Overview

overview

10

Static

static

3

2025-04-07...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    105s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2025, 03:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-07_9da577fc74b268fde1a59010c6f66f35_globeimposter.exe

  • Size

    57KB

  • MD5

    9da577fc74b268fde1a59010c6f66f35

  • SHA1

    a9939e746b69509c2521f75ddc97ea3260b9988c

  • SHA256

    70f4aee38887399799c9f7b1d721c6a0fca6459dd174ebae9585f10525e60108

  • SHA512

    d391633ec1b8f5de5b766f6ddd8384f66297fa95820f49101e5e26cafbf890926eb1bd9be33f6e3029fca0582199a761b6f59cbfd695db683256e9d3254a4ed3

  • SSDEEP

    1536:svjkfV+KJolntwrbDSTWvTwhQMhmpdLJlIZ:44fIKJolntGDT5qm3LzIZ

Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Pictures\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #4A83FD; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>���������������0B 23 C2 B1 F9 BA 5C 87 4D 14 EC 70 D7 8D 44 C2 6D DA 1B EA 91 EC 9D AB DE FD 81 41 A3 35 AE 93 89 FC A9 4F B5 1D BD E9 41 E3 DE E3 6D 17 59 2D BC BB 75 E2 82 F9 70 22 10 1B BE 9B 72 2D 2B 8B 1D 98 A2 EB 4C 91 CD D7 E1 96 58 81 D9 6D 9A E6 64 84 90 F5 B4 A3 8D 04 8E 23 3D 2C 96 CB 41 2A 9D BD 74 AD C3 D4 36 E9 FC 5B 3E 4D E8 40 3C BE 9D D3 93 6D EE D4 C3 C2 52 00 67 DC 6F 8F E0 79 E8 FF 40 77 94 7C 14 CC 2A 8C CC 9E 9B 5B 2C 8C B7 0A F7 05 E1 08 A6 B0 D4 D3 07 66 FC 1F 40 4B 5C 81 2E 01 47 25 9C E2 32 3C D7 6E C0 59 00 CD 12 A4 B3 58 EC AC 94 A2 C1 81 83 48 F8 12 51 A6 DE D0 8A 4E 10 1D 3C 7A 67 97 EE 76 0D 76 36 A7 7C 24 9D E2 99 BD 69 ED 6E D1 B1 43 68 0D F1 E1 08 14 E7 0E 93 0B 90 6E E0 18 19 56 9C B5 E4 5E 58 C3 94 12 5E 2F 6D 16 4F 01 00 1F 75 C4 48 C0 </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9760; Your network locked! &#9760;</h1> <hr/> <h3>All your important data has been encrypted.</h3> <br/> <div class="text"> <!--text data --> <h3>To restore files you will need a decryptor!</h3> <center>To get the decryptor you should:</center></br> <center>Pay for decrypt your network - 1000USD - BTC </center></br> <div align="left"> <strong>Buy BTC on one of these sites</strong> </div> <div align="left"> <ol> <li><strong>https://localbitcoins.com</strong></li> <li><strong>https://www.coinbase.com</strong></li> <li><strong>Any site you trust</strong></li> </ol> </div> <div align="left"> <h1><br> </h1> </div> <div align="left"> &#10004; Bitcoin adress for pay: bc1qyxflrf7jkkcc7g9ncxl9vamdkatfj37m09el56 <center> </center></br> &#10004; Send $1000 for decrypt <center> </center></br> <div align="left">__________________________________________ <div align="left">Contact us: <div align="left">Preferred option - ToxChat <center> </center></br> <div align="left">ToxID: CA04B61C320C50D12A2C1B95B5062474B5C00B995B588D0B3781DC052CBF9A354CD10F96C84D <div align="left">you can download Tox client from official website: https://tox.chat/download.html <center> </center></br> <div align="left">Option 2 - email: [email protected] <div align="left">__________________________________________ <center> </center></br> <center>----------------------------------------------------------------------------- </center></br> <center> Attention!</center></br> <ul> <li> $1000 BTC this is total price! <li> Only our team can decrypt your files.</li> <li> No Payment = No decryption!</li> <li> You really get decryptor after payment. As a guarantee you can send 1 test image or text file to our email (In letter include your personal ID)</li> <li> Do not attempt to remove program or run any anti-virus tools! This doesn't help &#9786; </li> <li> Decoders of other users are not compatible with your data, because each user's have unique encryption key!!!</li> <li> Attempts of self-decrypting files will result in loss of your data </li> <center> </center></br> <center> <span style="color: #FF4500;"> Never pay to any other addresse BTC than those listed here! We do not use any other messengers except TOX and the contact listed here! Remember! Turning to an intermediary - you risk losing your money, always ask for help yourself using the contacts indicated in this document.</span></p> </center></br> <center> </center></br> <center> </center></br> <center> </center></br> <center> &#169; 2019-2025 Pizdec Corporation 2.0 | All Rights Reserved.</center></br> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> ���������������
URLs

