Analysis
-
max time kernel
105s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
07/04/2025, 17:29
Static task
static1
Behavioral task
behavioral1
Sample
2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe
Resource
win10v2004-20250314-en
General
-
Target
2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe
-
Size
53KB
-
MD5
f4df354085cc9d71c4011841ff7ab228
-
SHA1
28210aeae1405a32e70849455f6f9fcf2a984c39
-
SHA256
b931e00c356c21534936596fd01ab4632b7e4042c95aca43abdc2b85568bd687
-
SHA512
7ef83d5d2b47219acbd4aa133337b2ee636a599ff406d95181be3c48ccfc8f8ef41d2cc5dc431ead09547260a580517809d35693f4e2a69759d7761fd442a957
-
SSDEEP
1536:szA4+k/t9cXalnawr1IwxVSHM0Zuikg8eT:94+k/t2XalnagIN1R8c
Malware Config
Extracted
C:\Users\Public\Pictures\how_to_back_files.html
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Globeimposter family
-
Renames multiple (9125) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe Key value queried \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe -
Executes dropped EXE 1 IoCs
pid Process 2848 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe" 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe -
Drops desktop.ini file(s) 43 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files (x86)\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-814918696-1585701690-3140955116-1000\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-814918696-1585701690-3140955116-1000\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Public\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Public\Music\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\circle.cur 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DLL 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Diagnostics.Tracing.dll 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\how_to_back_files.html 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-150_contrast-white.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\5px.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFPrevHndlr.dll 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-48_altform-unplated.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail-Dark.scale-150.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailSmallTile.scale-125.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailSmallTile.scale-200.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-unplated_contrast-white.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\PowerPivotExcelClientAddIn.rll 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-down.svg 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-48_altform-unplated.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_lt.json 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\FileAssociation.targetsize-24.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jawt.dll 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInAcrobat.gif 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-32.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\ui-strings.js 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\LargeTile.scale-200.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Rainbow.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.winmd 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_DogEar.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-100_contrast-black.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_download_audit_report_18.svg 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Helper.winmd 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-200_contrast-black.