Analysis

  • user interaction
    yes
  • max time kernel
    99s
  • max time network
    120s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    23/08/2026, 23:56

General

  • Target
    DesktopEditors_x64.exe
  • Size 356.3MB
  • Sample260823-3zalka1eqd
  • SHA256 a3b4a7353946a2d836eadfb8f59799f98b906ab961421c05c0bee00be9307a9f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 28 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DesktopEditors_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\DesktopEditors_x64.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3240
    • C:\Users\Admin\AppData\Local\Temp\is-6BKRXQYYUT.tmp\DesktopEditors_x64.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-6BKRXQYYUT.tmp\DesktopEditors_x64.tmp" /SL5="$50298,371532678,1015808,C:\Users\Admin\AppData\Local\Temp\DesktopEditors_x64.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Program Files\ONLYOFFICE\DesktopEditors\DesktopEditors.exe
        "C:\Program Files\ONLYOFFICE\DesktopEditors\DesktopEditors.exe" --assoc .doc:ASC.Document.1;.docx:ASC.Document.12;.xls:ASC.Sheet.1;.xlsx:ASC.Sheet.12;.ppt:ASC.Show.1;.pptx:ASC.Show.12;.pps:ASC.SlideShow.1;.ppsx:ASC.SlideShow.12;.odt:ASC.Document.2;.ods:ASC.Sheet.2;.odp:ASC.Show.2;.rtf:ASC.Rtf;.csv:ASC.Csv;.pdf:ASC.Pdf;.djvu:ASC.DjVu;.xps:ASC.Xps;.pot:ASC.Pot;.pptm:ASC.Pptm;.epub:ASC.Epub;.fb2:ASC.Fb2;.dotx:ASC.Dotx;.oxps:ASC.Oxps;.xlsb:ASC.Xlsb;.fods:ASC.Fods;.fodt:ASC.Fodt;.vsdx:ASC.Vsdx;.xlsm:ASC.Xlsm;.docxf:ASC.Docxf;
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:4120
      • C:\Program Files\ONLYOFFICE\DesktopEditors\DesktopEditors.exe
        "C:\Program Files\ONLYOFFICE\DesktopEditors\DesktopEditors.exe" --create-jump-list
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:2252
      • C:\Program Files\ONLYOFFICE\DesktopEditors\updatesvc.exe
        "C:\Program Files\ONLYOFFICE\DesktopEditors\updatesvc.exe" --install "Update service for ONLYOFFICE."
        3⤵
        • Executes dropped EXE
        PID:4336
      • C:\Program Files\ONLYOFFICE\DesktopEditors\DesktopEditors.exe
        "C:\Program Files\ONLYOFFICE\DesktopEditors\DesktopEditors.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4476
        • C:\Program Files\ONLYOFFICE\DesktopEditors\editors.exe
          "C:\Program Files\ONLYOFFICE\DesktopEditors.\editors.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2224
          • C:\Program Files\ONLYOFFICE\DesktopEditors\editors_helper.exe
            "C:\Program Files\ONLYOFFICE\DesktopEditors/editors_helper.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent-product="Chrome/109.0.0.0 AscDesktopEditor/9.4.0.129" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file=C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/log.log --mojo-platform-channel-handle=1636 --field-trial-handle=1796,i,3008723851600377829,15646680272459122873,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3484
          • C:\Program Files\ONLYOFFICE\DesktopEditors\editors_helper.exe
            "C:\Program Files\ONLYOFFICE\DesktopEditors/editors_helper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/109.0.0.0 AscDesktopEditor/9.4.0.129" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache" --log-file=C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/log.log --mojo-platform-channel-handle=2008 --field-trial-handle=1796,i,3008723851600377829,15646680272459122873,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
            5⤵
            • Executes dropped EXE
            PID:4740
          • C:\Program Files\ONLYOFFICE\DesktopEditors\editors_helper.exe
            "C:\Program Files\ONLYOFFICE\DesktopEditors/editors_helper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent-product="Chrome/109.0.0.0 AscDesktopEditor/9.4.0.129" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache" --log-file=C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/log.log --mojo-platform-channel-handle=2608 --field-trial-handle=1796,i,3008723851600377829,15646680272459122873,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
            5⤵
            • Executes dropped EXE
            PID:3712
          • C:\Program Files\ONLYOFFICE\DesktopEditors\editors_helper.exe
            "C:\Program Files\ONLYOFFICE\DesktopEditors/editors_helper.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/109.0.0.0 AscDesktopEditor/9.4.0.129" --user-data-dir="C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache" --first-renderer-process --no-sandbox --force-color-profile=srgb --log-file=C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/log.log --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1796,i,3008723851600377829,15646680272459122873,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
            5⤵
            • Executes dropped EXE
            PID:4368
          • C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
            x2t "C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/work_temp\T_BCED.tmp/params.xml"
            5⤵
            • Executes dropped EXE
            PID:3308
          • C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
            x2t "C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/recover/DE_C386/params_from.xml"
            5⤵
            • Executes dropped EXE
            PID:4840
          • C:\Program Files\ONLYOFFICE\DesktopEditors\editors_helper.exe
            "C:\Program Files\ONLYOFFICE\DesktopEditors/editors_helper.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/109.0.0.0 AscDesktopEditor/9.4.0.129" --user-data-dir="C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache" --no-sandbox --force-color-profile=srgb --log-file=C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/log.log --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3888 --field-trial-handle=1796,i,3008723851600377829,15646680272459122873,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
            5⤵
            • Executes dropped EXE
            PID:720
          • C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
            x2t "C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/work_temp\T_D181.tmp/params.xml"
            5⤵
            • Executes dropped EXE
            PID:2980
          • C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
            x2t "C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/work_temp\T_DD0B.tmp/params.xml"
            5⤵
            • Executes dropped EXE
            PID:5948
          • C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
            x2t "C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/work_temp\T_E8F3.tmp/params.xml"
            5⤵
            • Executes dropped EXE
            PID:5160
          • C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
            x2t "C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/work_temp\T_ED3A.tmp/params.xml"
            5⤵
            • Executes dropped EXE
            PID:5596
          • C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
            x2t "C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/work_temp\T_F20D.tmp/params.xml"
            5⤵
            • Executes dropped EXE
            PID:6104
          • C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
            x2t "C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/work_temp\T_F5E6.tmp/params.xml"
            5⤵
            • Executes dropped EXE
            PID:5020
          • C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
            x2t "C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/work_temp\T_FBC3.tmp/params.xml"
            5⤵
            • Executes dropped EXE
            PID:5360
          • C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
            x2t "C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/work_temp\T_1A.tmp/params.xml"
            5⤵
            • Executes dropped EXE
            PID:5984
          • C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
            x2t "C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/work_temp\T_52C.tmp/params.xml"
            5⤵
            • Executes dropped EXE
            PID:3276
          • C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
            x2t "C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/work_temp\T_AE9.tmp/params.xml"
            5⤵
            • Executes dropped EXE
            PID:5556
          • C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
            x2t "C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/work_temp\T_100B.tmp/params.xml"
            5⤵
            • Executes dropped EXE
            PID:5432
          • C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
            x2t "C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/work_temp\T_1888.tmp/params.xml"
            5⤵
            • Executes dropped EXE
            PID:5560
          • C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
            x2t "C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/recover/DE_C386/params_to.xml"
            5⤵
            • Executes dropped EXE
            PID:4896
          • C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
            x2t "C:/Users/Admin/AppData/Local/ONLYOFFICE/DesktopEditors/data/cache/work_temp\T_203A.tmp/params.xml"
            5⤵
            • Executes dropped EXE
            PID:2092
  • C:\Program Files\ONLYOFFICE\DesktopEditors\updatesvc.exe
    "C:\Program Files\ONLYOFFICE\DesktopEditors\updatesvc.exe"
    1⤵
    • Executes dropped EXE
    PID:2052

