Overview

overview

10

Static

static

3

2025-11-12...er.exe

windows10-2004-x64

10

2025-11-12...er.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    104s
  • platform
    windows11-21h2_x64
  • resource
    win11-20251015-en
  • resource tags

    arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12/11/2025, 00:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2025-11-12_84f0dc5476df89da0f9b58a30a8677f6_elex_globeimposter.exe
  • Size 54KB
  • Sample251112-bbweksel91
  • SHA256 2f767993cb656fec77b9a3f56e6fe2bc620094fb41a92afaab43d9401854fcb5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasiondiscoveryglobeimposterpersistenceransomwarespywarestealer

Malware Config

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (5923) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-11-12_84f0dc5476df89da0f9b58a30a8677f6_elex_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-11-12_84f0dc5476df89da0f9b58a30a8677f6_elex_globeimposter.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:236
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-11-12_84f0dc5476df89da0f9b58a30a8677f6_elex_globeimposter.exe > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2204
  • C:\Users\Admin\AppData\Local\2025-11-12_84f0dc5476df89da0f9b58a30a8677f6_elex_globeimposter.exe
    C:\Users\Admin\AppData\Local\2025-11-12_84f0dc5476df89da0f9b58a30a8677f6_elex_globeimposter.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5168
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\2025-11-12_84f0dc5476df89da0f9b58a30a8677f6_elex_globeimposter.exe > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4608

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        form_responses.gif
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\form_responses.gif
        • Size 2KB
        • SHA256 d183651a7a89b9bdfc19c8bdc25b2c0a2d257f67975921d2e99be8a7b52ec2e5
        • MD5 SHA1 SHA512
        Submit Download

        Close.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\Close.png
        • Size 2KB
        • SHA256 d17e0144ee9334f9c686001e13bde00c36baf56d87e5b24d2519881a84df2255
        • MD5 SHA1 SHA512
        Submit Download

        back-arrow-down.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-down.svg
        • Size 2KB
        • SHA256 b4f1ea4d497982b552f9531e03191aefb2ad121822b756775676ffa6217b7aaa
        • MD5 SHA1 SHA512
        Submit Download

        s_shared_multi_filetype.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_shared_multi_filetype.svg
        • Size 3KB
        • SHA256 f0f13724c30632e36fbb33e0a9a4400ceb5a3276ea08ac869b1bfccf3292e292
        • MD5 SHA1 SHA512
        Submit Download

        s_filetype_psd.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\s_filetype_psd.svg
        • Size 7KB
        • SHA256 e51424c7c1921ae25e46f99ee2f4fc25b30ff7b854405f86dae8f18912aed33b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        progress_spinner_dark.gif
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner_dark.gif
        • Size 12KB
        • SHA256 f1604286af06fece6d35c31ee5670e67cb4d7aaa7a24142ed608cb891ebcd488
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        s_gridview.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_gridview.svg
        • Size 2KB
        • SHA256 351a83731ac1f205898d3af86f54776d564d71a8d0bb9e45188e76979841dc27
        • MD5 SHA1 SHA512
        Submit Download

        s_sendforsignature_18.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sendforsignature_18.svg
        • Size 4KB
        • SHA256 25708e5a304b67c7b2001a0521e0cc9aa48b6eb7d2277a5873eb493d31b68f93
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        s_share_18.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_share_18.svg
        • Size 2KB
        • SHA256 497e767e500b9bab32bebf765ad266f01cf7659b25933327dcc96119f0463fae
        • MD5 SHA1 SHA512
        Submit Download

        s_uinline_warning.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_uinline_warning.svg
        • Size 2KB
        • SHA256 95dd97da58834152ac934710d1244d2d5f69fe836f5287079dc36b0b535b23ad
        • MD5 SHA1 SHA512
        Submit Download

