202f26cda071c5aa4996a5a28412fddceb3891dceb0366982c62650456c0730f

Analysis

user interaction
yes
max time kernel
100s
max time network
173s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LibreOffice_26.2.4_Win_x86-64.msi
Size 355.3MB
Sample260702-1x59cafw21
SHA256 202f26cda071c5aa4996a5a28412fddceb3891dceb0366982c62650456c0730f
MD5 7a711e1777077f5ea831afb60af09972
SHA1 f4c62b221cebb2a36a51b98fbf7036e1adcfd454
SHA512 544415df6dd14e385123a4b85fa63fca7dbebac81c4e0bdb0f003b2422de6bd5d49653bbf78c49172f809bd24cbdb9b1cc395a2fc783579ceaabd0328fe71303
SSDEEP 6291456:q0E7/E9039U9ndEhYJ065oyCTOIEw/4TZtFpeKIJ5D1oZ/Eoue0jfxPU:qV7/y039edEzyCqA4T3mvJ1oZWs
TLSH
T105093305B259D932E9664376D1055F3689BC1CA8D34283CF4B9DD3ACAD83BB402AB3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware persistence privilege_escalation spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Loads dropped DLL 13 IoCs

pid	Process
4092	MsiExec.exe
4092	MsiExec.exe
4092	MsiExec.exe
4092	MsiExec.exe
4092	MsiExec.exe
4092	MsiExec.exe
1844	MsiExec.exe
1844	MsiExec.exe
1844	MsiExec.exe
1844	MsiExec.exe
1844	MsiExec.exe
5744	msiexec.exe
5744	msiexec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1952	msiexec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	explorer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\lc_outlineexpand.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\sc\res\icon-set-flags-red.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\sd\res\presenterscreen-ButtonPlusNormal.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\encodings\iso2022_kr.py	msiexec.exe
File created	C:\Program Files\LibreOffice\share\template\common\wizard\styles\glacier.ots	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\sd\res\presenterscreen-ButtonEffectNextSelected.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\dict-an\dictionaries.xcu	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\dict-en\dialog\en_bg.properties	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\si\help.ht_	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\fur\help.db_	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\oc\help.idxl\segments.gen	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\zh-TW-xhp.done	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\sc_nextannotation.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\email\mime\__init__.py	msiexec.exe
File created	C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\xdrlib.py	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\ro\help.idxl\segments_3	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\nlpsolver\description-cy.txt	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\kok\help.idxl\_0.cfs	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\nlpsolver\locale\NLPSolverStatusDialog_nr.properties	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\32\arrowshapes.up-down-arrow-callout.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\32\refreshformcontrol.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\helpimg\starmath\mi22005.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\share\Scripts\beanshell\Capitalise\capitalise.bsh	msiexec.exe
File created	C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\_vendor\typeguard\_functions.py	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\helpimg\starmath\al21805.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\share\theme_definitions\ios\pushbutton-default.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\encodings\cp1140.py	msiexec.exe
File created	C:\Program Files\LibreOffice\program\unoidllo.dll	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\bn\help.tree	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\nlpsolver\locale\NLPSolverCommon_tn.properties	msiexec.exe
File created	C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\scalc\ui\pivotfilterdialog.ui	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\32\rejecttrackedchangetonext.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\32\validation.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\lc_groupbox.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\sc_toolprotectiondocument.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\urllib\request.py	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\nb\help.db_	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\32\changecasetoupper.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\32\connectorcurve.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\sc_flowchartshapes.flowchart-collate.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\sc_hidenote.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\share\fingerprint\mi.lm	msiexec.exe
File created	C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\urllib\__init__.py	msiexec.exe
File created	C:\Program Files\LibreOffice\program\soffice_safe.exe	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\kok\help.db_	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\sl\help.idxl\_0.cfs	msiexec.exe
File created	C:\Program Files\LibreOffice\share\config\soffice.cfg\cui\ui\querydeletelineenddialog.ui	msiexec.exe
File created	C:\Program Files\LibreOffice\share\gallery\bullets\triangle-green.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\32\formatline.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\lc_rect_unfilled.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\sc_showbookview.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\starmath\res\co21918.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\share\xpdfimport\poppler_data\cMap\Adobe-Korea1\UniKS-UTF16-H	msiexec.exe
File created	C:\Program Files\LibreOffice\share\config\soffice.cfg\dbaccess\ui\detailwindow.ui	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\lc_objectposition.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\sd\res\presenterscreen-ButtonSlideNextDisabled.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\vcl\res\check1.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\share\xpdfimport\poppler_data\cMap\Adobe-Japan1\Add-V	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\it-xhp.done	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\hr-xhp.done	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\mk\help.key_	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\nlpsolver\locale\NLPSolverCommon_my.properties	msiexec.exe
File created	C:\Program Files\LibreOffice\share\dtd\officedocument\1_0\accelerator.dtd	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\sc_toggletabbarvisibility.svg	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\AmiriQuran.ttf	msiexec.exe
File created	C:\Windows\Fonts\DavidCLM-Medium.otf	msiexec.exe
File created	C:\Windows\Fonts\NotoSansArabic-Regular.ttf	msiexec.exe
File created	C:\Windows\Fonts\GenBkBasB.ttf	msiexec.exe
File created	C:\Windows\Fonts\LiberationMono-BoldItalic.ttf	msiexec.exe
File created	C:\Windows\Fonts\LiberationSerif-Bold.ttf	msiexec.exe
File created	C:\Windows\Installer\e598ae1.msi	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSans-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansCondensed-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansMono-BoldOblique.ttf	msiexec.exe
File created	C:\Windows\Fonts\LinBiolinum_RI_G.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSans-BoldOblique.ttf	msiexec.exe
File created	C:\Windows\Fonts\LiberationMono-Regular.ttf	msiexec.exe
File created	C:\Windows\Fonts\LiberationSans-Bold.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\VGEIN9E0\X0FFIEYH	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0D149021B459D0D7.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Fonts\Alef-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuMathTeXGyre.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSans-Oblique.ttf	msiexec.exe
File created	C:\Windows\Fonts\GenBasB.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoSerifLao-Bold.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\JPMO1B24\NR7QF0QD	msiexec.exe
File created	C:\Windows\Fonts\MiriamMonoCLM-BookOblique.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerifCondensed.ttf	msiexec.exe
File created	C:\Windows\Fonts\LiberationSerif-Italic.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoSans-BoldItalic.ttf	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9BF9.tmp	msiexec.exe
File created	C:\Windows\Fonts\Carlito-Regular.ttf	msiexec.exe
File created	C:\Windows\Fonts\GenBasI.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoSerif-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\LinLibertine_R_G.ttf	msiexec.exe
File created	C:\Windows\Fonts\MiriamLibre-Bold.otf	msiexec.exe
File created	C:\Windows\Fonts\Rubik-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\Rubik-BoldItalic.ttf	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAEBA.tmp	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerif-BoldItalic.ttf	msiexec.exe
File created	C:\Windows\Fonts\GenBkBasI.ttf	msiexec.exe
File created	C:\Windows\Fonts\LiberationMono-Italic.ttf	msiexec.exe
File created	C:\Windows\Fonts\FrankRuehlCLM-MediumOblique.otf	msiexec.exe
File created	C:\Windows\Fonts\MiriamMonoCLM-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\LiberationSerif-BoldItalic.ttf	msiexec.exe
File created	C:\Windows\Fonts\Rubik-Regular.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\JPMO1B24\policy.1.0.cli_uretypes.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\132O1V0Z\637OKMPL	msiexec.exe
File created	C:\Windows\Fonts\NachlieliCLM-Light.otf	msiexec.exe
File created	C:\Windows\Fonts\FrankRuhlHofshi-Regular.otf	msiexec.exe
File created	C:\Windows\Fonts\NotoSansGeorgian-Regular.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoSerifGeorgian-Bold.ttf	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FC347C1D-B207-4BF7-981E-64E59429B63C}	msiexec.exe
File created	C:\Windows\Fonts\LiberationSansNarrow-Regular.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\7JZOR105\cli_ure.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\LQ0YKYAY\ORSLWFBZ	msiexec.exe
File created	C:\Windows\Fonts\Alef-Regular.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerifCondensed-Italic.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoNaskhArabic-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoSansArabic-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoSerif-BoldItalic.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoSerifArmenian-Bold.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\RX7RIJMJ\cli_oootypes.dll	msiexec.exe
File created	C:\Windows\Fonts\LiberationSans-Regular.ttf	msiexec.exe
File created	C:\Windows\Fonts\LiberationSansNarrow-BoldItalic.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoSansLisu-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\Scheherazade-Bold.ttf	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1952	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vsd\LOBackupAssociationDeref = "Microsoft Visio Document"	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dotx\LOBackupAssociationDeref = "Microsoft Word Template"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xls\LOBackupAssociationDeref = "Microsoft Excel 97-2003 Worksheet"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xltm\LOBackupAssociation = "Excel.TemplateMacroEnabled"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pps\LOBackupAssociation = "PowerPoint.SlideShow.8"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppsx\LOBackupAssociation = "PowerPoint.SlideShow.12"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vst\LOBackupAssociationDeref = "Microsoft Visio Document"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{6310BD4E-970E-452E-ADCE-0E38C151A5F6}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vsd\LOBackupAssociation = "VisioViewer.Viewer"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.docm\LOBackupAssociation = "Word.DocumentMacroEnabled.12"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlw\LOBackupAssociation = "Excel.Workspace"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppt\LOBackupAssociation = "PowerPoint.Show.8"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.potm\LOBackupAssociation = "PowerPoint.TemplateMacroEnabled.12"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dot\LOBackupAssociation = "Word.Template.8"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dot\LOBackupAssociationDeref = "Microsoft Word 97 - 2003 Template"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pptm\LOBackupAssociation = "PowerPoint.ShowMacroEnabled.12"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlsm\LOBackupAssociation = "Excel.SheetMacroEnabled.12"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlsb\LOBackupAssociationDeref = "Microsoft Excel Binary Worksheet"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.iqy\LOBackupAssociationDeref = "Microsoft Excel Web Query File"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dotm\LOBackupAssociation = "Word.TemplateMacroEnabled.12"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pptx\LOBackupAssociation = "PowerPoint.Show.12"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.potx\LOBackupAssociation = "PowerPoint.Template.12"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.potx\LOBackupAssociationDeref = "Microsoft PowerPoint Template"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.doc\LOBackupAssociation = "Word.Document.8"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rtf\LOBackupAssociation = "Word.RTF.8"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlsx\LOBackupAssociationDeref = "Microsoft Excel Worksheet"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlsm\LOBackupAssociationDeref = "Microsoft Excel Macro-Enabled Worksheet"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xltx\LOBackupAssociationDeref = "Microsoft Excel Template"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pptx\LOBackupAssociationDeref = "Microsoft PowerPoint Presentation"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pptm\LOBackupAssociationDeref = "Microsoft PowerPoint Macro-Enabled Presentation"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dotm\LOBackupAssociationDeref = "Microsoft Word Macro-Enabled Template"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xltm\LOBackupAssociationDeref = "Microsoft Excel Macro-Enabled Template"	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vst\LOBackupAssociation = "VisioViewer.Viewer"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.doc\LOBackupAssociationDeref = "Microsoft Word 97 - 2003 Document"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rtf\LOBackupAssociationDeref = "Rich Text Format"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlsx\LOBackupAssociation = "Excel.Sheet.12"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlsb\LOBackupAssociation = "Excel.SheetBinaryMacroEnabled.12"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.docx\LOBackupAssociation = "Word.Document.12"	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5744	msiexec.exe
5744	msiexec.exe
2800	explorer.exe
2800	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1952	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1952	msiexec.exe
Token: SeSecurityPrivilege	5744	msiexec.exe
Token: SeCreateTokenPrivilege	1952	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1952	msiexec.exe
Token: SeLockMemoryPrivilege	1952	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1952	msiexec.exe
Token: SeMachineAccountPrivilege	1952	msiexec.exe
Token: SeTcbPrivilege	1952	msiexec.exe
Token: SeSecurityPrivilege	1952	msiexec.exe
Token: SeTakeOwnershipPrivilege	1952	msiexec.exe
Token: SeLoadDriverPrivilege	1952	msiexec.exe
Token: SeSystemProfilePrivilege	1952	msiexec.exe
Token: SeSystemtimePrivilege	1952	msiexec.exe
Token: SeProfSingleProcessPrivilege	1952	msiexec.exe
Token: SeIncBasePriorityPrivilege	1952	msiexec.exe
Token: SeCreatePagefilePrivilege	1952	msiexec.exe
Token: SeCreatePermanentPrivilege	1952	msiexec.exe
Token: SeBackupPrivilege	1952	msiexec.exe
Token: SeRestorePrivilege	1952	msiexec.exe
Token: SeShutdownPrivilege	1952	msiexec.exe
Token: SeDebugPrivilege	1952	msiexec.exe
Token: SeAuditPrivilege	1952	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1952	msiexec.exe
Token: SeChangeNotifyPrivilege	1952	msiexec.exe
Token: SeRemoteShutdownPrivilege	1952	msiexec.exe
Token: SeUndockPrivilege	1952	msiexec.exe
Token: SeSyncAgentPrivilege	1952	msiexec.exe
Token: SeEnableDelegationPrivilege	1952	msiexec.exe
Token: SeManageVolumePrivilege	1952	msiexec.exe
Token: SeImpersonatePrivilege	1952	msiexec.exe
Token: SeCreateGlobalPrivilege	1952	msiexec.exe
Token: SeCreateTokenPrivilege	1952	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1952	msiexec.exe
Token: SeLockMemoryPrivilege	1952	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1952	msiexec.exe
Token: SeMachineAccountPrivilege	1952	msiexec.exe
Token: SeTcbPrivilege	1952	msiexec.exe
Token: SeSecurityPrivilege	1952	msiexec.exe
Token: SeTakeOwnershipPrivilege	1952	msiexec.exe
Token: SeLoadDriverPrivilege	1952	msiexec.exe
Token: SeSystemProfilePrivilege	1952	msiexec.exe
Token: SeSystemtimePrivilege	1952	msiexec.exe
Token: SeProfSingleProcessPrivilege	1952	msiexec.exe
Token: SeIncBasePriorityPrivilege	1952	msiexec.exe
Token: SeCreatePagefilePrivilege	1952	msiexec.exe
Token: SeCreatePermanentPrivilege	1952	msiexec.exe
Token: SeBackupPrivilege	1952	msiexec.exe
Token: SeRestorePrivilege	1952	msiexec.exe
Token: SeShutdownPrivilege	1952	msiexec.exe
Token: SeDebugPrivilege	1952	msiexec.exe
Token: SeAuditPrivilege	1952	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1952	msiexec.exe
Token: SeChangeNotifyPrivilege	1952	msiexec.exe
Token: SeRemoteShutdownPrivilege	1952	msiexec.exe
Token: SeUndockPrivilege	1952	msiexec.exe
Token: SeSyncAgentPrivilege	1952	msiexec.exe
Token: SeEnableDelegationPrivilege	1952	msiexec.exe
Token: SeManageVolumePrivilege	1952	msiexec.exe
Token: SeImpersonatePrivilege	1952	msiexec.exe
Token: SeCreateGlobalPrivilege	1952	msiexec.exe
Token: SeCreateTokenPrivilege	1952	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1952	msiexec.exe
Token: SeLockMemoryPrivilege	1952	msiexec.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
1952	msiexec.exe
6044	sihost.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1952	msiexec.exe
5744	msiexec.exe
4092	MsiExec.exe
1844	MsiExec.exe
4452	StartMenuExperienceHost.exe
3008	SearchHost.exe
2800	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5744 wrote to memory of 4092	5744	msiexec.exe	88
PID 5744 wrote to memory of 1844	5744	msiexec.exe	89
PID 6044 wrote to memory of 2800	6044	sihost.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\LibreOffice_26.2.4_Win_x86-64.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1952