https://tox.chat/download.html

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (9088) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 50 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-07_9da577fc74b268fde1a59010c6f66f35_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-07_9da577fc74b268fde1a59010c6f66f35_globeimposter.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-04-07_9da577fc74b268fde1a59010c6f66f35_globeimposter.exe > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3728
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\2025-04-07_9da577fc74b268fde1a59010c6f66f35_globeimposter.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4676
    • C:\Users\Admin\AppData\Local\2025-04-07_9da577fc74b268fde1a59010c6f66f35_globeimposter.exe
      C:\Users\Admin\AppData\Local\2025-04-07_9da577fc74b268fde1a59010c6f66f35_globeimposter.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3928
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\2025-04-07_9da577fc74b268fde1a59010c6f66f35_globeimposter.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3920955164-3782810283-1225622749-1000\desktop.ini
    Filesize

    1KB

    MD5

    b9b7e5c67b11e732ecf35fc64bf42556

    SHA1

    697d6d3e847ff121864489268211e4612e0ca762

    SHA256

    b515282dad24655884d6b2314e8088615b6e93d2598ff47ac4eef019009c8179

    SHA512

    540ddbae7f6db266f9ea1331c43d275c8aa1c5cf27da9102b0b8b67d0399e12954666801f36207b38dc06392fb9fc0e87b2ff3c1313778df699870adc02640a8

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\plugins.js
    Filesize

    24KB

    MD5

    8f3698231be93f508b922b516d64045d

    SHA1

    a9493b3c533f930ec7631a3181b702b61561440f

    SHA256

    8a3dc87ec8f9eb0b28c0aa80e1f531fd18d07fcdd725c09263b46a408f84a936

    SHA512

    3b7b5b85a4014e67bf7cdec0b5c27c63ec168e940f79ca17577add65714496ce0664089c6e7676eecd63d9f21a628a2b03b386dd3de9ce2ed25aafc7350208cf

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sortedby_up_18.svg
    Filesize

    2KB

    MD5

    4a24d61fbee7d2fa3dcb09425d630e5b

    SHA1

    0bbb1c8c13548218d3ab3c4ce0083f875ca0bca8

    SHA256

    f5bb75a224754439ae6ab78bb81985e3477fa21e18313102ac0167661f6594ad

    SHA512

    31f09ed33027aa102e084ebc4405e3162dd28a5e3de5f1c46e8bb8fac988349eba834f2cae3cadb6f6a1be72bf9c3f3a6da47b8429b3ccfab40b78320eea71e3

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\hscroll-thumb.png
    Filesize

    2KB

    MD5

    18d4ae614aff760eb9b7978b2bafcb7d

    SHA1

    7e25000e7a242f26a2e317b6af99c104fdf4093d

    SHA256

    49fa5dbf005bfa48cdf6a03cb3f9f37e69753588313e28ad59c861d295032491

    SHA512

    07345334cb20404901a039e2f15c63527d43914461ccaec946b8a789d04e189b87a924f59aca455df10d31ea458e3c8cf8a2e850db365b123dab057a93c00002

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\config.js
    Filesize

    3KB

    MD5

    eb071405b07ac5a55d21065b672fc30f

    SHA1

    12d2fc36df911f69f51dc95c9d8ad432d0724070

    SHA256

    bdba7a057e3d019a10dfab1afb91ad5533380128446a9c1ce3b7c199a4193023

    SHA512

    af17a09558f9f380ad8933376a8a69bd545493824704f2d3af4a3c0c661733a2421ff7f4c54d29c47b95d85990ac611308a2ca03773315528a8148d74f9431a3

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\main.css
    Filesize

    9KB

    MD5

    d53fd1fc85a3c9f0c885b43405586952

    SHA1

    e1947b0e11a351159bebf561bcf9aa28400cecc3

    SHA256

    5d65f386f3eeeeccc3850f41af4e2f3468b7b1f8d86273edc593bff4b9ac9e06

    SHA512

    286e2b6997d774b6f2328eef508430523e955a906f3d102b22e8ee867c9a289c16348f01567439fa82b6a29b774c3db257e3aac0ea888df3f64fc4f7a19097fc

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\ui-strings.js
    Filesize

    3KB

    MD5

    92a51f01c6fc002f57eef3f7caa17b52

    SHA1

    d0d39ba407647e4032ad60da152987bb47af2fad

    SHA256

    4393fe26322e1049ce7d2c90716df8c7d57cc3ad8b19733de8c2cc8f35146449

    SHA512

    420d1283564766084649b66e410a7befec9fddb66d3dca46435d75b1c27f528ef00e96b3ab12882ea531a0adb78fdf2c5fe9c90076e42ee39dcf0ee76ea7f34d