        Toast.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\Toast.svg
        • Size 2KB
        • SHA256 c95f5f611e7aa02605004fa2dda819e2be30b60ef17237a2ca3c3b8ab65494e9
        • MD5 SHA1 SHA512
        Submit Download

        back-arrow-disabled.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-disabled.svg
        • Size 2KB
        • SHA256 e53143ec7e09b36332da07c21366d5a5e2f3dad5235e31fea15e47f1fac75b40
        • MD5 SHA1 SHA512
        Submit Download

        s_fillandsign_18.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_fillandsign_18.svg
        • Size 4KB
        • SHA256 64828a871bea13aadd34a28bf07ac4de863c3cf78f8b85ae292b6c9dade4dbed
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        s_sortedby_selected_18.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_selected_18.svg
        • Size 2KB
        • SHA256 5ee84ce19aa263d1f433e3ad892ad4857f27a8f162fb3cf73b911f30ac918b2a
        • MD5 SHA1 SHA512
        Submit Download

        virgo-new-folder.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\virgo-new-folder.svg
        • Size 3KB
        • SHA256 53b932bcef52c7dafa4ce37305f8ffeb4a90429723033fe380b4685fd4bbe320
        • MD5 SHA1 SHA512
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\ui-strings.js
        • Size 2KB
        • SHA256 ca6d3718e75cbaf4c5fb2007fa4ba52e9ed0ea0c4ec4a8ba0518e512d392daca
        • MD5 SHA1 SHA512
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\ui-strings.js
        • Size 2KB
        • SHA256 edfc31df64c5ffad6cd058ca61cb4f0f7545e3ad2c76f8b27235065afffd5f0b
        • MD5 SHA1 SHA512
        Submit Download

        illustrations_retina.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png
        • Size 21KB
        • SHA256 656218c2591f958cefe440db8e5b1bd9c2be6e0193a10c01bbb6ce55ba4459d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        virgo_mycomputer_folder_icon.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\virgo_mycomputer_folder_icon.svg
        • Size 2KB
        • SHA256 69181bb3c1ec024eebbfa061917dd562ff4f654e2cd0a7d93825e84aad02dc43
        • MD5 SHA1 SHA512
        Submit Download

        example_icons.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\example_icons.png
        • Size 4KB
        • SHA256 1a30fc3d4051aed67789fd718aa3f7a48df48790f782d3706a4cbf0015414ae4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Download_on_the_App_Store_Badge_nl_135x40.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_nl_135x40.svg
        • Size 23KB
        • SHA256 1c68260282f9f7a82c85e7c6d2b15ad1b55d1ce4bf2731e27f3fafa69c41d2dd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        fr_get.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fr_get.svg
        • Size 9KB
        • SHA256 699b8f994ab7897446a745e9a82117858a6fce51bf955080c74fc7a5c64137e3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        fullscreen-exit-hover.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-hover.svg
        • Size 5KB
        • SHA256 feeedd379acdececf8ba09bfc2eba630b6f7c75c048cd1b8c31aeb88c884b131
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        fullscreen-exit-press.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-press.svg
        • Size 5KB
        • SHA256 60da82e5ec8ade68c411ee59e52bbd95c6b3b1bf8b5a7533e364ead8f749e4dc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        no_get.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\no_get.svg
        • Size 8KB
        • SHA256 be2e4dd37180458bb17701b4ebeab4ffa7525d3bbcd1a3aadc9c600dc7c31114
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sign-in.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in.png
        • Size 23KB
        • SHA256 1f9271166c8806818e64416dabfe4af15b8aa349d5b9b47028e4ea2b65b82ccc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sk_get.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sk_get.svg
        • Size 7KB
        • SHA256 6281fb3b719754c15384a8e143c30825df9f1d11184fea393758ca8ef48b4864
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cstm_brand_preview2x.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\cstm_brand_preview2x.png
        • Size 6KB
        • SHA256 14dc66d34b77d5a579121ed4924b602b5d45429508ef6f074fd69b46fc4bef4d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tr_get.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\tr_get.svg
        • Size 7KB
        • SHA256 c455f48cb22ffabec26fdbba05bed1732a6bc220887c51ddc297e84f75a6e6e5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ui-strings.js
        • Size 3KB
        • SHA256 b3c328929f4866d1ed07fbad6235b68a90485c5c3709bdb787543cada0ad8a9b
        • MD5 SHA1 SHA512
        Submit Download

        share_icons.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
        • Size 3KB
        • SHA256 239215aa19ba366f5e93b400f67a7340641d3d4dd0c3aba6917a67ee503d7085
        • MD5 SHA1 SHA512
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\ui-strings.js
        • Size 15KB
        • SHA256 00b4be9f58fbd57dac1f8e274b5503ceb0543c68852ebd814b3c6f50f90c4344
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        share_icons2x.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons2x.png
        • Size 4KB
        • SHA256 99984a6148a4bf4d558a08381c5e5a01e0b4f353935a60031d9f3dc88bb0ed7a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        variant.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\variant.js
        • Size 2KB
        • SHA256 eea458da5999e2def3c9ae3bf3804bb4464da7e0070195f1311d4599d3fd7466
        • MD5 SHA1 SHA512
        Submit Download