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 31B57AE7468C9F76C976A36B37A5725E C
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4092
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 83AC330BE041D012D9DB25E57BBDEAE6
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1844
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 54228AD336276256E74EA9E5A1CD7AE1 E Global\MSI0000
  2⤵
  PID:260
- - C:\Program Files\LibreOffice\program\update_service.exe
    "C:\Program Files\LibreOffice\program\update_service.exe" install
    3⤵
    PID:1560
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\LibreOffice\program\spsupp_x86.dll"
    3⤵
    PID:5072
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s "C:\Program Files\LibreOffice\program\spsupp_x86.dll"
      4⤵
      PID:2128
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\LibreOffice\program\spsupp_x64.dll"
    3⤵
    PID:5504

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2800
- - C:\Program Files\LibreOffice\program\soffice.exe
    "C:\Program Files\LibreOffice\program\soffice.exe"
    3⤵
    PID:4536
  - - C:\Program Files\LibreOffice\program\soffice.bin
      "C:\Program Files\LibreOffice\program\soffice.exe" "-env:OOO_CWD=2C:\\Program Files\\LibreOffice\\program"
      4⤵
      PID:4332
- - C:\Program Files\LibreOffice\program\soffice.exe
    "C:\Program Files\LibreOffice\program\soffice.exe"
    3⤵
    PID:5096
  - - C:\Program Files\LibreOffice\program\soffice.bin
      "C:\Program Files\LibreOffice\program\soffice.exe" "-env:OOO_CWD=2C:\\Program Files\\LibreOffice\\program"
      4⤵
      PID:2504

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3008

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e598ae2.rbs

Path C:\Config.Msi\e598ae2.rbs
Size 2.6MB
SHA256 514ce6824556a6dc3071f2b8c4bf8d503f704e3f9a864188d87e62b7835c5a71
MD5 507434538fb6636d7f7d874e318f4143
SHA1 efa5a6d9a2fae98030dfae41d79d7bb209eaaedc
SHA512 f71345925eaa32e9b36663992784286c127a025a8f09c2dc166a997b939fda793270cdba507bbbbfab36308aceda5f1fb6901a2b8cf82b6757512bd0cf62ffd9
SSDEEP 6144:6LOYXZkVnN/ACSpWw8AHTFAQ0BDjcz6xAXOF0qjMwhhyrGblq6GbyDGvjQrM4:6LORN/ACAZLHTFAQ0BI6kyIjeM4
TLSH
T147D52212B905C2C3F8921570E782371C6769C8AD7708A2572BDDD72FDCD2B961BBE188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_sesize.svg

Path C:\Program Files\LibreOffice\help\media\icon-themes\vcl\res\window_sesize.svg
Size 707B
SHA256 38aa21bdcd109b02609db938c254eaf8105885dcbfd4fbc38f704e39acb74091
MD5 09907267d69bd2f2fcefe8342b34092f
SHA1 09dc5cea4427c8f2c5cbe2333f118af0d6f627bd
SHA512 d816c24bf0dceda7d0f4aa5e092a118951ce77ac6a57b71c817942db50eabe6450b38772a943d4e9c96b2d0583ae2a984b0a25bc112d59ddf05e7742757b539c
TLSH
T14F0149A95498264D1D84BE66CDA469DC212F38F2E74D40ACDC4E051358315BAD4DB84E
MD5 SHA1 SHA512 TLSH

Submit Download

window_swsize.svg

Path C:\Program Files\LibreOffice\help\media\icon-themes\vcl\res\window_swsize.svg
Size 741B
SHA256 79ab44d98cd822805dbf02caa0951c21726c5d66d969bf511988bc15326fd827
MD5 acfbe9683b941a974d5b4d8196b92b7b
SHA1 ca558bb358f6a91bf4a9c14765caa7a09b51d0ea
SHA512 76d874b8fd99bb319a9962f8f03e2177bbd22f2b5cda2b7229bb1191537d0ec3d60709cd3d538ac76fa990a623780c100b981969b29ab1b49901bfc0d2594519
TLSH
T1270189B95888264C1D85BE62CDA8AECC222F34F2E74D40BCDC4E152358715BAD4DFC4E
MD5 SHA1 SHA512 TLSH

Submit Download

chart.mo

Path C:\Program Files\LibreOffice\program\resource\it\LC_MESSAGES\chart.mo
Size 111KB
SHA256 f18ed790afe9ef3ddd427044184c53fa12ab5fce3674f3fd9f50bdac63edba7a
MD5 2474fb2731945cf69ad9e2c5c719d0a1
SHA1 6bbbe54847c575adfbb5b04b0a7b88258da9d792
SHA512 c418e2b06d4951e324a28295373a966e785d13a5a20622f2f200928f626754bb544cd6ffece28718490dd0802fa8cd56183437107a5c4dc4e70eda5b1eec1a8a
SSDEEP 1536:tOR7aKKMmFWXprXGckbEInJXlzYTJGuut5PxudddXHxboJWbTPHo/wR1OpkvCdL3:tu7AsFIzGRCU7/AYjUXzIWd
TLSH
T1C9B35B27F7403377C90B5339868992A3F3B4C0BE56952B70BAC909892DC5D24AF7D792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cui.mo

Path C:\Program Files\LibreOffice\program\resource\it\LC_MESSAGES\cui.mo
Size 544KB
SHA256 8831559fe4b5b205a4bcef8818124b0788c06f9f3ae3aee0e4a396a04e893666
MD5 51eef20064d6b3bba422a736928b7869
SHA1 ac005e4d79f0e7fdb714a5bad13d9f378296fe26
SHA512 70cc5c8a3c676aa1a9818f79ace074743d24e7617d88f37a8001b284979117531bd0956679d58e55cbe86d440a228a12d8ba88eff406deef36df539af57a75bf
SSDEEP 6144:GCesyufSdc7nF1g9jpx1ohAHWLGK3e3rdy6BTfGW4jhqhsXQWQBh4o48xb3p79ER:3lV3QoCHWL3VDH
TLSH
T170C44B37D2853331C1974379A06AA0D1E774C4FD6A56A7B5E8CDA22D3287E40727E2CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dba.mo

Path C:\Program Files\LibreOffice\program\resource\it\LC_MESSAGES\dba.mo
Size 109KB
SHA256 771c9d8644df8675d50eeef5e23457bfea607b059f2199a8a21c3c204e1849bf
MD5 ce5e8fe979c449763b1764d8eb10ade7
SHA1 35d00740fb1e06f1c789eaa49144969679374c99
SHA512 a4b4a5431741a8ed47ba914fc836dbe67d3d59ddbdccc86c6bbce1577d6a42607405b566cccca78d900e0f90ef425f90907b5ee4b1685dbd9d39b314934233f7
SSDEEP 3072:YegoYWrsU93vUmg9k6e4x2WX6TDX8tHUoBSooHIutFhl:7YWrsaUmgyNLWKTDX8tHUoBSooHIutF7
TLSH
T1E0B35C22F3802795C65703B0A10A51A2DB70E0DC7B58436A9BEDC3193ED6F94FE6F685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcr.mo

Path C:\Program Files\LibreOffice\program\resource\it\LC_MESSAGES\pcr.mo
Size 69KB
SHA256 9a2453529f1adac4cb804a043423735d8cef47bb8d9a8f6719e5c37974160c90
MD5 c16fe408f15102dd70131a42dd75e3eb
SHA1 fc0ff01cb96cf4f01504366bb5b35ff55bb45d5c
SHA512 0418ce474afcc65452dc2d475859d3cad379e5cd34df2d85f475680a3fc55cb4e9eb59b4e05b8591d5cd914cb9c6571fb9417ea91ccf982da4d32cadcca10f38
SSDEEP 1536:j6Ag1pcuU/TTapKyKjS7Tvt8rzHFhrNWY7MKfrxs4/A:j6m/QB6rzHFhPIY1A
TLSH
T18463187EE7502321E1470371A11951E09A70E0F9AF6C0B63EADC870A19F5F307A6E29F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sca.mo

Path C:\Program Files\LibreOffice\program\resource\it\LC_MESSAGES\sca.mo
Size 80KB
SHA256 1259116308d96c4b0cc713fbdaeec65499571303dfd15de21a8b7249420e3760
MD5 d532c21f1a2d118d5ce1f13a651c2570
SHA1 50a7eb67e067eb1ab5404955070de14b8845f81c
SHA512 aa5bcf78912b4e4757c9679bd4b251901c80af8c0ae6af4d32e552e25c2acb2d30f58934e01f01e081a3d813c1e8c5a1bfead5062685413bfc395c8cb046a1af
SSDEEP 1536:90szVujUfJgbIdN7kClVArPac8joxE1/tpqX8beGt7mPcmPpmPOYmPpC:qsH8+7kClVArPacOoxE1lpqX8beG9mPq
TLSH
T1E583A22F6D863612C967C334463893ADCBA9C0989614E70DD53E017E2BC79609EBDFD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sd.mo

Path C:\Program Files\LibreOffice\program\resource\it\LC_MESSAGES\sd.mo
Size 162KB
SHA256 85e6ae95900168e46660426285830629c642411474bc6dfcb56da285a2c968cb
MD5 05ca87e4c96facd13eb2edfe3536067e
SHA1 a110475bea27871fddb8ea7044847c7ab6f60b7b
SHA512 0c59664d47aedf731c860c6cafcde9007573d8fc356f75c52767893b82f07e7c63c6e7156f3eb15f0b4c2ad6f9b6529ab33c4f3f5107bb37f6e47cff7ddf4670
SSDEEP 3072:61JnI46hA3u/ySMAQr016eeoGZIPEkZg3Uki8lFdZj+vTKHxLUg/RFUC3thc6iF5:6/5lUyG16G8l3bX+eTsfrIgYOnVHuz5+
TLSH
T18FF34B39D48117A4D6075336A0199051FBF8CCEE5BA1B73A75DC127E2EC5E402EBE2B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfx.mo

Path C:\Program Files\LibreOffice\program\resource\it\LC_MESSAGES\sfx.mo
Size 99KB
SHA256 8b9004297300796be917e451c2d2915ba68a7a3e47680ea61255b0a2404a8590
MD5 8f6ad7fcc1ca174a094a83f157b2df72
SHA1 5902aca2c4619aaf33ed6837c235206d3a9917da
SHA512 970999f13efb8461dc6642bca5ffd27a4ca31ae19cd1525353d80a7104429e05247d7bf6dd1e552868002ceca8a26b0acbc3a8da7b4b8ea825576ac70a06ee4f
SSDEEP 3072:S+t6y+nOYM03eu5G2diMlI9zHsgH7kpmj:SkL9aTIMi9zHsgH7kpmj
TLSH
T1A5A33A3AD2A626E2C2170379F521A1A1FBB1C1D97F567313AACD424C2DC5F40AF7E246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sm.mo

Path C:\Program Files\LibreOffice\program\resource\it\LC_MESSAGES\sm.mo
Size 55KB
SHA256 abbe834b1fdbcb3edc824e8bccc32f85fb2475751a0617d5cd348ae599935abc
MD5 a89816aa4c6727d6cdd4d568eb1c241f
SHA1 9a5bb92512c5c204571359e271fd4108922bb8d6
SHA512 6d17bd3d82997bd678ae01d5426a644e28e7b68f14cd3d4a194a88e32f1cc80749239ef681436a8f4131f02d9131c1caa7c63a58afe1220c483d3773fc6651cc
SSDEEP 1536:JBq1BPMhJoJJEaPAhhktlJKjtNcEGpOkzPQ7:a1kiKjtGp0IPQ7
TLSH
T11B4327866D4F1A32C21B0635D85F1150D3BDEEF9A661E7A36ACC0B6D65E8F48312630F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svt.mo

Path C:\Program Files\LibreOffice\program\resource\it\LC_MESSAGES\svt.mo
Size 90KB
SHA256 b89940ea76d865f8f40f3808f14f6a1d8012090ab094f6cd3ea8c785361a15d0
MD5 f0aeb1e9e077f72d7a8b9f04ceb8b01d
SHA1 4c4f44fe4eca477befcefe1aebff9910fea48615
SHA512 438c6c9370dfa2bb1df3e105c98c8a71a7f77dbb67fbc46fcf0e6557b17eb297fb12a39852fbf7f2d29438bfc05563ce240caef78f58d9db67d3de2353bc1682
SSDEEP 1536:yjcQNC36HrtVl6hXxn6+lW5k1BvrunWKTXf9mX:yYQA36Hr7+6+ZTvrunnXfYX
TLSH
T11F93F997C5A068C1C52265B68E32F2A3BF38C4E19D55330377FEAB489D96702CD5F21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svx.mo

