hxxps://drive[.]google[.]com/file/d/1U9IrbnOFqCWV2HSl64GZlaRWzJxkWtuk/view?usp=drive_link

Analysis

user interaction
yes
max time kernel
1049s
max time network
1028s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/file/d/1U9IrbnOFqCWV2HSl64GZlaRWzJxkWtuk/view?usp=drive_link
Sample260910-vrtqgaem7v

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
2556	update_service.exe
4812	update_service.exe
2812	swriter.exe
4864	soffice.exe
4860	soffice.bin
1648	soffice.bin

Loads dropped DLL 64 IoCs

pid	Process
2784	MsiExec.exe
2784	MsiExec.exe
2784	MsiExec.exe
2784	MsiExec.exe
2784	MsiExec.exe
2784	MsiExec.exe
3404	MsiExec.exe
3404	MsiExec.exe
3404	MsiExec.exe
3404	MsiExec.exe
3404	MsiExec.exe
4148	msiexec.exe
4148	msiexec.exe
3804	MsiExec.exe
2556	update_service.exe
2556	update_service.exe
2556	update_service.exe
3804	MsiExec.exe
4192	regsvr32.exe
4192	regsvr32.exe
4192	regsvr32.exe
2472	regsvr32.exe
2472	regsvr32.exe
2472	regsvr32.exe
2472	regsvr32.exe
4812	update_service.exe
4812	update_service.exe
4812	update_service.exe
3404	MsiExec.exe
3404	MsiExec.exe
3256	Process not Found
3256	Process not Found
2812	swriter.exe
2812	swriter.exe
2812	swriter.exe
4864	soffice.exe
4864	soffice.exe
4864	soffice.exe
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin
4860	soffice.bin

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
220	2692	msiexec.exe
225	2692	msiexec.exe
226	2692	msiexec.exe
228	2692	msiexec.exe
229	2692	msiexec.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	drive.google.com
12	drive.google.com
20	drive.google.com
137	drive.google.com
138	drive.google.com
7	drive.google.com

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\Desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 53 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140_threads.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\sc_formatcelldialog.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\ta\help.db_	msiexec.exe
File created	C:\Program Files\LibreOffice\program\soffice.ini	msiexec.exe
File created	C:\Program Files\LibreOffice\share\dtd\officedocument\1_0\libraries.dtd	msiexec.exe
File created	C:\Program Files\LibreOffice\share\registry\res\fcfg_langpack_es.xcd	msiexec.exe
File created	C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\toolbar\optimizetablebar.xml	msiexec.exe
File created	C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\ui\toxentrywidget.ui	msiexec.exe
File created	C:\Program Files\LibreOffice\share\template\common\presnt\Vivid.otp	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\svx\res\fwbuttn1.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\helpimg\starmath\fu21510.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\program\python-core-3.13.15\lib\concurrent\__init__.py	msiexec.exe
File created	C:\Program Files\LibreOffice\program\python-core-3.13.15\lib\encodings\shift_jis.py	msiexec.exe
File created	C:\Program Files\LibreOffice\program\python-core-3.13.15\lib\xml\dom\minidom.py	msiexec.exe
File created	C:\Program Files\LibreOffice\program\classes\officebean.jar	msiexec.exe
File created	C:\Program Files\LibreOffice\program\python-core-3.13.15\lib\pip\_vendor\resolvelib\resolvers\__init__.py	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\gug\help.key_	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\kok\help.ht_	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\vi\help.tree	msiexec.exe
File created	C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sglobal\toolbar\graffilterbar.xml	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\lc_testmode.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\sc_versiondialog.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\share\Scripts\python\LibreLogo\LibreLogo_tl.properties	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\qtz\help.tree	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\lc_showrow.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\program\python-core-3.13.15\lib\encodings\shift_jis_2004.py	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\gd\help.jar	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\nn\help.ht_	msiexec.exe
File created	C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\dbreport\ui\floatingfield.ui	msiexec.exe
File created	C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\ui\renameobjectdialog.ui	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\32\entergroup.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\nlpsolver\description-or.txt	msiexec.exe
File created	C:\Program Files\LibreOffice\program\resource\en_ZA\LC_MESSAGES\avmedia.mo	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\32\jumpdownthislevel.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\sw\res\sidebar\pageproppanel\documentsizeC5_24x24.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\share\basic\ScriptForge\SF_FileSystem.xba	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\dict-en\README_hyph_en_GB.txt	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\dict-es\es_PH.aff	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\or\help.idxl\segments_3	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\32\mergetable.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\sc_shownote.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\program\python-core-3.13.15\lib\multiprocessing\util.py	msiexec.exe
File created	C:\Program Files\LibreOffice\share\config\soffice.cfg\cui\ui\galleryfilespage.ui	msiexec.exe
File created	C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\scalc\popupmenu\row_operations.xml	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\res\recentdoc_remove_highlighted.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\share\basic\ScriptForge\po\fr.po	msiexec.exe
File created	C:\Program Files\LibreOffice\program\python-core-3.13.15\lib\pty.py	msiexec.exe
File created	C:\Program Files\LibreOffice\share\registry\Langpack-uk.xcd	msiexec.exe
File created	C:\Program Files\LibreOffice\program\wizards\ui\UnoDialog2.py	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\km\sc_underlinedouble.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\sc_toggleobjectrotatemode.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\sc_zoomobjects.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\fy.done	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\32\de\numberformatincdecimals.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\helpimg\starmath\bi21329.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\lc_flowchartshapes.flowchart-off-page-connector.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\screenshots\cui\ui\optasianpage\OptAsianPage.png	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\qtz.done	msiexec.exe
File created	C:\Program Files\LibreOffice\share\config\soffice.cfg\uui\ui\simplenameclash.ui	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\32\charmapcontrol.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\32\objectcatalog.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\cmd\sc_graphicfilterremovenoise.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\help\media\icon-themes\svx\res\marker-rectplus11-2.svg	msiexec.exe
File created	C:\Program Files\LibreOffice\share\extensions\nlpsolver\description-km.txt	msiexec.exe
File created	C:\Program Files\LibreOffice\share\basic\SFDatabases\SF_Datasheet.xba	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\DejaVuMathTeXGyre.ttf	msiexec.exe
File created	C:\Windows\Fonts\LinLibertine_R_G.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoSansArmenian-Regular.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoSerifHebrew-Regular.ttf	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI466B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Fonts\MiriamCLM-Bold.otf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansCondensed-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\LiberationSansNarrow-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoKufiArabic-Regular.ttf	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bd984.msi	msiexec.exe
File created	C:\Windows\Fonts\Amiri-Italic.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansMono-Oblique.ttf	msiexec.exe
File created	C:\Windows\Fonts\LiberationSerif-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\Rubik-Italic.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\VVALZJRI\policy.1.0.cli_cppuhelper.dll	msiexec.exe
File created	C:\Windows\Fonts\MiriamMonoCLM-BoldOblique.ttf	msiexec.exe
File created	C:\Windows\Fonts\LinBiolinum_R_G.ttf	msiexec.exe
File created	C:\Windows\Fonts\FrankRuhlHofshi-Bold.otf	msiexec.exe
File created	C:\Windows\Fonts\NotoNaskhArabic-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoSansHebrew-Regular.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\TPY1GL19\policy.1.0.cli_ure.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Fonts\Amiri-BoldItalic.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerif-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\LiberationSansNarrow-Regular.ttf	msiexec.exe
File created	C:\Windows\Fonts\ReemKufi.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\5HQ420JH\policy.1.0.cli_basetypes.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\XSXB6PG4\H02FLD41	msiexec.exe
File created	C:\Windows\Fonts\Amiri-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\FrankRuehlCLM-MediumOblique.otf	msiexec.exe
File created	C:\Windows\Fonts\MiriamMonoCLM-Book.ttf	msiexec.exe
File created	C:\Windows\Fonts\LinBiolinum_RI_G.ttf	msiexec.exe
File created	C:\Windows\Fonts\MiriamLibre-Regular.otf	msiexec.exe
File created	C:\Windows\Fonts\Scheherazade-Regular.ttf	msiexec.exe
File created	C:\Windows\Fonts\FrankRuehlCLM-Bold.otf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSans-BoldOblique.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoSansLisu-Regular.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\CEP32M87\cli_basetypes.dll	msiexec.exe
File created	C:\Windows\Fonts\Carlito-Regular.ttf	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE387.tmp	msiexec.exe
File created	C:\Windows\Fonts\AmiriQuran.ttf	msiexec.exe
File created	C:\Windows\Fonts\NachlieliCLM-Light.otf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerifCondensed-BoldItalic.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoSansHebrew-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\Caladea-Italic.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoSansGeorgian-Bold.ttf	msiexec.exe
File created	C:\Windows\assembly\pubpol34.dat	msiexec.exe
File created	C:\Windows\Fonts\opens___.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansMono-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\LiberationMono-Italic.ttf	msiexec.exe
File created	C:\Windows\assembly\pubpol32.dat	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol33.dat	msiexec.exe
File created	C:\Windows\Fonts\FrankRuehlCLM-Medium.otf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerif.ttf	msiexec.exe
File created	C:\Windows\Fonts\LiberationMono-Regular.ttf	msiexec.exe
File created	C:\Windows\Fonts\LinLibertine_DR_G.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoSerifArmenian-Regular.ttf	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF994.tmp	msiexec.exe
File created	C:\Windows\Fonts\Alef-Regular.ttf	msiexec.exe
File created	C:\Windows\Fonts\MiriamMonoCLM-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\LinLibertine_RZI_G.ttf	msiexec.exe
File created	C:\Windows\Fonts\Rubik-Regular.ttf	msiexec.exe
File created	C:\Windows\Fonts\NotoSerifLao-Bold.ttf	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1932	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335340397826171"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6102E7C5DF8355842AC7F3ED297013A9\gm_Langpack_Draw_gu = "\x06gm_Langpack_r_gu"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Tga	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.sxi\shellex\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6102E7C5DF8355842AC7F3ED297013A9\gm_Langpack_Basis_xh = "\x06gm_Langpack_r_xh"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{30A2652A-DDF7-45e7-ACA6-3EAB26FC8A4E}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E5A0B632-DFBA-4549-9346-E414DA06E6F8}\DataFormats\GetSet	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Wmf\shell\print	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\soffice.StarImpressTemplate.6\shell\new\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6102E7C5DF8355842AC7F3ED297013A9\gm_Langpack_Draw_id = "\x06gm_Langpack_r_id"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.CalcDocument.1\shellex\PropertySheetHandlers	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.stw\OpenWithProgIDs	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\LibreOffice.Eps\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Lwp\shell\ = "open"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Tga\shell\new\command\ = "\"C:\\Program Files\\LibreOffice\\program\\sdraw.exe\" -n \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Vsd\shell\printto\command\ = "\"C:\\Program Files\\LibreOffice\\program\\sdraw.exe\" -pt \"%2\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarDrawTemplate.6\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6102E7C5DF8355842AC7F3ED297013A9\gm_Langpack_Base_uk = "gm_Langpack_r_uk"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{7B342DC4-139A-4a46-8A93-DB0827CCEE9C}\AuxUserType\3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Pbm\DefaultIcon\ = "C:\\Program Files\\LibreOffice\\program\\soffice.bin,5"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Pct\DefaultIcon\ = "C:\\Program Files\\LibreOffice\\program\\soffice.bin,5"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Uos\DefaultIcon\ = "C:\\Program Files\\LibreOffice\\program\\soffice.bin,3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Webp\shell\print\command\ = "\"C:\\Program Files\\LibreOffice\\program\\sdraw.exe\" -p \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6102E7C5DF8355842AC7F3ED297013A9\gm_Helppack_r_dz = "gm_Helppack_Helproot"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6102E7C5DF8355842AC7F3ED297013A9\gm_Langpack_Fonts_lt = "\x06gm_Langpack_r_lt"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6102E7C5DF8355842AC7F3ED297013A9\gm_Langpack_Brand_ss = "\x06gm_Langpack_r_ss"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D0484DE6-AAEE-468a-991F-8D4B0737B57A}\verb\-1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\LibreOffice.ImpressDocument.1\shell\show	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Potx\shell\print\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Writer.Application	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6102E7C5DF8355842AC7F3ED297013A9\gm_r_Reg_Docm = "gm_p_Wrt_MSO_Reg"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6102E7C5DF8355842AC7F3ED297013A9\gm_Langpack_Calc_ja = "gm_Langpack_r_ja"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6102E7C5DF8355842AC7F3ED297013A9\gm_Langpack_r_sd = "\x06gm_Langpack_Languageroot"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Pptx\AppUserModelID = "TheDocumentFoundation.LibreOffice.Impress"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Tif\AppUserModelID = "TheDocumentFoundation.LibreOffice.Draw"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Xlsm\AppUserModelID = "TheDocumentFoundation.LibreOffice.Calc"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Tif\shell\print	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Vst\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\soffice.StarDrawDocument.6\Insertable	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6102E7C5DF8355842AC7F3ED297013A9\gm_Langpack_Fonts_eu = "\x06gm_Langpack_r_eu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6102E7C5DF8355842AC7F3ED297013A9\gm_Langpack_Basis_mni = "\x06gm_Langpack_r_mni"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpeg\OpenWithProgids\LibreOffice.Jpeg = " "	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Vsdm\AppUserModelID = "TheDocumentFoundation.LibreOffice.Draw"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\LibreOffice.Wpg\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\LibreOffice.Xlt\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6102E7C5DF8355842AC7F3ED297013A9\gm_Helppack_Help_hsb = "gm_Helppack_r_hsb"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6102E7C5DF8355842AC7F3ED297013A9\gm_Langpack_Impress_pa_IN = "\x06gm_Langpack_r_pa_IN"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fodt\ = "LibreOffice.WriterDocument.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dbf	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Uos	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6102E7C5DF8355842AC7F3ED297013A9\gm_Helppack_r_pa_IN = "gm_Helppack_Helproot"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6102E7C5DF8355842AC7F3ED297013A9\gm_Helppack_r_zh_CN = "gm_Helppack_Helproot"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.DrawDocument.1\shellex\PropertySheetHandlers\MyPropSheet1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.CalcTemplate.1\FullDetails = "prop:System.PropGroup.Description;System.Title;System.Author;System.Subject;System.Keywords;System.Comment;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.Size;System.DateCreated;System.DateModified;System.FileAttributes;System.ComputerName"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Uot\AppUserModelID = "TheDocumentFoundation.LibreOffice.Writer"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Tga\shell\print\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7B342DC4-139A-4a46-8A93-DB0827CCEE9C}\DataFormats\GetSet\0\ = "Embed Source,1,8,1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E5A0B632-DFBA-4549-9346-E414DA06E6F8}\verb\0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Bmp\shell\printto\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Pbm\shell\ = "open"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\soffice.StarCalcTemplate.6\shell\printto\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D0484DE6-AAEE-468a-991F-8D4B0737B57A}\ = "OpenOffice.org 1.1 Formula"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.otg	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xbm\OpenWithProgIDs	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LibreOffice.Jpeg\shell\print\command\ = "\"C:\\Program Files\\LibreOffice\\program\\sdraw.exe\" -p \"%1\""	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1648	soffice.bin

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
4148	msiexec.exe
4148	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2692	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2692	msiexec.exe
Token: SeSecurityPrivilege	4148	msiexec.exe
Token: SeCreateTokenPrivilege	2692	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2692	msiexec.exe
Token: SeLockMemoryPrivilege	2692	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2692	msiexec.exe
Token: SeMachineAccountPrivilege	2692	msiexec.exe
Token: SeTcbPrivilege	2692	msiexec.exe
Token: SeSecurityPrivilege	2692	msiexec.exe
Token: SeTakeOwnershipPrivilege	2692	msiexec.exe
Token: SeLoadDriverPrivilege	2692	msiexec.exe
Token: SeSystemProfilePrivilege	2692	msiexec.exe
Token: SeSystemtimePrivilege	2692	msiexec.exe
Token: SeProfSingleProcessPrivilege	2692	msiexec.exe
Token: SeIncBasePriorityPrivilege	2692	msiexec.exe
Token: SeCreatePagefilePrivilege	2692	msiexec.exe
Token: SeCreatePermanentPrivilege	2692	msiexec.exe
Token: SeBackupPrivilege	2692	msiexec.exe
Token: SeRestorePrivilege	2692	msiexec.exe
Token: SeShutdownPrivilege	2692	msiexec.exe
Token: SeDebugPrivilege	2692	msiexec.exe
Token: SeAuditPrivilege	2692	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2692	msiexec.exe
Token: SeChangeNotifyPrivilege	2692	msiexec.exe
Token: SeRemoteShutdownPrivilege	2692	msiexec.exe
Token: SeUndockPrivilege	2692	msiexec.exe
Token: SeSyncAgentPrivilege	2692	msiexec.exe
Token: SeEnableDelegationPrivilege	2692	msiexec.exe
Token: SeManageVolumePrivilege	2692	msiexec.exe
Token: SeImpersonatePrivilege	2692	msiexec.exe
Token: SeCreateGlobalPrivilege	2692	msiexec.exe
Token: SeCreateTokenPrivilege	2692	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2692	msiexec.exe
Token: SeLockMemoryPrivilege	2692	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2692	msiexec.exe
Token: SeMachineAccountPrivilege	2692	msiexec.exe
Token: SeTcbPrivilege	2692	msiexec.exe
Token: SeSecurityPrivilege	2692	msiexec.exe
Token: SeTakeOwnershipPrivilege	2692	msiexec.exe
Token: SeLoadDriverPrivilege	2692	msiexec.exe
Token: SeSystemProfilePrivilege	2692	msiexec.exe
Token: SeSystemtimePrivilege	2692	msiexec.exe
Token: SeProfSingleProcessPrivilege	2692	msiexec.exe
Token: SeIncBasePriorityPrivilege	2692	msiexec.exe
Token: SeCreatePagefilePrivilege	2692	msiexec.exe
Token: SeCreatePermanentPrivilege	2692	msiexec.exe
Token: SeBackupPrivilege	2692	msiexec.exe
Token: SeRestorePrivilege	2692	msiexec.exe
Token: SeShutdownPrivilege	2692	msiexec.exe
Token: SeDebugPrivilege	2692	msiexec.exe
Token: SeAuditPrivilege	2692	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2692	msiexec.exe
Token: SeChangeNotifyPrivilege	2692	msiexec.exe
Token: SeRemoteShutdownPrivilege	2692	msiexec.exe
Token: SeUndockPrivilege	2692	msiexec.exe
Token: SeSyncAgentPrivilege	2692	msiexec.exe
Token: SeEnableDelegationPrivilege	2692	msiexec.exe
Token: SeManageVolumePrivilege	2692	msiexec.exe
Token: SeImpersonatePrivilege	2692	msiexec.exe
Token: SeCreateGlobalPrivilege	2692	msiexec.exe
Token: SeCreateTokenPrivilege	2692	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2692	msiexec.exe
Token: SeLockMemoryPrivilege	2692	msiexec.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
2692	msiexec.exe
2692	msiexec.exe
1648	soffice.bin
1648	soffice.bin