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageBadgeLogo.scale-150.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul.xrm-ms 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jvmti.h 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\ui-strings.js 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\how_to_back_files.html 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-400.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80_altform-unplated.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.Edit.Services.dll 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36_altform-unplated.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-200_contrast-white.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosWideTile.scale-125.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\how_to_back_files.html 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-unplated_contrast-white.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.Osf.dll 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-60_altform-lightunplated.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfreeze_plugin.dll 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4160 wrote to memory of 2848 4160 cmd.exe 87 PID 4160 wrote to memory of 2848 4160 cmd.exe 87 PID 4160 wrote to memory of 2848 4160 cmd.exe 87 PID 5772 wrote to memory of 400 5772 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe 105 PID 5772 wrote to memory of 400 5772 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe 105 PID 5772 wrote to memory of 400 5772 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe 105 PID 2848 wrote to memory of 5876 2848 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe 106 PID 2848 wrote to memory of 5876 2848 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe 106 PID 2848 wrote to memory of 5876 2848 2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe > nul2⤵
- System Location Discovery: System Language Discovery
PID:400
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe1⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exeC:\Users\Admin\AppData\Local\2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\2025-04-07_f4df354085cc9d71c4011841ff7ab228_globeimposter.exe > nul3⤵
- System Location Discovery: System Language Discovery
PID:5876
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD585be9c5eb18def7e5ac6fb77b4f9f79a
SHA1713e3f6231b32b63ef5b21012f1ee5aabbc670f4
SHA2567b05b8000d5a2593757ac538576f82fdbb5d6a252da2dba971fa7528a5b60c41
SHA51254ddb8967489ccfeed6796660992bebc33ad558d046b1ad6add6821b6a08b7cb66a9c6659e646b663ddb1b329f6688cc91779a9269e80b90e4989739e4e467d7
-
Filesize
92KB
MD5033603836e96b40124c2794418346bc2
SHA1fc8bf92808fdaee56fd04eeaded5cdaed374abb0
SHA2562d13c27f6993ce2af2b0375b521d5d1eb6346cbe1603b8ec2f82c75d1b9bea22
SHA5126f1fe375c5be31bda6051fa40c11f3b8fe41ab601f758e06ee2ec45f5ca8a19af692d07210511935578ba8604919d9c3a7256d072d9ea227bab1b8a2cfc0f219
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\comment.svg
Filesize3KB
MD5ea363d82cdd6997daf3be1eead6719da
SHA1b9b3943623a0d76956575932c8c7bbc9bf72ca00
SHA256505c90d3c63e61865281570b8e6f83c11a2a7346e92b55406e513a1a3b2636a3
SHA5128a2df3ce0b7c3a735b17be4b369395ddd3596f28b38936463245ae6f8842d93948352524397d332631bef68c402e2c81456f5ec0f6250e46d2c47e7fa50b51e1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons.png
Filesize30KB
MD5b1923b1dbae381f4a099fbea835c8064