Path C:\Program Files\LibreOffice\program\resource\it\LC_MESSAGES\svx.mo
Size 339KB
SHA256 000670be827c99d74942d38b8186b4e33b27bcf9c31b62cf5bf93ad9d2840984
MD5 f2a81b95baf7779d05b784f00b82a955
SHA1 690c052a548d778d3793686a2b51850e754c64f5
SHA512 7df82035c48a812fececca7ead32334af69bbf3b0106deba84476d9f49f0ef0caa114f5f5b261cebba087d65dd031457f1ff138a46bdf565f3a9b8bc3215d7c4
SSDEEP 6144:YaqIUIZ/EvoIz0spmFgAhJUa9DywX+pekEiG2/nW6LNffuFACBo+x1HGv0R4oRC9:YaqhIdsZmFgAhJv9HzXg
TLSH
T163744977E2413A26C54B013D54B59121DF3484FEA712E363EEED668837EBD14193E2CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcl.mo

Path C:\Program Files\LibreOffice\program\resource\it\LC_MESSAGES\vcl.mo
Size 45KB
SHA256 ebe12e2a21709670967a4c13cef2dd34daf0982012ca9fdfb9b3dbd9fab41618
MD5 1ee0a94978889a6b70daef00459f6e51
SHA1 aaac8d814743ff64f630de4ffb3dbdd9f474e933
SHA512 d9f96bde9fc49717948bc1eaa51d3a225295cc6656f3ebb94b9137e4ac6b3313caf3e9981aa1e5bfa538583b3b1ec1231d151d214a12b83bf6069fb30c543004
SSDEEP 768:oqs7xgTmRhX8+Dkj2c94u9L6hd+R2KuuhZdUGpL2b/C:ls7KTAsYkj2c94u9L6h0R2KNh0GQrC
TLSH
T156233AE9C1441651CB7B4634A6314071D7D6C1B5DAE1FB736F88C04D38CFEAC26AE2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sc.mo

Path C:\Program Files\LibreOffice\program\resource\uk\LC_MESSAGES\sc.mo
Size 829KB
SHA256 f9d884d0d37c00c258b3cd0131dc4dc47faf08df1d334b73af12ea610a77ed71
MD5 1fcb9fc3c4cb3d70c496e6cd3c1b3be8
SHA1 04a503e438e60b15d45de43f0b67fcca0a8c8cc7
SHA512 75b76d77a70793ffd3c4afa59125c7befba729c6448c92649bcbfe31972f24112aa8cd7ea5e30c4380f96ab69656dbe8570fc79c39003e973b49c1a1739bd140
SSDEEP 12288:s+KA4nRLLZS3ar0LaWm7PAuS5TyUUKca1:sNRLLZi
TLSH
T15B0572A5AA5C15EF8202E177D5497659BEB740FE3FA2832A11A93C7F34E3420873D319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

soffice.exe

Path C:\Program Files\LibreOffice\program\soffice.exe
Size 511KB
SHA256 3c24436274cb9b5ccd363a517b377d07991eae82072690227e41c62ca9ca718b
MD5 2e30f9e2a5f10819a011dace823ded18
SHA1 9f27a2e8f48a8dba8765291597ca71dffe41a94c
SHA512 72f1ad26e29f036c2264241c290b6c38f43713fef7c58050b056063d3ba7173c7c325d884455bf4d5630105566d03a81d535a65fe7bf3ba4bb484a2ec08b51b2
SSDEEP 6144:lMGOulmupXUG3ZYTs1MVZB91oqMZHuAx9R9zF32b3mkWQR6peRzQ/rqy5h4VTt9s:lOTs10ZC9qRzQ/rBWTWSq
TLSH
T141B42955A311DCB5F06658B9CE9A94F4B0B16C4CC3D056CF21EA7E3876B3BD402FA60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spsupp_x64.dll

Path C:\Program Files\LibreOffice\program\spsupp_x64.dll
Size 66KB
SHA256 63e796bfec88f7a5b977b2494e76723e8a4632dc6bb06acece1dd4aeee26a9e0
MD5 65dfd8076720715e2a1d931f28a27374
SHA1 f3c1400fcd4ff96983e22c416a7938e23e895515
SHA512 0e291c900bb3e0d41e047cedf903d2e0310435e1216899492db7496dc0cdab382a534bc846a270afc2dfb4869e25601e59b260b7ea53a2469607a49cbc4da56e
SSDEEP 1536:rGrfNZQwRWNLTw/UB851IEGxcBAkJhmyVFEL7S:rGrfNZ/RWNI/UBuWzCJhmyVFEfS
TLSH
T11E634A16BF4881E5C127927CC9C74A12D6B6BC661B206BDF1791730D2FB37E4A339A21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spsupp_x86.dll

Path C:\Program Files\LibreOffice\program\spsupp_x86.dll
Size 55KB
SHA256 0f42ab3278942eff710ab9648b81660b74d14752fdb42dad557e8768b7eb4d65
MD5 5ce80a1facafec43eb6b3a9b4fc6c2d8
SHA1 50434bdcbbae8eb5d6b2057364089c6c5359fd63
SHA512 697fa532314d78b3d92f417c1ca118afce0bd8e85ccc387553c7cd761539169386c710f6587e2eb09e9a8e72140a996e9d216e3930e5a8de2f5915f362981773
SSDEEP 768:TZ6CwhORejsXbrTyaWY6SOkLFFDlcRqRkDjTpCMJ7+1lF+qv6hhaurVkySoQuSBD:1aWJ6+L/2WkDjlCW7MlFBqFJBL7S
TLSH
T1DB431722BA05D5B2D248093069BADBE949BDBC720FD060C7F759778D2C706D2AB36317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update_service.exe

Path C:\Program Files\LibreOffice\program\update_service.exe
Size 122KB
SHA256 08e9fb35509306bed14bde38ba74ba7a74a97b3cd0583839a27478e5c6e0da3e
MD5 c1439fd38a8bfcc5b6b92f6ffee54fa3
SHA1 1ed9f0451ef61ed20b8086799cf5f2f971ad7311
SHA512 95ce636e4b507dd076cb1ec540b6b01335710a18825e8dc4e205e2eab28e1f7fb5176e6594f7141bfbf153cd8a36ccf0f44d8c146a6821540b0be8ba9d52e8d0
SSDEEP 3072:TvC+iQjgZVsnr15+rBlaFSTdcP+eEEYmic2XjeFFwfS:IQjgLsr15ul0zEEkckjn
TLSH
T170C35A0B678404E8E467C33CC9DA0517E371B969436167CF07A580B90FA3ADDBE39BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.ini

Path C:\Program Files\LibreOffice\program\updater.ini
Size 501B
SHA256 af71ae13082984e1a9511a23fbefd520a18b0637e1cae21caf54b1904e334de3
MD5 d1970f08f48ca7bdf85a5382c7b93d0a
SHA1 89f089fc37f8855c6425cb85c52e696a9dd2d44d
SHA512 700d127883771acefa5b459d7b5317a2027a9b093e6fe084270bd01c5d0950df400c03396a8fab98c04df045457cbc4628fd8bc26ebe450c702032002b67b166
TLSH
T17BF00E2CD0C6D27126D2C705F66B3A85D223817D08A49238A8BC84610B4BD25C7F32DA
MD5 SHA1 SHA512 TLSH

Submit Download

arrowshapes.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\simpress\toolbar\arrowshapes.xml
Size 2KB
SHA256 39649a221e0a52b502335597a19aa57b3f7ffb5b35f44720425e55fe0ae41668
MD5 436aace49f0e1e996be5cdd46afca86f
SHA1 abb651e90a9548b93737313663eb8847cc5018e5
SHA512 1492b12a3232d110e404fb0755dd496472bc801d1430067c89ada06f9b53910b85fbdb258a8a32d99b1b2b5063f560cb28ed395ce17e043921066f5491bedf15
TLSH
T12051D533F4EBC1B2106F211D66AB54C69D8A8872D05E94C76C1D7AC482EF7CF8B692C4
MD5 SHA1 SHA512 TLSH

Submit Download

basicshapes.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\simpress\toolbar\basicshapes.xml
Size 2KB
SHA256 7d41a3eabec1ee4c5e1673f4c23f975fa2b458e7120b35e5138a6a86406818b9
MD5 10b9d8534b1204606d3b316b5c83ac15
SHA1 21b8e9a1bbececf3e738f107e4d558daa5c5bc8d
SHA512 b377b2ead69159049d4da6d3163267f478163011ae7ffac68cf909476edf20032613926f8b09440c7d981d7aae0a6e298e724c181962eb2500f545e7b5450841
TLSH
T158517F76F8E5C176012B311C65EE94CBED4E8832C11CA9C7AC18FBD482EE6CE47656C8
MD5 SHA1 SHA512 TLSH

Submit Download

calloutshapes.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\simpress\toolbar\calloutshapes.xml
Size 1KB
SHA256 a4d7abfa3498848d791eee3ba042393d9e840d4ccf688280b093fd253b1606cf
MD5 964a0e4f594cab81989748665dd25c42
SHA1 a06508df865082d1b03afd260cf6983d19710925
SHA512 08d60cd48852fa7695c518208774d990ce0ebd954bd6fa3d738b3579bf82ce6d7f1fb3135fd676375e1312dcd07dba3545db43dc83e883f4c1efba8b7917feb6
TLSH
T18A319039F8F582722157331C27EF90CBD41E88E5A45E81D2AC587AD442ED5DF43D2AC9
MD5 SHA1 SHA512 TLSH

Submit Download

starshapes.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\simpress\toolbar\starshapes.xml
Size 1KB
SHA256 be9873ec42bda70a4d6e9b7f99a248c7258f9c6ea091f8f07164a4271be035a7
MD5 474a909b023806339539b1f576754f94
SHA1 227d61275b9026a639dab0234048d6fc943b1749
SHA512 c07c5713c25451c535e6f1c080fd238cd4be26402004e4ca5951c604bce4f9cc481a1d5cc91533f8dccf2ea0706411a2233ffe06b5d013e46121cbf948a2e259
TLSH
T16C31A176F8F1C073016B620CA6EAC1CBD90D98B6C55C9AC75C6CB9C481DD5DE8393AC8
MD5 SHA1 SHA512 TLSH

Submit Download

symbolshapes.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\simpress\toolbar\symbolshapes.xml
Size 2KB
SHA256 9e59ef52bcca0aa2bbab167464c474445b0839cc7d43f82b81df18b6437aab4c
MD5 f8bfb3541f5cf7f5887b121f17313f1f
SHA1 80c7674c8afe9da2158640916c80a9a67bb470cf
SHA512 a2d11eb7c517db98f8fb63fd3231e6db3b691bf2c2a860f4a2189d5979a4cdb8c954cab4ee44b5a8147cf52922f63cc347181497868ad9cd86b9e583ee7240aa
TLSH
T145414D72F5E1D0B1402BA19D65AE50CBACC9CC22C05CA9C37C1D7BC582EE9DE43517C8
MD5 SHA1 SHA512 TLSH

Submit Download

formrichtext.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\popupmenu\formrichtext.xml
Size 1KB
SHA256 7eec18195d75578be8270861cc092c1598c09aa98cbd4fbad082cbdfd9753f0b
MD5 40c6bd7899756334b31e1091e51ee8e4
SHA1 0fa855faf12a9bdfb787b3fb063c4e8a91850708
SHA512 b74912905d37e0df6b2353291d7cd53f3e421d2d373124e72682132b8d86461aea422fe35b670b65a7f8885a368428d1beeb68287122db30dcbe6ac15a281cfd
TLSH
T166316F22BCE4B1A1E02E73A4BAD970AB6F59D5CAD31C3D507D9C4F91DB0241DA4F229C
MD5 SHA1 SHA512 TLSH

Submit Download

colorbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\colorbar.xml
Size 1KB
SHA256 92eedd7f5ac4f4915708b76e496d1dbbeea4de562ebd97295e8855286ed363bc
MD5 c01983403780b35a83cbc63576b8ffae
SHA1 ef6c4906f91eb4cb8bca0356e287b847bec95678
SHA512 1f40a0a04b842581cbbb8fc65d5987d4c47b0c670b45cfb37b31d43550871a09c6a5a6c10a982103eb7d3a236bdf5ed742fbcb3e24585e0364e60e1c53177a63
TLSH
T1C631DB36FCE68172015B152C2BEB80CBD40D88B5D05CA1C75C48BAD486EE9DE97D2EDC
MD5 SHA1 SHA512 TLSH

Submit Download

extrusionobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\extrusionobjectbar.xml
Size 1KB
SHA256 20ebc66fa3c061b8f7b9b97e29f52cfbaf5be634ddc8c6df64118a6f12416ce3
MD5 176e5c7ac0b6d6d91e10fa21a38559ed
SHA1 ebe074797d1888d206fee3025f4ddeefe5043b5c
SHA512 c55f1e6af6c1115fda4f6aa1d0f04411d070a3801775962a701d488f0a7c195107ae29de7b860c9ea92e0a0bca1f8937dd4590a5b773c4376d7d79d328b55cbc
TLSH
T18B319C36F8E78172016B210DB7EB80DB941E98B5D01E95C74C48FED492DE5DD43A1AD8
MD5 SHA1 SHA512 TLSH

Submit Download

flowchartshapes.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\flowchartshapes.xml
Size 3KB
SHA256 92268281fbe1f149a7be387a18559cae1b73ddc9ce031b21e6403c41c0f08ae2
MD5 4551cb51edf7a188c5c29ccb18712981
SHA1 7abbda8904dbeda6a8f50969cbf73641f55e1919
SHA512 5a658cb648495819c6b8817dbfa4a6c7b9a03378f2d8f72adbbf2355e0e96d05e75ca395a67f03faf024591dd230ea3f512de4d04007280df5bd31ebc9ec27ee
TLSH
T1FB616237FCB285F5043B320DA2AB94D79C8EC962C41C94C75C597BD9C1EFA8D83A1988
MD5 SHA1 SHA512 TLSH

