0cfe4ad5693b36cac1cbce4c242

SHA256
17ff98dcdb2fb7fc82102fcdd86be863a3a3e0363e24a304de94ddfe02e630c8

SHA512
8d94015445899ac9fc473ab2688d4f65ff81bf4e41ec9afa6a5070e51078b3d8a1e65958fdb6b2f9af02c567c1b2006ef00c54a64f80c0ead38a04d6ff076d7d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_empty_state.svg

Filesize
16KB

MD5
07a0176693f04b8d40fdfb86507570e8

SHA1
09a1a8a911aaac8c3823d2be3fe99a4503fdd48a

SHA256
f1e64f5c7224ec31319baf423909b727a59740d88e2de9e1ea601d507e2ea001

SHA512
4834273116ac3e3e23f9949683c94e7677baacdccfc203a30c17134311903cd440a5bc8d7571234f5a833414f91e0da654b63573313962e38ee7f8e8bdcf5df4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-down_32.svg

Filesize
2KB

MD5
a5adc416e7f9e1d96f2b8f1c21601427

SHA1
28c73511981843a88242a777abbc8446d4c9cb24

SHA256
1b6662f5f8e7d8f8b0a17505eeb9007aea389c66a5128593b2ee4b09f3d50614

SHA512
20fabc22057ab02f3f1df9ea9087275a98238f1aa09fe6c1a3f2578d694a9e7d3d7fbd5a92bc530d533236dd0dcb26b59927fbefb584470982a4f9322a82c0ab

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_gridview.svg

Filesize
2KB

MD5
74cfe9c123f388e114b7486279082909

SHA1
be63bbf35490918f2ab9838f625456ba7ca81684

SHA256
6ad7edee32505a9cf0ed708c2acef2384919c7ad801170dd501551cfd6b90e04

SHA512
a421642ed4e2ec87b3670a3f1a3ca5f6e6271006f5157e9c5f9510705dc876c93c0e6d65ef8333300291200a2d3f19ed0387ef8c091520669072d8712e1d275f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reject_18.svg

Filesize
2KB

MD5
725720e2d6fbe1490f4001caebbddd25

SHA1
d45e6dddf11107bc1c05406d9722f99b77d1089c

SHA256
de1388cd47c35d30f693c29c46470231f21a3f94db5a1f565ed0c1da86b731b9

SHA512
dcb942cc9b271a460dad33c237c922b38e28b3fe9ed0cae409e85e38a33d4caac3d0ca68fa3ade3bf3c1cd2d176a6cbfab10c4d4a4c6e1be76d52f2d79fdc96b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon.png

Filesize
2KB

MD5
fd8749b58a639b22366ad4dad13dac18

SHA1
1a85650c26d7b9227d8a2ea7f8a7a076e5ebe851

SHA256
8c17e5fa4f6be3ccbefc10721727c79003d7ce74a5e02870918154f6e838433c

SHA512
f7379c4a12d4ffa147fabbc78554cb107ca34d7fda18d63929f6ee345e41ca785048c4c9ecdf0b3cbbaa631b0bdd12c2731d76d1af1fd59357d6f286c5d9faf5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
2KB

MD5
f64838a92d97fed061f6fc7068ae40e3

SHA1
d0ae47ddd0422fc0bef6080574503192b35ee423

SHA256
7c1bbba8ff2773e364ee62ca3f1d064adb9813d6ada83a16808065842c3e4e40

SHA512
d9356d111a035b9cabffcd71266748e2c3d675fe6c39ebeeeac64a7edadc63a36f8dd29bd885c0d78e11d56ba686c71e7df414192ff8547af94fd2a80dd764c4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\ui-strings.js

Filesize
2KB

MD5
db483bef85328ff667aff8d8bea7896d

SHA1
8000b811584b4800218d7c2c3b6a9d483d21d56b

SHA256
ddca2364f5ec6d9d5269e09d9ae9ade34af3681fc708ae5d0d21602ab31fc765

SHA512
8d21425585325a28782b284a3c900555ac84a3b1f3e1eca1b6c7f0522255cc5b8ab8c36347d66ce32f3e3d913d93f77e51e9e3bcdd239b093786c0e59c0d4c03