SHA1f79d9b0fdf69c9f3c0afc09850129b8ccba2ece7
SHA256666d3bbcc8dedad759b3e7588375f16ad0cec7927fa9c6831d59c6678fc33fea
SHA512056bb6cbb2b152c05c6c68caf4620ab99503e3a88a0997a70687708c1f869d8f421ee0e965e81d3f309a394a918236eacea165b895de0f8eaaf0fed53679a0b8
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\remove.svg
Filesize2KB
MD5671c92cb32de0f52793a2b6625750c82
SHA1f9202fd9dcda8bcb9653c5f54f7edf8e128e256f
SHA2566a393e5d2b612ffa63e05ac4a07ad2516e894fcbac58ba43923a0b478066e500
SHA51286ad1f3004e45ea459e04539ec497800ebbe16b29c9feae833eb2d9d5a37107a65c05008a21cfb02a6a7a28a30ea4b34348bd3d962f3567ba024e9e4b8b4964c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_listview_selected-hover.svg
Filesize3KB
MD5a2e25213bb89cb97495f0dc250049b78
SHA133f7a3b79f6019b7a85fe4d467c13f45fb6f7de6
SHA256cd71890833478b2acff7d8bfe6f090912f16b81c67df924623ea894c4dbec5eb
SHA512e32fc9526f4702c5684d1074e8b02eb49727bcc4de9ba0fb5c17496f8eadfdd2cd992db3341d76c65a8740f44a106a1db9f194059256dc13386df5d9fc38b784
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_selectlist_checkmark_18.svg
Filesize2KB
MD53fba7e2fdec10ffa273795f7db804383
SHA1e8a157b98d2694ab910c4ded41b5eb6484601dce
SHA256e3e62e5976cf2e56fbd53895a843c29ca305ead24c8a503b963c9b8b6c2c01b4
SHA512ba5849321e2e7858a76ddc879b1cb0130bb3d957adff7caf5633735536dca247739948c53b7b5f5ebe27519e1e1c2210cdd87c901d44c568a03afb5b00dd1e38
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sendforcomments_18.svg
Filesize2KB
MD5f8faa82a4eb7b9abb45bafab6bd2590e
SHA11c108c1839c708375bea9d7b2173091afaff5d2a
SHA256e2f99296fbe6fcc118e75ca99de231fc819fcba857fd4af9808610e7fde7b3e6
SHA5129f61c9fca6c24d31f0a636288758530c6b52318831f62d3ee86ce0ffca283257a2e6b1618a09e1ad957574d08a2737523fd9221b61932d94766a8a72b5e98f53
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\svgCheckboxUnselected.svg
Filesize2KB
MD5675367294b422c2bd3692c78c7d2b5ee
SHA160abc8de29f1cd9a8668b995ef3631d21cc0c9a7
SHA25699d8f49bbed0edea9c2a2d0142b3fd3120c13ca6c44ca131aa0b8c9649a100fc
SHA512a0cc47c4bca4f1c75a7ce94593c0dfffcb9942c1c2ce6138e10e6e64bd464bc3bb48d28b755f3fe65f2080a05e96beb4af2e168ce7368de8edb3f1b2c032494d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons.png
Filesize29KB
MD560a674e4e89a3642e3ff8479d39d75df
SHA113892c7899256e431218d8b32569c82848b799d4
SHA2563127ef623f6bd670dee014417564c05b53dc55f3566ac1e0a19d444cd3193847
SHA512bd8565053ac63ab325c10afa59605c9013987eb9ce85e7b0ea0a789e71556a0e98e5ecd8ffb90fad5554dda98e6e11dfca943da97d88b5c99614d259b0c496e2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_forward_18.svg
Filesize2KB
MD573d2e35eb9fdbeaca36375088d3be394
SHA1cbf80c241835e490c256eaa2500532ab4ca7832a
SHA256e7c241bf1c0427267a1e00101344f63ce78cf3c5b6ae53505107ac0e3f9db5ce
SHA512ffecfe916212c963164d29a0bf8c422416a6c3c58d2f49a8465725388adc53ba0f88554271dbff90fc8a950d6eb16444d3fdd0aa14be0e70dbeeef7fa7210fde
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_hover_18.svg
Filesize2KB
MD54367f0d3aee4f9fe73aa4f27fae9924e
SHA1dc5f3746a872c37d366d57bc6427bcf17f67c1ef
SHA256d26c142d21ae2e42929d812a0f2ec36ee965bf9362874d63dd6c7dd1a2624523
SHA512149d396e2d629ee711e5fbd91abfa605fad7440bdc5528d40084c779a98affa3624f30d49f336b828e766b33f376fcce2a500d186af98026758b7f90425996b4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ja-jp\ui-strings.js
Filesize3KB
MD5903d6f981cf9dfae0494a86cc5062227
SHA1a4e6141e3be9498e10c98338482e7ca74c24afab
SHA256760f1d16774000f844338618fe0d50a998a0757c76c53c715575007b674b365b