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DesktopEditors.exe

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\DesktopEditors.exe
        • Size 1.7MB
        • SHA256 cb146392d17b63ce5ab5fecf7afebd7e31fb3a5ab2bc7c417509e550997cb7df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Qt5Core.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\Qt5Core.dll
        • Size 5.7MB
        • SHA256 38cb0ac0a27894e126bf2c7496de10110d8b100434e0cc1a67d7bc31c8c4f9a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Qt5Gui.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\Qt5Gui.dll
        • Size 6.7MB
        • SHA256 48868b3f17a225667db9e6a5839c4536ad09e43b1e17ab9e3bd1a87b4d825272
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Qt5PrintSupport.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\Qt5PrintSupport.dll
        • Size 311KB
        • SHA256 c018c83732fcd0b655c5609d7c3187c65dc4331b6682e72f021b954c850cfcaa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Qt5Svg.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\Qt5Svg.dll
        • Size 324KB
        • SHA256 d7f41666636715433d6d8ba9e34ec674a4ec6e1e68f4aa529a76f429f6d22de8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Qt5Widgets.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\Qt5Widgets.dll
        • Size 5.2MB
        • SHA256 43186a703969e760834b1eb479c8908fad5024fdbf15b0a7ea7fd7ddd775b4b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ascdocumentscore.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\ascdocumentscore.dll
        • Size 3.0MB
        • SHA256 3d00c5773094ffec137a7b15e862319f211c952786ab7aaac1c3f2a6ab3d3415
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DjVuFile.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\converter\DjVuFile.dll
        • Size 641KB
        • SHA256 8b6a081602646fa94f9984b105a166bae2f60a13e53641d83405a63f18e08397
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PdfFile.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\converter\PdfFile.dll
        • Size 4.8MB
        • SHA256 02b9b58c50510da9a9b371519b3c69c9873b6ae70b4d6c5d82f90235d6f587be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        XpsFile.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\converter\XpsFile.dll
        • Size 212KB
        • SHA256 fdf03e52b1a6c148d3ae5e8f8d58f1f2c40390c76f7e3639ccfcba567b92396d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        graphics.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\converter\graphics.dll
        • Size 9.0MB
        • SHA256 20bb12793313c0722d5f14b045c2f2585ce81b5dead2f1b1574163c9b8d7581d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icuuc74.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\converter\icuuc74.dll
        • Size 2.2MB
        • SHA256 1c0cad821b33e0058d8e2ce4d52c6ef328a5de19686a9a138f40e1884f6754de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kernel.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\converter\kernel.dll
        • Size 1.0MB
        • SHA256 a744a3c9680935580adf0d34054fb31d7705ed20bf94fe8f11a62b5dbb6fb0dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kernel_network.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\converter\kernel_network.dll
        • Size 64KB
        • SHA256 3d49fb89e9f13ce910967b394857a4994b6b4318bc421bba7de835dd8bf2deb4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        x2t.exe