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png

Filesize
2KB

MD5
faa778a932a656fa9e2472cdea11865c

SHA1
e7600039c173e211f8cb6ea3da6eb8a408b37e3c

SHA256
fcbe8cdc9724115f171931837de65dde847a13c8f6539484b0b7b8b16abf9a67

SHA512
231de49da0545938d1f0d71ff8ceffd1176358a1c44fa60028f86b7cbaec2c9bccb40c6fa88755d43f1010fd96863a34f8b98885fe9dde1687f1d63e3e27d39b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\ui-strings.js

Filesize
2KB

MD5
868f31f721b45eeec914e9ba73f73914

SHA1
25d15b4990a5f51906ba1b8a8a828c6dc69b9a59

SHA256
5db5e6440f64538e9a489454daad5e6522b37f84348f56dc9c838e94e329a084

SHA512
de78c1d7adf39ee43b9669176a6dd5cc3ae54ebeb4e747387100ddb58f65121db45919981d69be87e7e3fbf3d325d643e356e95fccfadad0b9a965a39763fe7f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\bg_get.svg

Filesize
7KB

MD5
d1e4fbc341da8a8833499afb01444aef

SHA1
0f98d2ba58e0604e2b87408a5e1ee1e74541e169

SHA256
d5c0662a10317501aee0eef96a8a248d573afb783d756faf4ba12ca56fe4711a

SHA512
b01dbfa0bc02bbfa35c7172a65e0e8eb816c5d97de2faaf6b3c3ac1bac2e4f2beee959cfc355c63b7af93af9448940b6a6ef24dfdf50c6f76e57f9f65093dc11

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-hover.svg

Filesize
5KB

MD5
b7b9361fc85578772681e40de8b51ee3

SHA1
47fbb12e614c2d6094ff1bddd70901b6d82d9949

SHA256
bd49b73d3eb0d3a885ece7b2c86ec052d2feaeefd3189ac872fd18fad5f18ce7

SHA512
170e0b8d0cbd632e517b4e336aa2cd05154bcfbe8ccfd77ad1e05a4744796c163a2417900ba5a50e1180a332bccdb5c35884841201b7426eb05c5a1609010fef

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg

Filesize
16KB

MD5
d7772d12d1ce5b6c268bd0409d7f28c2

SHA1
8995ba719cc247de1dc2c830c42fd9192e66242a

SHA256
0d3e5e18982f1791017ec0d4b4067c260523165a040754258e7fbd62ad8a8dc2

SHA512
ede6baf3bd902a69c99f96e296b699dc4b8f9b4f0b66c4a176b4f88b87518c3bd26187daaabed3f8266af322e2fe1c347425df6090fe7c89056943b2b7f5cc17

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nl-nl\ui-strings.js

Filesize
2KB

MD5
2b778e9b582aea08f65570e80210e338

SHA1
64af9ed5a9835886417c112bdff53dd1d55a9695

SHA256
82af86fb3a856152cc956edee613bcab60e28f4473c7dadbda0f7216ec7a52c8

SHA512
d6e566abda8b9fc48d9b1010847641ae50017c005c92ed78a492ccf1afa7dd6a052b5b8e092f69c46974d791267f9d7a620c50ac1f272dc7de79cb234795268b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_thumbnailview_18.svg

Filesize
3KB

MD5
8eb3df52d1a59ced3ac6217c9eea75ac

SHA1
3fa2d51f157cd01e86aed5b66a81dc83973e7d4d

SHA256
e6d0c6a399c4fabc35161a4bdbac10e42c3200ba8c90148d9d9179c10d379a12

SHA512
a8cbf25cf3431e96568251f081bfbfd2bb47266f625699eb15d37db06949e2b9e54764a38310f1b151d9c5e25f5055b90b60124ac7b25031f7a2dafe945e85c3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons.png