SHA512fcf320b3a37b2fada8c72404cf3b844e2116d5eefa7af2d53cf8ab98a0982f80ed9d7844759278a4207513f06a6eb3295f6d42bc830b0212b1129f55adee12dc
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png
Filesize2KB
MD5fbee091f70d7cbf68cb52acd83079f41
SHA1a660bbafe600e96c5ffeaa216a4b48777657907d
SHA2561d201515eb271a418329d6ab1a706c41b43dc9e8fe4346399997934bccdf4440
SHA512062309db7db8bd3c858c510a3f81dbda4b55625f7df79d4a3078094219046409a3cf62bf19c253e09c79d485d3f2cc57535cf0c286817d067a5934e1b31b7a69
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\sample-thumb.png
Filesize8KB
MD5ad5e102bdf01c16f46d69af08eefc665
SHA103c5019165d22d1d93d921344c2e614d72fce915
SHA25664c523e91c9ec773e6ab8dcfdecb57e89f81278964e04188703eb6692e52f20a
SHA512d3d08753bba9f41bfba7b2bd56d1d20d97afbf5166bf5667f84d06e5d18c9577f00a4bc9d508feb0374ceb51c99236b05f6b996e498faf0198e227b546d4bd1a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main-selector.css
Filesize2KB
MD5e0c4c5da6462e424c291269188c8c79c
SHA11aa92ad11a800112c8579f1f1a59fa5f1e9196a5
SHA2560d82f4508a1130129f4724f224a7912e1a762072f9b2f73ff5dea1915dad10a6
SHA512fab0feb39a1c5705452ed859510154e79bfbdfa28b108f3da03d6119102488d9ffe7b6eadb3f5266395e3465cf20c14d23eacf3cb5773b6509bc4f17c3dc6b36
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\ui-strings.js
Filesize2KB
MD58df00d7d29e3267796d7e9bd6a6c8ffa
SHA1fa047c0ae55d130d5790023ca3edc0936b846514
SHA256bc4f532b3caa28915403e68dc977de247c7be11fa79a9e748fd95cc339c3c81b
SHA5128f782b799bb4e7e7bdffc28690ed5442337828d86fe6c5c8291b4e43189507148f5577c3058a6bebbfc9e294c389458e55042704c2a45b642b6e76f328dfb277
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome.png
Filesize32KB
MD5cc50a26548a9b4248f21f0754f8ba51e
SHA11ba756e7cb56549e424df77d458d9ffbf615309f
SHA2565b561ecee6f41c40fea14bd21a7339cb6d2a6d6e59393472d15669216254e433
SHA512594b7aa1509b74885db4a272ab7316c6fa821d10df3d6a543adc57ddfeb2be1aad24d3f1edf1b1e400e1fac20e909de6bae2d7a753163efc8f6d365312121e53
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\flags.png
Filesize66KB
MD54da0f6abc5162fb83b5838e04871c3e7
SHA1cfa5301af0b6a2c50f9765c21d059c3da8870e94
SHA2566bcb352f2e3f29ea97ccc77742c96370e6457683a320e3ffe1096e0565448a4e
SHA512960e643ea0869695ffe1d511d2817b3a4ea9063dd555488c79d3337f267bee11f1c69462e6881c92cbf3f6a8cbec310a12611adca5da854f6a54282f204e493e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Filesize3KB
MD5dc922930d08c5fd2d1ec308af92804ac
SHA19a62fa2259c8dbb423012952368cdf8ec3406eef
SHA256cd3875ed4a674f518d3a6d1c189f1e91718f69d8c201a31b2ef7b4d2586c41ee
SHA5120ae9c773302a093d4fe532ff764bc8e61e97b1164f8c0b2bcd6c1138e1442f0350837b9bba90b938657d11f4e35d44865f302569a241316e1211dbe301b97399
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_radio_selected_18.svg
Filesize3KB
MD5a2d81d164662a70cec7c8d4ebb2da075
SHA1115c55b64129816278e531aee7f1b4f166e0de20
SHA256ef1fc03f25ec5cd2938fcf984528b955111bc1f8a7985bc68f12bd2e9edbdce8
SHA512905deeeff2ccdbae26bb12697aa786437eb5aed230a938abd9461b6c448728ec5c89ba5f99a5c9e04b76566bb84c69a235f638d30db117dff6e8684dc9a6a28c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT
Filesize16KB
MD5fad924d36ea64e334fd564c2b1b36c24
SHA1745fab0f148b0b1db120db9f402fb3a9beb829bc
SHA256a2a8662cadac19026b727b60e15ab9bdbf740175ffc31193f3109a957ce3359f
SHA512072fa090d944cf968b8ef9f2188388edcd06d13e971d2aab565ba856a55ed3340a09d8bba5e84f150c261778ac5dc817998695e84f9df6fc094fc9bd5b05474d
-
Filesize
17KB
MD58cc30dfdee3018893d10eed4360b75b3
SHA1b77270b977df2607d0c9a6e9ad3e20eebaa70e8b
SHA256c4e02397668599a4240a34d0f4f2a7af0918da027aca5e2c15a02f803d938e91