Submit Download

fontworkobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\fontworkobjectbar.xml
Size 1KB
SHA256 e30b1e98bfe47382ab7f7e77681e11a3ad2a67cbf2b9440514adcbf2a0fdb017
MD5 ab5bd7ae6c45c5fed7aad55744c17369
SHA1 2ebe522e13940cefe13358bc98685e004b588779
SHA512 234fd68e919e4d3ee05834ec002e0683901c2af1b1666462ee736baab2df647449d4f13a8e3063b844c33ec764a714e1204d0bf78654215e39d7054ef3661959
TLSH
T18231AC36F8E242320257125D3BEB81CBD00DC8B5C15992D79C4CBAD492EE5DE83E5ED8
MD5 SHA1 SHA512 TLSH

Submit Download

fontworkshapetype.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\fontworkshapetype.xml
Size 3KB
SHA256 c08756dc6cf0fa1840f8358a7273a9baaa453c328cbe191dc9e8a452a6412e4e
MD5 6b4ce5f25e375cd25575a2788da0b42e
SHA1 2a7f6e6b9bf384f274a1e3b4805d5ce81d1a90cb
SHA512 3b8b3cbad8b37e5271d1919a2d5b2097be7b1149cf534daf30fa4a4553e26146fe51070258bb48fb5283026202f6d2001f3eb7fa0a1b13d2609955d548b476db
TLSH
T1AD714F71F4F1817600AB270C66BA96CE6889CC72C12CB4E28C09BFC9D1DDACD57697C9
MD5 SHA1 SHA512 TLSH

Submit Download

formcontrols.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\formcontrols.xml
Size 2KB
SHA256 27198ef9e83480332bc408dd2a98142dc9334ddb25429a1be7f9f47b402ff667
MD5 2653d464f8fe3012aa592dded960f738
SHA1 b9dbfa863edec665e729f8448d2f94f7f802acda
SHA512 f2d615da7f21a05361f52721a5e0eda368bbb8aaff8435097143f7bd84cb9f47280d62b323625a5f83ec737f688d902f80845560c2e7c9e68fd8504caa03be0a
TLSH
T1B4519536F8F285B6016F211D75EB94D6984E9C71C05CE9C39C18BBC8C2EEACD43626C8
MD5 SHA1 SHA512 TLSH

Submit Download

formtextobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\formtextobjectbar.xml
Size 2KB
SHA256 5d5975c3cd9e7fa834159f50a5476efd4c0f225a9a0a25cd0e7eccf5f467be1e
MD5 d61466f41762a10c0e2b4fd284d6666e
SHA1 3c6a1295893e8255574b318bb307347caf3d4898
SHA512 2f21114ff33759861f0b08893f3591df41fc4a4d9e41a870f53f1099f173490ca9e4417ffd63cf5f38caa5cf5e442602ff925e48712b3be518994ee7a81aae2b
TLSH
T119412976F8F18176016F220D65FB94DA945ECC71C01CE9C38C08BAC492EEACD83A26D8
MD5 SHA1 SHA512 TLSH

Submit Download

graffilterbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\graffilterbar.xml
Size 1KB
SHA256 3674f6bfd68440ac255987935c526c2a6226bf6a451959df7d883bb61807c35d
MD5 9cdf1392f27bb59e50f1a6b85e73c093
SHA1 9f3334452bf7217c3a03f403ad8df0c4f4636052
SHA512 e3d3ba0f19eb80d4f1f325c1f5ce47ef41ac2b5d6a73a3c6e9a842e4ae391f586f6c3896d6991f9db943fbd2137f449a4e51ac72e8c5ab8371ac66a9836084e8
TLSH
T1D0318C36F8E581B2016F210CBEEF90CA905988E5D05DD5CF4C48B9C082DF5ED9F91AD9
MD5 SHA1 SHA512 TLSH

Submit Download

mediaobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\mediaobjectbar.xml
Size 1KB
SHA256 199d3dbc7e34b0c3e7ecbad03403837234ed0ad12426d65dfcbf9cab8f497c4a
MD5 208b3a5945e8dcc5ab347a037a63faaf
SHA1 bdb1fe2eaf4923cf4bf19b66a25654a774610632
SHA512 8faba578f2468d347936940e9d3b1510f8843ab91ea1e3f9a5a72d16663ec585c4828f106913330af7a82b26a2ab6b9a48d17b95f114fdbfb65be60494c98dd2
TLSH
T11521323AF9D141730393555D3FEBC09FC01D98A8419982D6AC4CA4E052EE4EE83E1EDC
MD5 SHA1 SHA512 TLSH

Submit Download

fullscreenbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swform\toolbar\fullscreenbar.xml
Size 1KB
SHA256 02866b29edb539552932283cc6a2781929acd78c9389a86c72e7328be558cbba
MD5 4342b265aad0f6ca15ce53e74187de9b
SHA1 37296341eba4f34c68dc4111e531390183723748
SHA512 e300cb37d9dd85cae8431fc5b45d39c93976a0d44df2c2ac711796d7eab1dfa32c3465117c6daee8135edc2fe12d3e148c2db622e06f7e4d84cd020933c1647c
TLSH
T12121373FB9C142330692555D3FEBC09FC11954A9119942D56C9C94E056AA4EF83E1EDC
MD5 SHA1 SHA512 TLSH

Submit Download

formdesign.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swreport\toolbar\formdesign.xml
Size 3KB
SHA256 5734993ce49d0b46cfd961ed4ba34c5c9ae34bb1ae01acc5cce36eada57fef48
MD5 967bad05e22292a9eec2632b931ce53c
SHA1 651fe705cd73109cde264e5a9d1f5e5cd53f3e8f
SHA512 181a41b7425f754c80d76f6a04708baf7dcccb2d55829850a543b57757a415063e8a6800bc06cf66fa5164ac904e1cf70f8b029a882b757aa73a1837359cfb73
TLSH
T1AF61E631F8F18177016F265D75FA94DAA94D9832C05DE9C39C08BBC4E2EDACD83526D8
MD5 SHA1 SHA512 TLSH

Submit Download

formsfilterbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swreport\toolbar\formsfilterbar.xml
Size 1KB
SHA256 a776adbef1a4fe659f291505e1e1368e7806897245d68e70574af552aef81fe0
MD5 10d7ce900885d1f463e96c6aa193af0d
SHA1 ecc4387c980f8c7ad8aa9e359df01702e4e29c55
SHA512 fb92ad0d2e3791840f916fe8495cb36e8d0b0403b6cb1bd31a2c4bb343be8557ba23cfa8740842350ec2d963b3b40df330230bd7d4793d91523d5a871afe3938
TLSH
T1D621233BF8D141320253551D3BEB80CBD01A88B9419981D69C5CA4E096EF4EE83E1FCC
MD5 SHA1 SHA512 TLSH

Submit Download

optimizetablebar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swreport\toolbar\optimizetablebar.xml
Size 1KB
SHA256 d3ef7df09b55a9506e8151df001f93c7e59172751a66bbb5ce799b00f3e90252
MD5 47a6003170b2ad23d09239aa4b09e91a
SHA1 74c43abd8258f72f9804df7e178be53441f0c217
SHA512 36a4a02e7a3c7eb59d163f027b748d9807771bce1e697e9dd2f6cd55807e649962b94399da79cd701e7bced1cfc89873b3ca622de7a1e4be27712e16f7f352d5
TLSH
T10A31D037F8D181320657650D67EF81DFD00A8869815D91E79C48EDD492EE5DE43E1EC8
MD5 SHA1 SHA512 TLSH

Submit Download

form.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\popupmenu\form.xml
Size 2KB
SHA256 39a22b6fecdd0787b6ef39d4ecdaf69e435603d4223905d12ebe36f2711f780b
MD5 135c89bad613a67fa177819ee4f5b605
SHA1 22cc0a43da10633fb97170fa0f23ee81ced8a2d0
SHA512 e2493d608ae85009634627545a261c3cf617f7ae2fe821224d3b8db93e2213afca40705eea1bc7d2435873e3307ef778de8fd0e6ecbce5b2ea12a0f6183e3296
TLSH
T1E2416E22BCE4B0A1E06F37A5B9C430AB6E98D4CAC35D7C547D9C4B81DB0251DA5F229D
MD5 SHA1 SHA512 TLSH

Submit Download

oleobject.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\popupmenu\oleobject.xml
Size 2KB
SHA256 644a80b57936119322b4735f2a47b8da7dc87730993c2131a65a311952c7fd5c
MD5 6502764fef125c76a9829f1fb56a6bfc
SHA1 328bbf670129b7c9e6628c5ad0f5d87a6b0adb94
SHA512 ce4fc3408fc3a2087485664095c0a6c7ba3833478ecf83e88c039fcb8c2491ec8733e1f29fc2cc76ac6efef1ae9fe818b70ce3365fe1b9acaf0fc9ce2417bb6b
TLSH
T165415011BCE8F0A2E02F37A5BAD430ABAE98D4DAC35D7D547D4C4B81DB0201DA5F229D
MD5 SHA1 SHA512 TLSH

Submit Download

preview.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\popupmenu\preview.xml
Size 654B
SHA256 3b562576867eaf6b9b7e6487be81eb6caaa63272278fda3decd02976f7f09e26
MD5 827d0d46c79df8983f21608b69bdb8a4
SHA1 f9d3413451232ec3cd596be9937dead51a4cf39d
SHA512 f2b6bfa225c8c626fd0db80c34895a9ba1e6893a39848fefadc12e828ac3bf74dd4b49d2bd6188e4fd6c0fcf75ba2d401f1d0a6e0a369e56e39f37172d395197
TLSH
T1F1F0DD16FDC0B121D51E3B54B3CD3097D226E4D883983A50DCAC4B90DA0352CA1F2BCD
MD5 SHA1 SHA512 TLSH

Submit Download

alignmentbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\toolbar\alignmentbar.xml
Size 1KB
SHA256 50a5680c4ba52b5ac62f2e598a8046aaa93206612f4da9f7e3207f3e820eba79
MD5 2cda7f9996802c5a2358e140863b97de
SHA1 9aae5a7ce9acc27ee6a6928e23268279cd4ca40e
SHA512 5073734bded4d9e735453caf1c82f9dc1369281a3b191f69ae1ef81812a4369a4594dafbea9fdcb5d7c150eebfdad54b7cd3b8bca955bf91006c5b6d4d57b973
TLSH
T1F021BC3AF8E181730267651D3BFB80CBD059986581DD91D69C4CB9D092EE5DE83E1AC8
MD5 SHA1 SHA512 TLSH

Submit Download

drawtextobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\toolbar\drawtextobjectbar.xml
Size 3KB
SHA256 2550d9478cb7d6e5ed9978b17ac09755545d963215d605f196982755300c365f
MD5 ea04defd9065a39a1e9b1c4f61649c10
SHA1 5631ce9942e368ae8eafcb7a849487b288a1276d
SHA512 e161e708085dbf235b4c786314d965a606e01df6335257d87b964d029b00f7a65bb31e9045a671b6932c33709b263cf3aac4b3b28e50ecc39dcd2d22b09e744a
TLSH
T19771A735F8F281B6012F721D65FE94DA954EC871C01DE9C39C087AC4D2EEACD83626D8
MD5 SHA1 SHA512 TLSH

Submit Download

oleobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\toolbar\oleobjectbar.xml
Size 2KB
SHA256 d7035ac40d746cc5de9659fceaaa6202c4489bbe8c759c68f30f6194d256edc0
MD5 6a930f62d9a4a942e1000a8706800e4d
SHA1 efd16aeee09aefc4c0e7ce60f114e0de3501ebcb
SHA512 088b11e2fca82cbfc1b6dee76bf6ff7412f79829af8df1673bfa53dd44e0b4ea0842edccfa0c3e98fba9eee88612ff528aa69e8537de4056fb1f5d7ae13db655
TLSH
T17051D631F8F5D0B7012F251DB5FA94DA954E8832C05DE9C39C08BAC4E2ED6DD83626D8
MD5 SHA1 SHA512 TLSH

Submit Download

previewobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\toolbar\previewobjectbar.xml
Size 2KB
SHA256 4e202c73ef8f67352c9115a669fa4591f2eb5f96f1b84f60b4bafcb2d52f7ac8
MD5 f96cd1281eb1179352ec78fa0db39f23
SHA1 e1ad39a58aa0b2ab7f3ee46a4f2b0d37ee9bb587
SHA512 17eed05e178e093d958218564af30fa9fd0f9a0fb617f88ad6ee2d594e034a064732f98c60abb2c0a44fcf977d34e7a904f06da3c8199f50ad5b4f0ac2ec2d55
TLSH
T1D0416D36F9F18172012B225C7AEF94CB944D8971C05DE9C39C0C7AD4E2EE6DD83925D8
MD5 SHA1 SHA512 TLSH

Submit Download

textobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\toolbar\textobjectbar.xml
Size 4KB
SHA256 136918dd12be208604613584ab129a40d0b30e28adbe00cf0ea2ea90e332959d
MD5 42dd0c04fe4e514556c847dd28877de3
SHA1 116fe23df513c49980f361b963a58be1a06e7b01
SHA512 f3fb839ae01be6309b8c711a7dc17d9cc604a1ecf2f68b9a20d53cb01f9712af4bd077947d3494a1fe97513c7fe4bc309502cafcc246203892681b4111462156
SSDEEP 48:cosnpKmpXgIxs4ZL4YU2rGvvEyQMTv5vb1lD7vtC9Vf9PrV6vfOvrjFJv4t6/vZf:jKprXvuqL4Z2r40v9lJv3Pf
TLSH
T108917131F8F291B7053F221D75EA94DAA94E8871C01CE9C39C097BC4E2DDADD83526D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

draw.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\popupmenu\draw.xml
Size 3KB
SHA256 0d982eee6c6bf3e1ff4cc4ac85314ae93f57cbd906dec392c6178aa1e553c0f7
MD5 d01f5ff2b4cc5a650edbd53138cf2c1d
SHA1 543330e8b96f13b6c3dbb1f43574b700af2026a9
SHA512 c2c573c6f291ea06eb9f17293c501777e251c52b79ad4c5da9c1b293e12977b249d9e9e9020cb5ec71b368fd61507b62ef5a4d20a368076fb350887cf4ce57ee
TLSH
T177713C22BCD4B0A1E02F37A9B9C830AB6E98C4DAC35D7D447C9C4B81DB0611CA1F229D
MD5 SHA1 SHA512 TLSH