Filesize
2KB

MD5
e5a196fdc3ed6e66fe3c585c5ec18731

SHA1
1acffa82bc4791d29c681c2bb6e77d4d01c6d908

SHA256
782ab29016963163f197f5c5425c1e83eac54fcc0d6a5488cd888a6aa8e4a4a7

SHA512
bac0d3cdff78a9581ffdbb02575f92a3674cbbe37d6ffa4cb9f357004bf172cfb817b23071583591bce8629df1660494398d12ff642ffe74f5035951d152f001

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png

Filesize
4KB

MD5
f6eccad0bc049e62d98d55eac37ce8f9

SHA1
54121318399223d9112a80566d7234b96034d718

SHA256
2a03e3dab615f6033c1dfb9b9703db89746c4f9386083c62acf4f6b95a133502

SHA512
7d8a511cf541ceb7b9e0d0dd7c7ac7733ced5b144acb5ff96f1eaa7557014f0865f1e839951580b2821000e3a31206c1dec2196f139662aa3bcbd529a838ce04

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\CompleteCheckmark.png

Filesize
3KB

MD5
a6e5a6f6c761497bf912343aa6bfcb01

SHA1
cbcb69848c5e7be44ac47f5f390a4051cd0274c1

SHA256
815ae32f2e69f1a359569b1aae7fc645437612e1a87806b88233f48f8c5243bf

SHA512
2b05c16ca1c612b8fcae41439925f34cc8f0ec5084e3d9c46af77b1fa5c4abbd431888bbf391540fbd1283d1c2e9cfdb595339d796b707c4a6b7f2cc43c20aad

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pt-br\ui-strings.js

Filesize
4KB

MD5
e8b8a33fe1fbe827636038d0b07c74bd

SHA1
5ac634f60deea7dfd346552ae41b335e8e33b5a7

SHA256
4879de7ff1aee38cd4ec7c13e6a61501d2e2bfcb9c6a1926c2d54097dcc2101d

SHA512
8c4317ace38c0d224630f4a5c49e141b6e1c68fa6b426a22675160407c25189a786bd70a35b64330e2ae1cf67f68890bd657d8f61ce7ce2c02eb8ee8b89ba286

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms

Filesize
13KB

MD5
97325e799e9892b76b56e14f29919358

SHA1
f350fdd1b621f8423b5b0d41008f831340ac57a7

SHA256
4fe2345e151648a9e2272ef357575fec170f85ed12634c99c38b82413770f6c8

SHA512
762836d3b24dfba3ca9d65793ded7fdd54c9157ac5791d2fe233c90dbb9e628c7de245af4c1e18e7a36aa8bc70799b0f6ac99a2cd031f31d4ff1d57a6c097e38

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms

Filesize
12KB

MD5
52857b960c3764061f63edc598ed27df

SHA1
04d20d61f23cd21f6683177e1d6dcc739c3bbc49

SHA256
55ae66db5bfadd85e6ba02d3ea359019dd91d975bef6bdd440e5d3ff5decaea8

SHA512
613613220ea54d5b10c1cef9af0410ed246546ec181ee38793203766ec018f2f675ea28435665a8de8f79c83e9caeefdc956f267cd3f8bc46093cfaea7a91ea3

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms

Filesize
13KB

MD5
ff78643a0c6ab23e0fcd5a058fc3c449

SHA1
32aed802c39a8c943e552d8e6e24d054b026fb8b

SHA256
58cbbf4da8b419a9fd40adbc31dd8099bf34134826e043fa260c583c3349b8cf

SHA512
616c58373bd9e4bfc6ae9e66ec49ff3d108389598c46786ce279315cb006736be78fdd9a08420a477b754fdb9023274b0712427e13beb8c95ff6d2cffbbca1b5