SHA512698b475c54dc725706d4795ce5a6d8342108eb31dd1296880c956ad93b81bbe35fbb71038517a81930e4adc162a5f2ccd220f27e6039ddc75611bd201aa36bc5
-
Filesize
358KB
MD5a810b56bd2f00177167dd64d6fdb459f
SHA15e0af3dda2018ded46c67cac03bee743aeb6ab7a
SHA2562eda629329811770d1f3e914f709ea1a322f97df9966440af6c0f5bd2266bb65
SHA5128379279dae6b34d1ce443a3f2653855063282a059d8ee8857c42b0a0432023debc3c3fd664af6f356a7cfcc1471f9e316dd6b7c79f6f08d4952eca5654780ceb
-
Filesize
366KB
MD51eb67e38f82165fa280b269446291ca7
SHA1516e4568ed954bb5d42277dbf8c635e262b8ff95
SHA25642b5be6ebae355240a9bcd47e5b541943285e355418a7adc63729bf2f68b5621
SHA512c195c5779cae2588e9ba4af80aed9e24daacc0dc414e06fb8fb275c324fa5b0f96db631d4ab85ba1d42cc0314c151b971511b3ccfc7a12060fed56fc1ad53791
-
Filesize
2.4MB
MD538fcc5308cfa160cb09fb05686fa634b
SHA19a26ad11956e889b595522713f9241a1ae130096
SHA256fe216ffcc9034eec978bf981a2c7ddc37b8d9b5767b5180f202fd34a690d0a2d
SHA512cdaf605b2dc799e5f72fec93614f55a06381ce8fcbce1431da6184b90fbe8c9b15f9832c5f92a1865090b778da3e786545754db9a13c0f021c039055f2c4c30d
-
Filesize
1KB
MD5a80721ccffa0899d16c9c2ea7af3f07c
SHA18e47201d40e696040469efe537fce8497ff65532
SHA256edd863790eb6217396d4eb7b52599d539ed7e755c0aa2d468633ab9477e66016
SHA51256551a4d2c1a60efdc271792d5cc64a1b1f74525a8802d016a526ca1de0873aad4d09ce99c714baa9155df06ac4490c9039945aca07d22307a78179fd1f7bb40
-
Filesize
2KB
MD513c5dc3d33aebaedd8bd5488fe503cc5
SHA196e530013e7996919c4cc143841e2c2466f8b55d
SHA256e61d81f00bb809ad5720509ddc6a00fd7b86762c32a7ce9f3f56181dc38d51b1
SHA512b585fb7fd38be96d22effbba27e9d0363558356b78f0781b36339cb6c77bc1016abb65c13abda63b1836d8d0beadf8eabfa7ba5fa61a6993e62df662dad90d1d
-
Filesize
29KB
MD527bda149a1e82a9694b695845ed2e106
SHA14f6fef65b6d73d2f4596dd99311c371b530f5833
SHA2568495f90ce5a208b74a05fa379b1f982ade777753332b48ea4252e1c7bce4977d
SHA512867a83704db02407978bdc43d8238bd7d4fce3299f1a06f0fd74e7d1c370d20f53ae3aa1ba5f5298e3171b09b946737e5db5f98c266440bc75d2eeabe79f1c47
-
C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Filesize2KB
MD5434cde2091b4f01777df1731e69f6dc9
SHA1abd6b26991d507f632dd672b482194224e7c795f
SHA256583f167000db54b3b30a3944932b1f1fec5e20481485f910ee9824e724acb332
SHA51287b73710f59ae50e53e93a5f79ec84a223b6e0b82171f6ffdbd49b4d5a31e474ab321530181cad988b4ddc269687f816569cc53e6c617255ca95f8937e6dc069
-
C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.GrayF.png
Filesize2KB
MD51ffb531ca2d9781a715ff44b4e528a47
SHA161a7676670908fd188645b7165e9e29be1d40ccc
SHA256468ae3e3b48c32cc391a5de26bd293830c275e9b2dd8e3efde43073c9c3f6637
SHA51291e61e8bd94a88d37e4e00c4ea1a60cf5aefbf31768849c2516ab2417e4793193bec65483aeeb4840683bbcd790b3f62ecf88514e786b355f145c742f8a4a733
-
C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Filesize2KB
MD552568dae0c87d513900d1388e7259b16
SHA1105b5f7c69ef5acfdbf5a18c0161670a3061d73a
SHA256341fa4b90f011205ded4a17fd53e66dce8d28c98cee97dd9ed54a977d283daf6
SHA5129dd2a0e857f48f897385a63f47afe6a8bd2d1ce96ca60168fb1811072f1e5bcf265421b514b6e2b703482362ee3734fe18f1b589e88ee4008449e14d21da7aea
-
Filesize
21KB
MD51888c2de72aca4713c0495a11752712a
SHA11a6cd29a5224ccf14a599c71dba050a9076c6a3f
SHA256549f4084453d8173df54b4fd0fba9bfb2d6d282f2036c4e0635df01cf1279cf7
SHA5127be22d38f77be7e4b63cf7e3ef513d3505563d88c68c735c0cf9e66497d831bb2f00bc19def3fa1e36144f2b258aad8a016e2ea1fa769fc24082abcd9444052f
-
Filesize
50KB
MD59d96579e085091bb5c74b11a0a155cc6
SHA14b325c2a6930b12137899e9d22e8c579bcb59a57
SHA256fc15460ce3dbb94c54c3ac47ebb37f594acf601c73438ceed91b8d10961d5fbc