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\ui-strings.js
    Filesize

    3KB

    MD5

    e90291f17d50d88b077c49896383f1c2

    SHA1

    0c3826cb66dd49cc550618d34e5d29a700d161ec

    SHA256

    a2012b05d00e911a0998aa92d259b69d97e791893b382dac643af3b7cf3c0c4b

    SHA512

    9fce1444e78fe551cf0a92abf96492e58ebb71e702b5be34359bce4f56bd329eb44108c3bfcd89c68d502f4b5b5d1bef666c64160958c230c135a998d52593c9

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons_retina.png
    Filesize

    19KB

    MD5

    d55e9e9b92a36a35f7eeed2030c4d7a0

    SHA1

    0e373d3da50ad55b3cd6ca6768f06bbd95c54822

    SHA256

    f419055250f059a44440b482e20f55c5a3ae63b071d8e5b8bce88d3a325a1ece

    SHA512

    4e2ba41765708605d4811430133ef1ff0a1065479cd134af84fa59299f46e8f5a54935347ed2e3174e0267b150fcf8cccc9be5de52ffeb5932f0fb923160e815

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons.png
    Filesize

    9KB

    MD5

    0e78dc10d691b24023cef1433244a427

    SHA1

    dc74447e56951d6f4390527637e5a74744758e94

    SHA256

    2a677d155bd8961c58820ac0940d62da33c679ff28583af2c4e95f0974f9b4e0

    SHA512

    120b41e1eb6eda245f9a90a67c5627753006170fc00a6aa36e0e396ad248d3653db9b09570804421bbb5a32f40962113a11eb93fbee1cedc14582ee847651ac5

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ui-strings.js
    Filesize

    3KB

    MD5

    8017e44233f85231e874f103eab4dfea

    SHA1

    452f6e703580f07eab892913a9c36ef386ef81eb

    SHA256

    eaaf520f85d0dca1443054d0abb2abcb79153f99814fb27a1f2f59d75499c86f

    SHA512

    98343a0c5c3448e0173ebd381ee182c45696e47f9b6b069758e1e826075dc2c60e9e5963365d3220ed220d01aacd249c95d7b6fa5801e5529e8133f827d874e7

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\FillnSign_visual.svg
    Filesize

    30KB

    MD5

    d06741c8b16ef1c36cc206757e948ec9

    SHA1

    6becaff81a3f35e35829347db8dd502803b9489c

    SHA256

    043193718a30359c532a69f479416004981ac8fbb801296bcb515d0e985af8d5

    SHA512

    76867e2b951f60218bc7533a546f9b86ca8cbba7c96d5c7107393cd282003bda60c9034b6baa7e1c174abb4df1eba323509ee9ece111e75f3503f44d9c3de8ae

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-press.svg
    Filesize

    5KB

    MD5

    aa9cbeb8fe743ad6683a3c4cd7218aeb

    SHA1

    28f91009a86a237b4812f4bb2844582ba07c50d8

    SHA256

    72862a15ccbd9aaf494e8bb6ee793155c3ea65b4770ba35dd979e794f43575ee

    SHA512

    1cdcce4c59178e56ea769118d60969c61dc49953c7e325755ee521b655c491963dad976385687b486092714355f8455ab0c6957c9e4fe4076fb03e3ceb0e2b09

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen.svg
    Filesize

    5KB

    MD5

    90233c7170bbf24af40ef8ae74dcffd2

    SHA1

    5e81e62c466dd6285adddd5d380fb386bc2e42a0

    SHA256

    b5891f7ee5120806c1f1fa840e626c852954e2d47ba1d5c13f7567f5e1c9b8ff

    SHA512

    c7f8b83fcdf33f39e8f0103b57a48a9c4353b47363b64c67c5645a2a887823d533f7b084551b96593a0c79e95a621be0bacb932a3250bacb3723a8fac7569444

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_hover.png
    Filesize

    2KB

    MD5

    7748ef113e89a79c0d60522347997d7e

    SHA1

    b99296023663c85d63dd4b113e38f07d06baaac4

    SHA256

    18a287b18561d53fb10fa8d62939c1af39d5ea3366ddc9e3f47d6ce6a9b50333

    SHA512

    a84701f8d2ae4dde7ec8814eaff927888122092b246cc92faa0d059741442d7622698228fda538d6b44955cfbb8a1916231e2d69d3166fdbd8a940f00d13f2cb

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\id_get.svg
    Filesize

    7KB

    MD5

    80e1007197380e602b33a62818dad6bf

    SHA1

    cadf7f8671c6aed325b73dbae13dcd4b22a260cc

    SHA256

    c8590fe9341bbed90572cad650979d0ce8afed436e1c6de2a4085eed74697c41

    SHA512

    d07fcf39a69558512e3f151759ce7df4659be9b562da258c06a4fef55b554c0ae29304b3e94dc42addef3f9ae18343ff0904c562cb0cc72ca3a58fd1c8d4890a