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\converter\x2t.exe
        • Size 37.7MB
        • SHA256 deb80914b5c8743be2373a31fe54c08e0422051546a9d8fea6a08688e913cffa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-2FWAC7OXXE.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\dictionaries\de_DE\is-2FWAC7OXXE.tmp
        • Size 17KB
        • SHA256 e7431ac20e815b6797369e802f9e4bb1b0082485060d8b096235f035d741bd89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-DIDIK88K7F.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\dictionaries\de_DE\is-DIDIK88K7F.tmp
        • Size 34KB
        • SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-HIQS58KZUT.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\dictionaries\de_DE\is-HIQS58KZUT.tmp
        • Size 24KB
        • SHA256 b7993225104d90ddd8024fd838faf300bea5e83d91203eab98e29512acebd69c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-NBW3RERRD8.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\dictionaries\de_DE\is-NBW3RERRD8.tmp
        • Size 25KB
        • SHA256 dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-XYY10CB2E0.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\dictionaries\de_DE\is-XYY10CB2E0.tmp
        • Size 675B
        • SHA256 2d9d81e88ecd0e837122f4688ca7a6a5bd7bb41bff6e21ff5d4663eb43372db3
        • MD5 SHA1 SHA512 TLSH

        is-532EJF2PTK.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\dictionaries\en_GB\is-532EJF2PTK.tmp
        • Size 14KB
        • SHA256 df84246204e3c54cd24aebbc23714235f5fc41d754d53b65444a2afbf070130f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-E1N0O2BKUA.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\dictionaries\en_GB\is-E1N0O2BKUA.tmp
        • Size 1KB
        • SHA256 23dbc4f3ea771304e5ab3e5709843813d2619f3c0cfc81229b53fcdb9985f29a
        • MD5 SHA1 SHA512 TLSH

        is-NNG6T36GY7.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\dictionaries\en_US\is-NNG6T36GY7.tmp
        • Size 3KB
        • SHA256 e746c882dd6f303c2c46e7452804b9201115a6942cfeb15f18f8edf774d2e24e
        • MD5 SHA1 SHA512 TLSH

        is-OR40SGNGSG.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\dictionaries\sr_Latn_RS\is-OR40SGNGSG.tmp
        • Size 42KB
        • SHA256 23d426e575567fcc095afb9f26ca3cc3704f1ef4d3656e586d5925c6503d8a0c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        editors.exe

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors.exe
        • Size 2.7MB
        • SHA256 bf5323ec4f0ad13b3ea81fba9c0e3564680dd7d40fde8abe3423989d40d40258
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-6F4LIPXHPX.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{55159EC6-C91A-4DDB-8E1E-558454666461}\licenses\is-6F4LIPXHPX.tmp
        • Size 1KB
        • SHA256 4ee0cbc51370afde358652a0f977972053729ed578b6a42f5e2a037d114f0b39
        • MD5 SHA1 SHA512 TLSH

        is-HJJMHIB4CB.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{55159EC6-C91A-4DDB-8E1E-558454666461}\licenses\is-HJJMHIB4CB.tmp
        • Size 1KB
        • SHA256 f8a99661f40bf7466904a9f7d10261e4da2fa400c8ea73d6f06bf56a7e099548
        • MD5 SHA1 SHA512 TLSH

        is-4S936YLYI5.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{55159EC6-C91A-4DDB-8E1E-558454666461}\vendor\jquery\is-4S936YLYI5.tmp
        • Size 85KB
        • SHA256 fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-TM4L2WHFGG.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{7CDB02C9-A0BF-4B56-9A1A-71C860B8498F}\vendor\select2-4.0.13\css\is-TM4L2WHFGG.tmp
        • Size 16KB
        • SHA256 8f8d8c5f3c475a6dee219b04f96c0caa4cb26de5058f4cf657b24b770e302a0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-1P4XX5ZQUL.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{7CDB02C9-A0BF-4B56-9A1A-71C860B8498F}\vendor\select2-4.0.13\is-1P4XX5ZQUL.tmp
        • Size 7KB
        • SHA256 a42f687b1a4c38ae68c4b3ee54953e1f01c745c0856f5310a9a8b471831a8b71
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-0IGP81X2TC.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{7CDB02C9-A0BF-4B56-9A1A-71C860B8498F}\vendor\select2-4.0.13\js\is-0IGP81X2TC.tmp
        • Size 140KB
        • SHA256 ce2e4ef445cfcd427edabc1bc19a3528a7293a6fde337838deb04f04f2641aed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-1X5TRUFGU2.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{9DC93CDB-B576-4F0C-B55E-FCC9C48DD007}\resources\icons\theme-classic-light\light\is-1X5TRUFGU2.tmp
        • Size 206B
        • SHA256 394110d228ea164493ff1c6331d955ec2b1bca35b21fd612399aede212f5fe51
        • MD5 SHA1 SHA512 TLSH

        is-V9H8WTQY6I.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{9DC93CDB-B576-4F0C-B55E-FCC9C48DD007}\resources\icons\theme-classic-light\light\is-V9H8WTQY6I.tmp
        • Size 210B
        • SHA256 c8db3aabc1797eafc04c0721d201b66821a5eb806ec60af2e9b5511dcc71f760
        • MD5 SHA1 SHA512 TLSH

        is-71SQA3QBRP.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{9DC93CDB-B576-4F0C-B55E-FCC9C48DD007}\resources\icons\theme-default\dark\is-71SQA3QBRP.tmp
        • Size 245B
        • SHA256 b0c7e9b44353f130a259934362dbb95d44f1be03c9ca0a2c7e3495797fff3e1c
        • MD5 SHA1 SHA512 TLSH

        is-FX7FETUJEX.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{9DC93CDB-B576-4F0C-B55E-FCC9C48DD007}\resources\icons\theme-default\dark\is-FX7FETUJEX.tmp
        • Size 162B
        • SHA256 669bd09ea06d339b2e48401ac8f3129be788024934dca5f94a92623fb2636c9f
        • MD5 SHA1 SHA512 TLSH

        is-QQXYV5NGE3.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{9DC93CDB-B576-4F0C-B55E-FCC9C48DD007}\resources\icons\theme-default\dark\is-QQXYV5NGE3.tmp
        • Size 202B
        • SHA256 eaadd91c17752716655edab5dbc8abeb72464890d35f1e585c3ab18fea0c99ad
        • MD5 SHA1 SHA512 TLSH