Submit Download

drawtext.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\popupmenu\drawtext.xml
Size 1KB
SHA256 ee8344d8c39b1c3d83deadccf2814306be0aa66c25d87a74551ad2065b3abd58
MD5 1cb3807ed1d106791a2aeb69a81aa6f1
SHA1 6c5527382edec6aa261bd1b39381b0cb25f9be3b
SHA512 9ededf2ceb451c93daa624a99b27e3b7e4c662fd08bcb6f17c6bc511c5d7dd4a48a80e3324a73a1ccb2c8d3bb90c4d055e8e31b44db10f7133ccfad4292a0be0
TLSH
T15221DC22BDC4B1B1E12F37A9B6C470ABA654D4C9C30E3E549C9C4B80D60761DA1F27EC
MD5 SHA1 SHA512 TLSH

Submit Download

frame.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\popupmenu\frame.xml
Size 2KB
SHA256 821560841a6c7f81bcf622ea43d1500daddd98286e1c32ee9296dcda3f537379
MD5 85b9fb3ce3797fca05267fce2dd229e1
SHA1 810661afbee200a97412f39f74c5af4ca5a456c0
SHA512 57409663d540bde20d8c477ac3ebc77070ffbc73caac0aef392b31bcfdd6aaa7b86996882362fe1af270d233864833313ab08003657683869fc604efb0c8251f
TLSH
T137413011BCE8F0A2E02F37A5BAD430ABAE98D4DAC35D7D547D4C4B81DB0201DA5F229D
MD5 SHA1 SHA512 TLSH

Submit Download

graphic.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\popupmenu\graphic.xml
Size 2KB
SHA256 2f04d84b78db4774c9301f98c34061740ad9e03bef20237e5bba8ac7d07e5c0f
MD5 c24bf7946ec6ee0de618a6dd373e1a00
SHA1 d98afc2820243dd5457e6036bfcb5341643aed5e
SHA512 f313d10f7d5e95e4d6ef91e76a997412cb047b77aace503f10ed17f7f3a3bfcb53b21b12ca966b7d00e12391cda01d6b62175e58614ede1f07c5d1e7b056db61
TLSH
T117513122BCE4F0A1E02F37A5BAD830AB6E98D4CAC34D7D547D4C4B81DB4211DA5F229D
MD5 SHA1 SHA512 TLSH

Submit Download

insertfield.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\popupmenu\insertfield.xml
Size 1006B
SHA256 7c7fb204f36d2421a9f771d755a27d323877da7c5787304be85abef02cedacea
MD5 aaa921e8a9e73843ac27ab3db93debed
SHA1 f6a595e656c6ec25dda3b193e98dae1005878b62
SHA512 9b54257ad7821cc8233f07c85d53d28755028d3ad8bde2285d0b758cedd79f27ac84ed32ed1abc5ef3141788d8e971b49b2dc01a97676ac0cfecb5a38cfd7f1d
TLSH
T15611E615F984B572E21E77A777C5309B9B55F4C983982BD18DAC0B41820A29860F77DC
MD5 SHA1 SHA512 TLSH

Submit Download

media.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\popupmenu\media.xml
Size 2KB
SHA256 00c985333d265fed1ef7dcba06336e1ee5706ac3f4273b10d43e6e84381cd028
MD5 ad66b3d0e2e4b3ae8e6af1b298201572
SHA1 b876d0d25223a70f0e2a6f323a6e03e1ce5289ec
SHA512 909885438d1810498f2c12aa3b6f4114b185618626664b68d5342e701989b27169ed53b9575f5bd304f2077396a8280d867d52a92f77d8dcc5e0681f4c8e9352
TLSH
T1A4413F11BCE8F0A2E02F37A5B9D430AB6E98D4DAC35D7D547C5C4B81DB0211DA5F229D
MD5 SHA1 SHA512 TLSH

Submit Download

showtrackedchanges.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\popupmenu\showtrackedchanges.xml
Size 625B
SHA256 32df4067843c96a5d268f3a3af9e18790f9091a0ec23a4978595f1131ca3f2ca
MD5 0b39d89b05c7d5717a8f279b806e8ef0
SHA1 d8e72fa242600f41d40d964d014af513ba76fe02
SHA512 c171b78b9a9bc5cca9562513af3369ec38f4c35a0cf343ee72a85d3aa4b1ecdda224c185c4d1b0421c38925bacc8fff2669bb583a35c16e11490baf793b45dfd
TLSH
T140F00C16FCC07222E1D5AB00B3E27257C32AE9E893581D605D6847A2774F428E1F2ACC
MD5 SHA1 SHA512 TLSH

Submit Download

frameobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\toolbar\frameobjectbar.xml
Size 3KB
SHA256 5467bfd6dc49330fd3a9e8f9a8d30cfd0a7df2862c382b0d5ced1d9761a1823f
MD5 87c0695150871f236679afc1ea864bbd
SHA1 4f5f98555a13749650cdb79fe9cbda1a19170152
SHA512 ad2557b26808c6aebf9c48decb89579fd347a91662a031f269cf8434053c2353cd2b0998ca158facfed2d5bbd2072f7159b27977fc176e955e7eafc5e8895f03
TLSH
T1D261C531F8F5D0B7012F261DB5FA94DA954E8832C05DE9C78C08BAC4E2ED6DD83526D8
MD5 SHA1 SHA512 TLSH

Submit Download

insertbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\toolbar\insertbar.xml
Size 2KB
SHA256 4005b7623f2b171969ea48084e7e3fcdc91bd3a18f63b8b48b3f7dde88e9dc05
MD5 c22d5962c70e88f0221e7adb4a385c3e
SHA1 fc2f3e47231e337111140ce63b8ff4a806b07a47
SHA512 6494109f48a5cc6a2aacae5a6cb0410f46ef10cedeaaee21811956d5cebda112db55bb1cdb73b24e03a3e52394a8d9ebe8e42a174531e1494e8ba9719040ada1
TLSH
T123512C35F9F58477026F222D66FA84C6995DC871C01CE7C39C08BAC492DE6DD83A67D8
MD5 SHA1 SHA512 TLSH

Submit Download

numobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\toolbar\numobjectbar.xml
Size 2KB
SHA256 247e8fe3271366ee7a1e42846b745b6a2ca4be8a3bd97f35b3581817900353ff
MD5 417f3b3ea6493891b253db3fd4749485
SHA1 163dedbf32ce614264610734c7655bac3485486a
SHA512 b287763a69764c998a1d2552a5876d06571c39b64ce8a8189a087fc20936f5c2da8b0c4a9f1e3d846cb72613903fbc0cc079eff17c6bf0913d40c712f24af9a9
TLSH
T141418D32F8F18177016F255C76FA90DB954E9835C01CD9C79C487EC0A2EE6DE83A16D8
MD5 SHA1 SHA512 TLSH

Submit Download

tableobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\toolbar\tableobjectbar.xml
Size 3KB
SHA256 5a36c02c012570ff184ec0b5668ca90e0c9ab3b60e125e73d12a7dda5bb00df8
MD5 bd9f21bc1861c649bcdcb6ef93c95c7e
SHA1 27b4d32f2a5db33dae161fb2ceb7cf855cc80724
SHA512 225148d57ef9e1bb29786c4730100c7896833510b4842dc64f18e909b816a47fb96913cf78c2e4e7b354b27bdca2c04ffa95efdaad43e787a0c64fbc36bed570
TLSH
T1CF71B972F9F68176016F325D65FE94CA994DC872C01DE9C38C18BAC4D2DEACD83626D8
MD5 SHA1 SHA512 TLSH

Submit Download

es_CU.aff

Path C:\Program Files\LibreOffice\share\extensions\dict-es\es_CU.aff
Size 158KB
SHA256 dc8213bb8fb08e51dd5869b348d873de23f89e3315656396ca3031fe1d7ffcea
MD5 ac19d445f162185c6a80c42b355d1c5b
SHA1 fdcaa1af4a6aa5e09c9861596586aa3554b58f7f
SHA512 4fc9ceb8512e10c11b37b846b02abd28d5f821867a1a7d81f0315c941d75c362aec836d3b755b7066845536cfc1b516ec25b3dd4b058215e5fcd318a24401c2f
SSDEEP 1536:JRcPZHrjfE8zbHFYKZZtw3OtpxK/jbznx3uxorzq9v+WMrRjajsVu/IpoJOhN9yc:JRcPZHrjfE8zblg1im
TLSH
T119F38616A9693D6532C310C6D9CF0F361C4CF62CC016E78BA78436EE70995D662FE92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

description-ckb.txt

Path C:\Program Files\LibreOffice\share\extensions\nlpsolver\description-ckb.txt
Size 119B
SHA256 22ffad3377adf787b2d9e72afbdba485cb9b98cf5b04d1e985737e730dad6aa3
MD5 654baf6d9f25fd11803b9fa1f0903d7b
SHA1 fcf9e064dcd02ae93bbc620dde75cbae25c2b863
SHA512 2f41525987d1e5afafbe7b0c5ea60ea05e492c87753e28c75a714029c7a2cc99650d3f828b10dcfd18c1c6401b713cfa7bc31f813ca1fcf11ae4e7f017ec921a
TLSH
T1F3B022228C800800000A2C088002E0820328883C3A8E082228BCA00ABAC2BC0233B080
MD5 SHA1 SHA512 TLSH

Submit Download

segments_3

Path C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\as\help.idxl\segments_3
Size 45B
SHA256 3e57f17c0af0e460c50252461e91958291e1bcbcd032898f823a70b336584a60
MD5 096193900fea78280e0727ced80fff0d
SHA1 668cfb9e067f46cff71f743f20cd30e822534896
SHA512 0bf1c2b36fee7a3eef5cf59fe1c30a080dafcc1c3c78565f31413890b2de6223b45fc6d17dcbc718a72ff2af2feb5690a1303b5b37741f1087a8dc5ecba44806
MD5 SHA1 SHA512

Submit Download

help.key_

Path C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\dgo\help.key_
Size 236B
SHA256 88e91edd2d374f50e71d5067f44ede1164563b39977c1626707e06d79ea8a7f3
MD5 ef84565f9a9da82e0454f8fe18c0a96b
SHA1 241e1cb3fab1fb7e737c1dad6af047d3aef64bfa
SHA512 be5cffe783ef1b243a65898757a54daf39dc229ee8a85ea4dc558cc68b2ab5ca44e4a6d28b29f8dfc410db7ddf24fd0852660f0331908cf491569bb3fe9bd25f
TLSH
T101D0A744AA992540355E781DA18CA6530758936AA2A1A68D9BBF709AA343CFD940F089
MD5 SHA1 SHA512 TLSH

Submit Download

help.db_

Path C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\nr\help.db_
Size 508B
SHA256 0c3b799d275f55714b20bfa6eb8765875d8163ec0de9a186c9efa46ef1f191a9
MD5 39502b2bc062b791e9e01284e6c3b1e8
SHA1 c3ad81a301e44d03ce3fa6c238df73dc064f1996
SHA512 cead807573d0a194dcc5aacd9dcbc0d4a03a514d2d302df0b22dcb04a92d0dc763c40bdc929e8925c11e0cf86df697eee84826dc4be53672296ccb22f4c46ac3
TLSH
T171F05485C3AF4208A8AE280DF1CCA7190B2443781161A1BDDBBB60614603C7EA04F042
MD5 SHA1 SHA512 TLSH

Submit Download

help.tree

Path C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\nr\help.tree
Size 666B
SHA256 29215ea09e370a7c2db76ad0fea1a74d01d05f24e64034f316309408c5de05be
MD5 7f37cdd1e51432d1c14022796ee38c27
SHA1 148a048d65e643ee574b2dcc1e93340b500aa2a1
SHA512 7333959612acf641e789d884556103053cce47dd1f504019626c9e83baa7c95bd0bb66627efaea9be3160bee4f6639fb5dbee48c6928ff94334b7ba54e2cd3d9
TLSH
T19101D3049095651149B45F09F3AB5161C362B26F53717394FCBD85250F02479A3DB6CE
MD5 SHA1 SHA512 TLSH

Submit Download

_0.cfs

Path C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\ss\help.idxl\_0.cfs
Size 4KB
SHA256 0cb17a940b0641a6985b8ea43034cbae5b1533af17fc798b4224b1b20bda80a4
MD5 8ee7f378fe80bb67bf3049611b9cf0e8
SHA1 cfea0a07bc10b6f58c24c8b563d78a74bd8f7283
SHA512 3f81b0217bdedc7ff2c41eb636573bf5b64fa7beea1082ca99ca49377bc025cf5e3b01d95fdfae93eda4384cca6df80db00887909a2c764a5eba246f37a724b5
SSDEEP 96:5Lv7onK1XjKGNhEvz3bCG3sjkJHWWtEIfmrbZRMI44Tp:FX1Xjw73bCG3okJvEIKbZ+XCp
TLSH
T166817417F97C91E0E5990233065D120F8D71544E2F574696BA3DEBB89A3A0C58A3F3B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NLPSolverCommon_dz.properties

Path C:\Program Files\LibreOffice\share\extensions\nlpsolver\locale\NLPSolverCommon_dz.properties
Size 1KB
SHA256 2ae4b9e632e8e3a99950ef3ae361e86694166523e1ccce9ef7719fe8a630acd2
MD5 f7fff25f6b13b25790ef0903a4bed117
SHA1 85f5e8a7a2624786969a76ebd531f72e55a957df
SHA512 f9e0d5f4356faf8fb17e706c95d38d15228f13a6ba57b1b43fbb0c68262394ca76f639fae39f4fbd79abe8f47fff06e9e10b8d5740225f166c18461d3f853e45
TLSH
T1922182C9D1800921BFD148BBC5D3215ADFD93E15913A2675FFB3B3186317BD0126287A
MD5 SHA1 SHA512 TLSH