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms

Filesize
26KB

MD5
a17934007235d2ccf93368bdc347acd5

SHA1
0045e7847581d46f87bb33e07ab809eed905e3e4

SHA256
00ccda0b1a0ca76b13998e38a1f0dd0c5f5797526c81360c088959782c594535

SHA512
d1054349efa27b608500eafd8aaf9a59fa26b04afb4109448f056fe2c13bf7d431ac8451e46e477f15ef1248e5a111d8ba136eac2b613a3322a2a8b8fa21aa73

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms

Filesize
25KB

MD5
4c6d2d7f15c59ce0c68b1fb83806e477

SHA1
91e83e30d4f49fd3f594a857318abaa9c02be4c7

SHA256
4cd3f561293928e51b227e4824e03a74dace4cb669bc9fbe7b713996f2765ba4

SHA512
95b0d3f6713b3ffbe657d9c43d291f7267df182aa5802155960681545b150796b876eab127de5a88e4af2908e8e0a26c611fc7dbdd9db262eb00424df215ec7a

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms

Filesize
30KB

MD5
b736228eec33642a7d46df4c8e3bb55f

SHA1
f24b3a9c0dded076b84e267776c5b7d54ecaf784

SHA256
6dc6ef4369f06f5610527c5d610cab0467a5736fef49ad4d1dc71b45d1ed880c

SHA512
f597dba4f9b91b9e482313fca50e6430f0ea4090e02c903e9711157afaa86075903a5c27240db0db0d9f15de5368bf38f69ce89c65a9b9c046a1e77ceaeb1981

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms

Filesize
12KB

MD5
7703498cf2325258c23825f253f5ced2

SHA1
37a42bc7641b7117661cb6295859cb1636e23ae1

SHA256
da236f07163e22e4bf4cbb099458a677fb956744dea3d5d30741d6449d4bb022

SHA512
eabe5059722fbc3d96ae980e2a14cc9137e1012fee38603a18ab40adf84b617f1981876b1e7457f278a5ecdb379b9e143352a7b1b0b9eadd30fce123f5069921

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms

Filesize
12KB

MD5
58690c98329ac0df38f0d584e74d0d6a

SHA1
3ee77e4ab7ff062211560b32840ecc5e503c53f9

SHA256
ef04bd89dfeca81385c31d0df7f5ab0c4029439b96e0f366faa5520648198a33

SHA512
4c90ddc59ff0250368ce0c2ffdc425adbe3b883203e8ff131c1c60c61d42d56b02a3245f4b639fb579b29f2b073d8f8e5ce7f3dead56c91c0e89c8617418a077

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms

Filesize
12KB

MD5
bf773e437518eb46ac6a80a05fc1434b

SHA1
d13895dc14937bf97f696b44dcf5c1df0b746ff4

SHA256
9a04daf09a161d4e4b3abb4ffe032f0adafbd7d99a8c2cb8f493d3e2682addac

SHA512
c0158f9c51081147deffd72fc50656a05019744e93df90a449da6442d484f4af7375251e2b79b9929b81f8cf96897c326b90ca31f0ac82855b21e73b4824c826

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms

Filesize
11KB

MD5
d01804a64907c0f6fff7cef002352871

SHA1
ec848abf761afe142cbb2f72bea4281c7a159c9a

SHA256
c9704a08deb8d4b1745c73783c180ad91ea0754b5c2f3f5472f550724104671f

SHA512
422e52fd6fb82a225efd8479e7037649b59d6aa2eacb14bcd6600e0fcc4b7d4fbe6bac8738e7a4b4facef0c7e8e2ac6f2f851862c83e1d793eded85343faad12

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms

Filesize
12KB

MD5
73825ff0dba9b3bf401eeb25db453d13

SHA1
0698a257af8aeef91ea62606f8dfd152052674bd

SHA256
b5c02559e178748336c19e44075e0ee6386d7e7031a0ebfda259bb2388a6ee91

SHA512
a46d01e60abfeda4a9809fe75a5da45bdfa4782c1a618d3c37533f550595df2f45b23c752da96421b330fb52656c45cdd0ab1bf382d714c7b3637a2b2261ca9a