SHA512b3ae4965a714406077007ff31e6f0d9dc474373447bb1b28c1b2b385424eb84a88f7dac9fbf6d6b0e0a64d2f23ebfbcaa9571d718d6eef291c5bc3a937533055
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe
Filesize49KB
MD547a6e08acabe4ffba8809c9e2451be17
SHA151ad3c806cf0a785b327a8d36b6a189f3a159b23
SHA256a207451f78b0c05957093c589b947d3589e33a30d9683da13f10302998e051be
SHA5125aff94dc93e5b5c3528812a47a2ad44567af637373097510fd47a3e189b9aacdff699808db62855ec5d0d4a82d8988d48116e2adb4e7c821735430f4e617dc76
-
Filesize
92KB
MD5f8d7cd7e163521daa31a048356fe4cff
SHA161c06cf3c5461b709c73be88110653d432ab7f0c
SHA2563881398fb07c29120e8a1a016a028d52ab7beffe97abec66fbfe075722993861
SHA5120b4dcb5d6fbd89a6f5a661cf4de7e495a95cd636530625d4b58103add5f54e830934bd17a443bb859cc209aecf77b2fd57ece2d6b1d06d9c644e53469497f62e
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l2-1-0.dll
Filesize20KB
MD5aa096fc115f6972a697f7899d729dbbb
SHA1cba3cdd8365345074248659ee79952e525ee5d85
SHA25632b1656b4186eaa00febbc1b9eb7a81d7bdec28b69ef7f73c44ce088e4804983
SHA512860bf15273598f588a8cfccb57ece1bd4ab86f43e9a489b6d9fdccdc749ee9546560c2aae6859a73553a8863b6c5db4fafa7628989c6171b104b61aa3b35195a
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-heap-l1-1-0.dll
Filesize21KB
MD561a7b806436b3474c008134c4a337060
SHA1eb8606e372599e7311953efa66c0ff07be779edc
SHA2561bdd898d71c6abab6b9554042178a637d48b119bcbab64eff988cbcb21d499e7
SHA512ef8e2a9d565a98c3d30a2ee0a393ec7287b3a2ad6a8a0423b8085e90981b3c050fae1c0fc5c736f595d00b87d99f7df3e408ffdefe282054388d38f3e004a9d9
-
Filesize
17KB
MD5765f78c0453cfe8c9beaf3bb7c7e6072
SHA1d0d8c7d71bd8fa6dc6ab18a96272d6bec5874789
SHA256090ed227023197242463076cb584f2f6f8182f972d6b8f4f6f7aa26a1e362b06
SHA512484199f061bbd63d3b74819a86038163ffed3e950755c66ae3f0b3045fc804334f576c905a281aade6a88d60cf176015694b00f8010f6abeabd975588439bbb4
-
Filesize
7KB
MD5efb733d7e65d5a15532c5d9485fdfd84
SHA1c39390fb4440b426f3eb731e45ff9e3c0ab3d5c5
SHA25619191fd6f79b6089527661e05690b32abcc5ea233d34794e797161e9c039fe2c
SHA51206a0bb424627cf68de89196caf2404b405847686359a1cbc70cf64879236088c54ee0afccfb847c2ffd87840d4efd8c790d27863c7fffeb0fecacbccd2a1ff19
-
Filesize
27KB
MD5d30f8dbe377455efe9fa25a6a8d1999d
SHA1c5570c483bebecfc9a8197c1c4277546735d1ce8
SHA2564b84e887aa8942975e34d7cdbf63788bc98e48811cadf6a6c58f367eef7cbe1b
SHA5123de4106cf18f7b0f64781734ecb555d7a5ddb4f92ee7b147bff89fded0178854961afe5c2922e90d7f2617c2c9ea6e734ea9702343d8d55b9307746951072200
-
Filesize
48KB
MD52f818c8d038bb842af8feac699adec3e
SHA1517819b86a8e7625cc1fa4c6a50400eb2dc62482
SHA25662dbcd13aabd234dc221c63ccc9c739aa9c38f6dec38e5ab569135f68b8482e1
SHA512472ed00cfc302217ec338ea20add061ed20e26acdebdba7672f77d74e6218f3bf8c28a26fb8faee528f2597c76d1e04c23c5761c7c52e0b2c5b80e3ea5c874de
-
Filesize
146KB
MD558d5c89806ed75a678c49a03a0fa9d76
SHA1d19b3a22ce5bee12d2ebe9b5173b26fc57bba3f5
SHA2568cac6f130be54cb9e99a24265c0ac43c4bb02644e2787a0276759cba0516a6a2
SHA51219330e64e1912c9fe36269d8bcf65c896c5e71bec933318fd187c697eeea32c5642feaf92e44de1b7d4da7fc750c38753bcbc637c0f37fb90b6bb0cdb79f4f44
-
Filesize
47KB
MD5d63c26c8e5ce6094c90f7665a82b2379
SHA1e893c3b40c53ad2d6417d09e87d9289a29f3c8a0
SHA256a9e6a3b20f6e3b78879b8aa6fdb998228589e54e3b7ec213ccbedc3c82701ac1
SHA51218676a0f165afc310977678ceb853159db2d69b290b3d56cd5fd70b95afd1741308ca7e51ef696bd1cea98b19e0a386f37c31c27e8855446d9f2029c63e850ab
-
Filesize
61KB
MD5b5ac50c13f1e6b6e718805e34df43da2
SHA19b9446fd829fce8e40aa5622b230ab26de1d120a
SHA256f4df7ae01ace0eeb060c76e596662221ad2183f630656414557dd12bed0cfcb4