        MSOUC_F_COL.HXK
        • Path C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK
        • Size 1KB
        • SHA256 9356379cca2755521f959a26857ceadcbc0b857d7aa97cc7d0b9b3ddf9a5b152
        • MD5 SHA1 SHA512
        Submit Download

        MSART14.BDR
        • Path C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR
        • Size 52KB
        • SHA256 147b3b1a3238fd9ea558e1f8b2c2eb3d4bdbe4c494f5638009d56b1c6e6e4962
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ExcelLogoSmall.contrast-white_scale-80.png
        • Path C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png
        • Size 3KB
        • SHA256 068b13307fee0db57c4a610fd8af16506a41904b5011123155566a45b82b7a30
        • MD5 SHA1 SHA512
        Submit Download

        PowerPntLogo.contrast-white_scale-100.png
        • Path C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png
        • Size 4KB
        • SHA256 0f438d03394c3d7e2d577dcd3c9aad9960f04fb5bdd15c095b7dd452180609dd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WinWordLogoSmall.contrast-white_scale-100.png
        • Path C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png
        • Size 3KB
        • SHA256 b5e7366a87b17a2900c3668ef146e43c3dcbf0ae6801d08dff850009508d65f4
        • MD5 SHA1 SHA512
        Submit Download

        WinWordLogoSmall.contrast-white_scale-140.png
        • Path C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png
        • Size 3KB
        • SHA256 53fc3e59699c7fd2e557bab9556183c2cd27e34538c8c1cebd866a8f6989d599
        • MD5 SHA1 SHA512
        Submit Download

        CASHREG.WAV
        • Path C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV
        • Size 9KB
        • SHA256 b1dcfd1a33663cb4b926a0f85c195c4f6084aa9af81b44648ceb87662328608a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DSMESSAGES.XML
        • Path C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML
        • Size 3KB
        • SHA256 910fe1f6afe0938504b6e9aabab116d9f6140b114ebb162d1bf139849fcff312
        • MD5 SHA1 SHA512
        Submit Download

        OFFSYMT.TTF
        • Path C:\Program Files\Microsoft Office\root\Office16\OFFSYMT.TTF
        • Size 127KB
        • SHA256 0ec3eb74464ece70d05c8805487a02e68cf2fdd73af55e2bbd09556ab953fb69
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PGLBL107.XML
        • Path C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML
        • Size 119KB
        • SHA256 7d72ecdd620053e8cdf41fcb1f836e14a2f01c9f5b1c19fbe64f47591e99f6b4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PGMN002.XML
        • Path C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML
        • Size 60KB
        • SHA256 7ff1fad47548a288ad39edaf076403142b89bb01cd90e6c2fd2c4ab2525cc030
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        [email protected]
        • Path C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
        • Size 2KB
        • SHA256 33ff7c5bdb585122f85ecf2441d6b93707557daf2f0b4239f99d004dfde7d639
        • MD5 SHA1 SHA512
        Submit Download

        [email protected]
        • Path C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
        • Size 2KB
        • SHA256 0afba9a2cec3bc2349c85947e830664ae303c905e908f7c5b0cc010e6ce8e0dd
        • MD5 SHA1 SHA512
        Submit Download