Submit Download

description-dgo.txt

Path C:\Program Files\LibreOffice\share\extensions\wiki-publisher\description-dgo.txt
Size 231B
SHA256 4305fb8d8cf118cda652656582039825f18e97fa614495114530d9394e6dccaa
MD5 68baef0ee8c1bc2eebaeda68b84c349b
SHA1 ff56ed853cbd4149fb1438816fc1a45e62d2d863
SHA512 c933156ffb372c58857c4aeeb824844a9fe4d12ce5972815e4993a477a0d6bc8d0abdfaf8fe25f348d05865f8e89a0226f9247ba2984e424da943fedc65605e5
TLSH
T1B7D0A7A5DC0022FB295D5301B4EC45DE7248500C97378B721A19409DB03661E46B1BF0
MD5 SHA1 SHA512 TLSH

Submit Download

segments.gen

Path C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\as\help.idxl\segments.gen
Size 20B
SHA256 a85dc4276747f5b0d095effc9bf32bbd8abe34ee86ecf97ae988f34200a45562
MD5 74b166dafdd55581096ad1a38b21b80e
SHA1 9bf6482f8878497a5d79ddb963b9e14be698f212
SHA512 d64fc4f71c03c83fd023c6d327ea325621c7441429f4c90fb1a408f209774e438474c1746ee16c058175fce3f9731426e0e8eba4b0c25a5fdec384466c8d1100
MD5 SHA1 SHA512

Submit Download

segments_3

Path C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\as\help.idxl\segments_3
Size 45B
SHA256 9fe1ae569ea89278149f21d4df55fa88db8ef8722a26b85585c03d54b5bb8018
MD5 6ab6ef2a5d4eb7a341862730ef6b6b91
SHA1 a3ea98de27cb7e7b3db6f6d1db7e464bda51d1a2
SHA512 115f7c16e80a13d9caaae07cd333d72937bf0cd96dac96f5109c24a8141182d663940c136c19c23ca479f62e86ad492a1c093f64fa670c84a8966b1dc6d7cf0f
MD5 SHA1 SHA512

Submit Download

help.key_

Path C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\bo\help.key_
Size 217B
SHA256 e69eba1a6dba7411c3c0088d131f20a0f6f34d8f8708fdf32c08169f50395536
MD5 466876069933b8c70b0d0e1b5617ca63
SHA1 1bf1dc6605fa728c6af27027c751a4c52d1f0b82
SHA512 51beb0af7c83182c27c98c68599790d44f16a2d8136f7665010f9003f4b46a98b958684d27764d3a8ae0a146a0f80e77f68ee78b798e7104112ccedf81244c2b
TLSH
T1C4D09E862E0315DB292C735E439C535F0369C18C37F70D0C37D595C859392254111927
MD5 SHA1 SHA512 TLSH

Submit Download

help.db_

Path C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\en-US\help.db_
Size 3KB
SHA256 b2a21a9cbe04e4f632b03a61842704f2d84b04c4febccf51a6e551efcfec8b96
MD5 f6512ac2044fa7b425aac4543d262bf6
SHA1 a0fa79f35858f6a1c7ae0866a7866f4aaf1dbaa9
SHA512 453d1a351caf1074e6216971315de052d2f0389361ca5c3b55dcf2c79ba0e59010f9269d9fcde3a4f9ed88bad863d0826ac06bc83e1c224fab675d242d6e0e8a
TLSH
T1D761D8EF5B0B09E7363E231A666D4B2D0BA7C0DC1E3B1C6CB3F5648D99354AD850281B
MD5 SHA1 SHA512 TLSH

Submit Download

help.tree

Path C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\en-US\help.tree
Size 890B
SHA256 2c49ae6dc12657d61d7ace1529e4dadc0e481747e1b5dbaf761b275b86e0b0ea
MD5 f55bb0a65a7be7a6a6d0489b1f403b96
SHA1 7c3651c2846d7cc5d9559e3fa9d837ba44ce46c0
SHA512 c197870a7c2db92358311b02484fc7f905fc79a789357b8fb2868450ed3666da4ec8990307d66de5437f9614b45406a756180daa71827cbe6db6d0c800d66187
TLSH
T15F118C6E664604F393786B56737A067D86D3D0871A7B220935FC8A290F164258293E8B
MD5 SHA1 SHA512 TLSH

Submit Download

help.ht_

Path C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\fur\help.ht_
Size 2KB
SHA256 7fcbf59532873b2d430ec059de0ee6e0d29cdd2b3ae3d4d64ab255a36e74a912
MD5 e5a6d1c8658e3e54ad6e862d9366f30a
SHA1 c2ce12d353f9acbf020b87d393b58a8817db2967
SHA512 c122653873c84c60a026b8d99057218b4e52c0d9a0f234994226b489459df36e9ab998a00cccf2a015a3f981d4636ffebee7c211191187fdc91f9cce88142b32
TLSH
T13A51B0E7890B033729FA1307245D27DD531280BC56776DADF3BE802CB52A9AED2664D3
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice (Safe Mode).lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice (Safe Mode).lnk
Size 1KB
SHA256 ccb6f09bda05e15019d2eada7dbabe65e38b7e3c7fedc072e698cd3ef1fae8cb
MD5 8dc59e57a6b46cb04607dac250b0ea75
SHA1 3827b008b2792dda4bf8130bd84a41dd8c80b710
SHA512 da7fde8f78a132e2f14a92f01172fc3ce0723e19e215e7135fe07e2fae3794990e6e11f4cfa93ecf5093ba8ccd9d0f45158552160dd929e921af379bed1ee9c8
TLSH
T1A321E31467FA3B24FAE2263040B61A654B3BBC07F6B5DB6D504A01CE197DE805F99F13
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice (Safe Mode).lnk~RFe5ac7c6.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice (Safe Mode).lnk~RFe5ac7c6.TMP
Size 1KB
SHA256 646048a8430312484ed058886338f5d2f1b00d5a09ab57993c12d0bf57a7804a
MD5 4db7d0858e314698cef3c8a60cd51791
SHA1 2a1b7aadac0ad79e16515ff627c34b01fa71c60a
SHA512 9e9fb57f9219843966fbc254cd34bf6db2ea624292b24323e52f87c844b2b110c37b1f3951be012a093ce1dcbe9850bb87c931eae990aa82497ff6b77c0c430d
TLSH
T1571126106BFA3B24F7F2263040B21A644B3BBC06F6B49B1D100601CE187DE809F99F13
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Base.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Base.lnk
Size 1KB
SHA256 f05b7a1f5f545ba534e1993ddf77ec240fab89e5aa7cf7657f4d75bfdf10457b
MD5 898fa20f68c7fea4f0ed27d5143074f1
SHA1 3a2bfd7320a90288d75208fb63167e535c508c05
SHA512 84a7513a90d8b6cb1d367f71cc0c3e9e79ad37781fd352a9e9a120ce59d92a5c07efe23108daed3ca59b4c4e1fdc2fed07b809152e92c691d09b06b912d4a73c
TLSH
T179214C5067E52B68FBF75A3041B606644737FC47FAB5D72C000941C919BAE40CEA9F23
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Base.lnk~RFe5ac7d5.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Base.lnk~RFe5ac7d5.TMP
Size 1024B
SHA256 d6ddb642c247b04160cd4e95737b86ea558f69c5bffd952c476befbd69701d75
MD5 9a304b72e7751ef5eea70dd55b8a3726
SHA1 7c880682bbcb09051dbdf4e0707a66819b23903a
SHA512 cac178b9dc5fbce94fe2fa5df7ae45cef4482b9daf375ef09a74aa4d350a45824b9b79a6491e8a706603244cd29e433598b156240593c2bc9875aad7c716f279
TLSH
T10911D8546BD62B68FBF75A3041B51664473BFC42EAB1DB1D000A41C918BAA40DAA9F13
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Calc.lnk~RFe5ac7e5.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Calc.lnk~RFe5ac7e5.TMP
Size 1010B
SHA256 377303631d28f50f8975a68d19b7b355b2666842f0dc4e118a74ca21b1ca6c2f
MD5 abc6582cdd8006ed0785edfd04925701
SHA1 a19b0c3be3ade199b53121effeb9e650b103ee4b
SHA512 f5f7029b9e6e1074a1e7268d7575ebf80cf91f7936cc2ec414dd5505dab4ebb0667d17a149eae55db9c839ee7875a775a8182e650fdf04cdcfcbdf4af2be0102
TLSH
T1CB1124145BE63B64FBF35A3054B617644B3BBC06EEB1571D410A42CA28BAA40DE69F23
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Draw.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Draw.lnk
Size 1KB
SHA256 7edfc75f7948c63429152059c079c46871c31ea23200a1240f7166435d552a82
MD5 927235c1d440093214750c876b372b71
SHA1 973028a23d607fffde2714648739baa56f46ec3e
SHA512 1d15155e38e486c7e5ba44837b918c5f8c77eb21a8f93591bc85aa005914cfa0c87b3a297bb944b26cccd57dedc780466dd5857ce105ea22a231fd8c2056fcda
TLSH
T13C1149546BE93B64F7F3863041B62B64473BBC46F6B5871D400942C918BAE009A5DF23
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Draw.lnk~RFe5ac7f5.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Draw.lnk~RFe5ac7f5.TMP
Size 958B
SHA256 5e46c77082d6c166f2435a13fc57562a6e551216f9b5e9708b3724de1ebe7ca3
MD5 ad3005d7c178c3af2cee565d8592930e
SHA1 01224d7d7e6e5e653e7eabe748789ca7bfe33977
SHA512 7064a746ffc636abb1080f8a47276adfee7223f53441fb6427d0359c7f766e6f05a79eb5073d7a46089c55f7e970695cc49db3e835d435b68367d2bb0d866fc5
TLSH
T16C112B546B953B68F7F3863040B627A4473BFC41EBF5471D004942C918BAB009A69F23
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Impress.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Impress.lnk
Size 1KB
SHA256 e822d46d50700c06ccc04fb1fee075e77909be357e55dbb6d1e04217b83c2ae3
MD5 6a21e67d82713728a8bfa8ca5ab1d1ec
SHA1 4997693c15956a3bef2d87863dbc5ab61d5c0412
SHA512 e1a96aa6a374a52b6ba841e5fedeb63c63b200358d6712cbf74e7fb21adedda116dc2a61cfa61446bfa616e97180e254ca3d0dcdf58c3f16d4e4eaeb33d27570
TLSH
T18221E55427E93B28F7F64F3040B60669473BBC46FEB5A31C104A01D918BAE40DA79F27
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Impress.lnk~RFe5ac804.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Impress.lnk~RFe5ac804.TMP
Size 1018B
SHA256 0219bc52ae4506c030b9411593e2303fd771a99c2b1e547a8c8130576e3631a5
MD5 7ab04f58c5a5db553505ddafa8c61178
SHA1 9e22638912e0a4c4efc1fa4141f5de30e40ba2b5
SHA512 acd960634fdd9834a06bb61bbae3898735b2f4c17c4bfee6f3cdc7d411f5f6ef8936e6191cca38924bdce6aa8350186bdae001e63d5020c18cc7c832e79800d7
TLSH
T1D711D8542BD93B68F6F64F3040B61768473BBC45EEB5971D104A41D918FAA00DA78F17
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Math.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Math.lnk
Size 1KB
SHA256 6d4aa8e5292f74c020495d0c40ac0785eebbdd9cbf77951d395e1110491aba49
MD5 17f15ed0dbb98fcfa2d82d33628aec76
SHA1 ae5ad874c8476d5d75298afc437e09e682ea5990
SHA512 c5a065c0e3fc4028325e32603df17ca1e5132f6f09a153c2d0ae8fdc5583f6ab53f9aeebb9546f9dd3488cd6ed9d30dd86b7278c34cd3d79cce1608c8c5d8eb8
TLSH
T11411661417EA2B20F6F3163102B21624473BBC06F6B1831D000A42CD18B9E409A5DF23
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Math.lnk~RFe5ac814.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Math.lnk~RFe5ac814.TMP
Size 960B
SHA256 903bcf24dbd1b41800bea9b8084afe2ea7238ade394e976c8c591f1af31bcbb5
MD5 e03870c6383a119f9e74ddfe385251b9
SHA1 34b4089de994ff20b899fee031a08ae26f3bdb65
SHA512 b4efa647110b2bc3bf3e65c9c492553c1854149881f374fe75e90824ed3b2a523081c7100412e75cf50bb69361e7ccf9c5faef1f39bcc231f4608286ce4993d4
TLSH
T1A911F2641BDA2B64FBF34A3141B61764473BFC02EAF1971E000A42C928B9A409A69F17
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Writer.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Writer.lnk
Size 1KB
SHA256 a5208c30093cdc1bec036659f511b4a4bb32d0915fc7141695e9ef30125beaae
MD5 f25ee50a2749ec2efaf721a414cf1800
SHA1 abdd28b0fe7fbb9448028dec48804516b61f76fc
SHA512 0e1c80806feafc50ebd73139df1ded217f6e1f2eb8a1836231eb3056b24ca8b8e3d80d1eb45a9b44f7e91d79b1331b4f2499e6a0ed55e5ff554d33970d47df82
TLSH
T1912108546BE53768FBF34B7004B117684B3BBC52FAB5D71D400A01DD18BAA409B69F23
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Writer.lnk~RFe5ac833.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Writer.lnk~RFe5ac833.TMP
Size 1KB
SHA256 27c65c482453de633525c885f30e69d4578e7df2e29a78055c80e8f188a324d9
MD5 5f473f349e30321640c2ebdf7c9b57fb
SHA1 a4419d9fc293feee4772b756bdfe27d913464dfb
SHA512 e9eecbaa09cda72d7631880d314daa0eb843f5455bad381da8ba2095cf95353e3c809cb294a745729bc0cabfda6bfea6f4ab97ff7f2ddfbfbfa31c70914b51eb
TLSH
T1AF11B1546BD62768FBF34A7004B117644B3BBC52FAF5D71D404A42DD18BAA409A68F13
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice.lnk
Size 1KB
SHA256 4524758769a91473c7a1b1d1d7d9baa5664aac46c7219f1ed3ecb6627fddb342
MD5 31782927dabafad734944e8ed0c4b5ce
SHA1 2eb28cd1e8c9682f837929536223bda68b1f6178
SHA512 d168916330229fcc391be2da3430bca5ec43948b7f645f7b299af2bbc712ef7a8420fa1f458576e77acdd4944bb3a14aa70d636fb136f8ad93aadb6e9930b0d3
TLSH
T16921061467FA3B20FAE2623440B61A654B37BC07F6B4D72D500A01CD197DE805F99F13
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice.lnk~RFe5ac7b6.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice.lnk~RFe5ac7b6.TMP
Size 1KB
SHA256 b2699748a70fc5b0680f15e3f45e9914e497182d5c035bc030d3c705fc3582c0
MD5 d09ccf1579bf5bd958ad153c8c83ffe3
SHA1 d40bafca2c3c2fa29e8c61eb2d2a082c999a76b5
SHA512 201de21f403949f1aa6ea55160a42cf38aadc106bda1edc34451551f1d14222d9aca1f40c900eb9a168d5fbb9fdaa57435d35cabae28b5bfa9d12f70aee44b93
TLSH
T18D11F91467FA3B24FBE2623040B61A644B3BBC06F6B5975D104641CE197DE409F99F13
MD5 SHA1 SHA512 TLSH