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\caution.svg
    Filesize

    3KB

    MD5

    2d454f13103b39dfffbf11d9a769bcb5

    SHA1

    3f6124749cc4bfe61b93235cb224fe2227f12ecf

    SHA256

    ab8aaecc2ea6f440e452cab806d357a3b06de9ef904f3f2ac7910129d08efc48

    SHA512

    65bd5376b99db6c60ec54e9919fa9d9e44e917ba966effca8d51de478bebb3c87fac325852cc984ce45a95c5d46dc8bdafb4d55a924d82aa54cf93536ee0aa73

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ui-strings.js
    Filesize

    2KB

    MD5

    ce15195a74980eea14f1b924fedbefb0

    SHA1

    f7d07e2af02c7eb57cc00b9d26394885c6fd7044

    SHA256

    62b7a8f65db3b4ddf91b21294403afac7b1d0b406a6c121aedcd1a7614257545

    SHA512

    7e4efcbabc6c5ab58e40cde1084aa25f6b1a88633e88cbf0a3e3469a59d5a45d19ca469886ec4bf4222d5bd8e6c4a4fa089df586ca6a52ca0a88b2459be2fa04

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\checkmark.png
    Filesize

    2KB

    MD5

    6b4aa97db6473ffd7cc25bbf62810fe2

    SHA1

    8a720524ebfa783e07bcf01cd1f263224230b07e

    SHA256

    18b3aad5bcb79394311ac4fe3071e44b10ebcc2cfe0a2e878b3a75c915bf14ec

    SHA512

    c67d60bf24c9be21830cadb3403ac900a4253eb895e27243c9fbfeb9ce9abbdc2bfae7c24717908743c0826e629cf48930e0c50affd9726e24e586cf3c0d5e2b

    Download Submit

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StorageConnectors.api
    Filesize

    415KB

    MD5

    bfe1e1589502b492e9b3feed6002ab8b

    SHA1

    763be106b107ec966c07015905094873efe33df4

    SHA256

    128944f764a2ad172e183c35526cd46ebadd7719c5ef8e2ce61e42d36487c3d6

    SHA512

    0cbef653a9d9be890837aad3786dafa57378463d445e4068f7ecbed6ebdae7056184f4cd09367c29797e8b43f7c12da30c9c14f6f7b79814a67f2c16346ba189

    Download Submit

  • C:\Program Files\7-Zip\Lang\pt-br.txt
    Filesize

    11KB

    MD5

    ac7b18d98469768cac1ac451e732aca2

    SHA1

    714ed1d5610fdec8ec0538c3d45c0e4d39b8ca6f

    SHA256

    74b35a66285b1c43e9cbcf982260e4283b22bb9a707755301f2cde2806203615

    SHA512

    4a68bf4cdace92051ae44cadde2329e183685d90a1c3a09a10059dc87dbb0e2f6eaa3d4ce488d4a1bc58689ad9c54af59f3fac1dec0c3b594fc0d1b4e89e5400

    Download Submit

  • C:\Program Files\Java\jdk-1.8\bin\orbd.exe
    Filesize

    25KB

    MD5

    469f83789033188dedf53be8a20d9295

    SHA1

    0280c0a41c1e49045991c05958d3639959c87e16

    SHA256

    712617b247f346e375eaa5636f05fb2a6909a67041cb08cc5da8ee5a3285c018

    SHA512

    f16271e7f217512ddfbb6a23ae50e9f1e08513b6e14998a1313df48782190fcc66c1eacffbb9ee65a9a24c04efe0a3fca4e0fa19392a2e96f7e26a88ce460d79

    Download Submit

  • C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll
    Filesize

    13KB

    MD5

    f6c764c435a64105d219ef8d11254a00

    SHA1

    8625a225b743c1ae14bd800e4fbdd745f5b42752

    SHA256

    d4f4d8be209b6e36993105fc644a110bec1d1af7dddda613f003d9cebb619ccd

    SHA512

    1787ccdca1ead52c3cbdc6a737a07ba0f7810233bed2cc85db0232cc2fd5f6243afc7d72ecd0d0326e0caf674f7709c7b52169fbbc40d6c6ca020a97e6b1928b

    Download Submit

  • C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md
    Filesize

    2KB

    MD5

    0f94499cdaf49dd057c72500a709ebe5

    SHA1

    449a5c421535b6995de5b199725aec4d2844679d

    SHA256

    56622e4459bd2adbe0a324e86884a430f01f7f70111c7edcf284e4177dac0011

    SHA512

    c38d641ab9b6762f6263751716763e6f0fdb1be0452614a9fb150e697168a1144cac895306b2a82e3a600a3e5a6533ac548e65663ba77f5b8f71c890150ecf22