SHA5127437dbd26a735db4b01ae78b3bfd1d5e642dffad89671c0a37cc9ab34b0e0110825c4e0867c3bb6ba143789914509e8131e5b501059c5c44de2a51ad32194b0c
-
Filesize
44KB
MD57ad9b9344046812c9a1e141db9a4eb4f
SHA1cfba1e9b104ce53c26d290c455aabf210973a611
SHA256c153ea7a7a8c1d5542755e84e648122faa74d0df133a0d790b597d3ea5445ee0
SHA512dbb19098b35a44133015c4be56e4e816d93a5cd72a72c2272054898443148c0299cd504d05576b8ec1df25ac0d191c5973dfb8e6ce5d4a19a85b910ade7baf2b
-
Filesize
52KB
MD58b753af3f398964ce25403ef483e2662
SHA172962a39e41f1b5ac8d97506ac3febf0ab69725e
SHA256d4ccbb989abbd5104a3810b39184addec4b033c6cd40701f48f1d1f2293bfc69
SHA512ad1ba4af1b313cd2ca2f9fa66a1d09198bff1349b1c45eaefa51b0cb97b1a552af64e703fc134a12ed1ff18a49b62c40eceb65fb5ef5af5b0bc896b893d8d7fe
-
Filesize
53KB
MD5f4df354085cc9d71c4011841ff7ab228
SHA128210aeae1405a32e70849455f6f9fcf2a984c39
SHA256b931e00c356c21534936596fd01ab4632b7e4042c95aca43abdc2b85568bd687
SHA5127ef83d5d2b47219acbd4aa133337b2ee636a599ff406d95181be3c48ccfc8f8ef41d2cc5dc431ead09547260a580517809d35693f4e2a69759d7761fd442a957
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\66b2b1a8-ad2f-410c-b353-29f571e361b3.up_meta_secure
Filesize2KB
MD53901b3cdca3c4eb7377c4752c6268408
SHA1dd0e15c5bddd20e7ee74f4e6e8467c87d2ad82b4
SHA256cd0112950e1ad7e54f4f1cfe57dfc39b9072e47fafbbb1cfd15ab03753ec00c2
SHA512213ba90f9305c4346e05689dd9f8a475aec7e52f2618deb3a266f7e8994d27c1bc85b267a487f292dcaaf471d2edbc7655072c5d4c5afc9aae12d317814b8472
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6f5e5339-9286-4301-af69-2c8942f1c8e7.up_meta_secure
Filesize2KB
MD588a519906340c10b534f771314b84f25
SHA167b50caf4ec69f9ea8dca5e379d4fc44c1500681
SHA25645264bdde12af8ccc834b27cbd3ef67ae2a8082206b4edcdef9c276f1a2d4ca2
SHA512fa1c3ce76e7a15986c1bd1670ca21b165518d90619d1c17b43c2aeaab1134025094c1ab738106c64d49ddb7dee7164726e3fa91a41df987310e3d12e138069d2
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\bfdca07c-7406-47fe-9afb-15a65e95105d.88417793-4c70-4dd3-8640-ced8cd4699bf.down_meta
Filesize4KB
MD5c4bdab5a5d4ed9fd0c9e415420f8abbf
SHA153e4bd6c9b2ec54271c005049e901f78907506ca
SHA2566dc73eb9e738323c5f4129a610d4b971abbeb6802cc2c3b6805848c4bcfbaee7
SHA512bcd732205f596468e5079d5a09eb06ab823c6d83e61e515ee3293b4b02fd1e83b47c2a63f99e7ea2d10187fec32361d8d980afe2ca8f5f6135e042d7e4579f35
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\Assets\4d37196bc735aaeee1b7479ffd7be02fd8efaaa4175d538e592c451486a1643c
Filesize7KB
MD5a79ca968ab477445ea2cb791ab6828c9
SHA1f15f720dcdb410808307d4afe23c20eac017159e
SHA25647ed0369720edd2812965e2e3109a8d9b5002ffdffe85de020a0129ac0eaf94a
SHA51217aacd50813abc7f4d0d4f11249475dd21ffbcc85ce5dcd2f0de9ad9f9780604012dc7b69b2dc4672caa4e9bc62aff6d5dc980f232d0241b416149b20ea86222
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\Assets\a721d601926cf156a60b5a7956e4b4d51af51ebe2b2d7702011cf0a98463a65c
Filesize563KB
MD5ee8f5537884026c26196fbceb294f202
SHA1bce8a566b6cc6e8f2d0115fc5ead1582029a9ef7
SHA2560f12cd02d3dcc205daf922a5810dba8aa8467a11cf0ef737dd852db5950e743d
SHA512743c4283f03d2f8b1bd3f0fbe339c290980c309f8d88d2f9670ec3658eeb49b93e022dbad13411b12128e49afa3848b6f8f502243c84294ba1c625b6a7cee6e5
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\SKEE0OSA\3\Cm-j2OJKwOWyiyy_LY0s7IvC7Qc.br[1].js
Filesize4KB
MD576dbc2baa7782cfbdb9a4b6b7a4cf69c
SHA115c2f21fffde65c2ee52d99bd819c0560f3b3948
SHA256feb80257564a3a441357e969cee62f883d652f09f8b53aed704ab12401761806
SHA512d4bc8e425a52db9308bde1a6b4d7876f4562ed2a19c419e3bd11c06ce96b7bbefd74d7b94490f7f88daec4af203c25db29d3cc336c5a4b34056ae33ccf3fbafa