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms

Filesize
12KB

MD5
7ff9e712a7bbf060146277c3522aa575

SHA1
a29652eab2ed74463e49ebfd07254119c400fcd5

SHA256
d84228e906507341b4752d4598ce39c7b4580d35955329d0c076c6b026a239f3

SHA512
1a98bcb92d8d39f0bb34b028df89f2321e4a92ce5fffe09120489470704f2c964cb520344388d6225d8e3903e67089ec4fdf6be1406f4f47926853ed4d10b14e

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms

Filesize
12KB

MD5
3c277dd621b70dca545c0a957bf6d6eb

SHA1
995d7c1237f73b18a2aadb57b9bccc0f1d7ec256

SHA256
05504950af42c6d08cebe4ffb6fd8909012049d08c11f4a75045a194468ef122

SHA512
191d056dbb484c91cb35cbad8446f7cf64628ea50c771f74477b9367d6dc8d8ffb110e783bd74436c2ac0d002058169b7e97b5e729ca1e0f4bfc1aed05a9bce0

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms

Filesize
12KB

MD5
8adebbdee8ed300ba4b7cdb38c718b36

SHA1
162602b987f14d9715831d16f8c3d936e4e7ca88

SHA256
1b4908f0bede8eb9db997bb5809d56629808dfb0a21992f882935177ea79c3c3

SHA512
29a0af87a9bb1233bdb069c1b33040dddd604437bc7500506601802d0d728ca0f23e6f5ec8ec4e5f57677c8914d9d4a91f10aa486cc12f423cef6a1536d54b28

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms

Filesize
13KB

MD5
a5a6a60e2de2f6b7c646a293e7d17215

SHA1
74afc73b8592ee057a04769d2cee9536a63976e2

SHA256
5232b4f8ac5148b3aed033fce59ef36592a5ca21685d3d59f37a0200484fe1d1

SHA512
3c10e58129e2c7ba0029fe73ac83197e8b1ebba1ed56003d8a37e275be16667a471bed505291ed9de6db293987ee9f721e02cfe420624146cda549af75b78626

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms

Filesize
13KB

MD5
d09aab69ef61d7668bd3ce990196da85

SHA1
0d523975c7550b76d9465360d9ad73c44b41fa47

SHA256
c9732a48363bacb6311f0fdd300069bf45685d0e4d02a7d49bf0e988c9ac3cca

SHA512
790a82b9ad1d4fa4b46286782105dfc78454e5a3179ff9003b99900390063ced3abb74896f89b95bebfcdc8dbe3e6dc63a0ed4d47341b06de68cac31791020a9

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms

Filesize
12KB

MD5
3c850922f91e2d5168552284d3d75fbd

SHA1
877c0ccc291b7a8d54cf5170e8124eb7d62bbd25

SHA256
3370c8863bdcac2c80f44c802431473279223650e9c761d124b15acec7923abe

SHA512
598ca7397cc58d1f8b0cddabefa99c7e2c4214310bf81d308e5bba0d588768c8bf5a179b6f4b35cf7797bdc45a6c8c625518c78ba2f67d050f9d0d5753b71e22

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms

Filesize
12KB

MD5
3629ead716437ab1db12b6d12c743624

SHA1
8738d6169bf8d0e0150f4eabb14138cd74762977

SHA256
2c3af2bc2db2012cfb6b8eeb573d65201ee3352d42d2135817ead6b7ea65abcc

SHA512
b9a89eca5d4a93ccb88c3a13d2b59cb3d07494da2ea6f4b3ebe5375b1919256e63ee31cdeb929551b2620f522029a7f33b03e4957654482987c68af84f872b5e

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA

Filesize
184KB

MD5
038568d171815ab5529f36f35caf4b13

SHA1
156a5a15c7b9828c9a68e0b0be1e13a76e276c44

SHA256
e32018191c443d04b7444a3b81c16712733a3ae35e457d5553c73d1bc0610567

SHA512
6e003f7a3dab68caf23192fc06c67afaa82faf0e031ee16068aa813418ff42187876e1c298a5ceb6a218d42aa4991f9433882c1aff5316ed3179e4504804cdb9