    Download Submit

  • C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll
    Filesize

    13KB

    MD5

    b742406abedd7778ad0ef4fb9ce77465

    SHA1

    32a970a5bf6591cb7fb31d73738aa6cdc4f72da8

    SHA256

    842d85c180042fd4951c9a0ad42dae11657dbe057176304e91c450a2c134db93

    SHA512

    b55c3319c5e65ed0f0bcbff74338f45ee2764eec220f9fcabe1a9682d3887e30df85e5fe7bd543d87b8ab58f852aaae6072d24cefe38203967f886896dd460f5

    Download Submit

  • C:\Program Files\Microsoft Office\root\Client\C2R32.dll
    Filesize

    2.0MB

    MD5

    b2e28be53ea325afef2f6a5ce29c9620

    SHA1

    1976843ee325425a1bc7dadb202a6ce72aff2960

    SHA256

    be89fd1906580a23ec486fd2f53abdbbeb52571fbed5720288528a4658bf6398

    SHA512

    acd69c6ef9821f336e30e4cacc15c52784fea3af4e58041331f8632cf872093759948d17c4f50b6f377c1c8289a1874a5dc0b0c144c2b89d0ca74511e1f9fca5

    Download Submit

  • C:\Program Files\Microsoft Office\root\Client\C2R64.dll
    Filesize

    2.8MB

    MD5

    f7674d92ff10276a8cd4d5438fcf8b9f

    SHA1

    14bac597c0ec846735fedcefe4f98675d341cb70

    SHA256

    21f620772c0dd0d8b5ed3dd8648957844e2e3f22de0a14485f30cb387f9358f3

    SHA512

    a53acfa6c8f12fc0461bd841392053af5859639f4ea1f2f302c25672b532903acd4ed33fc5d5ba1adcabae24782f77383285578605a446d5b5d5681a88fa9dd7

    Download Submit

  • C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms
    Filesize

    11KB

    MD5

    f0987a126c960a0445fc3a152f0b5db0

    SHA1

    5c3742a0c3bd156df5b31578e0f228e0faed2258

    SHA256

    0493ac8d01214cdda9d0136d0f7158bb1e0907029475fc0587ba143e496b7527

    SHA512

    00ab743aaffb334c917671ee4aee3b36c525e4b8886fc2ffa2afc82c2998676c95c8f017d90f2ff01f6db63ee64a079d297a6e2c36987ed84440d5c8ae2c6886

    Download Submit

  • C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms
    Filesize

    12KB

    MD5

    5d725621bc1e31f261458fc83172a600

    SHA1

    a8428357a46368f7ef9986ebd2cf19d0d3e9b18c

    SHA256

    b19171ac610ae5b47dc1976ae5043ed5dd41b48f74a4a0905fd39c7c9183aed5

    SHA512

    1796893e593c8a236d9783f0c504959f148683fc197f3339abfa7991aee8baac4a5363fa4ddbc2256e91351081606d8f3c056b29c96c49af3203ceaa416e942a

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt
    Filesize

    1KB

    MD5

    c128f0400e6811dbbccf0b94984a91d8

    SHA1

    7a73a1af7f73bc35706a43f40d95a8a518730cdf

    SHA256

    3fa16219f788fc75eb001b9c9b8d6c4f54b7abdc24379972da61ee07cc494382

    SHA512

    27f2de2201be17c4df403de64a511e1137930c4dcd15cf54244daad8c6448dacdc70393eadfcfc974d28ba9d9e8604c8674b8010b31d11092292918260eb500c

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL
    Filesize

    105KB

    MD5

    6383d83546af716f53dfbefd390af181

    SHA1

    b468feda1d7ee9fb6d41be5ddec60e64f09595b5

    SHA256

    2986755fa29130527a6a41ca9d464a8731858160c01d016c36a89c568de0c1a0

    SHA512

    24c65baef99889dcc9900da6cd98c7d7c70957b3f052f1c1fa775633499756bc36e86e7a939baa0d315f6a57cd1e7408cf82043bca1992718067c16784a58e1e

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png
    Filesize

    6KB

    MD5

    0f51b3c5b15358e08f6053059dea22be

    SHA1

    6d8a91e9a2793c15a9d665872bc2463ef64a6a74

    SHA256

    16050898a4a7838f685c9bd537324fd5361cab9d26b30849c180f109070b8054

    SHA512

    ff92dadb035fd9dc4363084cb804aac9731979a56d0516bbb26a0839644931d41773a7e5b7f06259341a001d82b2531efeb08337d034a7881feffeb13632a426