Submit Download

~ibreOffice Calc.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\~ibreOffice Calc.tmp
Size 1KB
SHA256 79e479b9e19cb646122771dbbc3299439d8374abe9b459b913e4a2fea8c2f495
MD5 5a91d8c183305373cf4f5240c5b23217
SHA1 3ffc6c85de7c4f68eecb1811b5779bce0fa055fb
SHA512 32af551f12502b0c01110dcf4f673dc4ebbec102eea284172e7d1f7f3de44ceb12b6f217913f3ff6ed282c94cd19506f79f4b3d2a80ea995e2b596db9a6f12b1
TLSH
T13C218800A7EA3B24F6F3163054B217240B3BBC06FAB1931C400A41CA18B9E408E6DF23
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

MSI4666.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI4666.tmp
Size 1005KB
SHA256 3b87dac3c0b6fd088e5ce8af37705ab8c04958e0b159cba32733c82acef13fa2
MD5 b82d9c72b877108c4612766932e83d67
SHA1 5b4f73d1b6f4be51e875c77b8d57c47c3f315e02
SHA512 de536f649f4dd9c665e3630c616c6825fbb0e9ca1c5ac5a7fed9a7e89f050d7a4f6037a460ee03099f56589f274a61ddd5c094edc240177908af98950d42b55b
SSDEEP 12288:XvkDN/KhUESP8VIA3Tavr8yntiszTXNNNsxVbqQaVHEJ:XvyN/KhLSP0IADavr8yntzz74Vn0kJ
TLSH
T160259E19639412B9E577D17CC9A78E56EAB2BC4A0330A7CB03E556A52F237E0473F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI47ED.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI47ED.tmp
Size 477KB
SHA256 5a40ca8425f19b8e45bcf807608d1ef93590fb96c72a38b3297c027e4f013cd5
MD5 d012b6cbb816f638287a093043ef98df
SHA1 8ad3cc694fdadd55ff1a03a9d09ea5d28be9433e
SHA512 22fcb0b80dfa7565b8610f27ae06162f3afed476d4b1c9dd449aa85a0f7202f8c769f9ba18486bd6702e31a2c389ee9ede2577cb8bc395c657b6339eed21bcff
SSDEEP 6144:kM2oDwJwE5SupfiDUXESC7aTYpDwD4c91CaluPweHWjn:92oDrE5Gs87asDwDr9walCG
TLSH
T1BEA48D16B7E501F5E1B7D139CA668E96FAB2BC190720E74B03E496B16F23351463F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI49C5.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI49C5.tmp
Size 498KB
SHA256 2ad91347bd98d35ad9a77bad6b0e1b7f1b8074907ded199d5d8bc559eca7ebc2
MD5 811415f0ebf8b305000de3e2a66ebefd
SHA1 5467c4878c4f92df99f947e96437d28c665a60ca
SHA512 0ad1b984b7212df737d543d47ac1d526013f73414239b06425ce4309aad9f15014d3e6ff41f70b723f6262a0fc0ded1cca431facb2d30afaf147d2a35328b00f
SSDEEP 6144:uYd7LrT+/4/AMbeNSNQ6Z5b2DuC1gAv1wPpHbFItBgM1OGzgB:n7PA4YMbWSW6SXv18pItBtg
TLSH
T1E2B47B16B7A403F5E0B7D139CA57CE96FAB2B8590B20A74703E496B12F13361563F326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backenddb.xml

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\extensions\bundled\registry\com.sun.star.comp.deployment.bundle.PackageRegistryBackend\backenddb.xml
Size 3KB
SHA256 7f9f55afb7a7db133eb71660cd358979a359a33c90c6b734b2bc1a60d202aae3
MD5 346e300e57b33cca5fea8a280850655c
SHA1 657e899cfb2d7f45dd3a7c48b56fc8fa85f1c338
SHA512 3956c0b4a53f2fab310f69dc7716308b7197815e6512e0d88a5b2575b9b4e77ef2282b6c48a682c134f77f254cddd36d0c1a928755af474a1d2459be583d5bb1
TLSH
T19871A280A69E18635C5BBBAECC7E436CAB3EB6855539310CFDFF096E814CE4D5223445
MD5 SHA1 SHA512 TLSH

Submit Download

backenddb.xml

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\extensions\bundled\registry\com.sun.star.comp.deployment.bundle.PackageRegistryBackend\backenddb.xml
Size 7KB
SHA256 f98f1f22ac72bc99478987cab211404de015f772c162bae03a37d2af91f49f9f
MD5 0aecb0bfacbb78d2d87f4ffe5f5a21b9
SHA1 478eff2007e3f526641c20b87fc76375a0315b42
SHA512 8bbdb9a17fed4fa1584ef0c50707649e42a94880b5c0575088d4c922f070da518b2ad3d968321fe9f27d5e523add438a397321411dc2ae6c389e20de4b18e5e2
SSDEEP 192:+dqh8ymCqBrL3rdRM8wwcYyW3Lt5PUOmX/V7Ku8f8jE8h8R8s8bT:+dc8ymCqBrL3rdRM8wwcYyWbt5PUOmXl
TLSH
T182F1A3C0A69E18B32D5B7B9E8C7E426CAF7EB6459939310CFDFF086E814CA4C5223545
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backenddb.xml

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\extensions\bundled\registry\com.sun.star.comp.deployment.configuration.PackageRegistryBackend\backenddb.xml
Size 4KB
SHA256 ca3dc26ed581a75a20eeeeb959d11344cca20e62f19a41e2213d716be898a0b1
MD5 5f090eecb24f4e66f0ebee75991b0961
SHA1 b8f9c48bd2d15d4d7558ede0ebfe287f2a2956b6
SHA512 c578dea22be329ffdc807be86bc0bb964d8a5008c1d56da2a977a6ffc13b91be1246cc2aadf4b49caef0e4b3a4ef22de65c024d6afa40a8706ca9cb5c5b62d9e
SSDEEP 48:KXAquhAAARbqphklbqmbqahNHNMbq9hS5bqKbqRh4JbqyDhJSbqQdh2rbqQhHMb9:el
TLSH
T14BA1D7F1BAAE6C2355979FFE94E963B87D3F3BE60015105CE6FB22E1425456E130310A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configmgr.ini

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\extensions\bundled\registry\com.sun.star.comp.deployment.configuration.PackageRegistryBackend\configmgr.ini
Size 1KB
SHA256 305273c299a5a6e2c7fe9393115e7119982fcdf3ec2d54d8c6049180a53fc6d4
MD5 e06dd37450d24e65e33967c3e120e8b7
SHA1 119c7f47c834efcaf594cb416747c8a43fb4e945
SHA512 b2db363c0ddd7e950bb2fe3c5cedc7c77e6d140367db050e60b6cf24d726c9a9f2e21665aa4061891f30b2d750177f1ce56a13b5bdc3bcb6a6bc56b92b87cb30
TLSH
T1A6312DA5B65F68231A5B4FED58AA03E87A3D3BFA040B1098D7F332F541909ED131314A
MD5 SHA1 SHA512 TLSH

Submit Download

configmgr.ini

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\extensions\bundled\registry\com.sun.star.comp.deployment.configuration.PackageRegistryBackend\configmgr.ini
Size 2KB
SHA256 af4bf1d797f9257d7ada4187c0d31e7f84cbf9719c7549b50d074b11c6252404
MD5 7c23bdd902150ddffc4c071ed3c59115
SHA1 67f3d340a223eed1cf1a768a9b047b8f32036f29
SHA512 b908e92042159b1237af33cd9a928343a8b0fcb7aa4db095026bcad4fb33e8c22cae0cac5f9306e90328c60ea25b97ca0faeea9b681e0519b520c0fe25ffa8d4
TLSH
T13241FD95BA5E6C331A5B4FED95AA03E8793D3BF600071198D7F732F542909AD131314A
MD5 SHA1 SHA512 TLSH

Submit Download

backenddb.xml

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\extensions\tmp\registry\com.sun.star.comp.deployment.configuration.PackageRegistryBackend\backenddb.xml
Size 135B
SHA256 ac6f585621eb04b34549a95c99e015ad5810a4156e021df46c46731e7a087698
MD5 2bf6ff815e43fff74544416742bbf888
SHA1 8b157b0e33dbf8b374bb6bf874b656c4c040b81d
SHA512 0737375e0308017c2f310e76d0605305feafeb874fa3df970be58d8792732ede009b53bec488e4d5d03080d664b6bd0a71e19c1da7025fef90be560d08aef73c
TLSH
T13FC09BE7950CEC530D558B47A9D45524DD3207D720841049E1FF3D7442116C52259158
MD5 SHA1 SHA512 TLSH

Submit Download

backenddb.xml

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\extensions\tmp\registry\com.sun.star.comp.deployment.help.PackageRegistryBackend\backenddb.xml
Size 117B
SHA256 845041424286d5b794c11ff0a59d3df289dcb1567fb448ef0b85297108675b46
MD5 9071cb6e373825c7757e03c0390edb51
SHA1 844c752db36f30c13ced0a09bcdd19ab86cb95f3
SHA512 941851d9e73bfa5af6526a035a608425685f470f82bdf20aaa9b7a4724a5ab486e867d7f199a0799b16f4330101a52610635b78c4408d2fcfe5653925ecde1a2
TLSH
T197B0925A9A0CE0234F198585ADE58221EA31035720C02622E2FF3EB451019C8A268199
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice 26.2.lnk

Path C:\Users\Public\Desktop\LibreOffice 26.2.lnk
Size 1KB
SHA256 0a32b2b04d23a7b86eb5364449001aa5255b798f9465f5531701e10f568a8b48
MD5 f4e0b282c02a74afb4595fe8e1c24a3c
SHA1 ddda0946723c5c921a2558bbaf22421c6d3d2b0d
SHA512 83f192b44cf68b43217db93422801e025725db908a30fcc206cd54ac0f1ebfc2482036c6a28997917f02d8a90c2df0369a56e6bb8e92aee20064c1cf0b88b86e
TLSH
T19A21061067FA3B20FAE2623440B61A654B37BC07F274D72D500A01CD1979F805F99F13
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice 26.2.lnk~RFe5ac824.TMP

Path C:\Users\Public\Desktop\LibreOffice 26.2.lnk~RFe5ac824.TMP
Size 1KB
SHA256 d6fc18e4e141f6949529d2d0f12293b26db1443b0c3803953fc763252d368621
MD5 95edb60969f2accc58e8e1ac55396378
SHA1 38a199ab4e64aa59e91da029bde10f5fcf7dca18
SHA512 c646a791f719d95e89701bea1a31480e601e31f1df71ca6f6a50fee2c6da51a5dbfb474a8083ca51089038a7cfd0f33b9935808daa8e76b4817a27ce9ce67dd9
TLSH
T14C11F91067FA3B24FAE2623040B61B644B3BBC06F6B5975D104601CE1979F409F99F13
MD5 SHA1 SHA512 TLSH

Submit Download

MSI9BF9.tmp

Path C:\Windows\Installer\MSI9BF9.tmp
Size 494KB
SHA256 839254d83c7b07dc5419573b83864afed619a04fe511f41fd92498dc88cc7f71
MD5 c0be39e599f7307680cd49f78084dbc0
SHA1 4fdd42dd3b6b202203590ca9d05e04480c511d39
SHA512 d400aac905588985bf89dfec42949f9bdcf2726f1686c0a25e16364e4ea20d52717a12b0f8ab2e7c899bedd8116048d8c755798ae25f4a1ebc470e5e6028e135
SSDEEP 6144:hGcfWmgU2iSsmI/hPk3KLQT7Ypp1i2ILQommV1VvROuyk+f:hfWlUFSCZPZL3p1PIUomCZRX+
TLSH
T1AFB48E16B7A503F5E0B7D139CA568E86FAB2BC590724E78703E496B52F23390553F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9CB5.tmp

Path C:\Windows\Installer\MSI9CB5.tmp
Size 505KB
SHA256 3fadfd8082aca08d6a83b3792a451309397a1337f17a67a84d1e05ae9fb4216e
MD5 843f2f5a7bc328dc268ae9d04b574c04
SHA1 1480bad4b9c08e9702ba73c9410cf0fc36d40312
SHA512 f34c73900ed4b71b8f878125ff342854850902e05573326481b7dcffb9c759d67946e5db29561525058e20b167b0c6c699deabdea3dead604d1aa0969d0bfdb6
SSDEEP 6144:nBLmUErZ6RhoSxGFD3NBe8OFVBUrX4PQfIGIbEDW21Ts:BSUErIRFGl36jU74PQIVbgT
TLSH
T1A4B47D1677E503B5E0B7D139CA568E96FAB2BC590720E78B03E491B52F237A0453F326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9D43.tmp

Path C:\Windows\Installer\MSI9D43.tmp
Size 1.0MB
SHA256 c9dfa1f92b8145c9af60186f3d5a0b6e0b80413cf2ccd97330e2031ce843665b
MD5 50d1de92d6639e7e130206b660c4df72
SHA1 25f077045af8897bd46726329901ede1b4cac734
SHA512 1987800d9a99d4b11bc7af71a1b7bd977c5cfa4d9f84271ed67f0ca4fd34656a3ba6905df38c73455516004c3414b572c2797c0c3e384ed2f0d30584275ef6be
SSDEEP 12288:FJYj3jFrR+HiubeNMeOaab2Wv7sYBYBxZPc2TbOU0:3YTjFrR+CrCefE2hMAPc2u
TLSH
T100359E1567A402B9E173D17DC9A74A56EAF2BC0A4330ABCB03E556A52F277E0473F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9DB1.tmp