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL

Filesize
54KB

MD5
3aacbf2eceec53489791a158d9a9bb50

SHA1
4ba47c92b31f70705926dfe97938e9833694de2e

SHA256
a943a1302074ace9b2b88de08ee5acb4d44791694edb8d4b62d6a0291c13460f

SHA512
8c0024c267c8e7e19703c0129ed6544d2ab0bb12bbfb8aad882abe39a83eeca3f74356b2e772d6dc92c547f768e165e6531290ddc1e51ef3879e5de0b87fea48

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXT

Filesize
2KB

MD5
ce97d14ef58d496802994dad3f2ee9c0

SHA1
f2778e99959da3b4e37f23cb7632874fb2ff4327

SHA256
d1730b88f921c0263fdd77053ac796cb40a5b8285e4d6a0b0c93a9ee07e5cd32

SHA512
bc8478e4669ed5120280b154ccc7526257334cd547fbd1a656787c2a241540cd913518a9b69d744f077ba9302eeac9a582504a1330450c2f98f750ed2f105e52

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL

Filesize
22KB

MD5
18bf3db9e26c2d6cf48452fc32b6c10d

SHA1
d544900d6f55d7fbfc19e407d5d00a86a213f014

SHA256
03c904042972ab3f8c36f3f7f9ed254b2e3d132fd0a350f8545b18c0a2a50d74

SHA512
6af5180dc8898b69cfa7defab09feb5e0563c9b9067cc71687d3236d1476805f30504bff126d118ff0540261f1f882a17def82ee7ec5e789ab5f6238e2883fd9

Download Submit
C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png

Filesize
2KB

MD5
90b9f86702d3dee26c16912f7a19dfd2

SHA1
c552d20f639e905c83ac9c0d0e71212a559b13ef

SHA256
62fc0affdec4bd7ff9d4b04458df88fd753d4368472c4cac2c64bb8737e22a81

SHA512
c29fe81bf5c1d0a0a7ea058895ab626948f3cccb7ec3f1bcc53ca1fdd48f176f0c7d31959981c7a9d9708772de9962cf75b924d5b2d24a61af9bb6f8c1e78eb2

Download Submit
C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]

Filesize
18KB

MD5
278b2a939046fb7753eb2e89a15ac473

SHA1
71e6a5f2c9aba1cce355a1c0f351757909cc3fa5

SHA256
7230bd76b7fa358b707b14cd8a538970ce49b19c1dc053d8ddd723df716956d8

SHA512
dd1eea30d1698fd5a28347934ea1dd8204ad78a211128f1fffd5c7b5ce802e2f799d383877946dd82e3c0a0beaa239dda66937697fd1cd2a0a35525f66286c05

Download Submit
C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.boot.tree.dat

Filesize
18KB

MD5
bf662a2fcda592d5bd99e0c6146be1fd

SHA1
bbc108d6594638daba1f3123a05200cc78283f87

SHA256
666f06eb761cd3d86311a2c8aae281248205dd914ba253b7922fc23bea265143

SHA512
be3d29e5c5255005f1cd70f6bca49eec0e854167ed0efe2a81b34b227d8409eb27f1dc5c736d8d64bca2c49bb411cd6a1c0bdaa1dc474e4c89441731a9004740

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\NativeShim.dll

Filesize
83KB

MD5
2fa7aba29dc6d398ba5147ec76b681f7

SHA1
a6d67a8c20504066bbe9ef4ffcd9dcfd936c0d95

SHA256
0b821e7e7cf30bd5a41d590e60396a8601f4c8adbc7d528bb507e41a6efc53af

SHA512
1f708801730aa54837380756d865a0245184d096f98ae35aad46a448607e37b473676637e7fe9c043451289e8cd930510761cd7eb4e7a684d9d6c5c8fec526de