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png
    Filesize

    1KB

    MD5

    2b5e13b5349aa9348933379ae35a4a32

    SHA1

    caf6df017cacd2788834e4f91616bc3b8bf9ab6a

    SHA256

    0a7db790881eee7c9045f356df8d0eb87740e0eb62b1d760ad37aba06bedf426

    SHA512

    aa40bd095cd16949d4fb7669203c674228b4e6e647df06dfa09b0b4f2a2d7eeda26abb1fdd3a237e63f26cbc7e6759e553696c9c1564e95f400652c860f66b5c

    Download Submit

  • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinTabControl.v8.1.dll
    Filesize

    261KB

    MD5

    c6eaf076ff6286110a6dde1fee5c37d8

    SHA1

    b5d096e98758b513b353f7eca1b336b80787e392

    SHA256

    3f180743dd9a41e7d362b710f6327c6af3ac4032aa7a4b47c191d661939156b7

    SHA512

    d827b495d443f18216671784777bb9e9e9624d4f422d0dfeb62209ba34d6ce28d695434c4419a1c356d9a863bb7385bf2479387cc879cd88496461b431c104bc

    Download Submit

  • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MeetingJoinAxOC.dll
    Filesize

    81KB

    MD5

    dfb137ed0c1b27a8f5272357ea493df9

    SHA1

    427f0cc2f6ec6d69cecf5e8288300e696b75c7c6

    SHA256

    a69573a30b68259109ddb8bf8918e7bd9268dd645f606f94601b1627231f16a5

    SHA512

    ee8efe83e57c82ec3a3880cb86c67da848c4b85e3eecdf7543cbf6819b40b4b0cdcaa3109659dd547ea6b45f664b109c0a1988fd83802b78133f7d9108137aa3

    Download Submit

  • C:\Program Files\VideoLAN\VLC\lua\intf\telnet.luac
    Filesize

    2KB

    MD5

    8a797809499bd90fa5c446179c1d1d3d

    SHA1

    f705b8b4e1e6ac918c462a375e834d4cd1ce69a5

    SHA256

    93187550ed04a41f0b0a5c8c7a1d22b5a528b263634b61fadc19b41a4b412d59

    SHA512

    2239db6179c21a4388fda5bf7d82c5bf58fa9b35cccc2d7818b80c03c0b54ef4ad07acb501c06449024a9a48e922c9b232557972a5e628d6f1b6613ac48d402f

    Download Submit

  • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll
    Filesize

    17KB

    MD5

    5d7bc5f88c3b2cb657cddd11b5bdc506

    SHA1

    c25ad56ff7c917a5671e876116a6d35e1701a524

    SHA256

    a79cad6afcce17da1af0170ff9a5d0f565fb497ffb205898d19969e520ac5cf1

    SHA512

    475c70421881c4cc553ce62d41b43543fc58f6dcfd85574cedd3239c49f0872933d43d6e211e6b0bc5c9236045782cd8b7b4995b9c2da12f8be30403f5aadf74

    Download Submit

  • C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll
    Filesize

    193KB

    MD5

    caf9e72215615f8f6489d8feb8601ed2

    SHA1

    ab7edb67c87a7234e50e74bf15a2b725fa971572

    SHA256

    58beb882610d998df59ce6d5c5442f98d55a7cdae1805331a7e67532cfc78689

    SHA512

    d18ff30f62941f721a1a3e33e238926e83e4dd7e08100103cb405e9c751d8a16ae207a2b2ea38e276515a104a24e217206713c3e4906aec1ec40ce6b031948f7

    Download Submit

  • C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll
    Filesize

    21KB

    MD5

    d95ce75f2a56f46c0595758cc1dae45c

    SHA1

    0f5abb42d93386e8b833dd489f9a60a92f0d8996

    SHA256

    e28675ed062ca8765fbd128636976ce4377f2e372c362fcc9ce26a5b989c0387

    SHA512

    1f0a3e53be14eae453df78eedb09af4cfe9f934bb62f6dee5411636978e9f9724deaf0bf5a058d52ccf12c37f69cad86cd84c637f3accef82c8d86c08278277d

    Download Submit

  • C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll
    Filesize

    154KB

    MD5

    6aa582622bd9297ba164ddf237e451cc

    SHA1

    29c47ed9fe9d22914e1cd51c7cb7eca8a21ff3d1

    SHA256

    ab5a80cf8fd427e7ea7f5e21edc68c50098d4a7171d0938ee05c943dea4f3b03

    SHA512

    66e769e9063c44d44ebc5dd9d72ee6f03d97bf794d719efa331d8c551922c8cb335954d0762dcb7030cf992311a14a4eddda74167f469ddf92a8a5ac92f92f8e