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2468	1404	msedge.exe	86
PID 1404 wrote to memory of 1932	1404	msedge.exe	87
PID 1404 wrote to memory of 3340	1404	msedge.exe	88
PID 1404 wrote to memory of 3340	1404	msedge.exe	88
PID 1404 wrote to memory of 3340	1404	msedge.exe	88
PID 1404 wrote to memory of 5056	1404	msedge.exe	90
PID 1404 wrote to memory of 5056	1404	msedge.exe	90
PID 1404 wrote to memory of 2860	1404	msedge.exe	91
PID 1404 wrote to memory of 2860	1404	msedge.exe	91
PID 1404 wrote to memory of 2860	1404	msedge.exe	91
PID 1404 wrote to memory of 4664	1404	msedge.exe	92
PID 1404 wrote to memory of 4664	1404	msedge.exe	92
PID 1404 wrote to memory of 4664	1404	msedge.exe	92
PID 1404 wrote to memory of 2980	1404	msedge.exe	93
PID 1404 wrote to memory of 2980	1404	msedge.exe	93
PID 1404 wrote to memory of 2980	1404	msedge.exe	93
PID 1404 wrote to memory of 1728	1404	msedge.exe	94
PID 1404 wrote to memory of 1728	1404	msedge.exe	94
PID 1404 wrote to memory of 1728	1404	msedge.exe	94
PID 1404 wrote to memory of 2076	1404	msedge.exe	98
PID 1404 wrote to memory of 4956	1404	msedge.exe	99
PID 1404 wrote to memory of 2076	1404	msedge.exe	98
PID 1404 wrote to memory of 4956	1404	msedge.exe	99
PID 1404 wrote to memory of 5072	1404	msedge.exe	101
PID 1404 wrote to memory of 784	1404	msedge.exe	102
PID 1404 wrote to memory of 784	1404	msedge.exe	102
PID 1404 wrote to memory of 784	1404	msedge.exe	102
PID 1404 wrote to memory of 1452	1404	msedge.exe	104
PID 1404 wrote to memory of 536	1404	msedge.exe	103
PID 1404 wrote to memory of 1452	1404	msedge.exe	104
PID 1404 wrote to memory of 4068	1404	msedge.exe	116
PID 1404 wrote to memory of 4028	1404	msedge.exe	117
PID 1404 wrote to memory of 1396	1404	msedge.exe	118
PID 1404 wrote to memory of 2888	1404	msedge.exe	120
PID 1404 wrote to memory of 2888	1404	msedge.exe	120
PID 1404 wrote to memory of 1860	1404	msedge.exe	122
PID 1404 wrote to memory of 4020	1404	msedge.exe	123
PID 1404 wrote to memory of 4020	1404	msedge.exe	123
PID 1404 wrote to memory of 4020	1404	msedge.exe	123
PID 1404 wrote to memory of 3812	1404	msedge.exe	124
PID 1404 wrote to memory of 3812	1404	msedge.exe	124
PID 1404 wrote to memory of 3812	1404	msedge.exe	124
PID 1404 wrote to memory of 4960	1404	msedge.exe	125
PID 1404 wrote to memory of 4960	1404	msedge.exe	125
PID 1404 wrote to memory of 2568	1404	msedge.exe	126
PID 1404 wrote to memory of 2568	1404	msedge.exe	126
PID 1404 wrote to memory of 2568	1404	msedge.exe	126
PID 1404 wrote to memory of 2216	1404	msedge.exe	127
PID 1404 wrote to memory of 1860	1404	msedge.exe	128
PID 1404 wrote to memory of 1860	1404	msedge.exe	128
PID 1404 wrote to memory of 4320	1404	msedge.exe	129
PID 1404 wrote to memory of 4320	1404	msedge.exe	129
PID 1404 wrote to memory of 4764	1404	msedge.exe	130
PID 1404 wrote to memory of 4764	1404	msedge.exe	130
PID 1404 wrote to memory of 2692	1404	msedge.exe	131
PID 4148 wrote to memory of 2784	4148	msiexec.exe	135
PID 4148 wrote to memory of 3404	4148	msiexec.exe	136
PID 1404 wrote to memory of 2272	1404	msedge.exe	137
PID 1404 wrote to memory of 2272	1404	msedge.exe	137
PID 1404 wrote to memory of 4144	1404	msedge.exe	139
PID 1404 wrote to memory of 4144	1404	msedge.exe	139
PID 4148 wrote to memory of 3804	4148	msiexec.exe	140
PID 3804 wrote to memory of 2556	3804	MsiExec.exe	141
PID 3804 wrote to memory of 4036	3804	MsiExec.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1U9IrbnOFqCWV2HSl64GZlaRWzJxkWtuk/view?usp=drive_link
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fff715ec188,0x7fff715ec194,0x7fff715ec1a0
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,7521211064541635408,10263003930371848914,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,2663887996349245813,2930305125640323647,262144 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,8897577175583597671,12643764523260245848,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,6522317421459607686,9052642766446660317,2097152 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,11064149393666649603,2114108808470306519,2097152 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,7451747886633571677,1861663219741307708,2097152 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,17497750495161572501,9206881917959796399,2097152 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:2
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,2826082985038179294,15915683932617628901,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,8797088721396572305,14605762635954499356,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,10868148667747520364,14542698823227469229,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,10868148667747520364,14542698823227469229,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6276,i,3863007358657544361,16991130644107262485,2097152 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,8145006156851214419,2906114495995820371,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,17629547423021336497,13056227687752469566,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,12909692090284248780,16948401535309966926,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,3099409278940754147,8100881825422515240,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,1584819041293712336,11553735568757827165,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,12860364147328151636,903944210596022385,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5980,i,8624712885919636387,8086221880205143326,262144 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6232,i,51259355201206725,2868195502105397919,2097152 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3540,i,13120202729612073312,8021562652467409762,2097152 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,9231025750916153216,14290633266654785069,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6728,i,5557537528680987873,17202450784817550442,2097152 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,8550315052367689244,3268112708664919836,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,10045432035717739641,12835699123645808452,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,10910238366141927721,4717477026599342372,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,7813644574456436326,15620347705496442540,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:8
  2⤵
  PID:4764
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\LibreOffice_26.8.0_Win_x86-64.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1508,i,6390333462142993075,6149966560343922550,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7552,i,18023715393818683470,12452407912607081943,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,2985978807801526496,16293741366544692744,524288 --field-trial-handle=2312,i,7523877415628998090,15209829381699858894,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1048

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 329BB29A852D3BEC75DB7DDDBD2449F3 C
  2⤵
  - Loads dropped DLL
  PID:2784
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 2A5636253E8F4997BA53E0E83F4FD259
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  PID:3404
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 397AD37D320762FCCD6D74C59A3ED0D0 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Program Files\LibreOffice\program\update_service.exe
    "C:\Program Files\LibreOffice\program\update_service.exe" install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2556
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\LibreOffice\program\spsupp_x86.dll"
    3⤵
    PID:4036
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s "C:\Program Files\LibreOffice\program\spsupp_x86.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4192
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\LibreOffice\program\spsupp_x64.dll"
    3⤵
    - Loads dropped DLL
    PID:2472

C:\Program Files\LibreOffice\program\update_service.exe
"C:\Program Files\LibreOffice\program\update_service.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4812

C:\Program Files\LibreOffice\program\swriter.exe
"C:\Program Files\LibreOffice\program\swriter.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812
- C:\Program Files\LibreOffice\program\soffice.exe
  "C:\Program Files\LibreOffice\program\swriter.exe" --writer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4864
- - C:\Program Files\LibreOffice\program\soffice.bin
    "C:\Program Files\LibreOffice\program\swriter.exe" "--writer" "-env:OOO_CWD=2C:\\Program Files\\LibreOffice\\program"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4860
- - C:\Program Files\LibreOffice\program\soffice.bin
    "C:\Program Files\LibreOffice\program\swriter.exe" "--writer" "-env:OOO_CWD=2C:\\Program Files\\LibreOffice\\program"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of FindShellTrayWindow
    PID:1648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5bd985.rbs

Path C:\Config.Msi\e5bd985.rbs
Size 2.6MB
SHA256 d5abd93beed0ca67f7619f6e0e77cd9aa8a54512cbc4748070039bbbdf20ddac
MD5 7682a072f3dbee881d69581d66b4b714
SHA1 87adea5e2783f9aab0d76cc992e2b7deeb931797
SHA512 5490e27d688700d0adbd73c35ecac9b8b3887f46ee7d53016f6831780b01de1e2a79cb54154f08e8902bf6c9ca04618a3703f063d9feab17eb5d0cd79a7d3815
SSDEEP 6144:Ja9n51OUSz85mI/ACSJWp8AHTFAQ0B5wcz6xAXOF0qjMwhFy+0Z0giqGsWdavcT1:CVaI/ACWSLHTFAQ0BMaEuIr4W
TLSH
T1EDD52316B805C2C3F8531170E7863B1C2765D86D3B09A21B2BDDA33B5CD6B962FBE185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_sesize.svg

Path C:\Program Files\LibreOffice\help\media\icon-themes\vcl\res\window_sesize.svg
Size 707B
SHA256 38aa21bdcd109b02609db938c254eaf8105885dcbfd4fbc38f704e39acb74091
MD5 09907267d69bd2f2fcefe8342b34092f
SHA1 09dc5cea4427c8f2c5cbe2333f118af0d6f627bd
SHA512 d816c24bf0dceda7d0f4aa5e092a118951ce77ac6a57b71c817942db50eabe6450b38772a943d4e9c96b2d0583ae2a984b0a25bc112d59ddf05e7742757b539c
TLSH
T14F0149A95498264D1D84BE66CDA469DC212F38F2E74D40ACDC4E051358315BAD4DB84E
MD5 SHA1 SHA512 TLSH

Submit Download

window_swsize.svg

Path C:\Program Files\LibreOffice\help\media\icon-themes\vcl\res\window_swsize.svg
Size 741B
SHA256 79ab44d98cd822805dbf02caa0951c21726c5d66d969bf511988bc15326fd827
MD5 acfbe9683b941a974d5b4d8196b92b7b
SHA1 ca558bb358f6a91bf4a9c14765caa7a09b51d0ea
SHA512 76d874b8fd99bb319a9962f8f03e2177bbd22f2b5cda2b7229bb1191537d0ec3d60709cd3d538ac76fa990a623780c100b981969b29ab1b49901bfc0d2594519
TLSH
T1270189B95888264C1D85BE62CDA8AECC222F34F2E74D40BCDC4E152358715BAD4DFC4E
MD5 SHA1 SHA512 TLSH

Submit Download

pcr.mo

Path C:\Program Files\LibreOffice\program\resource\it\LC_MESSAGES\pcr.mo
Size 69KB
SHA256 0eae852182a771f7dbb1c46c89bc472cb563140f65797d6b514c78d0042d4f45
MD5 dd04792dbfc247682842af5dc15ff2b4
SHA1 32014e38342898ff23cec4bb2bc5f42773572ed6
SHA512 f9f6f77b091b51c9a0c8826f18b82143be16d65844570c973c86c22c3b913e028a6197c2c17af60b33faaba7f2383a803236370a78b140b38da0689729268433
SSDEEP 1536:jkgT3mlMU/TTapKyKjS7Tvt8XzHFhrNWY7SKfrxs4/A:jkn/QB6XzHFhP+Y1A
TLSH
T17863077EE7502321D1470371A11951E09A70E0F9AF6C4B63EADC870A09B5F317A6E69F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sca.mo

Path C:\Program Files\LibreOffice\program\resource\it\LC_MESSAGES\sca.mo
Size 80KB
SHA256 1259116308d96c4b0cc713fbdaeec65499571303dfd15de21a8b7249420e3760
MD5 d532c21f1a2d118d5ce1f13a651c2570
SHA1 50a7eb67e067eb1ab5404955070de14b8845f81c
SHA512 aa5bcf78912b4e4757c9679bd4b251901c80af8c0ae6af4d32e552e25c2acb2d30f58934e01f01e081a3d813c1e8c5a1bfead5062685413bfc395c8cb046a1af
SSDEEP 1536:90szVujUfJgbIdN7kClVArPac8joxE1/tpqX8beGt7mPcmPpmPOYmPpC:qsH8+7kClVArPacOoxE1lpqX8beG9mPq
TLSH
T1E583A22F6D863612C967C334463893ADCBA9C0989614E70DD53E017E2BC79609EBDFD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcl.mo

Path C:\Program Files\LibreOffice\program\resource\it\LC_MESSAGES\vcl.mo
Size 45KB
SHA256 0bf5d865d0f952866cebd8bad6bf6053b9c0f14aec41530c79a204a8094324ce
MD5 8b8f40582d80db5ef543f8d08705856a
SHA1 b263355cd5fa6fd49289df9f62b43f22f5e7cd20
SHA512 4340d77e3c4ada5e72f90ce739b611393092eb0b221218fd58ffb0778d79da13347005421878b0a4eb4a5309d237e28e9f43c56c94fb9d71d7a9ff03900e54ea
SSDEEP 768:iW26IQcO3+BcFhXu+Dkj2c94u9L6hd+R2KuuhZd7GpL2b/C:06oO3+BieYkj2c94u9L6h0R2KNhbGQrC
TLSH
T161235BE9C2481661CB7B0634AA314071D7E6D1B5C9E1FB736F8CC04D39CFEA851AE299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chart.mo

Path C:\Program Files\LibreOffice\program\resource\uk\LC_MESSAGES\chart.mo
Size 133KB
SHA256 9342d78e1a3fed2c32e4c293e84e120cb187faf09bb45fced044ef194768c6f8
MD5 37b77a75ca18af5410e32adabaea6336
SHA1 679f84de0032708752e79b1a65ab9480057b6957
SHA512 2041fa70791343f04c624675939caefcef467ed1cde57f8084e07beb21da6750f045aa5db3f3393f8167ac382f42dc03196c28cd5df3f23501a671a008fb8de1
SSDEEP 1536:Cq8QQW/P0gl/u6ckbRInJXlzYTJGuut5PxudddXHxboJWbTPHo/wR1OpkvCdLJ65:1J/FFIcGRpw/vVQsN
TLSH
T131D37566E65819EFC606E13BD8487B4ABFE640FE37A5472225983C7F2CE18148B3D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dba.mo

Path C:\Program Files\LibreOffice\program\resource\uk\LC_MESSAGES\dba.mo
Size 131KB
SHA256 4ab51937e1f2a641bb10338fccaec7f77aae67f83830fcee262f135f260664b6
MD5 436420941837ec0cf8f225d88bf38afc
SHA1 e6e81a01112a7e5e7bf37d6343024d2d54610a65
SHA512 ebd1f2ee62a7de03ae8f5625ab33935823dd0e0af8b6a660961802654bd90700ad1298ab2c091174248fd7944cca6baf18869c77ede605158e999a5059b543df
SSDEEP 3072:LywsU93vUhg9kJFZxCWXpvESDG9/28AHjtF8pXBYADDkLYBi:LywsaUhgyXOW5vQ48AHjtFMYADDk0Bi
TLSH
T1DAD384A1A75815EFC203E177E40C6909BFA680BE3BB5831616A97D7F2CF21148E3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svt.mo

Path C:\Program Files\LibreOffice\program\resource\uk\LC_MESSAGES\svt.mo
Size 107KB
SHA256 5849e2cd28e4abd402416cf3b87bda5df692cabdb76f7a9818fd61fe1d61086e
MD5 9dfbf933b467da9db244189f18356f26
SHA1 a7c59c0cd9ee039ddf9c2cc94130e069b586c9bc
SHA512 7a12a676a6de09389f7b4d336ce56ea3a7335e3e7499525fecc3c45d6b4819d94db357aef2ba022a6df99c51ddf805f834c467463704ab377122756a35d05eb1
SSDEEP 1536:8DotO3n6ZrgJFn6+lWQk1eao15HGycWMGaxGqHVthi:8Dxn6C6+cMhGycWMGaxXHVthi
TLSH
T134B3819386A458DBC111A1B3CD117A973F7980FA2E66530236BD3EAD5DF2211CD3E30A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

soffice.exe

Path C:\Program Files\LibreOffice\program\soffice.exe
Size 510KB
SHA256 a2823391857db1dd8ebbd8234267f9ec58ec7e5b5fc434665c0ecec4671cb988
MD5 b21829f006ec0d8460b43cf2625760c1
SHA1 6069d8bf98285f545a7a67f4fefab5432b7c9c6e
SHA512 126c82bca46610c93e17fe5af8157186ae2ee5787f93dd49c6912293b287ed44ca286f9a4be13560d2f2ebe9a8f47dbb07a150d95f53556fa2b8308d6d1edd88
SSDEEP 6144:gJBpY5Xj/M7bkS7rbW8yBzg1oqMZHuAx90YFFW2u34kWQsnp1prvpLXFfWR5bkd6:W7rbfyOYdprv/0zSqr
TLSH
T1DEB42A55A311DCB9F46658B9CD9A94F0B0B16C4CC3E056CF21EA7E3876B3BD002FA616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update_service.exe

Path C:\Program Files\LibreOffice\program\update_service.exe
Size 122KB
SHA256 2698e72aa1d6c5edd4cfbf3f3498c09c2026764634bc38f5ed42c7b6d1c239b9
MD5 0a33e2d99b37417c9d7cc8b5010ace2f
SHA1 d211fdc6dfba8a47e88f878089cb7ce4f9330d86
SHA512 378c1114bccf0d119f6619228966acdc75fcd9222a4b8b155601010e7aa34d1e60f15411d8665b5b76b08ff0ca7a7320a03219053101aedd2b4178511575217d
SSDEEP 3072:gvC+iQjgZVsnr15+rBlaFSTdRP+eEEYmic2Xjd8FnfS:hQjgLsr15ulNzEEkckjq
TLSH
T140C35B0B678400E8E467C33CC9DA0517D3B5B56A536167CF07A5C0A90FA3ADCBE39BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arrowshapes.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\simpress\toolbar\arrowshapes.xml
Size 2KB
SHA256 39649a221e0a52b502335597a19aa57b3f7ffb5b35f44720425e55fe0ae41668
MD5 436aace49f0e1e996be5cdd46afca86f
SHA1 abb651e90a9548b93737313663eb8847cc5018e5
SHA512 1492b12a3232d110e404fb0755dd496472bc801d1430067c89ada06f9b53910b85fbdb258a8a32d99b1b2b5063f560cb28ed395ce17e043921066f5491bedf15
TLSH
T12051D533F4EBC1B2106F211D66AB54C69D8A8872D05E94C76C1D7AC482EF7CF8B692C4
MD5 SHA1 SHA512 TLSH