        is-UEUEUD3ZMY.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{9DC93CDB-B576-4F0C-B55E-FCC9C48DD007}\resources\icons\theme-default\dark\is-UEUEUD3ZMY.tmp
        • Size 179B
        • SHA256 262cdfa17d62d3fb0375e9c690c2cbacab5415fc9dc8801345733ae7ebdf587d
        • MD5 SHA1 SHA512 TLSH

        is-0YTU6S5LMN.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{9DC93CDB-B576-4F0C-B55E-FCC9C48DD007}\resources\icons\theme-default\light\is-0YTU6S5LMN.tmp
        • Size 248B
        • SHA256 95940c265fa16d4684c2bd10a51a7c65b43c3a40676495b641b417e80c0cead6
        • MD5 SHA1 SHA512 TLSH

        is-GI0IPCZXKV.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{9DC93CDB-B576-4F0C-B55E-FCC9C48DD007}\resources\icons\theme-default\light\is-GI0IPCZXKV.tmp
        • Size 159B
        • SHA256 a2a18e953f17f6f6a957bcd1d6c44c382665582787db431fd08c1583a07bde3c
        • MD5 SHA1 SHA512 TLSH

        is-GXG02F24Q5.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{9DC93CDB-B576-4F0C-B55E-FCC9C48DD007}\resources\icons\theme-default\light\is-GXG02F24Q5.tmp
        • Size 195B
        • SHA256 7ad0718181709c5569e13e18d7858b22f3c520c81e5137141c8660b1bdc05400
        • MD5 SHA1 SHA512 TLSH

        is-S4ZO20GIAO.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{9DC93CDB-B576-4F0C-B55E-FCC9C48DD007}\resources\icons\theme-default\light\is-S4ZO20GIAO.tmp
        • Size 176B
        • SHA256 c1b83609a7121588fed95e24864146d12bdce45cdd728b06a2670b7395421ba3
        • MD5 SHA1 SHA512 TLSH

        is-F38RETJW83.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs-plugins\{b78a062b-e349-4634-8a44-99825600d299}\translations\is-F38RETJW83.tmp
        • Size 152B
        • SHA256 1681d1b244d752d55eccea1798938fe39c59f3b548081d33f594a4866664e969
        • MD5 SHA1 SHA512 TLSH

        is-THZK7XIL9Q.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs\slide\themes\theme22\is-THZK7XIL9Q.tmp
        • Size 137B
        • SHA256 c844873a604a79bce6e56849885a02a4e94e8b65db1123f41cb80e857fc9a740
        • MD5 SHA1 SHA512 TLSH

        is-7XYYTRRSDH.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\sdkjs\slide\themes\theme24\media\is-7XYYTRRSDH.tmp
        • Size 84KB
        • SHA256 089828ba3d69490968b6fe597be23e02983ce5e52596486776bcb676b54cfa5b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-1SVCQ18XZK.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\web-apps\apps\common\main\resources\img\doc-formats\is-1SVCQ18XZK.tmp
        • Size 568B
        • SHA256 e111879faa12f8f7bb25965489d0787c270dff10dfac54adac901157cd865b4f
        • MD5 SHA1 SHA512 TLSH

        is-72UATHVOYB.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\web-apps\apps\common\main\resources\img\doc-formats\is-72UATHVOYB.tmp
        • Size 752B
        • SHA256 369695ba2b17931edd46df567d2c8fe7a49c77678c48e8a8d5bad2fc7672f77a
        • MD5 SHA1 SHA512 TLSH

        is-F3788KXUOC.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\web-apps\apps\common\main\resources\img\doc-formats\is-F3788KXUOC.tmp
        • Size 546B
        • SHA256 bc5f5a07b245a961722304296df3b5888fe46e36a84558e0036906800ac65ba9
        • MD5 SHA1 SHA512 TLSH

        is-F7PZUAH0JG.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\web-apps\apps\common\main\resources\img\doc-formats\is-F7PZUAH0JG.tmp
        • Size 991B
        • SHA256 61bd14461a3d1e8f7c7184be2171cf4b2cca8e0b5865f48e884672254b559cb6
        • MD5 SHA1 SHA512 TLSH

        is-KQIML5FYAA.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\web-apps\apps\common\main\resources\img\doc-formats\is-KQIML5FYAA.tmp
        • Size 685B
        • SHA256 bf847c3dd783c4cc73fb42efa3f7cb68d1e589c74b3befa0e99b00498d6af5df
        • MD5 SHA1 SHA512 TLSH

        is-NX96E9EN7O.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\web-apps\apps\common\main\resources\img\doc-formats\is-NX96E9EN7O.tmp
        • Size 521B
        • SHA256 6a3e5b8b9ec727495842c7828bf12efb2a16bf86c67d662377c88899f39a141a
        • MD5 SHA1 SHA512 TLSH

        is-VMXEADWE3N.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\web-apps\apps\common\main\resources\img\doc-formats\is-VMXEADWE3N.tmp
        • Size 862B
        • SHA256 5ae1aacb37f51d75e67c0b7037bdc6143a213ac11f4a17472e402f48e2a9b01f
        • MD5 SHA1 SHA512 TLSH

        is-Y8AX4712WO.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\web-apps\apps\common\main\resources\img\doc-formats\is-Y8AX4712WO.tmp
        • Size 495B
        • SHA256 df450ba2ba179d885fa67833e2817b551c9b6135d9e75080c1323ff649522f2f
        • MD5 SHA1 SHA512 TLSH