    Download Submit

  • C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll
    Filesize

    46KB

    MD5

    ae55743eb5d89f39485de2d26b4d2976

    SHA1

    b312e63687bbfcd3f70e9e8ece41f7099c8c1693

    SHA256

    cc991bcfdb8b03dba917316743ceeaadf0c05d74ee596821c69b42d836e976e0

    SHA512

    3eb605a19ff55bcdebae668a4004ed944a29906228eb2bc9d254f986ab68be6905675d009994d1e354d8d9660126f8b1e54a5669420b6bd7841d8021c1bb4d39

    Download Submit

  • C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Primitives.resources.dll
    Filesize

    18KB

    MD5

    f5dd2a6b24f5b40687f2051fe0497716

    SHA1

    f3ba8a2070c692007ff8525fc1824249b8c87613

    SHA256

    c9b61d172c05da78f163d175f4a2ab4ddac487e29395745a2f6e276202ce805a

    SHA512

    5ccbcad1bcb472e8a4d30365f444cbded0fe9c9df0775429e6217da51d1989ed51ec6c15a1b17284e6fa4017245d2abac74e4ebcee52c8ba035af5bc79d1feeb

    Download Submit

  • C:\Users\Admin\AppData\Local\2025-04-07_9da577fc74b268fde1a59010c6f66f35_globeimposter.exe
    Filesize

    57KB

    MD5

    9da577fc74b268fde1a59010c6f66f35

    SHA1

    a9939e746b69509c2521f75ddc97ea3260b9988c

    SHA256

    70f4aee38887399799c9f7b1d721c6a0fca6459dd174ebae9585f10525e60108

    SHA512

    d391633ec1b8f5de5b766f6ddd8384f66297fa95820f49101e5e26cafbf890926eb1bd9be33f6e3029fca0582199a761b6f59cbfd695db683256e9d3254a4ed3

    Download Submit

  • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
    Filesize

    12KB

    MD5

    16bce71c6d8c4dffff6da33e11bfe367

    SHA1

    373d275c7d22603c206a4baae881d63101dedf61

    SHA256

    65a95856880efd6b3883845acc5a3bf71dbbaad49bf47256b9f9c228a1932f67

    SHA512

    8c6163c519c68efb9bac9b5eafe3c169185a549818fb5014b47e54109f386a49e29fe07321be7922d79f82c83a5c0d2291872cb89f9459a039b1e9064a798e96

    Download Submit

  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\056i5meh.default-release\safebrowsing\google-trackwhite-digest256.sbstore
    Filesize

    45KB

    MD5

    05dbca207430d6369a151bd5f322fc6f

    SHA1

    b9cb8d41d4bcd65abac06fc6227713ca4ffe5195

    SHA256

    57a29063069f400a3e5c593b4d337cdf4e8ecc288f1818c5149787bcc7129543

    SHA512

    bead5d6e570a8ba43f607bed44f723cb1168f76719709cd1bb4cea7e821c0c0ccc0c300900e69f258b6b43a7946882bee027ca8815c846feefcaea3568f0cde1

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Microsoft3DViewer_8wekyb3d8bbwe!Microsoft_Microsoft3DViewer
    Filesize

    8KB

    MD5

    b3321b2d95a7c8ed7cba69702263bb06

    SHA1

    727ffa84233bf14c2cdebb243793a98588a39bc7

    SHA256

    ab5e1b0c7cf004ed51917208351c8cc338c570c2cd70d69845585c4c8b1a28cb

    SHA512

    46c4bc128842113764b4d4c93e006de19f04cc56895aa9a363e177dcc18523a3df15da55e0ede2823f4c190f81c272fbc091cd75bfb767600fc00eb6a535c2ac

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_RemoteDesktop
    Filesize

    38KB

    MD5

    6926948f573f22a414579c8c67d5fe8e

    SHA1

    42022272ece033e5074d3ac3fccfd06d69d61be8

    SHA256

    e21cab7e66810d6819dcc406df478d6fbb33a98a9eef1c24fb27ebc57d751cdf

    SHA512

    be76bef98ee760b0f02aeee5bb72f75c121047a1555317e0b711fe73e3876354d5b8a06e39f5d5b521df7bbdc9bfe6c01190bf080e9f5f7c8767c6f319561147

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\aria-debug-1940.log
    Filesize

    1KB

    MD5

    81e1697558012b4ec14118c7d4f01a38

    SHA1

    8705fa37d789586354f7baf097dc1e239e752dfc

    SHA256

    b8961346655565eb7e2cd9aa1dde2015030a351cdb94c4c2c3fb0b575b00394f

    SHA512

    b1146d974341f4cf32bc66b0f3711981e60613dba621f1d7a680170413dbb67d8729631bf081c7a1ee7ddbfa9ae705cef2c2f11716ca9b683d405576c95a2586