Path C:\Windows\Installer\MSI9DB1.tmp
Size 507KB
SHA256 48a4bbce857859b786de908a6178654f3257ebc8fb885bc153febd32ed72e87b
MD5 051f3238035bb4750f0f0655e38bdfb2
SHA1 40fd2aae3af76dd153ec6d724654f21f9f657a7e
SHA512 3f3e722e799a83c7bca457f8565d246ea54afde29d46d034f70d5a0f58cfd2408fdb2afa8454381f36e7716a289bf4a988f9e6106caa7b17a9f0c1edefc3c46e
SSDEEP 6144:CcbpQqYKP2CGivcR/udOn+kHyddfgG/MDkAKfUCC:CcVQqF2Undfdd4GEDU
TLSH
T1A5B47D1677E503F5E0B7D139CA568E96FAB2B8590720E78703E492B52F233A0553F326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFC1C.tmp

Path C:\Windows\Installer\MSIFC1C.tmp
Size 478KB
SHA256 e78c80f634cf133ae3782b915c5ae8b178507f545566ea4b167a2b8d7d59823d
MD5 edb239d0f7ba89299a110e097f496702
SHA1 cb7e70583560aaf407bf2290a3839e41ac966894
SHA512 104e84f3c601c4ad2dab564e7d8b30e58176fb983056456e9f2b1731822d4514e9a3bc33e5fc0ee92c6a6f338d16366fd4067f2fbd8f009d307f3a4ab6b7e4f4
SSDEEP 6144:7ddGtydjjDVn7W3aabACHH1qv+8vaCqnV5aUqGgI:RdYy1jdVw1qv+oaPnLqX
TLSH
T16BA48D16B7E501F5E0B7D139CA568E96FAB2BC190724E74B03E496B16F233504A3F326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policy.1.0.cli_cppuhelper.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_32\policy.1.0.cli_cppuhelper\v4.0_23.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_cppuhelper.dll
Size 13KB
SHA256 13b204a5ca1f4e8e5f1d9022339c82848a9a95cde2aebbe4c41433f2127ac6be
MD5 fedfcbd1239221581f46d67505ff3882
SHA1 ec63773e711bd4b17e284836f197d164126618fc
SHA512 8108fa4cef2f51a60b8e5bae7737522c69ac0fbb5a642a6c0217b2760d12c4e797a4b58c480a39a98c5a15271a43263257624f983512bd44ce215fd09e81ef20
SSDEEP 384:IW2mND0yzrpG8ZnLdWXSofousWu4qWSM:IWhaur/nLySoQuSBWL
TLSH
T145525A2A4F14A4E6F967EF30A4F9823B6DB1B6809D81494B744800D92F427B93F7937C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cli_basetypes.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\cli_basetypes\v4.0_1.0.20.0__ce2cb7e279207b9e\cli_basetypes.dll
Size 21KB
SHA256 65617a9dc3fb2291a363724671dc9bead6109ba46c4dccaf13696cce62a91502
MD5 656de12721fcfca5685facdcdf07a3d4
SHA1 6bf04282e179d564a101224641fc59da96957ea5
SHA512 ea0492419f4126cf605b5237d3355b599fc85633c8eedfc450f7d7c11a62a56675df0e6d61b6f88ff5f97b8a4bd179ce6a1c307a06cc6a55d0970d38578d5ef3
SSDEEP 384:92BlrJPI56/uyG+2mND0yzrJvDvWdWXSofousWu4q2SS:kJP7G+haurZuySoQuSB2
TLSH
T1A3A26E189F2CC27BEA7B9F7474F587160E30EA856562CA0F144C849B1D43BB52F623B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cli_oootypes.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\cli_oootypes\v4.0_1.0.9.0__ce2cb7e279207b9e\cli_oootypes.dll
Size 1.1MB
SHA256 730cf03793f3bf0603864d2f6224d546fa306f58381b5d8ad5692355d3ff5e68
MD5 f180477724cf7ac1bdbbc1cb6c20af3a
SHA1 0ea547f75705c23d8c6d8719716a1b4a81f7d262
SHA512 62f0cc5b0e201366ef7fe94ea2a07aba452dfb868b62ef540f3514c0a5edbd80e09dc93edf618edd422ae4d3dbbec1fd1dcfe45b29ed8e2f84b8458484fbdf41
SSDEEP 6144:yXR1FSfrkEWcOIL3BBaRL50O0/vMvHS/4NRRSVVSNrhZWJszsIvVWNjfk3L1VcoL:kjafkTcbbGnR+UN97qhl3vvx
TLSH
T1944562071FE64714EABE277839720B108E72FA53D935C71DC315186C1C6BAE69E21BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cli_uretypes.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\cli_uretypes\v4.0_1.0.9.0__ce2cb7e279207b9e\cli_uretypes.dll
Size 121KB
SHA256 992ff2c2b1774171abfd2276bb02b1df56248e81b7d9de1946312407f092dd1f
MD5 d55089fc96768c7cc00609ccdaca677c
SHA1 f17f965bd148853443563087011554cacab14584
SHA512 a9b6f8d7aed279eabe6b0bc76732a96da75e222370aa5a56cec92e9c1392085b07e77363e0bc97b6de8114bd3e0594c5aa28c7ce6a79898fe541b08d2dd56b3c
SSDEEP 3072:DQhOB+3V9nyRf5JgY8kU40qHLbkjnADFZJfS:Ms/U40tkzJ
TLSH
T13DC362166FDB0205EEBA377929760A104FB6FA17EC35C32ED210091D1C67A6B8E51B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policy.1.0.cli_basetypes.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.1.0.cli_basetypes\v4.0_20.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_basetypes.dll
Size 13KB
SHA256 6758b0d6487d9cc93d92f13b1be3f44dddd3cf98c00dd9bb139801906f485060
MD5 6dd632773b8b3ca0ffcdae16b525a188
SHA1 22a83b4f8bb688a5201841dd14d33475f4691787
SHA512 b3882f4684086af7200b9cc2b9b771b762c040251902f9c1842df1aea62d5842905f77480b3d886b4838f7fc5ab0eb62593b504b9c926b8f3dd2a2150933c3b0
SSDEEP 384:kU2mND0yzrTcMwdWXSofousWu4qWFS42:kUhaurJwySoQuSBeF2
TLSH
T1D6524B2A8F2454E6F927EF30A5F9823B6E71A6805C81894B700805992F437B93F7937D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policy.1.0.cli_oootypes.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.1.0.cli_oootypes\v4.0_9.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_oootypes.dll
Size 13KB
SHA256 dd51a677bc3aca0952c43f2b3692c4f610a463f96d8dc7b5e50d1def85cfb46b
MD5 8e52305cfa494b6344c9fb6bd6095d90
SHA1 79e2496289caddd52f86c67000019801ccba6951
SHA512 cd1aab68e24a15c673658b49c0655d46230db166da19b9be65c6e06ff41c31c874213a2cc620e63e579d91e00fb4e1fad1adc8e8a735c33b6052383baa7b678f
SSDEEP 192:WnBf3t+PBo21ZtDYNDxKy/dRo6Kw8NxaIWbHPTSofousUwz2T3+4qNSyt:0f3P2mND0yzrtuxdWXSofousWu4qNS
TLSH
T167525A2A8F2855E6F963DF30A1FA862BAD7167C05D91490B304901DD2F427B92F3937D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policy.1.0.cli_ure.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.1.0.cli_ure\v4.0_23.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_ure.dll
Size 13KB
SHA256 575ebb18f4c2b4d504d65eac446ba2cf5e0dd52377b60a1e0dee02a4044c320a
MD5 779bb3fa33460b78de11c6c5c8750c70
SHA1 33fe5b7ff2045307a99e9e1dee78e3a2c54e1928
SHA512 6657872284e4a758248b461305c1b711a91f2aa29f384a4085cdd876064aa3fe196a1084474dc2bd397c4e389a09c13f15dcda1b8597230d7ddde14476e1ba38
SSDEEP 192:mGzzmuSv+PBo21ZtDYNDxKy/dRo6KsCREkgaIWbHPTSofousUwz2T3+4q1ZSw:9u2mND0yzrYR0dWXSofousWu4qvSw
TLSH
T129525B2A4F2458EAF91BEF30A5F9822B5D72A6C15C914907704801AD2F427B93F7937D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policy.1.0.cli_uretypes.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.1.0.cli_uretypes\v4.0_9.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_uretypes.dll
Size 13KB
SHA256 54df2af169803a1d56baa9434dad6005ef42b5c140855924b0d0c0ed7069e383
MD5 9ea3a2fd909575a7ed1f8841269f8e01
SHA1 d83687347cf1527e0cc302034d1f0c9350b2deb3
SHA512 b410ff62d3bc1bcf5985d23542ece7a8e0975f4df8bffec038fe92244e0c9b50d5c00c0270fb5906741775f01d0758b21e141e1b1f00c3f7e07e0c46aa320068
SSDEEP 192:mzq3wDT+PBo21ZtDYNDxKy/dRo6KX5+2YaIWbHPTSofousUwz2T3+4q7YSTI9++q:BIN2mND0yzri56dWXSofousWu4q7YS
TLSH
T143525A6A8F2459E6F967EF3095FD822B5E71B6C09C91890B304C01A92F427B92F7537C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Windows\SYSTEM32\MSVCP140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Windows\SYSTEM32\VCRUNTIME140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Windows\SysWOW64\MSVCP140.dll
Size 437KB
SHA256 97e71a3c697fb1ab3af777db39009e4602525e8c3aff0837ecc7031cba188165
MD5 cbf2f368dae5e7dcf338c6f63533a2a9
SHA1 66ed78a01447a005bf1bb5a3950a3e9b728972ca
SHA512 3fedbd8819f2f33ccfa537eea3450157ff445eedaeb8a069d453e22726eb3b90a3c93f8069845fe9dc0ff39d9f4ff71209f61c66aeb5dbb7590d47a91641944a
SSDEEP 12288:zm0Gxo1x5zvNk5/IQUG2MiwB19uaCOmhUgiW6QR7t5s03Ooc8dHkC2esGyadKN:ztR1x5zvNkfp2MiG1303Ooc8dHkC2eX0
TLSH
T1679417227B060DF1E49923B572CA431293F9EC6503A0E3C393DEF5196F662C6A773691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Windows\SysWOW64\VCRUNTIME140.dll
Size 89KB
SHA256 a9d7732a3c3de09f0601a7fa2555093dcb49f08e2fc62a86091461f0f38393ed
MD5 4bea1ba68690620b78c7502ac968f0ba
SHA1 acdc523fa28632fcecede3eeaf62c6bce26527b4
SHA512 d451625494b54b96a481d34f5b42b9c631810558267e8b37b182fe09583422f1c1171a922c9abfe4227ee91f430f3579e8ab8173234264a435fdcfa6a16ce57e
SSDEEP 1536:WJJFW1PcUMCdLiNWNrjO+MT+S0OeneLDA50Xsd2zkkBGCGVbBBTkfeecb6RWSwgZ:I3W1P/MCdnQ+8EWXsd2ARNBPecb60Swo
TLSH
T10C937E9375F881B2D99E05B0D9BBFB161D3DE6410FF06BD71B949844DEA2BC09B3021A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Windows\System32\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cli_cppuhelper.dll

Path C:\Windows\assembly\tmp\36TIERXM\cli_cppuhelper.dll
Size 219KB
SHA256 e843536bbce36791b3cd3cdbae9de309654e6c2bb32ae4ee024898435fa3c5dd
MD5 55f7f385cae8492d27cdc227b3d973a0
SHA1 23a466dac507772ee402b0077bf1d93d14066560
SHA512 0edbf2eadde812b0069671045c5a7954b5cad7851aadeef3b4a74dc6f7c2bd98b4ae2ab00a9226c5fd8b5567ce05a400e93ee4a9e699b712eeed9ab7ef958dc9
SSDEEP 3072:m+0nUZZavGOYgoKbvFFVEllhFRYIHJmZ3aeDbFMfS:mdnUZ0vGOlb1EXhXYITeDC
TLSH
T1A624193836730D63E9E513B800DB674183B2D9133B17571761A6A26A0F873AFDB32796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3008-98-0x000001CD82C90000-0x000001CD82CB0000-memory.dmp

Download

memory/3008-85-0x000001CD82E70000-0x000001CD82F70000-memory.dmp

Download

memory/3008-81-0x000001CD82930000-0x000001CD82950000-memory.dmp

Download

memory/3008-230-0x000001CD97B90000-0x000001CD97E2E000-memory.dmp

Download

memory/3008-112-0x000001CD94210000-0x000001CD94230000-memory.dmp

Download

memory/3008-66-0x000001CD801E0000-0x000001CD802E0000-memory.dmp

Download

memory/3008-68-0x000001CD801E0000-0x000001CD802E0000-memory.dmp

Download

memory/4332-14486-0x00007FFF1F320000-0x00007FFF20320000-memory.dmp

Download

memory/4452-231-0x000002E67C000000-0x000002E67C29E000-memory.dmp

Download

memory/5744-8856-0x0000020C34500000-0x0000020C34520000-memory.dmp

Download

memory/5744-8859-0x0000020C344E0000-0x0000020C344E8000-memory.dmp

Download

memory/5744-8853-0x0000020C33C50000-0x0000020C33C58000-memory.dmp

Download

memory/5744-8863-0x0000020C344F0000-0x0000020C344F8000-memory.dmp

Download

memory/5744-8867-0x0000020C34520000-0x0000020C34528000-memory.dmp

Download

memory/5744-8850-0x0000020C33C40000-0x0000020C33C4A000-memory.dmp

Download

memory/5744-9477-0x0000020C35B00000-0x0000020C35C24000-memory.dmp

Download

memory/5744-9474-0x0000020C34530000-0x0000020C34569000-memory.dmp

Download

memory/5744-9480-0x0000020C34570000-0x0000020C34578000-memory.dmp

Download

memory/5744-9484-0x0000020C346D0000-0x0000020C346D8000-memory.dmp

Download