        is-LSKUBAJI5O.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\web-apps\apps\presentationeditor\main\is-LSKUBAJI5O.tmp
        • Size 734KB
        • SHA256 6984c483bf6d7610efe882c5b0b7add0aabc5622e110aeb02b2182ec25de9ad1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-179CZXBHZN.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\web-apps\apps\presentationeditor\main\resources\css\is-179CZXBHZN.tmp
        • Size 618KB
        • SHA256 d7063c25442989b74399c829744b923e5931c066d4ec98cb14bcbb3438c81a5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-FYLJY5MSLE.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\web-apps\apps\presentationeditor\main\resources\img\is-FYLJY5MSLE.tmp
        • Size 5KB
        • SHA256 f178a214b054d7267b7bfd38fac29240aee4befb8210b83716d75011becb4b84
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-Z6IUCQ7AKA.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\web-apps\apps\spreadsheeteditor\main\resources\formula-lang\is-Z6IUCQ7AKA.tmp
        • Size 10KB
        • SHA256 f5bb88ac3d5806e3a992e56c3ed567f800fdd0b6843c6dc2cc62b7a306ce559f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-5GWJ0535ZE.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\web-apps\apps\spreadsheeteditor\main\resources\img\v2\is-5GWJ0535ZE.tmp
        • Size 53B
        • SHA256 bcc593c2bf25f16bef6d516916ac2c1d28160a94afa5e494f5408d5d49363bf0
        • MD5 SHA1 SHA512 TLSH

        is-MJTWK5N83G.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\web-apps\apps\spreadsheeteditor\main\resources\symboltable\is-MJTWK5N83G.tmp
        • Size 1KB
        • SHA256 7588f4535becf48fdf352ad813e7fd82b2a5b0ed59b0641da3641b8066425cc0
        • MD5 SHA1 SHA512 TLSH

        is-TY9PGZZQEI.tmp

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors\web-apps\apps\spreadsheeteditor\main\resources\symboltable\is-TY9PGZZQEI.tmp
        • Size 17KB
        • SHA256 627d7ea4db833a43693b0a269cc85ee1094c4da5b6f04a9f838532a370ea0726
        • MD5 SHA1 SHA512 SSDEEP TLSH

        editors_helper.exe

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\editors_helper.exe
        • Size 23KB
        • SHA256 0c25050c56d507a21baf7195f289d2cff77cfba6d670aadd024cbf3d46e946c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qdirect2d.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\platforms\qdirect2d.dll
        • Size 1.5MB
        • SHA256 fe8054677d12eb2bd2ab2c6afd7c3b7eea3844e74a5de6f7f097ee0e2f3aea22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qminimal.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\platforms\qminimal.dll
        • Size 826KB
        • SHA256 bf42c90713d15075b8c369f47c970f6324fca93591f8af4c3f932725e4604551
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qoffscreen.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\platforms\qoffscreen.dll
        • Size 738KB
        • SHA256 716e01ce28f9720692cf5cda55be2bcfc2cfc0a2ca60bb052e50e957676f37c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qwindows.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\platforms\qwindows.dll
        • Size 1.4MB
        • SHA256 47b4c4b66365830ed8154953c854377a213d762668aa9cb76f7a98b82e3eb290
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qxdgdesktopportal.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\platformthemes\qxdgdesktopportal.dll
        • Size 68KB
        • SHA256 fc6c253b1e0f26e1876e1768213caf5b1437afcf34e2c921f6122096ba96d8a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qtascdocumentscore.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\qtascdocumentscore.dll
        • Size 139KB
        • SHA256 cd517af677e9fe3b77eb6ddce32598bee035bbcc25f169a5a9dfedf089ab4936
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qwindowsvistastyle.dll

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\styles\qwindowsvistastyle.dll
        • Size 142KB
        • SHA256 15f13726352d19bae1e2fdc74626bba8af65a7d1c46cc4507a45787edb404d56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        updatesvc.exe

        • Path C:\Program Files\ONLYOFFICE\DesktopEditors\updatesvc.exe
        • Size 618KB
        • SHA256 71bddac50288dabadce7649ef5ad89aa8184817a306d1f10ff80cfb3fce4e37f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        data_2

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\DawnCache\data_2
        • Size 8KB
        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
        • MD5 SHA1 SHA512 SSDEEP

        data_3

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\DawnCache\data_3
        • Size 8KB
        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
        • MD5 SHA1 SHA512 SSDEEP

        data_0

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\GPUCache\data_0
        • Size 8KB
        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
        • MD5 SHA1 SHA512 SSDEEP

        data_1

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\GPUCache\data_1
        • Size 264KB
        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
        • MD5 SHA1 SHA512 SSDEEP

        CURRENT

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\Local Storage\leveldb\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512

        Network Persistent State

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\Network\Network Persistent State
        • Size 627B
        • SHA256 5c91edc4d1572fb76b464b22da281c30eaa464804a69d6e352274f166e5db611
        • MD5 SHA1 SHA512 TLSH

        Network Persistent State~RFe5a2099.TMP

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\Network\Network Persistent State~RFe5a2099.TMP
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH

        MANIFEST-000001

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\Session Storage\MANIFEST-000001
        • Size 41B
        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
        • MD5 SHA1 SHA512

        item1.xml.rels

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_100B.tmp\docx_unpacked\customXml\_rels\item1.xml.rels
        • Size 295B
        • SHA256 4f1adb5b566036d4d6f96db52ddddad6101c53aa3bb073544d5972a340eec6b2
        • MD5 SHA1 SHA512 TLSH

        itemProps1.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_100B.tmp\docx_unpacked\customXml\itemProps1.xml
        • Size 319B
        • SHA256 cba06a744490a6328707df0eb093f129d8a51816c5165e21ba94cdf07df4b466
        • MD5 SHA1 SHA512 TLSH

        main.xml.rels

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_100B.tmp\docx_unpacked\oform\_rels\main.xml.rels
        • Size 213B
        • SHA256 4070b37276a4fd72f15fcdced121dd0597e0b06412fabd5819f24e6c7527f1ac
        • MD5 SHA1 SHA512 TLSH