        QuizShow.potx
        • Path C:\Program Files\Microsoft Office\root\Templates\1033\QuizShow.potx
        • Size 95KB
        • SHA256 5f4c7ea05c84a2755ffb748bd6932e6c010d1e9312415816d6648d536d44b179
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        osmux.x-none.msi.16.x-none.boot.tree.dat
        • Path C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.boot.tree.dat
        • Size 9KB
        • SHA256 2f061aee90bce1a0ac14e25bf538c7935e7a08f4845bd9a980871d3f1f4361d8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        osmux.x-none.msi.16.x-none.tree.dat
        • Path C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.tree.dat
        • Size 10KB
        • SHA256 e6e735e9e3c57e6871649bcc58627b15ed7c4fafb5bc7b646b91144e732f9b58
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        powerpointmui.msi.16.en-us.tree.dat
        • Path C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.tree.dat
        • Size 23KB
        • SHA256 e7680dae1a56edbe2daf45ec73aea57932d68a1583a4963cb27ed8c90a303a1e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        proof.en-us.msi.16.en-us.tree.dat
        • Path C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.tree.dat
        • Size 21KB
        • SHA256 83b4d1046b392e2095dd12aea2c3285a999dd4f0522b1e334f796eb1dbfefa23
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ITCKRIST.TTF
        • Path C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ITCKRIST.TTF
        • Size 60KB
        • SHA256 6f7b0432fd3a6bbb136f2983901fabe755284cf11899db1084f69195d5cef0f7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        proofing.msi.16.en-us.vreg.dat
        • Path C:\Program Files\Microsoft Office\root\vreg\proofing.msi.16.en-us.vreg.dat
        • Size 17KB
        • SHA256 906711d85f48a9597230ac2c3d0ce02040f7cc44ee6af93ae7f8f7e188416d52
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        how_to_back_files.html
        • Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\how_to_back_files.html
        • Size 5KB
        • SHA256 c4e24621859bc7a0f6492ed20a476740ae0f929bd9c66ffd463a07af1000f548
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2025-11-12_84f0dc5476df89da0f9b58a30a8677f6_elex_globeimposter.exe
        • Path C:\Users\Admin\AppData\Local\2025-11-12_84f0dc5476df89da0f9b58a30a8677f6_elex_globeimposter.exe
        • Size 54KB
        • SHA256 2f767993cb656fec77b9a3f56e6fe2bc620094fb41a92afaab43d9401854fcb5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat
        • Size 9KB
        • SHA256 3ca8b5c9079d4aa2a3771d0097bb3afa33b92a726d424456293fd32426e10ed1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        OKIHRYDKS0_8
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\Z2V4MWMQ_1\WVAD85G7_3\OKIHRYDKS0_8
        • Size 2KB
        • SHA256 d7aa5060ea911786faa6888585ec42df541a11ae114021039946dabb6745927c
        • MD5 SHA1 SHA512
        Submit Download

        Apps.ft
        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d0d7ca3b-0919-4166-a9d1-57fb909ff382}\Apps.ft
        • Size 34KB
        • SHA256 4a5b851e2375b3eba14606d730bcf16cf3f448aad6bab223fe489c1cd725daf7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dd_vcredistMSI3D80.txt
        • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI3D80.txt
        • Size 416KB
        • SHA256 27f237e0d3d5a642c38b30abfad7de01e0950bb562b13334f80b38849031720e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cookies.sqlite
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\cookies.sqlite
        • Size 97KB
        • SHA256 8a789057e640afb1e8f3cbd6c8b74ec222dda25c9b85576a7519a1be441eb4e5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SetGroup.DVR
        • Path C:\Users\Admin\AppData\Roaming\SetGroup.DVR
        • Size 371KB
        • SHA256 7d574ed1853892e8e035ead8af8b4c5a7c51fc136f8bd5004b42c7b817efc391
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        StartLock.scf
        • Path C:\Users\Admin\Desktop\StartLock.scf
        • Size 542KB
        • SHA256 9b0e1237ab5acd078baf8860a0d0b432ab430955028ce24356b1022c6a5f156c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        4D1850727698D645140345A948C81E97506131CE6CAABAA2A018743BDCDD31A0
        • Path C:\Users\Public\4D1850727698D645140345A948C81E97506131CE6CAABAA2A018743BDCDD31A0
        • Size 1KB
        • SHA256 1dc0e978bd2bcf7e48da8b67d2f23439a0fd2d819e63a6b20b3900ff62ea38b5
        • MD5 SHA1 SHA512
        Submit Download

        memory/236-3803-0x0000000000400000-0x000000000040E400-memory.dmp
        Download

        memory/236-0-0x0000000000400000-0x000000000040E400-memory.dmp
        Download

        memory/5168-4886-0x0000000000400000-0x000000000040E400-memory.dmp
        Download