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{DAA168DE-4306-C8BC-8C11-B596240BDDED}
Filesize37KB
MD5cc89325f535607ecfa515798f3279e66
SHA14c6130ea275ed4390b13bb2321fa033b1b4ff359
SHA256fc5e45d521b63a221dae499d3dba4f132e487a696a805e51bc7bd5224d580aef
SHA512c2c73e307e15aa314830b090a9bd77bd112fe9d51fce169b40af002285c6fb88134782265cfe86e8d96b478750d913900f60ac15be48f0201591c84553cb70e6
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{14544ab0-b8f4-402f-ae81-4770677c3e81}\settings.csg
Filesize2KB
MD539c0f4425478a6bce6b9d00401e971e1
SHA176b692b6e8b08617b4cb9db8d822c1d23645befb
SHA256ae77184e3ec89c3dbed7a72ada3b82f8b15b5c4206f9ec802a72902d5b582f86
SHA512fbe2e0f2d0a306183f3ddf24852329db8a76bb287f0b957585a9630b61c08002a7db0449f1a03518f7541feccb8ce901cae64ba54ec2e5dcaf6cbc3e1304d2aa
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20250314063538_002_dotnet_host_8.0.2_win_x64.msi.log
Filesize110KB
MD53a9ae0085f2383658aeea03e9c9f009c
SHA1bb082aca9d75113c01a21b85ac4eb244a1fe23ca
SHA2561166ff5093c1f495c46518dd276ec4d80ae108840f0e39a713c9a0fe12469a59
SHA512bc1171d56a99456bbb1b758dc37f293a32552aca441b981dd7a831c865f21070b293861c06d9fd175b642f65cbc566b8bf331160b99f46801e38371ef01cb367
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\nmpoxsee.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\prefs.js
Filesize2KB
MD56d7d3f11d06c6f141d839ffd8ceaccf1
SHA15e88da1c26fefb0ca73d28e472a1d0401cf0cad6
SHA2563ba99f6256f13390934aa9b54147dbf31216e45d4b643b552adc8206039c182a
SHA51236a47bb541131842c55a4b9628a78f251e8b34ef978e7824099f9714628109ea6e9e593e77d2e2087f7d0204f8dc485d81b064038a1dbdd9b7d282062797a94d
-
Filesize
453KB
MD5ac1b386b737270fe8c224cf43ba2b481
SHA18f754af291bb228000f95f83011be1a8ee9874a2
SHA256ad58e4a0142af9c4019715cb0374c6e34a98cc3a831456dd8a9e97aa9843649e
SHA512e62b0e4876463027823cd44f9dfa4dc9a0eae884a13bc8bc00e92e9f37235dcca4315acaca89e18356cd7cd988d15b5db14526b20e4a9a0e71a3d54ae5e30646
-
Filesize
306KB
MD55d63a417e1daed73cae422c80ff60579
SHA1ef995e8a92e9c95ef623755fb97672be7581d5a5
SHA25650da726bd3c97d71eb5da1af154dcde10c3e659c5f92db99c637937108c14545
SHA512591ee49054711e5f391d07d61c26daa62a8d78f00e5ebad912b0eb0180983d08f896fd694af5e79dd7f4d40db9757c9004204a173d389e934ec47dc8e894bfea
-
Filesize
340KB
MD5a302a5176b4e0b6050080783a2a215d3
SHA1d9fddd6699c0fe11eb5432fecaf574b1053c1b99
SHA25645073b1b428bbd03a267e04b89bbb8e187ba91e7580ddc4fa2bd3e0a81e2d75c
SHA512efbf743e240d8b571ea0653e3e42b9af2eb2e6814fcba0263364ffcc300b3eeeef0b9883c816d2c5b738fb7a36073dc72cfe301cdf5c02c678d1831ac74aff04
-
Filesize
543KB
MD5a7a355a7236504c6ce9ed048e25d03c8
SHA12b03afe2585f6d888b41296b53e4188f9bfe4528
SHA256a4357b2e0c90051cc85d9b5194b6389f832e580ff08f5adaa1ad51930481d2d0
SHA512522f3b283eb50abc3fdc5fe2a351e97cb5b4c4d387207e3f46053f543dd9d2eadcd15830cd86b5c8b740a98911fe7487ec944e34fc4f42ba18fed4eae1109090
-
Filesize
1KB
MD5d10d09801202f45b98ba8f79b7bb93c6
SHA1b5693d1a46c298bcf84278010c8f4a51c9ee3ecc
SHA2561e7e3880117bd3933a442957f01a04edbeecd4551db89ca7e76a4e51ee61e11c
SHA512ecce94443a52ac8cbf31517894c4369b5ea29c81e68377442f398b55a2a19bc84f456474cda075ef2f94ebf15052cb0f6233b3c8a7705a7ca68792ed2083174d
-
Filesize
4KB
MD5267498e22edac2fb41b52c3f74ced4b7
SHA157e8f8286ad0d6e6a9aa57104906471412cada52
SHA256bbb1512cf70de91dccc215229e38375f5ab4ee088c1acad4e54a742523f1c84b
SHA512a24e423528f85950785f809484f5ce48278c5b16834aba5d44e04d06dfa687baa425a1325eed8244c792a5bfb1c548ddff2ff4db485341c2d438208b245d7f77