        main.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_100B.tmp\docx_unpacked\oform\main.xml
        • Size 236B
        • SHA256 1fe59dfb28fba9c1ae32b42288e678c385754a5f60e475b733e073935c04ac7f
        • MD5 SHA1 SHA512 TLSH

        settings.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_100B.tmp\docx_unpacked\word\glossary\settings.xml
        • Size 2KB
        • SHA256 1ba9692a417c09bac23a4d84ac7e5fefe46fdfb70a617d25cde50fede700b0cd
        • MD5 SHA1 SHA512 TLSH

        styles.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_100B.tmp\docx_unpacked\word\glossary\styles.xml
        • Size 628KB
        • SHA256 8b6bb3ff55043a95ddd8518fa52246b9a88358d54e35f9240473c4912c2f8d1f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        image1.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_100B.tmp\docx_unpacked\word\media\image1.png
        • Size 214B
        • SHA256 01346361b7aa52880c61302bf98d367609232791b7a08d4f4ef61fde989ce11c
        • MD5 SHA1 SHA512 TLSH

        settings.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_100B.tmp\docx_unpacked\word\settings.xml
        • Size 2KB
        • SHA256 16b6afbbf839272ff572328efc4aa1fa5b7108561fa6edf310126d4f1c21d8d7
        • MD5 SHA1 SHA512 TLSH

        meta.docx

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_100B.tmp\meta.docx
        • Size 117KB
        • SHA256 c1f7ece8b93d410a1012265af6b109c6bcea89f6bd885eea275ecbc7002301a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        meta.docx

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_1888.tmp\meta.docx
        • Size 135KB
        • SHA256 019b1190192dee99c1ff2f6875d02ac5f11b174bb13ee65415573cf5c0e3e45e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        document.xml.rels

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_1A.tmp\docx_unpacked\word\glossary\_rels\document.xml.rels
        • Size 687B
        • SHA256 f6544353d4f141bf2074563f97af9ad41320cadabee1586c0797888f07170ab5
        • MD5 SHA1 SHA512 TLSH

        settings.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_1A.tmp\docx_unpacked\word\glossary\settings.xml
        • Size 2KB
        • SHA256 2e8f03d664a43539bebd1449af7c80690c175ebe57bfdb9f874a931239b9dc47
        • MD5 SHA1 SHA512 TLSH

        image1.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_1A.tmp\docx_unpacked\word\media\image1.png
        • Size 18KB
        • SHA256 da02d8a6b302a12689bcf07f7170731f8e6ed38627c9a01d954d3d3c2718630a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        header1.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_52C.tmp\docx_unpacked\word\header1.xml
        • Size 1KB
        • SHA256 72d64aed1cd1d278294e5ce4b9406d26f774612ffa975783570054e30047bebd
        • MD5 SHA1 SHA512 TLSH

        image1.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_52C.tmp\docx_unpacked\word\media\image1.png
        • Size 86KB
        • SHA256 e51bfa07f6fd589bb5af80940894c4dd217e77d6e53ea1b9c235230f626f6240
        • MD5 SHA1 SHA512 SSDEEP TLSH

        image4.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_52C.tmp\docx_unpacked\word\media\image4.png
        • Size 10KB
        • SHA256 258ec733d6d1f0f638e1458e09057f32d58f80c541f440c61530df69246f8019
        • MD5 SHA1 SHA512 SSDEEP TLSH

        image6.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_52C.tmp\docx_unpacked\word\media\image6.png
        • Size 19KB
        • SHA256 8a88ffb71fc9690f7ccd27c4f4573ddb9362ce4a596d0d578717ee6b3b7f400a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fieldMaster45.xml.rels

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_AE9.tmp\docx_unpacked\oform\fieldMasters\_rels\fieldMaster45.xml.rels
        • Size 216B
        • SHA256 f39c154add76098ac96828374f94e496c71108456cdbf6a13a75d95f040dd0e0
        • MD5 SHA1 SHA512 TLSH

        fieldMaster7.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_AE9.tmp\docx_unpacked\oform\fieldMasters\fieldMaster7.xml
        • Size 222B
        • SHA256 f5e35c7c9677282832f9beef2eb2ec619f3191c0bc387aedba457b0f8d5f702a
        • MD5 SHA1 SHA512 TLSH

        meta.docx

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_AE9.tmp\meta.docx
        • Size 95KB
        • SHA256 8be7334bf34615d405d8479efddafdce85149bd4faeab275f8ddae9073107d86
        • MD5 SHA1 SHA512 SSDEEP TLSH

        footnotes.xml.rels

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_BCED.tmp\docx_unpacked\word\glossary\_rels\footnotes.xml.rels
        • Size 155B
        • SHA256 5a2d586f932fb1d244771719792d87d11d1070a07b38fe433ecb746b376285cb
        • MD5 SHA1 SHA512 TLSH

        endnotes.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_BCED.tmp\docx_unpacked\word\glossary\endnotes.xml
        • Size 1KB
        • SHA256 314490d8efae465140d01efc4671c8dd4310b2a4da88657f89fd53372c993d5f
        • MD5 SHA1 SHA512 TLSH

        footnotes.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_BCED.tmp\docx_unpacked\word\glossary\footnotes.xml
        • Size 1KB
        • SHA256 3329a4181c1ab7a87a0f1084b986c66d9c4eda8e7df72cbfd7147ec0b45b850d
        • MD5 SHA1 SHA512 TLSH

        image1.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_BCED.tmp\docx_unpacked\word\media\image1.png
        • Size 1.1MB
        • SHA256 e1363de054bbeb4f4ba1f412dcad80e4c34fe8c023c889707fc2f151c66dcc1b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        webSettings.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_BCED.tmp\docx_unpacked\word\webSettings.xml
        • Size 183B
        • SHA256 a04f5c27ac024c4601ef7b14278703970b61337371966c5e615b4b08b245fc3c
        • MD5 SHA1 SHA512 TLSH