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\wct37D4.tmp
    Filesize

    64KB

    MD5

    546a832fde42e56464a902191586d8ef

    SHA1

    4c0b20b0b2c2cf2600910f38a91e73c9b1c79204

    SHA256

    68c7cf2b2d4c4fc45f682cf5baca34882e08e4d1053d91eb1fe44fff04536a8b

    SHA512

    87abe2982cadfa455e25dd90b871edcaca75c3ac76b09695140c2de99dac5a6a746c4c967962c1d185e0d4f876fbbb6fc38cdf4e4f2bde9d106d246fc739e150

    Download Submit

  • C:\Users\Admin\Pictures\InvokeSplit.tif
    Filesize

    209KB

    MD5

    7243e8c0ebe8bc6530608c84514df6a9

    SHA1

    e46c3ccb17e2bffeb81ca3e1e63200d4cd87b3a2

    SHA256

    ded12d00ccdf043f23ee322ac6cbe93415d0daceaa8c77e93ddfc5947303e273

    SHA512

    1873194a283564f3b518d16713fa6e410d1bb3fe01853547023c914a6bcaa20477c9f1f54bfa7008ec24d762c42f262fcb79925645d5ddc900a36045f65731f5

    Download Submit

  • C:\Users\Admin\Searches\Everywhere.search-ms
    Filesize

    256B

    MD5

    c9a673864e308ae025360b29988c220f

    SHA1

    c0fbd4e848623ea7cadc32d74846eafa18b17c3a

    SHA256

    af0a89a84fb801333266c862beb7a21aa65e6bcd21deb51338fd885be9778f63

    SHA512

    1af9e3d4a19fa3f11a05a05d9ce5f039b0bfbe8ef180eb17d63c63e776118909d66b06846759add17ad728285f88eae3012a5f6277a0c0d6c45aa6d72057ac53

    Download Submit

  • C:\Users\Admin\Searches\Everywhere.search-ms
    Filesize

    1KB

    MD5

    98f1f0544e61c78cd2a0b7afa61ba4f7

    SHA1

    29eb3fce97ef239b07544fb590f6af4cb1e5620a

    SHA256

    2bcdbe8a52d325213e3e258041f1f87b44b3ec833b08d6d31e93a610aeca8d2c

    SHA512

    b711e3b0451b3b5a721f4b730c41b0c787a40c7875657bf9be4c4c13df13abe0e42aa0e39a83e8f139f35c15d18e2388d8b07609c4c61e63845ab3f944ded1c3

    Download Submit

  • C:\Users\Admin\Searches\Indexed Locations.search-ms
    Filesize

    1KB

    MD5

    e779bd528807bcac9c98d84189ffeb1c

    SHA1

    0c62f3ad0aceea8b0db0ea449e161905c53e53e1

    SHA256

    bf13bb8f0491ce0734b20017fde27358ce98974621e6eab818627d5371c252e6

    SHA512

    c974e04f477ee4b54636dd9da68515023f5576fe9c24183c06c77a9073462247d400db3d92a5c048062866e58557c00a6e9d1a6490d4f1e4d23d7b976ea842e0

    Download Submit

  • C:\Users\Public\B55E45BB6440C55D539BE58ABB829114C4F9D7AA06F5F13DE3E087454DBC8FE6
    Filesize

    1KB

    MD5

    f035e4133017a96a58b4a065d57460d1

    SHA1

    7de731f7c6d2ded34ec272a7242c05badc962df2

    SHA256

    c5a2e3d2ac498e013061182ffa7657d292a07235a976b5931a4162b9f2cde7b1

    SHA512

    a39bc032682434a9c7144267055c1f6dd675b1fc22bdc3236366e1f0791bad8d66b4944b2727539bed239c4ec857ef847594e580ef1c5fe0999853ebbedff5fa

    Download Submit

  • C:\Users\Public\Pictures\how_to_back_files.html
    Filesize

    6KB

    MD5

    5a4fec725c7100b1785ef4ffac53c316

    SHA1

    70acd8c72cd5ba1f9503f2d302f780ae414efb1a

    SHA256

    4365a890d5a610ee613e47bd32c64e76300c34a1ffdc64c4abaa116165b1aa06

    SHA512

    b31ee93c8959e79e2635ad76a714f40d1b5b55e7682801ea13a19744da1f6c4b7b36c7326d6f43eb3bf3f98b24f5b232b22005a3a2c8a4d8fccbf8c580208ff9

    Download Submit

  • memory/2016-869-0x0000000000400000-0x000000000040F200-memory.dmp

    Filesize

    60KB

    Download

  • memory/2016-0-0x0000000000400000-0x000000000040F200-memory.dmp

    Filesize

    60KB

    Download

  • memory/3928-1037-0x0000000000400000-0x000000000040F200-memory.dmp

    Filesize

    60KB

    Download