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetCompare_f_col.hxk

Filesize
1KB

MD5
b939c27d2c35c8cd7434e4f3347dd7b4

SHA1
273b76dbffca5ec6a0daa56881cb85b79c068076

SHA256
46bf30de8cb4c265d2d863d17645a6bed2a830345d7d55486017238ed586a57e

SHA512
e255a0810f1262c4a271eeecb7872eeff24c545e3980443e4365c2e79e9c2afa2e69321427e6dc38ec4da44ba9825822c21987057b3d1737a2158ff1f61b1959

Download Submit
C:\Program Files\Microsoft Office\root\vreg\proof.fr-fr.msi.16.fr-fr.vreg.dat

Filesize
65KB

MD5
632e16b18a156115588b29be0f991603

SHA1
767e0be528c6cf503d5e386ff74d5b17ed0a44bf

SHA256
fa17cbead2d37917f68bad107e47f4c13f447263af6d42d2ccedcad9bfda9e3a

SHA512
d9f88822c96cfecbd22d535e53825a60d830f8e994f5797756744e39a9e9e1c793caa7f09b19203d28dc0cf0fe7cccf976e27ec1d4279be0be20bb9808d8b0c1

Download Submit
C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml

Filesize
4KB

MD5
a8655105ee999fb7fdd3ea5c4d53b78d

SHA1
8b2e7dfe7384adec5be1f1f1c97f4e1f74d28611

SHA256
652e0e1ee8223abb592cccbd2a03dbd478b9a6a58a4f7ee04f45fdd76f45d99a

SHA512
7ce543be73a60e4294acf20611522c73171cab52fe8fe77ffddeb93bc1fa9b79f35c46c5d6955a8cc28a6c5f8ae55680c1b409d70576f3fb07c6607f4745d13f

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll

Filesize
51KB

MD5
0c057522625c4a17c8ee8e5dbd5da200

SHA1
554bf0a51ce303201da52509287678a542570eb0

SHA256
38d6f19dce3a6f261aafcf00fd358b52cf2d2d0c7f9167549deccef255372b4e

SHA512
2da679f47388eb2609849083c3c03f5face8d222db1d303952c52f82ce02d52ca3b11f8ec9b7e3eea913e693ee68dc1bc17741ca2306477558855a34b6a7fdeb

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_dummy_plugin.dll

Filesize
40KB

MD5
bf8d60d836a183c5ecce341465ff1276

SHA1
04f8b90fbb1528a132882ecf0efa119ec5ae49ef

SHA256
20b515d5df0159f90946933c7aa178ee793030323cf09c3475ba35351971519d

SHA512
cc5d020d9ea2689a12a9271ded2baf72382a17629914602dccfd3eb5aeab4220e574aadcb90a751602e7ec7c81bf83de46cc21055d1d914617251f5c82df8725

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\video_filter\libvhs_plugin.dll

Filesize
45KB

MD5
8e3b322a400e7bf2f3b67712c0675b5f

SHA1
6b69c3a34f155dd9d395e2eebdcc95c069a6e5a6

SHA256
9948595439107034e07625d0cc9b6a69fdbf4c777f1eb68a0499d6cc3c23d6d3

SHA512
c1426fc0575c9199ce4eebb50af4ecab47370891e8f9b56d900efb62e6f63c03cc0ec2d5065d3bc6c7d04688d51c3dd85d3eaf87e22d9eae73c4fbf52645315b

Download Submit
C:\Users\Admin\AppData\Local\2025-04-06_c68fae1bc0f9c1258fa63c42401ef194_globeimposter.exe

Filesize
53KB

MD5
c68fae1bc0f9c1258fa63c42401ef194

SHA1
e019a08ea29e2124a336bd9ba57ff34a0da10183

SHA256
80de97c40e0f1a1fe2577494fd58f950333f38429501a6a0091ac5073f04b841

SHA512
13d37fb9b01db9d44381ebbfa512a4f612d29ca403e266b453fc7e87fc4b7ff3bcd7ea745be0e4e57e6a4e1ca0a97ff6fd07818756585e9479da3641e2470725