        .rels

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_D181.tmp\docx_unpacked\_rels\.rels
        • Size 592B
        • SHA256 12291e581c5c69fb71713c664fb83d19372dba96f083e9a2e8e17087e8416882
        • MD5 SHA1 SHA512 TLSH

        document.xml.rels

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_D181.tmp\docx_unpacked\word\glossary\_rels\document.xml.rels
        • Size 953B
        • SHA256 93340e003c3303e370eec8550f839ad5d85ec4d3c8242da01346bafe0d6a63c9
        • MD5 SHA1 SHA512 TLSH

        fontTable.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_D181.tmp\docx_unpacked\word\glossary\fontTable.xml
        • Size 753B
        • SHA256 b31f067700ba5afe416be93dfba09af72b1f99af11033f8bdd2fd20a2fb6c805
        • MD5 SHA1 SHA512 TLSH

        styles.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_D181.tmp\docx_unpacked\word\glossary\styles.xml
        • Size 625KB
        • SHA256 38fb0080d576131b43a36326247ba9daaa04c4eff6a069f9a9bbaed5587b33a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        image1.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_D181.tmp\docx_unpacked\word\media\image1.png
        • Size 958KB
        • SHA256 7789cc6841d060f9e708e6e0c7cc445a4965d924dc526c3afae0952a3c469074
        • MD5 SHA1 SHA512 SSDEEP TLSH

        image2.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_D181.tmp\docx_unpacked\word\media\image2.png
        • Size 11KB
        • SHA256 740908bf6484ee6b84d9b77f3584eba182207d1ab3d816fcf8baf332f88a76a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        image3.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_D181.tmp\docx_unpacked\word\media\image3.png
        • Size 43KB
        • SHA256 1553b530c27c8248628b21795b5eba930bc18e2a0053e9b3c9f28a0e7276a220
        • MD5 SHA1 SHA512 SSDEEP TLSH

        settings.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_D181.tmp\docx_unpacked\word\settings.xml
        • Size 2KB
        • SHA256 9cc2edce30e6bc6e42a795d50047c167cfd8c20cc06a639c94b9a1f24628e2ce
        • MD5 SHA1 SHA512 TLSH

        styles.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_D181.tmp\docx_unpacked\word\styles.xml
        • Size 625KB
        • SHA256 4faab47afc37ad39032b3cea4f3ee52279683a4b042688ccf3ece848da4ef829
        • MD5 SHA1 SHA512 SSDEEP TLSH

        theme1.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_D181.tmp\docx_unpacked\word\theme\theme1.xml
        • Size 4KB
        • SHA256 1593a26b0625211382a2900fbda7ef39378fd603140e23ba15ff5758942f552f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_DD0B.tmp\docx_unpacked\docProps\app.xml
        • Size 483B
        • SHA256 6bfd3fd3a664fb1deefb9fb2328817ca5587f47bd599164d948aad7d7e36d599
        • MD5 SHA1 SHA512 TLSH

        settings.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_DD0B.tmp\docx_unpacked\word\glossary\settings.xml
        • Size 2KB
        • SHA256 cc54f7f236389b8a13591d944cc14995cc2b8c3da4b441038345eefb684e2249
        • MD5 SHA1 SHA512 TLSH

        image1.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_DD0B.tmp\docx_unpacked\word\media\image1.png
        • Size 24KB
        • SHA256 f510bf0600cd29d0973b5fecadf2e38d2ba31b8df4b25e36d18a441822acb110
        • MD5 SHA1 SHA512 SSDEEP TLSH

        image2.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_DD0B.tmp\docx_unpacked\word\media\image2.png
        • Size 9KB
        • SHA256 5dfdffa3023b87032a2c21c67007d57eaddbef76837fd52aca809f14b6cbd36a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        image3.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_DD0B.tmp\docx_unpacked\word\media\image3.png
        • Size 11KB
        • SHA256 19acbccca4c807a0d3e7507b5997784a6c185fe17920976f0af77f01af632ac7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        image4.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_DD0B.tmp\docx_unpacked\word\media\image4.png
        • Size 12KB
        • SHA256 d1e5946baef698aa105e59146d4b8f497d7579f97e912f3faf1f6f7f96508ab0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_E8F3.tmp\docx_unpacked\docProps\app.xml
        • Size 484B
        • SHA256 3eb738bf3d0ef9b65befcac78e87dbe78fa88aa1525118ac5b594952ac139a2f
        • MD5 SHA1 SHA512 TLSH

        image1.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_E8F3.tmp\docx_unpacked\word\media\image1.png
        • Size 1.4MB
        • SHA256 07d7f776bb8d73f5f3dadaa6bb3e73cd0692c73795c20528d2514270ce94f117
        • MD5 SHA1 SHA512 SSDEEP TLSH

        [Content_Types].xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_ED3A.tmp\docx_unpacked\[Content_Types].xml
        • Size 2KB
        • SHA256 c55888ff3b584afd431e856058ba5147e0137bb522baf55f24985705f842508c
        • MD5 SHA1 SHA512 TLSH

        image1.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_ED3A.tmp\docx_unpacked\word\media\image1.png
        • Size 319KB
        • SHA256 8deedd9deeaa33bdfecab336f7d3af83b416743e2048f9a184b68191af914315
        • MD5 SHA1 SHA512 SSDEEP TLSH

        image2.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_ED3A.tmp\docx_unpacked\word\media\image2.png
        • Size 22KB
        • SHA256 791d93a3953a8fc331842e5d3b0faaaf9389791049addfc33b36dfc1ff19557d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        endnotes.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_F20D.tmp\docx_unpacked\word\endnotes.xml
        • Size 1KB
        • SHA256 5772eaf8382f7fa24f66395b1490c50da78d78145a9e8ca692b6a6a21194cae8
        • MD5 SHA1 SHA512 TLSH

        footnotes.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_F20D.tmp\docx_unpacked\word\footnotes.xml
        • Size 1KB
        • SHA256 d208db39abd5917a12fec5ff71fbca4b6dcf84baaa62237eaf950e0fe73f890f
        • MD5 SHA1 SHA512 TLSH

        settings.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_F5E6.tmp\docx_unpacked\word\glossary\settings.xml
        • Size 2KB
        • SHA256 879c369236ee555cec970c9f72dabe0f680e2e0f31c4670c4e6bd54ad2e6e2f1
        • MD5 SHA1 SHA512 TLSH

        image1.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_F5E6.tmp\docx_unpacked\word\media\image1.png
        • Size 7KB
        • SHA256 efa37885defd63044bf819c4e76783eecae7879f0554d379a700023938c132d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        image2.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_F5E6.tmp\docx_unpacked\word\media\image2.png
        • Size 9KB
        • SHA256 f6ba38e7495f7454efc6973dd46fe62ae257381215e24e52b06b4ff6d0ee3b36
        • MD5 SHA1 SHA512 SSDEEP TLSH

        image3.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_F5E6.tmp\docx_unpacked\word\media\image3.png
        • Size 7KB
        • SHA256 cbccdf6a53c16148e11da46ff10d61f1841debe1135892fe9e279c9db800bd3d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        image4.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_F5E6.tmp\docx_unpacked\word\media\image4.png
        • Size 7KB
        • SHA256 a58ebfb6f6282f197cc066b0a9aefcb15c58c20a65dec08cc5f0034464bfe01b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        image5.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_F5E6.tmp\docx_unpacked\word\media\image5.png
        • Size 11KB
        • SHA256 5eec387a1dcffa72c8376ed0ac14b577d698ede0dfba9445095e2574a8972365
        • MD5 SHA1 SHA512 SSDEEP TLSH

        document.xml.rels

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_FBC3.tmp\docx_unpacked\word\_rels\document.xml.rels
        • Size 1KB
        • SHA256 48330d67d8d2752297947c5024c320d942c93e0a2b5bb022f4ac2b7754e665e1
        • MD5 SHA1 SHA512 TLSH

        image1.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_FBC3.tmp\docx_unpacked\word\media\image1.png
        • Size 105KB
        • SHA256 9b2b613e70188ea6f53635e2891f58a36886d0068e8fcd9fab071df56aaace99
        • MD5 SHA1 SHA512 SSDEEP TLSH

        image4.png

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\cache\work_temp\T_FBC3.tmp\docx_unpacked\word\media\image4.png
        • Size 7KB
        • SHA256 948874df8e1c67ddf4081ffefc1d9c763ffaa4d56396e764a4a9c08d91700901
        • MD5 SHA1 SHA512 SSDEEP TLSH

        plugins.css

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\sdkjs-plugins\v1\plugins.css
        • Size 16KB
        • SHA256 d0fabc8d79c8c4fa677f399df7e433dea1c7f77bf33e0653c530b55367e08abd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        settings.xml

        • Path C:\Users\Admin\AppData\Local\ONLYOFFICE\DesktopEditors\data\settings.xml
        • Size 51B
        • SHA256 d60fe88f2f60db6bcf983774b4a4fe89e3a45e502fc59b38834cbc96aa6559cc
        • MD5 SHA1 SHA512 TLSH

        DesktopEditors_x64.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-6BKRXQYYUT.tmp\DesktopEditors_x64.tmp
        • Size 4.9MB
        • SHA256 cb75f2e23aa086fae8dbd802a8f8cb5f07f129b056ac9e62c58d78a3c35b0415
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2224-11308-0x00000211D8E80000-0x00000211D8FED000-memory.dmp

        memory/2224-10530-0x00007FF957630000-0x00007FF957B71000-memory.dmp

        memory/2224-14614-0x00000211D8E80000-0x00000211D8FED000-memory.dmp

        memory/2224-12333-0x00000211D8E80000-0x00000211D8FED000-memory.dmp

        memory/2252-10477-0x00007FF957630000-0x00007FF957B71000-memory.dmp

        memory/2252-10487-0x00000229E7E50000-0x00000229E8416000-memory.dmp

        memory/3240-7-0x0000000000400000-0x0000000000506000-memory.dmp

        memory/3240-10534-0x0000000000400000-0x0000000000506000-memory.dmp

        memory/3240-0-0x0000000000400000-0x0000000000506000-memory.dmp

        memory/4120-10483-0x000001C70A720000-0x000001C70ACE6000-memory.dmp

        memory/4120-10465-0x00007FF957630000-0x00007FF957B71000-memory.dmp

        memory/4476-10531-0x000001DE1F4C0000-0x000001DE1FA86000-memory.dmp

        memory/4476-10499-0x00007FF957630000-0x00007FF957B71000-memory.dmp

        memory/4772-10533-0x0000000000400000-0x0000000000911000-memory.dmp

        memory/4772-750-0x0000000000400000-0x0000000000911000-memory.dmp

        memory/4772-38-0x0000000000400000-0x0000000000911000-memory.dmp

        memory/4772-8-0x0000000000400000-0x0000000000911000-memory.dmp

        memory/4772-9-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

        memory/4772-2584-0x0000000000400000-0x0000000000911000-memory.dmp

        memory/4772-5-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

        memory/4772-7414-0x0000000000400000-0x0000000000911000-memory.dmp

        memory/4772-10492-0x0000000000400000-0x0000000000911000-memory.dmp