Submit Download

basicshapes.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\simpress\toolbar\basicshapes.xml
Size 2KB
SHA256 7d41a3eabec1ee4c5e1673f4c23f975fa2b458e7120b35e5138a6a86406818b9
MD5 10b9d8534b1204606d3b316b5c83ac15
SHA1 21b8e9a1bbececf3e738f107e4d558daa5c5bc8d
SHA512 b377b2ead69159049d4da6d3163267f478163011ae7ffac68cf909476edf20032613926f8b09440c7d981d7aae0a6e298e724c181962eb2500f545e7b5450841
TLSH
T158517F76F8E5C176012B311C65EE94CBED4E8832C11CA9C7AC18FBD482EE6CE47656C8
MD5 SHA1 SHA512 TLSH

Submit Download

calloutshapes.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\simpress\toolbar\calloutshapes.xml
Size 1KB
SHA256 a4d7abfa3498848d791eee3ba042393d9e840d4ccf688280b093fd253b1606cf
MD5 964a0e4f594cab81989748665dd25c42
SHA1 a06508df865082d1b03afd260cf6983d19710925
SHA512 08d60cd48852fa7695c518208774d990ce0ebd954bd6fa3d738b3579bf82ce6d7f1fb3135fd676375e1312dcd07dba3545db43dc83e883f4c1efba8b7917feb6
TLSH
T18A319039F8F582722157331C27EF90CBD41E88E5A45E81D2AC587AD442ED5DF43D2AC9
MD5 SHA1 SHA512 TLSH

Submit Download

starshapes.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\simpress\toolbar\starshapes.xml
Size 1KB
SHA256 be9873ec42bda70a4d6e9b7f99a248c7258f9c6ea091f8f07164a4271be035a7
MD5 474a909b023806339539b1f576754f94
SHA1 227d61275b9026a639dab0234048d6fc943b1749
SHA512 c07c5713c25451c535e6f1c080fd238cd4be26402004e4ca5951c604bce4f9cc481a1d5cc91533f8dccf2ea0706411a2233ffe06b5d013e46121cbf948a2e259
TLSH
T16C31A176F8F1C073016B620CA6EAC1CBD90D98B6C55C9AC75C6CB9C481DD5DE8393AC8
MD5 SHA1 SHA512 TLSH

Submit Download

symbolshapes.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\simpress\toolbar\symbolshapes.xml
Size 2KB
SHA256 9e59ef52bcca0aa2bbab167464c474445b0839cc7d43f82b81df18b6437aab4c
MD5 f8bfb3541f5cf7f5887b121f17313f1f
SHA1 80c7674c8afe9da2158640916c80a9a67bb470cf
SHA512 a2d11eb7c517db98f8fb63fd3231e6db3b691bf2c2a860f4a2189d5979a4cdb8c954cab4ee44b5a8147cf52922f63cc347181497868ad9cd86b9e583ee7240aa
TLSH
T145414D72F5E1D0B1402BA19D65AE50CBACC9CC22C05CA9C37C1D7BC582EE9DE43517C8
MD5 SHA1 SHA512 TLSH

Submit Download

colorbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\colorbar.xml
Size 1KB
SHA256 92eedd7f5ac4f4915708b76e496d1dbbeea4de562ebd97295e8855286ed363bc
MD5 c01983403780b35a83cbc63576b8ffae
SHA1 ef6c4906f91eb4cb8bca0356e287b847bec95678
SHA512 1f40a0a04b842581cbbb8fc65d5987d4c47b0c670b45cfb37b31d43550871a09c6a5a6c10a982103eb7d3a236bdf5ed742fbcb3e24585e0364e60e1c53177a63
TLSH
T1C631DB36FCE68172015B152C2BEB80CBD40D88B5D05CA1C75C48BAD486EE9DE97D2EDC
MD5 SHA1 SHA512 TLSH

Submit Download

extrusionobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\extrusionobjectbar.xml
Size 1KB
SHA256 20ebc66fa3c061b8f7b9b97e29f52cfbaf5be634ddc8c6df64118a6f12416ce3
MD5 176e5c7ac0b6d6d91e10fa21a38559ed
SHA1 ebe074797d1888d206fee3025f4ddeefe5043b5c
SHA512 c55f1e6af6c1115fda4f6aa1d0f04411d070a3801775962a701d488f0a7c195107ae29de7b860c9ea92e0a0bca1f8937dd4590a5b773c4376d7d79d328b55cbc
TLSH
T18B319C36F8E78172016B210DB7EB80DB941E98B5D01E95C74C48FED492DE5DD43A1AD8
MD5 SHA1 SHA512 TLSH

Submit Download

flowchartshapes.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\flowchartshapes.xml
Size 3KB
SHA256 92268281fbe1f149a7be387a18559cae1b73ddc9ce031b21e6403c41c0f08ae2
MD5 4551cb51edf7a188c5c29ccb18712981
SHA1 7abbda8904dbeda6a8f50969cbf73641f55e1919
SHA512 5a658cb648495819c6b8817dbfa4a6c7b9a03378f2d8f72adbbf2355e0e96d05e75ca395a67f03faf024591dd230ea3f512de4d04007280df5bd31ebc9ec27ee
TLSH
T1FB616237FCB285F5043B320DA2AB94D79C8EC962C41C94C75C597BD9C1EFA8D83A1988
MD5 SHA1 SHA512 TLSH

Submit Download

fontworkobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\fontworkobjectbar.xml
Size 1KB
SHA256 e30b1e98bfe47382ab7f7e77681e11a3ad2a67cbf2b9440514adcbf2a0fdb017
MD5 ab5bd7ae6c45c5fed7aad55744c17369
SHA1 2ebe522e13940cefe13358bc98685e004b588779
SHA512 234fd68e919e4d3ee05834ec002e0683901c2af1b1666462ee736baab2df647449d4f13a8e3063b844c33ec764a714e1204d0bf78654215e39d7054ef3661959
TLSH
T18231AC36F8E242320257125D3BEB81CBD00DC8B5C15992D79C4CBAD492EE5DE83E5ED8
MD5 SHA1 SHA512 TLSH

Submit Download

fontworkshapetype.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\fontworkshapetype.xml
Size 3KB
SHA256 c08756dc6cf0fa1840f8358a7273a9baaa453c328cbe191dc9e8a452a6412e4e
MD5 6b4ce5f25e375cd25575a2788da0b42e
SHA1 2a7f6e6b9bf384f274a1e3b4805d5ce81d1a90cb
SHA512 3b8b3cbad8b37e5271d1919a2d5b2097be7b1149cf534daf30fa4a4553e26146fe51070258bb48fb5283026202f6d2001f3eb7fa0a1b13d2609955d548b476db
TLSH
T1AD714F71F4F1817600AB270C66BA96CE6889CC72C12CB4E28C09BFC9D1DDACD57697C9
MD5 SHA1 SHA512 TLSH

Submit Download

formcontrols.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\formcontrols.xml
Size 2KB
SHA256 27198ef9e83480332bc408dd2a98142dc9334ddb25429a1be7f9f47b402ff667
MD5 2653d464f8fe3012aa592dded960f738
SHA1 b9dbfa863edec665e729f8448d2f94f7f802acda
SHA512 f2d615da7f21a05361f52721a5e0eda368bbb8aaff8435097143f7bd84cb9f47280d62b323625a5f83ec737f688d902f80845560c2e7c9e68fd8504caa03be0a
TLSH
T1B4519536F8F285B6016F211D75EB94D6984E9C71C05CE9C39C18BBC8C2EEACD43626C8
MD5 SHA1 SHA512 TLSH

Submit Download

graffilterbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\graffilterbar.xml
Size 1KB
SHA256 3674f6bfd68440ac255987935c526c2a6226bf6a451959df7d883bb61807c35d
MD5 9cdf1392f27bb59e50f1a6b85e73c093
SHA1 9f3334452bf7217c3a03f403ad8df0c4f4636052
SHA512 e3d3ba0f19eb80d4f1f325c1f5ce47ef41ac2b5d6a73a3c6e9a842e4ae391f586f6c3896d6991f9db943fbd2137f449a4e51ac72e8c5ab8371ac66a9836084e8
TLSH
T1D0318C36F8E581B2016F210CBEEF90CA905988E5D05DD5CF4C48B9C082DF5ED9F91AD9
MD5 SHA1 SHA512 TLSH

Submit Download

mediaobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\sweb\toolbar\mediaobjectbar.xml
Size 1KB
SHA256 199d3dbc7e34b0c3e7ecbad03403837234ed0ad12426d65dfcbf9cab8f497c4a
MD5 208b3a5945e8dcc5ab347a037a63faaf
SHA1 bdb1fe2eaf4923cf4bf19b66a25654a774610632
SHA512 8faba578f2468d347936940e9d3b1510f8843ab91ea1e3f9a5a72d16663ec585c4828f106913330af7a82b26a2ab6b9a48d17b95f114fdbfb65be60494c98dd2
TLSH
T11521323AF9D141730393555D3FEBC09FC01D98A8419982D6AC4CA4E052EE4EE83E1EDC
MD5 SHA1 SHA512 TLSH

Submit Download

formrichtext.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swform\popupmenu\formrichtext.xml
Size 1KB
SHA256 fa3837cb694c7cfaaecd590451e593ebaa9e9b2584e2d639da9ea30e82abb3e8
MD5 26ca4475f288cb9fe2fed1e596018751
SHA1 988c0215a49f2bfab32ddeda99f814a66b774d51
SHA512 a606bfbac760425dfa716273b6106823ddbd45bed74a241f65d9fe26185bd4235d1fe90bbb3953455b538ab6c5ce2a79d2c294922423d2916e298d94fd8664c9
TLSH
T17E318F22BCE4B1A1E01E73A8BAC570AB6B59D4CAD31C2D507D9C4F91DB0241CA4F329C
MD5 SHA1 SHA512 TLSH

Submit Download

formtextobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swform\toolbar\formtextobjectbar.xml
Size 2KB
SHA256 afce0233fd8bab369ed65401c5d19dc5722b45c5ed31891c9b80452f710bd9f5
MD5 6137f0c31f0ce3c14127963ddbe96892
SHA1 d8a84ac95b968d0cc0c22e87e24a1acbab793ce8
SHA512 8e815d5f2e1dbd085399ee556e351d5209744564fa1631e644c6aae986538fc0104ad45336a77c432e8a9b09bf0cff1131cacd53b421802976adfa5d8c4bb447
TLSH
T1DF412976F8F18176016F620D65FA94DA945EC871C01CE9C38C08BAC492EEACD83A26D8
MD5 SHA1 SHA512 TLSH

Submit Download

fullscreenbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swform\toolbar\fullscreenbar.xml
Size 1KB
SHA256 02866b29edb539552932283cc6a2781929acd78c9389a86c72e7328be558cbba
MD5 4342b265aad0f6ca15ce53e74187de9b
SHA1 37296341eba4f34c68dc4111e531390183723748
SHA512 e300cb37d9dd85cae8431fc5b45d39c93976a0d44df2c2ac711796d7eab1dfa32c3465117c6daee8135edc2fe12d3e148c2db622e06f7e4d84cd020933c1647c
TLSH
T12121373FB9C142330692555D3FEBC09FC11954A9119942D56C9C94E056AA4EF83E1EDC
MD5 SHA1 SHA512 TLSH

Submit Download

formdesign.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swreport\toolbar\formdesign.xml
Size 3KB
SHA256 5734993ce49d0b46cfd961ed4ba34c5c9ae34bb1ae01acc5cce36eada57fef48
MD5 967bad05e22292a9eec2632b931ce53c
SHA1 651fe705cd73109cde264e5a9d1f5e5cd53f3e8f
SHA512 181a41b7425f754c80d76f6a04708baf7dcccb2d55829850a543b57757a415063e8a6800bc06cf66fa5164ac904e1cf70f8b029a882b757aa73a1837359cfb73
TLSH
T1AF61E631F8F18177016F265D75FA94DAA94D9832C05DE9C39C08BBC4E2EDACD83526D8
MD5 SHA1 SHA512 TLSH

Submit Download

formsfilterbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swreport\toolbar\formsfilterbar.xml
Size 1KB
SHA256 a776adbef1a4fe659f291505e1e1368e7806897245d68e70574af552aef81fe0
MD5 10d7ce900885d1f463e96c6aa193af0d
SHA1 ecc4387c980f8c7ad8aa9e359df01702e4e29c55
SHA512 fb92ad0d2e3791840f916fe8495cb36e8d0b0403b6cb1bd31a2c4bb343be8557ba23cfa8740842350ec2d963b3b40df330230bd7d4793d91523d5a871afe3938
TLSH
T1D621233BF8D141320253551D3BEB80CBD01A88B9419981D69C5CA4E096EF4EE83E1FCC
MD5 SHA1 SHA512 TLSH

Submit Download

optimizetablebar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swreport\toolbar\optimizetablebar.xml
Size 1KB
SHA256 d3ef7df09b55a9506e8151df001f93c7e59172751a66bbb5ce799b00f3e90252
MD5 47a6003170b2ad23d09239aa4b09e91a
SHA1 74c43abd8258f72f9804df7e178be53441f0c217
SHA512 36a4a02e7a3c7eb59d163f027b748d9807771bce1e697e9dd2f6cd55807e649962b94399da79cd701e7bced1cfc89873b3ca622de7a1e4be27712e16f7f352d5
TLSH
T10A31D037F8D181320657650D67EF81DFD00A8869815D91E79C48EDD492EE5DE43E1EC8
MD5 SHA1 SHA512 TLSH

Submit Download

form.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\popupmenu\form.xml
Size 2KB
SHA256 39a22b6fecdd0787b6ef39d4ecdaf69e435603d4223905d12ebe36f2711f780b
MD5 135c89bad613a67fa177819ee4f5b605
SHA1 22cc0a43da10633fb97170fa0f23ee81ced8a2d0
SHA512 e2493d608ae85009634627545a261c3cf617f7ae2fe821224d3b8db93e2213afca40705eea1bc7d2435873e3307ef778de8fd0e6ecbce5b2ea12a0f6183e3296
TLSH
T1E2416E22BCE4B0A1E06F37A5B9C430AB6E98D4CAC35D7C547D9C4B81DB0251DA5F229D
MD5 SHA1 SHA512 TLSH

Submit Download

oleobject.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\popupmenu\oleobject.xml
Size 2KB
SHA256 644a80b57936119322b4735f2a47b8da7dc87730993c2131a65a311952c7fd5c
MD5 6502764fef125c76a9829f1fb56a6bfc
SHA1 328bbf670129b7c9e6628c5ad0f5d87a6b0adb94
SHA512 ce4fc3408fc3a2087485664095c0a6c7ba3833478ecf83e88c039fcb8c2491ec8733e1f29fc2cc76ac6efef1ae9fe818b70ce3365fe1b9acaf0fc9ce2417bb6b
TLSH
T165415011BCE8F0A2E02F37A5BAD430ABAE98D4DAC35D7D547D4C4B81DB0201DA5F229D
MD5 SHA1 SHA512 TLSH

Submit Download

preview.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\popupmenu\preview.xml
Size 654B
SHA256 3b562576867eaf6b9b7e6487be81eb6caaa63272278fda3decd02976f7f09e26
MD5 827d0d46c79df8983f21608b69bdb8a4
SHA1 f9d3413451232ec3cd596be9937dead51a4cf39d
SHA512 f2b6bfa225c8c626fd0db80c34895a9ba1e6893a39848fefadc12e828ac3bf74dd4b49d2bd6188e4fd6c0fcf75ba2d401f1d0a6e0a369e56e39f37172d395197
TLSH
T1F1F0DD16FDC0B121D51E3B54B3CD3097D226E4D883983A50DCAC4B90DA0352CA1F2BCD
MD5 SHA1 SHA512 TLSH

Submit Download

alignmentbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\toolbar\alignmentbar.xml
Size 1KB
SHA256 50a5680c4ba52b5ac62f2e598a8046aaa93206612f4da9f7e3207f3e820eba79
MD5 2cda7f9996802c5a2358e140863b97de
SHA1 9aae5a7ce9acc27ee6a6928e23268279cd4ca40e
SHA512 5073734bded4d9e735453caf1c82f9dc1369281a3b191f69ae1ef81812a4369a4594dafbea9fdcb5d7c150eebfdad54b7cd3b8bca955bf91006c5b6d4d57b973
TLSH
T1F021BC3AF8E181730267651D3BFB80CBD059986581DD91D69C4CB9D092EE5DE83E1AC8
MD5 SHA1 SHA512 TLSH

Submit Download

drawtextobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\toolbar\drawtextobjectbar.xml
Size 3KB
SHA256 5bb4e6ce43a6a4866d43f32057a1c67fb230790234b4f1864a3e97a0297a2775
MD5 93a0495a789832b4cda1270c0c4bf2bf
SHA1 bcf698810abd87cd0009fa430bcbc2affe22e41c
SHA512 3eba3855f6cc44cac652fe518108c412a945d7516d970a9ca23ff2b0cd6970f91bfaab50518465f51eaf5b975a6408f6de8ebfff4945803cf641c2a2f49d07ac
TLSH
T16B71A635F8F281B6012F721D65FE94DA954EC871C01DE9C39C087AC4E2EEACD83626D8
MD5 SHA1 SHA512 TLSH

Submit Download

oleobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\toolbar\oleobjectbar.xml
Size 2KB
SHA256 d7035ac40d746cc5de9659fceaaa6202c4489bbe8c759c68f30f6194d256edc0
MD5 6a930f62d9a4a942e1000a8706800e4d
SHA1 efd16aeee09aefc4c0e7ce60f114e0de3501ebcb
SHA512 088b11e2fca82cbfc1b6dee76bf6ff7412f79829af8df1673bfa53dd44e0b4ea0842edccfa0c3e98fba9eee88612ff528aa69e8537de4056fb1f5d7ae13db655
TLSH
T17051D631F8F5D0B7012F251DB5FA94DA954E8832C05DE9C39C08BAC4E2ED6DD83626D8
MD5 SHA1 SHA512 TLSH

Submit Download

previewobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swriter\toolbar\previewobjectbar.xml
Size 2KB
SHA256 4e202c73ef8f67352c9115a669fa4591f2eb5f96f1b84f60b4bafcb2d52f7ac8
MD5 f96cd1281eb1179352ec78fa0db39f23
SHA1 e1ad39a58aa0b2ab7f3ee46a4f2b0d37ee9bb587
SHA512 17eed05e178e093d958218564af30fa9fd0f9a0fb617f88ad6ee2d594e034a064732f98c60abb2c0a44fcf977d34e7a904f06da3c8199f50ad5b4f0ac2ec2d55
TLSH
T1D0416D36F9F18172012B225C7AEF94CB944D8971C05DE9C39C0C7AD4E2EE6DD83925D8
MD5 SHA1 SHA512 TLSH

Submit Download

draw.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\popupmenu\draw.xml
Size 3KB
SHA256 fe38eb2366ec277124ea6785b4e01dff47eb01c6a7484f28d2baf2580c58c871
MD5 7cdd892a1260080a0b981062f78f6946
SHA1 e60ad7a49cf03fdd3ef3ff6fa4248353f8563e9a
SHA512 8a431899568988ba27032dc89e6f1411fd0c769c4a08de8f250731ee85a4834fee4a2114ba3f38e58001c459d53e1e8e020e9c72d6188bba3508ef9e091c96f6
TLSH
T14E713C22BCD4B0A1E02F37A9B9C830AB6E98C4DAC35D7D547C9C4B81DB0611CA1F229D
MD5 SHA1 SHA512 TLSH

Submit Download

drawtext.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\popupmenu\drawtext.xml
Size 1KB
SHA256 ee8344d8c39b1c3d83deadccf2814306be0aa66c25d87a74551ad2065b3abd58
MD5 1cb3807ed1d106791a2aeb69a81aa6f1
SHA1 6c5527382edec6aa261bd1b39381b0cb25f9be3b
SHA512 9ededf2ceb451c93daa624a99b27e3b7e4c662fd08bcb6f17c6bc511c5d7dd4a48a80e3324a73a1ccb2c8d3bb90c4d055e8e31b44db10f7133ccfad4292a0be0
TLSH
T15221DC22BDC4B1B1E12F37A9B6C470ABA654D4C9C30E3E549C9C4B80D60761DA1F27EC
MD5 SHA1 SHA512 TLSH

Submit Download

frame.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\popupmenu\frame.xml
Size 2KB
SHA256 821560841a6c7f81bcf622ea43d1500daddd98286e1c32ee9296dcda3f537379
MD5 85b9fb3ce3797fca05267fce2dd229e1
SHA1 810661afbee200a97412f39f74c5af4ca5a456c0
SHA512 57409663d540bde20d8c477ac3ebc77070ffbc73caac0aef392b31bcfdd6aaa7b86996882362fe1af270d233864833313ab08003657683869fc604efb0c8251f
TLSH
T137413011BCE8F0A2E02F37A5BAD430ABAE98D4DAC35D7D547D4C4B81DB0201DA5F229D
MD5 SHA1 SHA512 TLSH

Submit Download

graphic.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\popupmenu\graphic.xml
Size 2KB
SHA256 2f04d84b78db4774c9301f98c34061740ad9e03bef20237e5bba8ac7d07e5c0f
MD5 c24bf7946ec6ee0de618a6dd373e1a00
SHA1 d98afc2820243dd5457e6036bfcb5341643aed5e
SHA512 f313d10f7d5e95e4d6ef91e76a997412cb047b77aace503f10ed17f7f3a3bfcb53b21b12ca966b7d00e12391cda01d6b62175e58614ede1f07c5d1e7b056db61
TLSH
T117513122BCE4F0A1E02F37A5BAD830AB6E98D4CAC34D7D547D4C4B81DB4211DA5F229D
MD5 SHA1 SHA512 TLSH

Submit Download

insertfield.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\popupmenu\insertfield.xml
Size 1006B
SHA256 7c7fb204f36d2421a9f771d755a27d323877da7c5787304be85abef02cedacea
MD5 aaa921e8a9e73843ac27ab3db93debed
SHA1 f6a595e656c6ec25dda3b193e98dae1005878b62
SHA512 9b54257ad7821cc8233f07c85d53d28755028d3ad8bde2285d0b758cedd79f27ac84ed32ed1abc5ef3141788d8e971b49b2dc01a97676ac0cfecb5a38cfd7f1d
TLSH
T15611E615F984B572E21E77A777C5309B9B55F4C983982BD18DAC0B41820A29860F77DC
MD5 SHA1 SHA512 TLSH

Submit Download

media.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\popupmenu\media.xml
Size 2KB
SHA256 00c985333d265fed1ef7dcba06336e1ee5706ac3f4273b10d43e6e84381cd028
MD5 ad66b3d0e2e4b3ae8e6af1b298201572
SHA1 b876d0d25223a70f0e2a6f323a6e03e1ce5289ec
SHA512 909885438d1810498f2c12aa3b6f4114b185618626664b68d5342e701989b27169ed53b9575f5bd304f2077396a8280d867d52a92f77d8dcc5e0681f4c8e9352
TLSH
T1A4413F11BCE8F0A2E02F37A5B9D430AB6E98D4DAC35D7D547C5C4B81DB0211DA5F229D
MD5 SHA1 SHA512 TLSH

Submit Download

showtrackedchanges.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\popupmenu\showtrackedchanges.xml
Size 625B
SHA256 32df4067843c96a5d268f3a3af9e18790f9091a0ec23a4978595f1131ca3f2ca
MD5 0b39d89b05c7d5717a8f279b806e8ef0
SHA1 d8e72fa242600f41d40d964d014af513ba76fe02
SHA512 c171b78b9a9bc5cca9562513af3369ec38f4c35a0cf343ee72a85d3aa4b1ecdda224c185c4d1b0421c38925bacc8fff2669bb583a35c16e11490baf793b45dfd
TLSH
T140F00C16FCC07222E1D5AB00B3E27257C32AE9E893581D605D6847A2774F428E1F2ACC
MD5 SHA1 SHA512 TLSH

Submit Download

frameobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\toolbar\frameobjectbar.xml
Size 3KB
SHA256 5467bfd6dc49330fd3a9e8f9a8d30cfd0a7df2862c382b0d5ced1d9761a1823f
MD5 87c0695150871f236679afc1ea864bbd
SHA1 4f5f98555a13749650cdb79fe9cbda1a19170152
SHA512 ad2557b26808c6aebf9c48decb89579fd347a91662a031f269cf8434053c2353cd2b0998ca158facfed2d5bbd2072f7159b27977fc176e955e7eafc5e8895f03
TLSH
T1D261C531F8F5D0B7012F261DB5FA94DA954E8832C05DE9C78C08BAC4E2ED6DD83526D8
MD5 SHA1 SHA512 TLSH

Submit Download

insertbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\toolbar\insertbar.xml
Size 2KB
SHA256 4005b7623f2b171969ea48084e7e3fcdc91bd3a18f63b8b48b3f7dde88e9dc05
MD5 c22d5962c70e88f0221e7adb4a385c3e
SHA1 fc2f3e47231e337111140ce63b8ff4a806b07a47
SHA512 6494109f48a5cc6a2aacae5a6cb0410f46ef10cedeaaee21811956d5cebda112db55bb1cdb73b24e03a3e52394a8d9ebe8e42a174531e1494e8ba9719040ada1
TLSH
T123512C35F9F58477026F222D66FA84C6995DC871C01CE7C39C08BAC492DE6DD83A67D8
MD5 SHA1 SHA512 TLSH

Submit Download

numobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\toolbar\numobjectbar.xml
Size 2KB
SHA256 247e8fe3271366ee7a1e42846b745b6a2ca4be8a3bd97f35b3581817900353ff
MD5 417f3b3ea6493891b253db3fd4749485
SHA1 163dedbf32ce614264610734c7655bac3485486a
SHA512 b287763a69764c998a1d2552a5876d06571c39b64ce8a8189a087fc20936f5c2da8b0c4a9f1e3d846cb72613903fbc0cc079eff17c6bf0913d40c712f24af9a9
TLSH
T141418D32F8F18177016F255C76FA90DB954E9835C01CD9C79C487EC0A2EE6DE83A16D8
MD5 SHA1 SHA512 TLSH

Submit Download

tableobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\toolbar\tableobjectbar.xml
Size 3KB
SHA256 5a36c02c012570ff184ec0b5668ca90e0c9ab3b60e125e73d12a7dda5bb00df8
MD5 bd9f21bc1861c649bcdcb6ef93c95c7e
SHA1 27b4d32f2a5db33dae161fb2ceb7cf855cc80724
SHA512 225148d57ef9e1bb29786c4730100c7896833510b4842dc64f18e909b816a47fb96913cf78c2e4e7b354b27bdca2c04ffa95efdaad43e787a0c64fbc36bed570
TLSH
T1CF71B972F9F68176016F325D65FE94CA994DC872C01DE9C38C18BAC4D2DEACD83626D8
MD5 SHA1 SHA512 TLSH

Submit Download

textobjectbar.xml

Path C:\Program Files\LibreOffice\share\config\soffice.cfg\modules\swxform\toolbar\textobjectbar.xml
Size 4KB
SHA256 81672c8e60575a20dfe3608570b12a3af1d341cccc95d49534a46ede70317e82
MD5 d728e0de9da9c791c95f36f46c9330ea
SHA1 ceee9e67a3d3d4e5a909a6a4596853b58f73b608
SHA512 b4d73326a91c4fcdcd9939f263af441a16183f00b6619938b461c00059df12440ec07922faef6244cb8bffa6cc535747f4175fcc5e98802ee4a6510adee03ec5
SSDEEP 48:cosnpKmpXgIxs4ZL4YU2rGvvEyQMTv5vb1lD7vtC9Vf9PrV6vfOvrjFJv4t6/vZR:jKprXvuqL4Z2r40v9lJvtPf
TLSH
T105918131F8F291B7053F221D75EA94DAA94E9871C01CE9C39C097BC4E2DDADD83626D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es_CU.aff

Path C:\Program Files\LibreOffice\share\extensions\dict-es\es_CU.aff
Size 158KB
SHA256 dc8213bb8fb08e51dd5869b348d873de23f89e3315656396ca3031fe1d7ffcea
MD5 ac19d445f162185c6a80c42b355d1c5b
SHA1 fdcaa1af4a6aa5e09c9861596586aa3554b58f7f
SHA512 4fc9ceb8512e10c11b37b846b02abd28d5f821867a1a7d81f0315c941d75c362aec836d3b755b7066845536cfc1b516ec25b3dd4b058215e5fcd318a24401c2f
SSDEEP 1536:JRcPZHrjfE8zbHFYKZZtw3OtpxK/jbznx3uxorzq9v+WMrRjajsVu/IpoJOhN9yc:JRcPZHrjfE8zblg1im
TLSH
T119F38616A9693D6532C310C6D9CF0F361C4CF62CC016E78BA78436EE70995D662FE92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

description-ckb.txt

Path C:\Program Files\LibreOffice\share\extensions\nlpsolver\description-ckb.txt
Size 119B
SHA256 22ffad3377adf787b2d9e72afbdba485cb9b98cf5b04d1e985737e730dad6aa3
MD5 654baf6d9f25fd11803b9fa1f0903d7b
SHA1 fcf9e064dcd02ae93bbc620dde75cbae25c2b863
SHA512 2f41525987d1e5afafbe7b0c5ea60ea05e492c87753e28c75a714029c7a2cc99650d3f828b10dcfd18c1c6401b713cfa7bc31f813ca1fcf11ae4e7f017ec921a
TLSH
T1F3B022228C800800000A2C088002E0820328883C3A8E082228BCA00ABAC2BC0233B080
MD5 SHA1 SHA512 TLSH

Submit Download

segments_3

Path C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\as\help.idxl\segments_3
Size 45B
SHA256 3e57f17c0af0e460c50252461e91958291e1bcbcd032898f823a70b336584a60
MD5 096193900fea78280e0727ced80fff0d
SHA1 668cfb9e067f46cff71f743f20cd30e822534896
SHA512 0bf1c2b36fee7a3eef5cf59fe1c30a080dafcc1c3c78565f31413890b2de6223b45fc6d17dcbc718a72ff2af2feb5690a1303b5b37741f1087a8dc5ecba44806
MD5 SHA1 SHA512

Submit Download

help.key_

Path C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\dgo\help.key_
Size 236B
SHA256 88e91edd2d374f50e71d5067f44ede1164563b39977c1626707e06d79ea8a7f3
MD5 ef84565f9a9da82e0454f8fe18c0a96b
SHA1 241e1cb3fab1fb7e737c1dad6af047d3aef64bfa
SHA512 be5cffe783ef1b243a65898757a54daf39dc229ee8a85ea4dc558cc68b2ab5ca44e4a6d28b29f8dfc410db7ddf24fd0852660f0331908cf491569bb3fe9bd25f
TLSH
T101D0A744AA992540355E781DA18CA6530758936AA2A1A68D9BBF709AA343CFD940F089
MD5 SHA1 SHA512 TLSH

Submit Download

help.db_

Path C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\nr\help.db_
Size 508B
SHA256 0c3b799d275f55714b20bfa6eb8765875d8163ec0de9a186c9efa46ef1f191a9
MD5 39502b2bc062b791e9e01284e6c3b1e8
SHA1 c3ad81a301e44d03ce3fa6c238df73dc064f1996
SHA512 cead807573d0a194dcc5aacd9dcbc0d4a03a514d2d302df0b22dcb04a92d0dc763c40bdc929e8925c11e0cf86df697eee84826dc4be53672296ccb22f4c46ac3
TLSH
T171F05485C3AF4208A8AE280DF1CCA7190B2443781161A1BDDBBB60614603C7EA04F042
MD5 SHA1 SHA512 TLSH

Submit Download

help.tree

Path C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\nr\help.tree
Size 666B
SHA256 29215ea09e370a7c2db76ad0fea1a74d01d05f24e64034f316309408c5de05be
MD5 7f37cdd1e51432d1c14022796ee38c27
SHA1 148a048d65e643ee574b2dcc1e93340b500aa2a1
SHA512 7333959612acf641e789d884556103053cce47dd1f504019626c9e83baa7c95bd0bb66627efaea9be3160bee4f6639fb5dbee48c6928ff94334b7ba54e2cd3d9
TLSH
T19101D3049095651149B45F09F3AB5161C362B26F53717394FCBD85250F02479A3DB6CE
MD5 SHA1 SHA512 TLSH

Submit Download

_0.cfs

Path C:\Program Files\LibreOffice\share\extensions\nlpsolver\help\ss\help.idxl\_0.cfs
Size 4KB
SHA256 0cb17a940b0641a6985b8ea43034cbae5b1533af17fc798b4224b1b20bda80a4
MD5 8ee7f378fe80bb67bf3049611b9cf0e8
SHA1 cfea0a07bc10b6f58c24c8b563d78a74bd8f7283
SHA512 3f81b0217bdedc7ff2c41eb636573bf5b64fa7beea1082ca99ca49377bc025cf5e3b01d95fdfae93eda4384cca6df80db00887909a2c764a5eba246f37a724b5
SSDEEP 96:5Lv7onK1XjKGNhEvz3bCG3sjkJHWWtEIfmrbZRMI44Tp:FX1Xjw73bCG3okJvEIKbZ+XCp
TLSH
T166817417F97C91E0E5990233065D120F8D71544E2F574696BA3DEBB89A3A0C58A3F3B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NLPSolverCommon_dz.properties

Path C:\Program Files\LibreOffice\share\extensions\nlpsolver\locale\NLPSolverCommon_dz.properties
Size 1KB
SHA256 2ae4b9e632e8e3a99950ef3ae361e86694166523e1ccce9ef7719fe8a630acd2
MD5 f7fff25f6b13b25790ef0903a4bed117
SHA1 85f5e8a7a2624786969a76ebd531f72e55a957df
SHA512 f9e0d5f4356faf8fb17e706c95d38d15228f13a6ba57b1b43fbb0c68262394ca76f639fae39f4fbd79abe8f47fff06e9e10b8d5740225f166c18461d3f853e45
TLSH
T1922182C9D1800921BFD148BBC5D3215ADFD93E15913A2675FFB3B3186317BD0126287A
MD5 SHA1 SHA512 TLSH

Submit Download

description-dgo.txt

Path C:\Program Files\LibreOffice\share\extensions\wiki-publisher\description-dgo.txt
Size 231B
SHA256 4305fb8d8cf118cda652656582039825f18e97fa614495114530d9394e6dccaa
MD5 68baef0ee8c1bc2eebaeda68b84c349b
SHA1 ff56ed853cbd4149fb1438816fc1a45e62d2d863
SHA512 c933156ffb372c58857c4aeeb824844a9fe4d12ce5972815e4993a477a0d6bc8d0abdfaf8fe25f348d05865f8e89a0226f9247ba2984e424da943fedc65605e5
TLSH
T1B7D0A7A5DC0022FB295D5301B4EC45DE7248500C97378B721A19409DB03661E46B1BF0
MD5 SHA1 SHA512 TLSH

Submit Download

segments.gen

Path C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\as\help.idxl\segments.gen
Size 20B
SHA256 a85dc4276747f5b0d095effc9bf32bbd8abe34ee86ecf97ae988f34200a45562
MD5 74b166dafdd55581096ad1a38b21b80e
SHA1 9bf6482f8878497a5d79ddb963b9e14be698f212
SHA512 d64fc4f71c03c83fd023c6d327ea325621c7441429f4c90fb1a408f209774e438474c1746ee16c058175fce3f9731426e0e8eba4b0c25a5fdec384466c8d1100
MD5 SHA1 SHA512

Submit Download

segments_3

Path C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\as\help.idxl\segments_3
Size 45B
SHA256 9fe1ae569ea89278149f21d4df55fa88db8ef8722a26b85585c03d54b5bb8018
MD5 6ab6ef2a5d4eb7a341862730ef6b6b91
SHA1 a3ea98de27cb7e7b3db6f6d1db7e464bda51d1a2
SHA512 115f7c16e80a13d9caaae07cd333d72937bf0cd96dac96f5109c24a8141182d663940c136c19c23ca479f62e86ad492a1c093f64fa670c84a8966b1dc6d7cf0f
MD5 SHA1 SHA512

Submit Download

help.key_

Path C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\bo\help.key_
Size 217B
SHA256 e69eba1a6dba7411c3c0088d131f20a0f6f34d8f8708fdf32c08169f50395536
MD5 466876069933b8c70b0d0e1b5617ca63
SHA1 1bf1dc6605fa728c6af27027c751a4c52d1f0b82
SHA512 51beb0af7c83182c27c98c68599790d44f16a2d8136f7665010f9003f4b46a98b958684d27764d3a8ae0a146a0f80e77f68ee78b798e7104112ccedf81244c2b
TLSH
T1C4D09E862E0315DB292C735E439C535F0369C18C37F70D0C37D595C859392254111927
MD5 SHA1 SHA512 TLSH

Submit Download

help.db_

Path C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\en-US\help.db_
Size 3KB
SHA256 b2a21a9cbe04e4f632b03a61842704f2d84b04c4febccf51a6e551efcfec8b96
MD5 f6512ac2044fa7b425aac4543d262bf6
SHA1 a0fa79f35858f6a1c7ae0866a7866f4aaf1dbaa9
SHA512 453d1a351caf1074e6216971315de052d2f0389361ca5c3b55dcf2c79ba0e59010f9269d9fcde3a4f9ed88bad863d0826ac06bc83e1c224fab675d242d6e0e8a
TLSH
T1D761D8EF5B0B09E7363E231A666D4B2D0BA7C0DC1E3B1C6CB3F5648D99354AD850281B
MD5 SHA1 SHA512 TLSH

Submit Download

help.tree

Path C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\en-US\help.tree
Size 890B
SHA256 2c49ae6dc12657d61d7ace1529e4dadc0e481747e1b5dbaf761b275b86e0b0ea
MD5 f55bb0a65a7be7a6a6d0489b1f403b96
SHA1 7c3651c2846d7cc5d9559e3fa9d837ba44ce46c0
SHA512 c197870a7c2db92358311b02484fc7f905fc79a789357b8fb2868450ed3666da4ec8990307d66de5437f9614b45406a756180daa71827cbe6db6d0c800d66187
TLSH
T15F118C6E664604F393786B56737A067D86D3D0871A7B220935FC8A290F164258293E8B
MD5 SHA1 SHA512 TLSH

Submit Download

help.ht_

Path C:\Program Files\LibreOffice\share\extensions\wiki-publisher\help\fur\help.ht_
Size 2KB
SHA256 7fcbf59532873b2d430ec059de0ee6e0d29cdd2b3ae3d4d64ab255a36e74a912
MD5 e5a6d1c8658e3e54ad6e862d9366f30a
SHA1 c2ce12d353f9acbf020b87d393b58a8817db2967
SHA512 c122653873c84c60a026b8d99057218b4e52c0d9a0f234994226b489459df36e9ab998a00cccf2a015a3f981d4636ffebee7c211191187fdc91f9cce88142b32
TLSH
T13A51B0E7890B033729FA1307245D27DD531280BC56776DADF3BE802CB52A9AED2664D3
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice (Troubleshoot Mode).lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice (Troubleshoot Mode).lnk
Size 1KB
SHA256 ccb6f09bda05e15019d2eada7dbabe65e38b7e3c7fedc072e698cd3ef1fae8cb
MD5 8dc59e57a6b46cb04607dac250b0ea75
SHA1 3827b008b2792dda4bf8130bd84a41dd8c80b710
SHA512 da7fde8f78a132e2f14a92f01172fc3ce0723e19e215e7135fe07e2fae3794990e6e11f4cfa93ecf5093ba8ccd9d0f45158552160dd929e921af379bed1ee9c8
TLSH
T1A321E31467FA3B24FAE2263040B61A654B3BBC07F6B5DB6D504A01CE197DE805F99F13
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice (Troubleshoot Mode).lnk~RFe5d10db.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice (Troubleshoot Mode).lnk~RFe5d10db.TMP
Size 1KB
SHA256 646048a8430312484ed058886338f5d2f1b00d5a09ab57993c12d0bf57a7804a
MD5 4db7d0858e314698cef3c8a60cd51791
SHA1 2a1b7aadac0ad79e16515ff627c34b01fa71c60a
SHA512 9e9fb57f9219843966fbc254cd34bf6db2ea624292b24323e52f87c844b2b110c37b1f3951be012a093ce1dcbe9850bb87c931eae990aa82497ff6b77c0c430d
TLSH
T1571126106BFA3B24F7F2263040B21A644B3BBC06F6B49B1D100601CE187DE809F99F13
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Base.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Base.lnk
Size 1KB
SHA256 f05b7a1f5f545ba534e1993ddf77ec240fab89e5aa7cf7657f4d75bfdf10457b
MD5 898fa20f68c7fea4f0ed27d5143074f1
SHA1 3a2bfd7320a90288d75208fb63167e535c508c05
SHA512 84a7513a90d8b6cb1d367f71cc0c3e9e79ad37781fd352a9e9a120ce59d92a5c07efe23108daed3ca59b4c4e1fdc2fed07b809152e92c691d09b06b912d4a73c
TLSH
T179214C5067E52B68FBF75A3041B606644737FC47FAB5D72C000941C919BAE40CEA9F23
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Base.lnk~RFe5d10db.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Base.lnk~RFe5d10db.TMP
Size 1024B
SHA256 d6ddb642c247b04160cd4e95737b86ea558f69c5bffd952c476befbd69701d75
MD5 9a304b72e7751ef5eea70dd55b8a3726
SHA1 7c880682bbcb09051dbdf4e0707a66819b23903a
SHA512 cac178b9dc5fbce94fe2fa5df7ae45cef4482b9daf375ef09a74aa4d350a45824b9b79a6491e8a706603244cd29e433598b156240593c2bc9875aad7c716f279
TLSH
T10911D8546BD62B68FBF75A3041B51664473BFC42EAB1DB1D000A41C918BAA40DAA9F13
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Calc.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Calc.lnk
Size 1KB
SHA256 79e479b9e19cb646122771dbbc3299439d8374abe9b459b913e4a2fea8c2f495
MD5 5a91d8c183305373cf4f5240c5b23217
SHA1 3ffc6c85de7c4f68eecb1811b5779bce0fa055fb
SHA512 32af551f12502b0c01110dcf4f673dc4ebbec102eea284172e7d1f7f3de44ceb12b6f217913f3ff6ed282c94cd19506f79f4b3d2a80ea995e2b596db9a6f12b1
TLSH
T13C218800A7EA3B24F6F3163054B217240B3BBC06FAB1931C400A41CA18B9E408E6DF23
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Calc.lnk~RFe5d10fa.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Calc.lnk~RFe5d10fa.TMP
Size 1010B
SHA256 377303631d28f50f8975a68d19b7b355b2666842f0dc4e118a74ca21b1ca6c2f
MD5 abc6582cdd8006ed0785edfd04925701
SHA1 a19b0c3be3ade199b53121effeb9e650b103ee4b
SHA512 f5f7029b9e6e1074a1e7268d7575ebf80cf91f7936cc2ec414dd5505dab4ebb0667d17a149eae55db9c839ee7875a775a8182e650fdf04cdcfcbdf4af2be0102
TLSH
T1CB1124145BE63B64FBF35A3054B617644B3BBC06EEB1571D410A42CA28BAA40DE69F23
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Draw.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Draw.lnk
Size 1KB
SHA256 7edfc75f7948c63429152059c079c46871c31ea23200a1240f7166435d552a82
MD5 927235c1d440093214750c876b372b71
SHA1 973028a23d607fffde2714648739baa56f46ec3e
SHA512 1d15155e38e486c7e5ba44837b918c5f8c77eb21a8f93591bc85aa005914cfa0c87b3a297bb944b26cccd57dedc780466dd5857ce105ea22a231fd8c2056fcda
TLSH
T13C1149546BE93B64F7F3863041B62B64473BBC46F6B5871D400942C918BAE009A5DF23
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Draw.lnk~RFe5d10fa.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Draw.lnk~RFe5d10fa.TMP
Size 958B
SHA256 5e46c77082d6c166f2435a13fc57562a6e551216f9b5e9708b3724de1ebe7ca3
MD5 ad3005d7c178c3af2cee565d8592930e
SHA1 01224d7d7e6e5e653e7eabe748789ca7bfe33977
SHA512 7064a746ffc636abb1080f8a47276adfee7223f53441fb6427d0359c7f766e6f05a79eb5073d7a46089c55f7e970695cc49db3e835d435b68367d2bb0d866fc5
TLSH
T16C112B546B953B68F7F3863040B627A4473BFC41EBF5471D004942C918BAB009A69F23
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Impress.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Impress.lnk
Size 1KB
SHA256 e822d46d50700c06ccc04fb1fee075e77909be357e55dbb6d1e04217b83c2ae3
MD5 6a21e67d82713728a8bfa8ca5ab1d1ec
SHA1 4997693c15956a3bef2d87863dbc5ab61d5c0412
SHA512 e1a96aa6a374a52b6ba841e5fedeb63c63b200358d6712cbf74e7fb21adedda116dc2a61cfa61446bfa616e97180e254ca3d0dcdf58c3f16d4e4eaeb33d27570
TLSH
T18221E55427E93B28F7F64F3040B60669473BBC46FEB5A31C104A01D918BAE40DA79F27
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Impress.lnk~RFe5d110a.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Impress.lnk~RFe5d110a.TMP
Size 1018B
SHA256 0219bc52ae4506c030b9411593e2303fd771a99c2b1e547a8c8130576e3631a5
MD5 7ab04f58c5a5db553505ddafa8c61178
SHA1 9e22638912e0a4c4efc1fa4141f5de30e40ba2b5
SHA512 acd960634fdd9834a06bb61bbae3898735b2f4c17c4bfee6f3cdc7d411f5f6ef8936e6191cca38924bdce6aa8350186bdae001e63d5020c18cc7c832e79800d7
TLSH
T1D711D8542BD93B68F6F64F3040B61768473BBC45EEB5971D104A41D918FAA00DA78F17
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Math.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Math.lnk
Size 1KB
SHA256 6d4aa8e5292f74c020495d0c40ac0785eebbdd9cbf77951d395e1110491aba49
MD5 17f15ed0dbb98fcfa2d82d33628aec76
SHA1 ae5ad874c8476d5d75298afc437e09e682ea5990
SHA512 c5a065c0e3fc4028325e32603df17ca1e5132f6f09a153c2d0ae8fdc5583f6ab53f9aeebb9546f9dd3488cd6ed9d30dd86b7278c34cd3d79cce1608c8c5d8eb8
TLSH
T11411661417EA2B20F6F3163102B21624473BBC06F6B1831D000A42CD18B9E409A5DF23
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Math.lnk~RFe5d110a.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Math.lnk~RFe5d110a.TMP
Size 960B
SHA256 903bcf24dbd1b41800bea9b8084afe2ea7238ade394e976c8c591f1af31bcbb5
MD5 e03870c6383a119f9e74ddfe385251b9
SHA1 34b4089de994ff20b899fee031a08ae26f3bdb65
SHA512 b4efa647110b2bc3bf3e65c9c492553c1854149881f374fe75e90824ed3b2a523081c7100412e75cf50bb69361e7ccf9c5faef1f39bcc231f4608286ce4993d4
TLSH
T1A911F2641BDA2B64FBF34A3141B61764473BFC02EAF1971E000A42C928B9A409A69F17
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Writer.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Writer.lnk
Size 1KB
SHA256 a5208c30093cdc1bec036659f511b4a4bb32d0915fc7141695e9ef30125beaae
MD5 f25ee50a2749ec2efaf721a414cf1800
SHA1 abdd28b0fe7fbb9448028dec48804516b61f76fc
SHA512 0e1c80806feafc50ebd73139df1ded217f6e1f2eb8a1836231eb3056b24ca8b8e3d80d1eb45a9b44f7e91d79b1331b4f2499e6a0ed55e5ff554d33970d47df82
TLSH
T1912108546BE53768FBF34B7004B117684B3BBC52FAB5D71D400A01DD18BAA409B69F23
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice Writer.lnk~RFe5d11a6.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice Writer.lnk~RFe5d11a6.TMP
Size 1KB
SHA256 27c65c482453de633525c885f30e69d4578e7df2e29a78055c80e8f188a324d9
MD5 5f473f349e30321640c2ebdf7c9b57fb
SHA1 a4419d9fc293feee4772b756bdfe27d913464dfb
SHA512 e9eecbaa09cda72d7631880d314daa0eb843f5455bad381da8ba2095cf95353e3c809cb294a745729bc0cabfda6bfea6f4ab97ff7f2ddfbfbfa31c70914b51eb
TLSH
T1AF11B1546BD62768FBF34A7004B117644B3BBC52FAF5D71D404A42DD18BAA409A68F13
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice.lnk
Size 1KB
SHA256 4524758769a91473c7a1b1d1d7d9baa5664aac46c7219f1ed3ecb6627fddb342
MD5 31782927dabafad734944e8ed0c4b5ce
SHA1 2eb28cd1e8c9682f837929536223bda68b1f6178
SHA512 d168916330229fcc391be2da3430bca5ec43948b7f645f7b299af2bbc712ef7a8420fa1f458576e77acdd4944bb3a14aa70d636fb136f8ad93aadb6e9930b0d3
TLSH
T16921061467FA3B20FAE2623440B61A654B37BC07F6B4D72D500A01CD197DE805F99F13
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice.lnk~RFe5d10bc.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice\LibreOffice.lnk~RFe5d10bc.TMP
Size 1KB
SHA256 b2699748a70fc5b0680f15e3f45e9914e497182d5c035bc030d3c705fc3582c0
MD5 d09ccf1579bf5bd958ad153c8c83ffe3
SHA1 d40bafca2c3c2fa29e8c61eb2d2a082c999a76b5
SHA512 201de21f403949f1aa6ea55160a42cf38aadc106bda1edc34451551f1d14222d9aca1f40c900eb9a168d5fbb9fdaa57435d35cabae28b5bfa9d12f70aee44b93
TLSH
T18D11F91467FA3B24FBE2623040B61A644B3BBC06F6B5975D104641CE197DE409F99F13
MD5 SHA1 SHA512 TLSH

Submit Download

30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4
Size 1KB
SHA256 f0ca9d5d0179b847f50daaacd6d61248335ece7a901cf5a7d5abe98a12d78e61
MD5 d4ad9b11dc4ef168f5ef0d68b8c0ed8b
SHA1 934d34f5841600369ddc55fc8e7e24532d26af58
SHA512 8c2c4bd805057adb71b20ffca5383e381edec6c7d04a4f33f63d65f1fa75b938ce4b45b8bd85e3b718d4cd2c4491feb0c0a5dd8440245dbe507ffd30cab8e133
TLSH
T1B031D92BCFAA49215F425E249EF4E03D6D7A6BD504492086602484CADE1177DBF52C0F
MD5 SHA1 SHA512 TLSH

Submit Download

4E4160FB650E5091C535216313A4ECD3_B101DB419EE6C35835A245DF2E164562

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E4160FB650E5091C535216313A4ECD3_B101DB419EE6C35835A245DF2E164562
Size 2KB
SHA256 2c8219eb2aec55041aec4fa25af0ccd5b50e84a059823694f541792cc1bcc18d
MD5 0d28cfff844dc49de14414ad16ad5459
SHA1 a6edc84379c1d716988b51d54c1e30d77226027e
SHA512 441fba4ee7b436b7d9fd44ccaa33061e4ce782670915302fa6e89c14b0aa2504522a9ac86977a959d98774a6d0a9026cdb267bdd9a4464b445f65697db4f9436
TLSH
T10B41F9165F602955A743EAA28D98C1313DFA8BF368012D85346C81CF9B99F767F7A01C
MD5 SHA1 SHA512 TLSH

Submit Download

856FDBDDFEAC90A3D62D621EBF196637

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\856FDBDDFEAC90A3D62D621EBF196637
Size 762B
SHA256 8551ddcd07724a9a5abf9d36b376ea43e5faa3b267ae3adb2a45634a3677030c
MD5 bfdb10852f21909318ec25593da9c0b6
SHA1 02782e925a604ea61b21984e19a10d9503245fdc
SHA512 20204183a591e61519123b9b4ea4fdb120cca4d9eece5b9263ebc590686e4f18a12d18221a4d2adc116fd2545c66a85f7571c49f37b9cffb1c706e759e354b76
TLSH
T1CE01757B4E00644968422E608FCEDCA7ECB691410BC3800215A092D54832F58BFEA485
MD5 SHA1 SHA512 TLSH

Submit Download

30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4
Size 412B
SHA256 437d9e48493b360ce77fac9c53f81af84656ed502b68522a2fdc4c34560f7aaf
MD5 a3fe67c33f32f67baf6a6705f403ec1c
SHA1 341d46fd1f6f6c44f1231928980b23b312e8926d
SHA512 2f9b10f93f0a5df24ed3b0f34902f336e72de6585cc69cc17cf664c5a6d56911b2663becbe3953ec3eb65225244b934831368ecad7e0f7ab360412983bb250a8
TLSH
T180E0680830EF0185F275CC7903D92230AE38F193204466B217600609B391D04CEEB769
MD5 SHA1 SHA512 TLSH

Submit Download

4E4160FB650E5091C535216313A4ECD3_B101DB419EE6C35835A245DF2E164562

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E4160FB650E5091C535216313A4ECD3_B101DB419EE6C35835A245DF2E164562
Size 420B
SHA256 4cc96e564200e009ddefc090893b3105986902b21eb0bab5040b0c164d6b0992
MD5 bda70e9d1de80a05d9931021371adb84
SHA1 7d6f30eee48eafbd64d63397f46157dc49b53af7
SHA512 41602de86aed5f24805345ceb1a168bbdae04fbec543ce3d5557b9ca6e8665e713143725bfb669e4b790e5afd4214ce692bb63e91b4e11868ac95e10510973f4
TLSH
T1A9E068183BEA001DE232E87587E9B6568A4DF22290944B7A168052075F13F008DB3D24
MD5 SHA1 SHA512 TLSH

Submit Download

856FDBDDFEAC90A3D62D621EBF196637

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\856FDBDDFEAC90A3D62D621EBF196637
Size 178B
SHA256 29e10bc726ec778eac446843f50a98135067e373fe8d727f9541365eacca0e6e
MD5 11a72a491e9ad2f855fdda3d3c6cca22
SHA1 2d8d28b386dddffcbebf46fb3ea163b12b6c3b98
SHA512 384bb390ac04bda8c56c29df7b7c9eb1976e81620d7e26dca932646d36d4b83debb2928637a968cabe4a7c522a839c4bd4ad40c98217c5a55b868be547396868
TLSH
T1CDC04800779A1227E3548B3B6E2206280EABAA13C301C7969EB476088868A204C359A0
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 25559293c954898f2da344ed5fe3faf3c076ca2a1868befb99178bedacb3d026
MD5 7921e958d547711c39f2211be9d582e9
SHA1 d327f17351a129da59733ef73c24b256addb1b88
SHA512 29c83b34cc319b93140a7156f0e4fd32fca94b626b32f9aa46eb5471603b5bab4338ee0313db91199b04ee0ff93fc3dd5d552299e129f6c1cd750f4211244525
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T117B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 fd0aa924a163e1fa49bb482f13560ade1310a4562f6d0cdb4904d05e91f94f0f
MD5 21f869ffd5166bf4b108bc0dd62a2ff0
SHA1 e769198776a722f7034b7b242cf1c9a98c58cf02
SHA512 9839912e5309f46e8b1d9ecfb51721bda3b48092f5ab001a0f1f7cdc354c4884228f35889458f85b04169006b6683b276be8f7ba412a6e7336741d85cc41e068
TLSH
T137E020840DC5C21DE5C065474294E74CC2D13B9B92CC6A0F1F14C8CD744118467D16D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 27c62692fe7a6c545e87713eea64401a3bdad1b0d76bd26e9cd400a9a62031cb
MD5 9215fee61451cb502701cecb61d30ed7
SHA1 ee9a0517972657e746bf0d641c53f6f8624079c5
SHA512 b16673de3c171d0e691a9ba692391247ea0472ebbce5b4cebc7fd5bcb5c254f6d19dbacf53141ba9d2db642879a1652190b349f6a27a395aecc94bddc525f349
TLSH
T129E07DD41AD8C22FE680E4E742A8E74CD2913B5FD3CC6A0E97048CCD7485651BBD26D0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 269bce6d3c96b5536b2b158f7e9ede856f5e7c984dbd363c6893e1599f0493a8
MD5 7e75600ca80e0ba2cc1462ee95612a43
SHA1 6dc25eb7b8208cbf02057353aec47d4c1ef5c18e
SHA512 f340dc9fe8987df363f7d5735a463da0b15af6cf8936930b87f9c65f4d541503610d8c896a29cd6bf847f03c29268f56e40a2ca1576122254fd7431a98739c05
SSDEEP 48:6WEoWdGDylog/36YtVOBGIBzT264qsrAuRtQfKz0mZyQjUnTC9/IeO0:6WwGDylL/9QBzKDpTonW/Iev
TLSH
T1619140358A020462F35103B162E1863679BC82DBFC17EE41A7B0F9B51BB63574D6D787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fbbd80c8741c73ee9d325b3b0234c71c71a81a15b60a4ea2bd0f757ccc31bb3d
MD5 110021b92b2a6a9c1883ecb453277a8d
SHA1 e95d7d881c05eb2e9f5c9e1b810f7aaf6ec37959
SHA512 d4b970c5c8eee0e515f7e20a5b4cbc6723e8a3a5303be5bca1ee55b06f71ded1c612a3c85a6c8c540df03fe3f08641f289eabff5404753053631236cfe4576bb
TLSH
T18D816F354B020062F35603B162D0962678BD81DBFC17EE41D3B0E9B95BB63534DA578B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5909f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5909f9.TMP
Size 3KB
SHA256 a351e083db18755ae78717416bae3fe38dc27dbf6a1c2d80090e318cfa5f8aee
MD5 9645ed069a44dda8997db7f68b0c45e2
SHA1 90789b0dbb7bb9f7235818f6f4cf53bb382004fd
SHA512 5cbcceb86cebb0b22892364ebbc8f771629307aaa87b44649ea3b2977958e2a4715a3d42a0293fb1425f07985aeb94168bcaa77acff457c0b6e5d3472895b13a
TLSH
T1097140354B4200A2F75603B162D0D2067DBC85DBFD23EE41D3B4A9BA5BBA3534D69387
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 419516052e256e83b0632ac5a93d57a31487e1078a2d989d1f6bab94ec7c19b5
MD5 26c732d8ba317b1cffb3a98f3a991b7c
SHA1 ef05bbc4da50ac5a12ea055e859bd36f088d314f
SHA512 39af31c4f8f48a223d75ad454cc1d2490f9c983a7903437aa9948cfa1d58bdd2d9bed38979e4d66a47b2739ef960768e765ce3ec1fd1641241fe43f4b9f7ff91
SSDEEP 192:DWEZwOCtvTQZPw65UE1kDYls7WftuqsZeRNWQZsj44GE1kSaf9:DWEZwOCtvTQZPw65UE1kDYls7Wftuqsq
TLSH
T10FF17BF783E5822DC91156F4D715AF1FCE291618431C387688D8BE2BD3E2472E21579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 2877fc140e7916f937cf823d61bcd9a127bac12c41ba8764200e8c53f31ac212
MD5 700d630f4dc273b62c9e0269295719bc
SHA1 c1c7ad812db615ed5fe079ed746fd937832a05cd
SHA512 7f7ede58ce46b248bc93b4385a734862df71d67153c3c927cd524d0c2ab4ed1339f3f818b1664822b2da5ae3e2b0646c234d8f048bdb5c3a26a9f44e77729451
SSDEEP 192:DWEZwOqCtvTQZyPw6h1krEYls7WftuqsZeRNWQIZsj44b0o9:DWEZwOqCtvTQZyPw6h1krEYls7Wftuq/
TLSH
T143F16AF783E5822DC91156F4DB15AF1FCE291618431C387688D8BE2BD3E2472E21679E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 82d2b28935989317b9386bf2efc3cb3ffbe71b77972f3f4a3b49735d8e4b3303
MD5 6740fbcae213d60b9eb760b0d83eb464
SHA1 b6a950a3fa3f9a04ed7369da8c5c069f7e491bdb
SHA512 15b18c0a487e880d72dc816927638feacc5e5f330b67d6a9999ff5fc6151b4f8c5108e942e4132de262bb5aab7ee61b79b2c8221ff61c29049d9f67e9eccfa23
TLSH
T150719CF7C3D9862DC91156F49715AF1ECE1E0A18432C3C6A88D8FE1BD3E2871E11569E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 1c30795fc290827943935fdd658520373363236c17db5a16a497680a995230a9
MD5 3abe897fd8acd215962f2e32bf137433
SHA1 130257c57857f84a3e7bf7133f985bc552fe88d0
SHA512 4012a0e8ddacb5cb45db254803a4cbc0ba8c9c783cbb951fe2234b0f098f9054920d810c67916bb915bb51fbde6de13847e9eb6e28b96085ba75b0e2890c07da
SSDEEP 192:D2YpcTPsVCM7yNvoj1krEYls7WfMVnB3Jf8BAeWE9uk3/R:D2YpcTPsVCM7yNvoj1krEYls7WfMVnBY
TLSH
T10B128CF7C7D9822DC81156F49B15AF1ECE1D0A18432D3C2AC8D8BE5BD3E2871E21569E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 dde5ce491e1c690b979b9535f01a85deca1959946e728063cd2c0daa8449f1d6
MD5 3a0788c38450ccd2c3055e506b19c3d5
SHA1 cc750f2ed0e11f55d3b85110ef2bbb731ea0a6e6
SHA512 637c4fc2672049b172ce333004eeb421c5f23a2aaf72763ae835fb1813799df4ce9ef30c3adfb6068a1d5d682ed25c5ab65fc90379bbfa9cd59ea95f4498c71a
SSDEEP 192:DWEZwOqsVCM7yNvosh1krEYls7WftVnB3Jf8BFeWQI3s0Gj459:DWEZwOqsVCM7yNvosh1krEYls7WftVnM
TLSH
T19E027BF7C7E9822DC91156F49B15AF1ECE2D0A18431C383A88D8BE5BD3E2471E21579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 08130736c4667e3ce7e575df013deb6ea9800b1dd4bd1dd965c0bba76c8493fc
MD5 c4460f6c5af76590cf04f7f2afd46652
SHA1 610124700f4a8430c85ffa2c3b62f6f70f37a01a
SHA512 24add600e34883da6131b34155a8f77b0db2cb46d06313eda88429fce09750cdb0ab3687e97290b8d7207fd6972b4d27d78e22b5b642136c29350c9e06e5a128
SSDEEP 192:DWEZwOqCtvTQZPw65A1kDYls7WftuqsZeRNWQIZsj44bmrKT:DWEZwOqCtvTQZPw65A1kDYls7WftuqsM
TLSH
T163E16BF783E5822DC91156F4D715AF1FCE291618431C387688D8BE2BD3E2472E11679E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 68a953d3f95984bffa6ae9dc11876fcceb326ff6cf76cdebfd6f643974590519
MD5 0db91b2555fb1d3a260c105d6d62f24f
SHA1 d561084ac7b64a4d9d2139e8f9d046b7ea3d7263
SHA512 4b1a702baeee86dc7992475e47be50081faf8a9e56f60fe248b3e96ee89e8785e341db85e7fddfbb73418beb590f667b46568744721cb8d5f585dad1108256c8
SSDEEP 192:sxZpRLyM/jK1Ml8MWH/fss8jwSIdpJ7vHW6+WNuvz/Yz7GtSy2IgrJ:sxZpDuH/fsseYFHbe/tO9
TLSH
T17F42E8527A34697BCCDBD209B945BF93D6F54472A2940D44AAFCCA1C00E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 43a58202ca78b9468e90323ed2066da4664795a6805ef52922f4dd9a380fb4d6
MD5 e031c089d539af82a23428c49011168f
SHA1 ede9ff1f277e6c77b29e02fa7c25bbd79d6710d5
SHA512 17f5b9aff1418eff706f7ae1ec3621cc67f660123a5c02507728906ff5aba2fbc3ac093f93e607be8e4d4a88e32ccb9b505abe9037770690c9cda1dc0b5c654a
SSDEEP 192:sxZZRLyM/jK1Ml8UQVnH/fssZj/SIdpJbn1FTf2QZM4VRCW6+WN8XHUFYzWttSyV:sxZZtqFH/fsstDpC6+brFpOUL
TLSH
T1EF62C6936A349A77CDD7D209B551BF97E6F45422A3940D88AAFCC91C00E7FEC220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c4235a5c023c390ece0e438763001ac3d0a609a1359300d87b9aa46b756fa90f
MD5 4cc76de467caefc9eed1a2773d7ca406
SHA1 bcd5f41bee2ea434f6272b73852a755fd0382e9c
SHA512 7dbda3a2a522084df4671c8c9d7fafbeb45d49f5441d145f08e888c46e59abec6eb64345f3c3cb4f2958a3c4a8c00e7782a32d4d1a35b3ed52f83212ee0e01c1
SSDEEP 192:sxZpRLyM/jK1Ml8MWH/fssgjwSIdpJ7vHW6+WNuvz/Yz7itSy2Ig5rJ:sxZptuH/fssyYFHbe/7O7
TLSH
T19B52E8567A345977CCDBD208BA45BF93D6F54472A2940D44AAFCCA1C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 22ba25f56b6eff5d50bd6439165d758b904e901cc5852a4b2de8e081a46ef354
MD5 8eda7d9374fc01d3dbacd5b4714cb85a
SHA1 9aaeac42d238389dd60100bbc0794dbc211cef4f
SHA512 ea5697269e26fff8aadf0fd6796825e2f906a1c96fa723e0f1f0febea28634c4d567f73586dd6cd001b0ad40c5e9cffd6914e72d0a46b05c7c574cd632ec6ef3
SSDEEP 192:sxZ6RLyM/jK1Ml8UQVWH/fssZjwSIdp61FTf2+PVRCW6+WN8XHUFYzWttSy2Ig5z:sxZ6tq8H/fsstYrM+brFpO9
TLSH
T14162B6926A349A77CCDBD209B551BF97E6F4546293940D88AAFCC91C00E6BED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 023fe7a869fe0e571b308f646163f5b8f135328d9a6dbc1f4b340c9a43264ee0
MD5 46bd4feaa2f78ce5a60c3aa4706b998a
SHA1 a4d89de03c97a5d81f85d67669b8e422583b5e1c
SHA512 17f820d05f4bdca1cde1b352cb7d2c5bca0a1a85c13be9e6aec8069c32b817d80962dec9702ce42e3ad3d6d2208d7119930dadb10c39e5cf22622b2a12cd75d2
SSDEEP 768:/WW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjYroImisYu:/WW7kf0Wvqidau1jaa5LA3jjcu
TLSH
T135D2FB3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 1KB
SHA256 29cb29ff083f3987989002b1307e7620b6cdc771a597f353c5a016696ffb90c4
MD5 0ef1d1f535fd2a7dfd8418721005bf68
SHA1 d4adf813f132a4d6f0634290e814b32639ccad11
SHA512 f84ed57a3c0ac18d76c43e65df107e1237422caf92c7e7d34ad5cb792dd2dcff78ab2ccac96522b489a93dd6b79c8368fe3dd0f35ce0ba7afe1b13d7509c2a32
TLSH
T17531358D8E51959FD9E485F11577B5E43370D9CC1711B3534C3C32763C2639A2A4B1C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d20e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5d20e8.TMP
Size 1KB
SHA256 368036d1e7a01db0d7bafeeaf3915f45d3947c4d5ffa67ee3a1cefd92fba6e17
MD5 8b975425964c2854be28b7faaa1e4e81
SHA1 d1e14332c4d2f0748813a8b24335ff6cefe824f0
SHA512 b482883508914f6473adb1493653dcb17a170879a1248a68a36acd86805259d641b4c7ab924024cf50e80790ea5470897fc053cb189ef3e858ef7e1d92055bb9
TLSH
T1D431218E4A915A0FE8D040B61957B4B83375C9106322B393987D633A6C7979D6A8F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 7a8bba4d44a039d33383b17bf6f3fc75ed4fd3d5ec3c4bed1665fb541c14b78d
MD5 20b0e4b512aba08f0413458d022bea91
SHA1 e205ba4110c3aa6c2d132fe0de8334310f83f028
SHA512 a6f94794241e739ef27d30f421db72eeb27455ff72065ff7a752deabcd6cbaf0c5419cc276a20e62c56d88b43d302a3e714dfb3d825568ab79a8d2c8fb736312
TLSH
T1A4E068BB2DFB1C24AC6F97C138B054A081953818D500EC0E3027A28730F23512406C21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0a09d0ddb77d66ba61da69190a50a500c3006b6338db698a0422820576773ea4
MD5 bb14874a8e831465ffbc5d62c6c5f52e
SHA1 47638d46dac0f16ab925f34be28fe4fa30ed43b1
SHA512 612287045647ef9d1c1cb9e45b1c7ac8d0fe7047c318749222b16a5f545cd83b56935f02cf186dab2de9bbb64c0a3fd2eacc2a6309aa970094b31d5890990b7b
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTnnIFK8sgHyNzIhKowU4JIpKSi:KIbCKcnnGK8siGziKowXJqKSi
TLSH
T172914105723A0642387D2D58A2AB96271F8372F33419A6AF7FB814A50D67E114EFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

270421c1-ea6a-4e3b-91fe-3d870df0ccd1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\270421c1-ea6a-4e3b-91fe-3d870df0ccd1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fd5db285dfcf624b7c1d4900e06a24ac9eea99c88849b970080272019b64c230
MD5 b2649dc968dd1aeb1fa425e76827530f
SHA1 7e3f9d45d6505200c5fa1ac8785853736054c952
SHA512 e0e09a4205bb2ddd65c849399863e83f95bfd04f3d75297b0b99e2aa0f35a5dd1b83e0a902e5f77cd86af48954514d56f76b8ce3e4f370b0108c6e7ee29c7cf4
SSDEEP 384:qkiF4ZcIvJsNv8TUNTUlIRx4eb4uV2LdXm0CEJrmtsa+VYDPoy:q/FGBawglPV0vhmthgYPh
TLSH
T1FFC23BF25CD7887AD9AE9743E77D2E028EBCC067B5845950B7D85A0CCC962BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7c0269bcb4d1a372b9f5c2e787a1d40fc5edcafadf84bf43c0e8d9055af81f07
MD5 87832bf6b69e5bb77b86cf272d80fb3b
SHA1 ac1a448da6a58a9b301adc60cf28eb372ef31a85
SHA512 27af57c45b172993b80c94d6d9e2d02f856f1b97b09aec7f205d84f21b9bcb179449e31d10abe5adffd1b8c3bfbcab52c706651af9dcee3febf2c76423f4d450
SSDEEP 384:7EZcIhsNvNzebsb5kLdXm0CEJrYtsa+VYDPoy:7ihLeyvhYthgYPh
TLSH
T1B8827D716C745D7B99F7F292F94736135EF88067A6CC2A44D6ECAB0C00EA79C1316C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f48a19322f1b21494502f0e2bc570a7057d8ece52d13bb1627e78534a754bd72
MD5 df6636dcf43e8c8244cb1811b2c93a1e
SHA1 24d5a8ad27b5a34aa1ffbae50803302ceecbac7b
SHA512 36cdbd5e8d28f9ec62dab959a1485efe0dd8818f74d6d47d700f37dbdab348c7cab6cf43786be83aa8ce9c97a735257fddc2e4b4ba7d1f723ccd67e19d99bb96
SSDEEP 384:qkiFPZcIvJsNv8TUNTUlIRx4ebkuV2LdXm0CEJr1tsa+VYDPoy:q/FHBawglrV0vh1thgYPh
TLSH
T1B7C23BF25CE7887AD9AE9743E77E2E024EBCC067B5845950B7D85A0CCC962BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 08270b67e7fd43cb9e9fee507a6dac527ba0b34e9e9c55358f11f37d6efec6c9
MD5 dc8f64a24df72b88271fb1a175ce2def
SHA1 5c81950c08b0251b5201f911f5ba2be2e290d53d
SHA512 9322a4735f7e0b17b0f6a5c977e1786f3e30feb884d131d33cb8639b2dbd1add623a249d980080a39666b53131a212ce5f2af3cd84bfd333bacb060dbb271041
SSDEEP 384:qkiFMZcIvFsNv8TUNTUlIRx4ebDuV2LdXm0CEJrytsa+VYDPoy:q/FatawglGV0vhythgYPh
TLSH
T1C3C23BF25CE7887AD9AE9743E77E2E024EBCC067B5845950B7D85A0CCC962BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8cb2c92e91d8002eb760dcb2f8183ef68c39895119ebc38f0f5e265fa09d7da2
MD5 c3a6c75fed5b23f82e163006ef88a9f3
SHA1 13afa7f9194b6e7fa0e4e6619066084275174139
SHA512 f557a1228a5f9c222100ee1d72cffce1708a412217e23369a95f89260cb48c3cb9111d541047f01ad9233d3637efc8548f34bac7978fc7d5dad2d6b50ddbf011
SSDEEP 384:qkiFfZcIvQsNv8TUNTUlIRx4ebguV2LdXm0CEJrXtsa+VYDPoy:q/F34awglfV0vhXthgYPh
TLSH
T127C23BF25CD7887AD8AE9743E77E2E028EBCC067B5845950B7D85A0CCC962BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2745e01497cb39a5b3d1ce90fc83e1c68c9a0bf5f723ec62a7d2546d38b0410d
MD5 4cdd618a7d621cb05d59d3597bac0a5d
SHA1 3d56fc022668ad02c2824036d63145ea651dd9ee
SHA512 d28f956728f417bd80edf22acc868ce17fe8237f9efba22ac800f67341a6ef25255d7482ce08efdf5ce61d72a4730842e16bc4f5757ff14f3b706012d0308022
SSDEEP 384:qkiFoZcIvRsNv8TUNTUlIRx4eb5uV2LdXm0CEJrltsa+VYDPoy:q/FW5awglcV0vhlthgYPh
TLSH
T194C23BF258D7887AD9AE9743E77E2E028EBCC067B5845950B7D85A0CCC962BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4e25d806e4d9abed81f0b3d8b7bc790257146ed5a6452a79e84634cab52f9fc5
MD5 817412642cd8ff0e9052a108f417b983
SHA1 45ce0731fae38e96a6fe40e0fe36c2c2a5b51555
SHA512 1a3b12269fff7e17822d15c02ff9f57657ac2d2cd488ad4ab6fc53581c832efb10ac582947a286c1f27bff7e3714b5ae64fa66598ec183f92f02ea86dd53e5c5
SSDEEP 384:qkiFiZcIv6sNR8TUNTUlIlNzebsbfkLdXm0CEJrDtsa+VYDPoy:q/FQiYwgCAyvhDthgYPh
TLSH
T14AC23BF258E7897AD9AE9743E77E2E024EBCC067B5846550B7C85A0CCC962BFC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 721005d191a97608126aae98882ea31f7b1f26c03e8d892385a767b4d4d531c2
MD5 1e9617c4d26bdbae42253207c9bb51c2
SHA1 02597a8ca0b45a76ed1b116fbc602e27be9fe889
SHA512 1ff9b3b70bcb7e23a4a37be23f5eef4fefb1e654c1ea93a750d37994a591af5bb34f761dd523c33704d1221350f40c5e0588fbe669a7b938393a8d084d1a2d2e
SSDEEP 192:MONq64BAQmiUyI19W5GBPKnX+FdG4m0+aDAOU6:MONq6eAX7WMdXmgvU6
TLSH
T1BA02EA356C786C7B9EB3BE45F4863B175FD8113BF6942B44EAE82B1C009775C234682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 6230d05075387e6a8a175920e31976780bcc7d88920f277f9798907a82adf993
MD5 ff5d29166a13d290ad88b94292a04465
SHA1 71644d6301d9009c4b4f0f1a4632b831b309ca29
SHA512 9b703c07f970eef524c85a4c5f3a45a6d52d8ff02c4ccc6822feeb41b42f43180d2ebc0b46499beabdbab2b3c8c66f560a84b7108b7763f4b21143bb5d4987f6
SSDEEP 192:uCHLsNvEQgyHBb+xdQmiU1OU74aGBPKnX+FdG4m0PbFC1SJrEVdNDqGqva+4LcYV:7rsNvEzebsb5kLdXm0CEJrYtsa+VYDR
TLSH
T10A624B717C74AC7B99A3A292F54737139EF48167A6C82F58EADC6B0C01DF39C130681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 db5d5c5d03a8870e87af70c9079195999199c27b7e3b826f3a16562d321d4ce1
MD5 da362dead500495b0d0416d9b83cda6e
SHA1 f4e8287b739dcdfceca71f45afb3f6dc25ce949d
SHA512 b513026aabf42547669b4f043eb28310612e62e0369f3c10e2481ec4282129bd11f6506cd76684ba77bae35768ad7aa18c8b72bfbca4ca8ed43dc392a0245aac
SSDEEP 192:xONC64B9QmiUyt9k5GBPKnX+FdG4m0PbFC1SJrE/WwDqGU6:xONC6e7WkMdXm0CEJrCtU6
TLSH
T1B5120B71AC65AC2B5DA3B552F4873A135EE4813BFAC86F44E6DC2B1C01EF7AC1706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5744fd904d689469e93fa3eb689145712ebd3af25cf99018aea0ac8bd7951d08
MD5 910221edaf37f2c07c8a65346d20f1f2
SHA1 e1c74019d5ca6c301bae55a43354d8d5fcb4ccad
SHA512 6a51c2dd74547984fd799e7823748b953f56c589c8f227b7d2a87f85f416b0fb9950faa48bebac1578762025e04da0d47b3ef4a307699f0c5455d9aa5405e864
SSDEEP 384:CEZcIhsNvNzebsb5kLdXm0CEJrYtsa+VYDPoy:CihLeyvhYthgYPh
TLSH
T195827D716C745D7B99F7E292F9473A135EF88067B6CC2E44A6DCAB0C00EA79C1306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9d9ba366fb891c7156b3d960985095a49141588af6257cbc185e5ae84fa3957a
MD5 bbad6ce78774992657e4f951a06e20d0
SHA1 07d1651b6fa5d36bc56c15c74f3de2086bd53696
SHA512 847ed3b75681b88e17a2c218ca7341d6d15dfc64e9b6690702b85629ec0c6c7388127cf2a55f3e6957a43bfbaa1c69c5947a904218f6b2eaac47ac2119b56413
SSDEEP 384:qkiF2ZcIvFsNv8TUNTUlIRx4ebfuV2LdXm0CEJr1tsa+VYDPoy:q/FktawglSV0vh1thgYPh
TLSH
T113C23BF25CE7887AD9AE9743E77E2E024EBCC067B5845950B7D85A0CCC962BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 233e8c6fe5975156355ec053eda51aa8e03857bb209b7f26231b5a0ca22c02df
MD5 7248663a8978d23fe2034f5012c8a976
SHA1 0b95167e9624d9d5f1eca837b6ab043c3d64d5cc
SHA512 162dbf0f36bae71a17dd2881530c4d7e468c84f46eda468030cc09ed52cdf0f889ce19bce357c0ddd3870a2cd56ad870e4fdc69c8abb64c74dd142f731d2979f
TLSH
T17EE00215120044AEC52C17310283113026E2941051FA07469402059058833411A20BC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 51b1478f620f7a01a5b9eeec24db1429c199cc6352b2616c1b9acd658a5b4f7f
MD5 29ef53ccdb0a23c1390111d407e94449
SHA1 422cce7aa445bea0a33733961b8bc1403f1aa7a3
SHA512 86c079f7d1fb65e4631212b8d754514851d359d3d91cbbf677a2e0d981c134a050afe8da1a55f976372992e1bec839e6153088302ae6d61962e8f252aefd745f
TLSH
T1ADE00215920444BFC52C173142C3113035E2941051FA164694130590B8833411A30FD1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a4a2a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a4a2a.TMP
Size 392B
SHA256 166c2632a7cdc82cd6a6037714aed508187729a0f0f095e7a9df6f947ae6e1c8
MD5 6c377e7e04df33f5c1a605ca3bac7bcb
SHA1 5fc93af1b079675db3c077a2ef47994a1af5a6aa
SHA512 c648674103c4d4e89bcba9a5da50ab51ac94d1b3feac89e1d65b4b1315e7b9f659c08bb4ef3771659eceb1f6dec51510ba1a4cedea18eab97e7143d46e446677
TLSH
T155E004001000447FC51C173103C1101035D1540051D50545D00305D054C13411130DC1
MD5 SHA1 SHA512 TLSH

Submit Download

becaffb4-3ca4-4255-8ccb-6f5abd8992fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\becaffb4-3ca4-4255-8ccb-6f5abd8992fe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c3d8c76bd484a3969f4ad1c007e9d7f964344bee9b53719872d744aed5e4c903
MD5 d6f8eedab37834ee19c940a1551af800
SHA1 3862a78ba5438641f723b9e6893f7df7b2130881
SHA512 656e83019b07ebbc81ec345b10946a19aa1821033ccfcb37883aa942cb5b21c287c02ec132870de56be98216d5476b50d36bdfc9fa96fd1b536cd73b81c6a9ec
TLSH
T164413959B6E91108B3B76E1AAFF6A86D847FBC772E0AD45E10110D4F0A33A40C961737
MD5 SHA1 SHA512 TLSH

Submit Download

MSI608B.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI608B.tmp
Size 1005KB
SHA256 13f59b80cd808dcf423618b27933edeb5dcdab4557e829e8c556f59ace8712ff
MD5 91abcb7053ce69a9242af7f11df404c8
SHA1 3394fcb31c2b2ff79c0b1dd96ef5fb39f1f0dbd2
SHA512 54daadb9c7fbaf7f156b142b1a483258420e7fcc587647aa70bb42ff2b1fef4b2e00014d2d5df5496a340dc018326dbd591be49b6ce5a6d52ab707e3d1182b62
SSDEEP 12288:LvkDN/KhUESP8VIA3Tavr8yntiszTXNNNsxVbqQaVqEJ:LvyN/KhLSP0IADavr8yntzz74Vn0dJ
TLSH
T1FA259E19639412B9E577D17CC9A78E56EAB2BC4A0330A7CB03E556A52F237E0473F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI60EA.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI60EA.tmp
Size 477KB
SHA256 8c85261a486083d9b8ad5cbcb17c2529f268d414ab2a51b396eea245e2ae1e19
MD5 2d106a6f59f5f329c118ae494a7697b3
SHA1 d2a3291a070f25ddbf8ac5dc37cb07a00ea436ba
SHA512 525292e2f9f5eb210f479c3c6828fed0e154609b5bdfbefda7a1f905a74f6ce407839e7e13f1b73c5099e59f2bfbefd21fd48682c8f0c855013df1e3e3e086d3
SSDEEP 6144:DM2oDwJwE5SupfiDUXESC7aTYpDwD4c91CaluBweHWFpf:A2oDrE5Gs87asDwDr9wal0w
TLSH
T16FA48D16B7E101F5E1B7D139CA668E96FAB2BC190724E74B03E496B16F23351463F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6448.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6448.tmp
Size 498KB
SHA256 f0f131145e422d7527b7b0fad75933d4ddf92553075f0909b75dbf734045f3c6
MD5 077290c64fef34c616a2f987395e2e5b
SHA1 db6c27e84e038bd40e114e35e5f855cb2d3bf81f
SHA512 85e006881401237826573df8c6471c254de1c130b2cd975e803c6e0b22f70b09e2a9a5b56e8a38494c3a7ce00b4eadf71cd5b78c04a1e5a894443d40eeded00b
SSDEEP 6144:V3t7L3luyc5/NvSAawSO4FOrawG+R2BwSONOVItBmm1hNe61OIO2u:T7Li/pSATSDFEr2BJuwItB1M61OG
TLSH
T10AB46B16B3A403F5E0B7D139CA57CE96FAB2B8550B20A74703E496B16F23361563F326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.~lock.untitled_001.odt#

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\backup\.~lock.untitled_001.odt#
Size 95B
SHA256 02a4da42c64da4e7f5c6ba77212f86a276ec6c65f1cd8bf88f8003726b579689
MD5 de93054025c28e6c1d7ad062a40bd160
SHA1 11cd4eb8f8516f3aacf7fca29a995e1efd4e0e7b
SHA512 9f1c086a3667a86e12a717b2388ced894fe7f3bdbfb294701b3043da9a89c01c48af9277f68a00a43b6c98007f517fff8a4e11f446dd4f0761a311448037ae2a
TLSH
T182B0120400C717271D0085227309001B2C72A728E010140CAD55D204290A08F39898B0
MD5 SHA1 SHA512 TLSH

Submit Download

untitled_001.odt

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\backup\untitled_001.odt
Size 7KB
SHA256 035ff95f31f77c0aed06dfb3b7dfcc027edcdb902c284f9a7301ea8bb0e647c4
MD5 e28dc38ba16887fc617531ad30ef6f9c
SHA1 33aa7e50953e64ca9c83ca4817b19b744cf8bc9c
SHA512 a62c827b3d7b125d98f7fa16bad24376f70b980449f470f3fc04e0013a7923e873e240cbe463d842e5d448b2693380141c7331ca0806edec4f772e27185a3fea
SSDEEP 192:4Vp+Qyv+VtOTF3VF909O/PNciOjOSfCCeDgZm:4L+EtYy9O/2ioK7
TLSH
T143F19FF23DC7A4AAF023F2F480C06D1568F1676C1169D42FFC6091E431EA8767E5B5A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backenddb.xml

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\extensions\bundled\registry\com.sun.star.comp.deployment.bundle.PackageRegistryBackend\backenddb.xml
Size 5KB
SHA256 8d66289b8bb63b4d86e4795d171442fac2860dba69794dc55e66741e4c48e4ff
MD5 50792ab2934f451d3f4ffd96030a9a9e
SHA1 38c751fb3219537ccb794a0235832efe4e25dd65
SHA512 b3532a4d42e85e68921401016338385ef4ff26910e8b7341b8d928a6ffb800582e451e274995f639a5b0d120bf13d23bed062805a9fdcf4125809ef21ae222cc
SSDEEP 96:+OeO5h8ymOBOJO+OoOM3OUOKOCOUc8wwODOkAORW3LOGO6:+dqh8ymCqBrL3rdRM8wwcYyW3LtT
TLSH
T16EC1A480A69E18635D5BBB9ECC7E436CAB7EB6859539310CFDFF086E818CE4C5223445
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backenddb.xml

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\extensions\bundled\registry\com.sun.star.comp.deployment.configuration.PackageRegistryBackend\backenddb.xml
Size 7KB
SHA256 0f568eeecae324833fdf7d8e579a052d0566220eae3487ea21e4de2f77d06ae6
MD5 6ccd6f869904894dee39b81eef74c595
SHA1 384d5613aac3f012377248caf997c6e09ce47ff8
SHA512 dfbc2fc741cca1f2dbf3451c317e283d823cc0030466d09193442bffc87f7329ec33dda0c83a4580c64fc0a1ed0b6b8fa4d1fdeabbbc7239949742f04328e74a
SSDEEP 48:KXAquhsNbqph7wbqmbqahARbq9hxSbqKbqRhnsbqyDhMtbqQdhtWbqQh6fbqnhT5:upS1R3t
TLSH
T124E1F6E17BAE2C5309979FFE84E953B8BD3F3AE61015115CE6FB23E1425856E130310A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configmgr.ini

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\extensions\bundled\registry\com.sun.star.comp.deployment.configuration.PackageRegistryBackend\configmgr.ini
Size 2KB
SHA256 166f5e78bedd28e05917684aa63770fe06e92a9e5e43a0e1b8ddef1f3fb74166
MD5 dee8a6e04af4deaace7484702955fa69
SHA1 f2d037c0c27182065a0346f8b302ea1e1ea6b4b5
SHA512 61142a9506d8436863770408c31590dcfa0eae2a44cca43bf9d844779c3efa0ee3a1d7aac8b1b72092fe5b54cede52dce4e512fc65824564d1de83b6fa8b3dea
TLSH
T11E4120957A6E68630E9B8FED95AA03E87D3D3BF610071199D2F333F5825096D131314E
MD5 SHA1 SHA512 TLSH

Submit Download

sg30.sdv

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\gallery\sg30.sdv
Size 2KB
SHA256 65365530165a871772e21962a5d7dda107d8d010f329bf59c878eabc3465bbe4
MD5 58b26eb6ab03be973425381f1de81aeb
SHA1 83c8ac739ac0069d7b6fefd84b9317c457b9a821
SHA512 837b1ef7212aed8b8f8106a40a9ea61b14b97f03e455aff35847ea609023fb4ddd454c9546f0cb61acaa434fefa3330069993d7b0ee17102e4fd40d0e4a556b7
TLSH
T144414882B234DA22D08C0A378C42E9CC567ABD00EF18E14330DA33AF0A308F00510363
MD5 SHA1 SHA512 TLSH

Submit Download

registrymodifications.xcu

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\registrymodifications.xcu
Size 110KB
SHA256 2162781e6f383f4968c519717104870e444ea92bc9295e6ecbb4c8a452883aaa
MD5 607fb4ca923e8bc595955e33bd9cb7a5
SHA1 368b9d3f6f0efff30c2884db4c97c46bb5ccd04e
SHA512 dc5f28aeda5860bd05e3a5d3a39c193e40fdcd46d4ae1f9a4b111a87bf930c10ffb7090b870e47eeb5181bb8463e768188dadf02b5e81f77c9ad2fa2318ea5ec
SSDEEP 768:LuraQyGOHDQN1xUqxcA8XRnvXsugTtHklxpkYe2wWA:7MN1xUqxcA8XRn/sugTtHklxpkYe2O
TLSH
T102B3442BF1E98AD88ABC7027CD2116389471C6D8D4A4B4F4D2FFD3BA6897E4951F7201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

registrymodifications.xcu

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\registrymodifications.xcu
Size 107KB
SHA256 36694954b0901b4f0dd85109f74f227171d4c822f317cf08f8a32951e54d695b
MD5 364d54c7853a30c09f40b365ebc80ce3
SHA1 1d64a5ba36e3fb28005892929a394fb3c59cfdd5
SHA512 809c9a0d9f37ceba35e12d4ecddee139ece3260e6f399b1f00972993213b107f2f06f0523145538580bf872001b1dfac6480ed156f382812e97f9a47f6e8141f
SSDEEP 384:9itIB2/ho/pHHSCaqb5ByvWmDBJc2HgiYYJdtBsiK7ycaplOWZCdOHDQN1xUqxcZ:UuraQyGOHDQN1xUqxcA8XRnvX5WA
TLSH
T1E9B3442BF1E98AD88ABC7027CD2116389471C6D9D4A4B0F4D2FFD3BA6897E4951F3205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

registrymodifications.xcu

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\registrymodifications.xcu
Size 1KB
SHA256 e30f97625687fed6998fc0a638254d798e800e381846b7c604130a1fc396f85e
MD5 f4db32170ad9c32c41bea7cc3efc06a9
SHA1 7773da5856f4d7941857c965ad28619d4f037e25
SHA512 ebe897a196a61d24a88a82adb867b7368a780e2a0c4da35292d547973a7b6967357fad630fe33b5e5980756f48fd991293c439c34c476564028c7016ab1ec2d0
TLSH
T17E31495DF146CE48814CB56ADE25423914B0E0ADC4C474F0E2FFD3622486B8410FBF0A
MD5 SHA1 SHA512 TLSH

Submit Download

registrymodifications.xcu

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\registrymodifications.xcu
Size 1KB
SHA256 9a6e3d7eb3a122ae25fdd069c30290707615f807620af1d1cc2013c87b69653b
MD5 10fb499d9138fea0f229dfecf81b67ec
SHA1 b35eb1c1a49535b70e16b7baa587eb993191aced
SHA512 be13ad4d045319694a9e1b7b5cc657e09970ba7857cd342377fb40a12096f6d5be6600f01c44c8939749e0e538f14faa73db6308d5348f6d669bf85e0bd93953
TLSH
T11D31065DF586CE48418CB56ADE25423515B1E0AEC5C4B4F0E2FFD3622486B8414BBB0A
MD5 SHA1 SHA512 TLSH

Submit Download

registrymodifications.xcu

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\registrymodifications.xcu
Size 111KB
SHA256 8181cee0f89b5d57a002c73c1981c6a78ab5f5bfd33bbf0ce907db08fa7d5d93
MD5 eec39abbf57f1bfa5619fa34f4bba348
SHA1 ba7e94564d041bf5c8f8d772574c3dd2520e4b63
SHA512 bdc9b5324a7f7bfa436eb4b784023524c4fe8bf65773413bf34929f1cea6126b7520bad85f544675908e56bb98a12851e8a0f48ca353221ff1292174ccfab46f
SSDEEP 768:NuraQyGOHDQN1xUqxcA8XRnvXsugTtHklxpkYe233GA:FMN1xUqxcA8XRn/sugTtHklxpkYe29
TLSH
T181B3442BF1E98AD88ABC7027CD2116389471C6D8D4A4B4F4D2FFD3BA6897E4951F7201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

registrymodifications.xcu~RFe5dd331.TMP

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\registrymodifications.xcu~RFe5dd331.TMP
Size 1KB
SHA256 034176a0ee6d4460c457618ceba6c35153fb64b3f69ccba869f0e6b3b69eaf4e
MD5 cd6d3fb71a4489630efb8d7d06d98917
SHA1 dbccb7ecd5145b277d409bc86766843748ffdfb8
SHA512 4892f4ce095f31065c3e8e0400932e7d08c791f7b605b37e4db4daa860d3af636662e14b98562719fdefcf275614ee78f45d9362f297916cef49f7aac8465315
TLSH
T15E210B5EF18ACE48414CB56EDE2543391571E0AEC5C474F4E2FBD3A27896A8814BBB0A
MD5 SHA1 SHA512 TLSH

Submit Download

backenddb.xml

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\uno_packages\cache\registry\com.sun.star.comp.deployment.configuration.PackageRegistryBackend\backenddb.xml
Size 135B
SHA256 ac6f585621eb04b34549a95c99e015ad5810a4156e021df46c46731e7a087698
MD5 2bf6ff815e43fff74544416742bbf888
SHA1 8b157b0e33dbf8b374bb6bf874b656c4c040b81d
SHA512 0737375e0308017c2f310e76d0605305feafeb874fa3df970be58d8792732ede009b53bec488e4d5d03080d664b6bd0a71e19c1da7025fef90be560d08aef73c
TLSH
T13FC09BE7950CEC530D558B47A9D45524DD3207D720841049E1FF3D7442116C52259158
MD5 SHA1 SHA512 TLSH

Submit Download

backenddb.xml

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\uno_packages\cache\registry\com.sun.star.comp.deployment.help.PackageRegistryBackend\backenddb.xml
Size 117B
SHA256 845041424286d5b794c11ff0a59d3df289dcb1567fb448ef0b85297108675b46
MD5 9071cb6e373825c7757e03c0390edb51
SHA1 844c752db36f30c13ced0a09bcdd19ab86cb95f3
SHA512 941851d9e73bfa5af6526a035a608425685f470f82bdf20aaa9b7a4724a5ab486e867d7f199a0799b16f4330101a52610635b78c4408d2fcfe5653925ecde1a2
TLSH
T197B0925A9A0CE0234F198585ADE58221EA31035720C02622E2FF3EB451019C8A268199
MD5 SHA1 SHA512 TLSH

Submit Download

stamp.sys

Path C:\Users\Admin\AppData\Roaming\LibreOffice\4\user\uno_packages\cache\stamp.sys
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

LibreOffice 26.8.lnk

Path C:\Users\Public\Desktop\LibreOffice 26.8.lnk
Size 1KB
SHA256 0a32b2b04d23a7b86eb5364449001aa5255b798f9465f5531701e10f568a8b48
MD5 f4e0b282c02a74afb4595fe8e1c24a3c
SHA1 ddda0946723c5c921a2558bbaf22421c6d3d2b0d
SHA512 83f192b44cf68b43217db93422801e025725db908a30fcc206cd54ac0f1ebfc2482036c6a28997917f02d8a90c2df0369a56e6bb8e92aee20064c1cf0b88b86e
TLSH
T19A21061067FA3B20FAE2623440B61A654B37BC07F274D72D500A01CD1979F805F99F13
MD5 SHA1 SHA512 TLSH

Submit Download

LibreOffice 26.8.lnk~RFe5d1177.TMP

Path C:\Users\Public\Desktop\LibreOffice 26.8.lnk~RFe5d1177.TMP
Size 1KB
SHA256 d6fc18e4e141f6949529d2d0f12293b26db1443b0c3803953fc763252d368621
MD5 95edb60969f2accc58e8e1ac55396378
SHA1 38a199ab4e64aa59e91da029bde10f5fcf7dca18
SHA512 c646a791f719d95e89701bea1a31480e601e31f1df71ca6f6a50fee2c6da51a5dbfb474a8083ca51089038a7cfd0f33b9935808daa8e76b4817a27ce9ce67dd9
TLSH
T14C11F91067FA3B24FAE2623040B61B644B3BBC06F6B5975D104601CE1979F409F99F13
MD5 SHA1 SHA512 TLSH

Submit Download

MSIE387.tmp

Path C:\Windows\Installer\MSIE387.tmp
Size 494KB
SHA256 faadfeac9ab29ef5695ba736798c8402e5c387e71dfb13d885587a42638881b2
MD5 86fdd1a7be6541bc5b20f2cede9ec026
SHA1 df954121eeb36f2892140d3e7f8d4b4cdf734c09
SHA512 29760c0e4de6b71c235b91a22a0cd5d29e1280e2440e45b1f43cb56b59ddd1f7e629e4db617774af378a733944052a542a49b2c8190a996467956b613ffb0e99
SSDEEP 6144:kGcfWmgU2iSsmI/hPk3KLQT7Ypp1i2ILQommVCVvROuyk+s:kfWlUFSCZPZL3p1PIUom5ZRX+
TLSH
T196B48E16B7A503F5E0B7D139CA568E96FAB2BC590724E78703E496B12F23390553F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE434.tmp

Path C:\Windows\Installer\MSIE434.tmp
Size 505KB
SHA256 38305570f4bcc0b199a668de815e026ae5577b45a7ee702774a1b1ea31e1b911
MD5 c7e98880e47ee8f913b13da51d3a36b8
SHA1 97d2a2a10e8767f9209962ecdc1836fc4c5c3a40
SHA512 b25d14e8153d459e6267a73d249caa500585accb14724f3bc8ab58d2e83fa59836ada4c6ccc8a3ce3f66178d51b1ee222e64c8468d1bf379fb23183338b8d265
SSDEEP 6144:wBLmUErZ6RhoSxGFD3NBe8OFVBUrX4PQfIGIb+DW21T7:OSUErIRFGl36jU74PQIVbiT
TLSH
T10DB47D1677E503B5E0B7D139CA568E96FAB2BC590720E78B03E491B52F237A0453F326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE4E1.tmp

Path C:\Windows\Installer\MSIE4E1.tmp
Size 1.0MB
SHA256 f8b3847f1e6c8d864a8662aefadd5ec56e53e0a01f1798dc43eb4232bd3998ff
MD5 b5bf82cd150c2c9b00dbee23b2c0771e
SHA1 70b89e9e4cc86efdb5cf00c3d37846ccb951137e
SHA512 bdf8d58b4c70d6af9ddc36e492a86f39bf67c5538911a4eca9a71a83e0af13517c8a6f6b8b50df1e3f2d082b48815a2e1ffaf530861249b98a9561198cfb6bb7
SSDEEP 12288:/JYj3jFrR+HiubeNMeOaab2Wv7sYBYBxZPc2TbDUb:BYTjFrR+CrCefE2hMAPc2j
TLSH
T14D359E1567A402B9E173D17DC9A74A56EAF2BC0A4330ABCB03E556A52F277E0473F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE550.tmp

Path C:\Windows\Installer\MSIE550.tmp
Size 507KB
SHA256 16f811ef317ac5883a4f88071229739369e69ecf134195dcdf21f072a8913cce
MD5 2973280ffbdec9e4fca5172450b55153
SHA1 5518307f16c5129207aead45a62fe11af71803b4
SHA512 1954a5fd4164c7ff4ba683726570150a3bc065142dac6935447ca96f5c0f58cf3078589d5b987e5a27bd3ed47afe1a0028b6cd449adf70c746c5d1a07b52eed1
SSDEEP 6144:VcbpQqYKP2CGivcR/udOn+kHyddfgG/MDkAHfUCn:VcVQqF2Undfdd4GEDt
TLSH
T1A8B47D1677E503F5E0B7D139CA568E96FAB2B8590720E78703E492B52F233A0553F326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policy.1.0.cli_cppuhelper.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_32\policy.1.0.cli_cppuhelper\v4.0_23.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_cppuhelper.dll
Size 13KB
SHA256 a355ec545e90c91321e6c2f079659314a73649f030ea082819c8293f6609c96f
MD5 2ce14cae8f5e8eb9f62462bf1b416b0c
SHA1 0eae7fca059fb3edd2bd33113d24c7bd0d21c275
SHA512 66742b3f615c5d50bbf31775da586e5cf198840a2194dfc5e30d5d94c57fb9af4e5288c124c1d557b1e890a0f826e2d8d106bf6aa76587df314438febf482dd6
SSDEEP 384:aFf2mND0yzrMHvfDdWXSofousWu4qeSOn:efhaurMDySoQuSBe
TLSH
T1E452496A8F2454E6F917EF30A5E9823B6E7177C0AD8149077448009D2F027792F7A37E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cli_oootypes.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\cli_oootypes\v4.0_1.0.9.0__ce2cb7e279207b9e\cli_oootypes.dll
Size 1.1MB
SHA256 311d7a3155416d1caefc137b6c941f15c0915e9d81af303ac9059db8e51b98fb
MD5 92a9d0d2096ab42a9280a9945e928c50
SHA1 ee6e7dd634f33071a97960ad943cc792d510c3b1
SHA512 28ee9a0c3bb3c10d0b98cc7236b0b19fd389f5139dc27d6af6c518c9a836c48140d4b726ea20469a30d9ddf66bf09a18481d840212ee06c553237975576b1496
SSDEEP 12288:gXrvmBxXjlWrCAfYVRdvFfuGQoD9xxAQ3v5Z:gb4xXjlWmT3uGFxxAQ3v5Z
TLSH
T1744552071BE64719EABE377C29B21B108E71FA13DD35C75DC311186C1C6BAA68D21BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cli_ure.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\cli_ure\v4.0_1.0.23.0__ce2cb7e279207b9e\cli_ure.dll
Size 17KB
SHA256 b6c0d67dd8b3948825cbbef2449837fd52f8faaeb47f3b5458082829d2e130dc
MD5 3ce9d0fa0da926e846847d2b9885ea5c
SHA1 d8c6f1edf35c63e975f03761bca61be30045a77f
SHA512 caa4561842e5e456a9bc339c17768a2aa265027dad218f6b21b3c08d4e63af908d76e82e7e75420bb8c70711b6ff74c7480561c8a6a5c9c98cd4943ab35fa1ef
SSDEEP 384:YJduJ4znwqE2mND0yzrhSM+PdWXSofousWu4q2SsT:SuJ7qEhauruPySoQuSB2P
TLSH
T13C826C658F4845E7FDABDB3065FA42295F71A2816D52CD0F648800AC2F42B752F7633E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policy.1.0.cli_basetypes.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.1.0.cli_basetypes\v4.0_20.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_basetypes.dll
Size 13KB
SHA256 a6a4bdb520b16bc1f154656fd23e1f86ab2ab609cf70a4ab630970281a470ac0
MD5 b2d8899f94188a34bfde89a34f59c71d
SHA1 c9933188a683aab5611b88426df25dcdbb193bbb
SHA512 2ed8fc28f8974789d6ac699cf8a89354edf7bb4e52dbabc175a0d4cdcfd3186b7413dbab4e2dfe408b9d4c34b8d8300dafbf89425db5aa0a82ccd673ee3a1f6f
SSDEEP 384:1j2mND0yzrtPF8dWXSofousWu4qVSdMANU:1jhaurdmySoQuSBV2MANU
TLSH
T112524B6A8F2454E6F927EF30A1FD86279EB1B6805C81590B7008019D2F027B83F7677D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policy.1.0.cli_oootypes.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.1.0.cli_oootypes\v4.0_9.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_oootypes.dll
Size 13KB
SHA256 3a36441f06589124240704ff4604434c28faf1b0af72f76516e439ee8173490f
MD5 36963f2865a415f1cbda16925b9d4190
SHA1 4fbb3c05cb30db35ad943c2ceb644a2b2f913d15
SHA512 f92afb90c836b20c8d5d9dab9f4a33887663a0d03d738b19d21e764c2d32bd41196bcde8188900516ae0de6d450f94188d628e2eb95071424f336ef306b039f7
SSDEEP 384:xf3I2mND0yzrkyXYdWXSofousWu4qaS+:xf3Ihaur7oySoQuSBa
TLSH
T175524A6A8F2458E6F927EF3091E9862B6D71B3C15D81490B3448019A2F437792F7937D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policy.1.0.cli_ure.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.1.0.cli_ure\v4.0_23.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_ure.dll
Size 13KB
SHA256 cead1857df6ec155507e49f2e3e33794aa3e82d0079b2cdb876631e7474ba44f
MD5 67b2053daa59e1b3d8c7493f8ec4b1d5
SHA1 52365af2b4059fdcdf15e79c94a8792ee827e329
SHA512 baa28388f364be515ed67c2c721290c7a3e00d3f643059e0170d4bd452c5f4eaa057751bdaf8997555193022843a37def7154bbcef8649dad47027af9865e462
SSDEEP 384:5M2mND0yzraPOadWXSofousWu4q3yASL:5MhaurOhySoQuSB3P
TLSH
T132525B2A8F2454E6F927EF3091F9812A6DB1B6C19D814D4B704805AD2F427B93F3937D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policy.1.0.cli_uretypes.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.1.0.cli_uretypes\v4.0_9.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_uretypes.dll
Size 13KB
SHA256 14c4e516276beb0c22d873cd860ee52cf73b9f08685a1bc9e4596a4883cc1a5a
MD5 c2c586a478972800dc3c76e2d87bf81f
SHA1 ddeef61847655ff00dce5dcde895a905b3de0abd
SHA512 911e0ab343abd348b41762b7109716c9a2e080b55bd8730fd539ebab8e8fb46f77e2d271cb8140854a77868e69aff9cb27d7710994153732b33021a9c83e9dff
SSDEEP 192:0EDB+PBo21ZtDYNDxKy/dRo6KoA8baIWbHPTSofousUwz2T3+4qu+SFkpJ:P72mND0yzrtA8bdWXSofousWu4q7Si
TLSH
T17A525B2A8F2458E6F9579F3095FA823B5DB1B6C05D91490B740C009D2F427782F7937D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Windows\System32\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cli_cppuhelper.dll

Path C:\Windows\assembly\tmp\VVF451BE\cli_cppuhelper.dll
Size 219KB
SHA256 c303b838adb0bbcecda244c431f07f4cdb23a6a33b343855b85c896414fc09df
MD5 e78dcbdaaf07b874d5bd3647ebd5b5e2
SHA1 44123f06ade466c8626a40e664c0ce3a72d833eb
SHA512 b43b0f79639b3226cec485651c4587eecdc4461d2815afce06b98ec301e88dc6617eb88582c557a02f4341ee6a864be2e1498eee845e93381c6560c2c42d6cdb
SSDEEP 3072:yC0nUZ/TY+bYQ4K7vFPVwllhFfYIRxeZI7eDxFqpfS:yxnUZLY+b17jwXhlYIbeDq
TLSH
T19E24193836770D67E9E503F810DB674183B2D9133B2757075196E26A0F823AFEB22796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4148-9132-0x000001BE6B650000-0x000001BE6B658000-memory.dmp

Download

memory/4148-9129-0x000001BE6B670000-0x000001BE6B690000-memory.dmp

Download

memory/4148-9126-0x000001BE6B640000-0x000001BE6B648000-memory.dmp

Download

memory/4148-9123-0x000001BE6B630000-0x000001BE6B63A000-memory.dmp

Download

memory/4148-9747-0x000001BE16690000-0x000001BE166C9000-memory.dmp

Download

memory/4148-9753-0x000001BE6B6A0000-0x000001BE6B6A8000-memory.dmp

Download

memory/4148-9757-0x000001BE6B6B0000-0x000001BE6B6B8000-memory.dmp

Download

memory/4148-9750-0x000001BE6BF70000-0x000001BE6C094000-memory.dmp

Download

memory/4148-9136-0x000001BE6B660000-0x000001BE6B668000-memory.dmp

Download

memory/4148-9140-0x000001BE6B690000-0x000001BE6B698000-memory.dmp

Download

memory/4860-14756-0x00007FFF42F50000-0x00007FFF43F50000-memory.dmp

Download