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iauxn5db.default-release\activity-stream.weather_feed.json

Filesize
960B

MD5
8860495309b67e763b31b07cde029db3

SHA1
acf74739b2b9fe57151407c60a6eb1440b9b1b73

SHA256
4a307ae997881fce1a097fce2fede97a730d8d5d8507644372a70644e8e04ee1

SHA512
95e6083c2861a78c2d45c5fa1c6a947e019791ef47d5b2f588027a96467c25185edbfda0591be9bebfda9eaf0a7beaf737db05eeec4c44cf491d38bbcf5a97cf

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C1C6F8AC-40A3-0F5C-146F-65A9DC70BBB4}

Filesize
38KB

MD5
81e4f74121f0a26b601518c5a589b876

SHA1
53217401f85da71f3531a5b0ec1aa8816c4e6c24

SHA256
70983e8d2bffb36f6cafe0287cb1ae6b4b7be9215185f6227d6a5b355eafbc04

SHA512
dcfd35bfec3c7d2fb455351ed7f2b38f4d42fd0f6f83913e01e3f2c134fe7b02acfde8ded0fe0ec00ae83bbfb04f1317a1e214b6b26243ea771d0de28b329c18

Download Submit
C:\Users\Admin\Searches\Everywhere.search-ms

Filesize
1KB

MD5
46833736b19f182cb4a2cb9047084af8

SHA1
0f8b5137eb4ed90668d8962a0540e177d575eccd

SHA256
7e358aa89bbf5dab135c8c58b2d2106ff537a61433488d149f830f9c3030c08d

SHA512
40438ee928447828778458edee0b22892e6122a208f0433e03db91ea719f6f300a6da70bcbad011ced120d363748838978cb9c9e5658edd4a0b4257a441acacb

Download Submit
C:\Users\Admin\Searches\Indexed Locations.search-ms

Filesize
1KB

MD5
f965c60be7e65c11902091e5059ad743

SHA1
205c32a84d5bb193106b9fb7a0c838daceaf47e6

SHA256
83d5a6e176c604449b7931857b3656d5c9d4db332f37c6d9dd9713094a601fa2

SHA512
39205b6a86acd5d703cdfe94dcb7b48a726c938e2fc52412d2d981d4cf2f20712ac0777c9019aaecc3405d831f4efa2db7aa8446712132cb16b67fd97ff2128c

Download Submit
C:\Users\Public\4293265C6816E1A702A69D5E1BB5D263CA16B95AB563D3FC9E90545FD7ACE20B

Filesize
1KB

MD5
945c3fcdc8b1354e948d5c1f7cddcaff

SHA1
4c8b695f6a880b8214beb0a43a581a8a5dd3a186

SHA256
fa06a509dcf240eca18e91a6310a69bd8b2a3b8886fc497c002f450016e609c1

SHA512
4792ecfdf7e76c93e5e62068cc1746406a46c020b13e2743b9c55be6624d6501dbbea76ee98611db04175065f7b6b243b1d2903158c5762bd7805d223bdcd281

Download Submit
C:\Users\Public\Pictures\READ__ME.html

Filesize
2KB

MD5
3c36e540d0025e017dcddf51faf73892

SHA1
b9f74d425fa66a51546c12d263dab4158ce5bf33

SHA256
2d3324a1a6aada3034b5d820e02b1e33d370b915e83275b5e83d259fb38904f3

SHA512
2beceaedff66f3d88664fc2c963bef1d673d04cc918b2459a40945c119874cc5cfbf4d7c2544e17fc0f267219946774a9b04d30daa09f6f2bc50ca69c5ddf9a1

Download Submit
memory/2936-0-0x0000000000400000-0x000000000040E200-memory.dmp

Filesize
56KB

Download
memory/2936-1303-0x0000000000400000-0x000000000040E200-memory.dmp

Filesize
56KB

Download
memory/2992-1554-0x0000000000400000-0x000000000040E200-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads