813d81ed71be50496fcf3fa21409bab06ad586950f5ac47530045bed5f94883d

Analysis

max time kernel
187s
max time network
127s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
16/01/2023, 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Apache_OpenOffice_4.1.13_Win_x86_install_es.exe
Size

125.6MB
MD5

c9951f2d5caac8256213b82c2cb6ae6f
SHA1

d76a5e24896606875ef89d12d4e3d90b3b6361e0
SHA256

813d81ed71be50496fcf3fa21409bab06ad586950f5ac47530045bed5f94883d
SHA512

f28bca5b9830432ba563a6a6ed46cdfe0eb284198ae007f969367d586758f50f2439c366939be5dabd863d35d4bc8d75bbedd25cbc6e3cbce47f87317d46a9de
SSDEEP

3145728:c8BRTVKFlYz8BFu4XhGr9gLoLgsoY/F97FpdIoIRCmGL3Fmqm:fBx6P5ohgLe/F9h3ERCl3st

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
1984	setup.exe
1228	unopkg.exe
1524	unopkg.bin
976	soffice.exe
1880	soffice.bin

Registers COM server for autorun 1 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32\ = "C:\\Program Files (x86)\\OpenOffice 4\\program\\shlxthdl\\shlxthdl_x64.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32\ = "C:\\Program Files (x86)\\OpenOffice 4\\program\\shlxthdl\\propertyhdl_x64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32\ = "C:\\Program Files (x86)\\OpenOffice 4\\program\\shlxthdl\\shlxthdl_x64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32\ = "C:\\Program Files (x86)\\OpenOffice 4\\program\\shlxthdl\\ooofilt_x64.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32\ = "C:\\Program Files (x86)\\OpenOffice 4\\program\\shlxthdl\\shlxthdl_x64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32\ = "C:\\Program Files (x86)\\OpenOffice 4\\program\\shlxthdl\\shlxthdl_x64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe

Loads dropped DLL 64 IoCs

pid	Process
1696	Apache_OpenOffice_4.1.13_Win_x86_install_es.exe
1696	Apache_OpenOffice_4.1.13_Win_x86_install_es.exe
1696	Apache_OpenOffice_4.1.13_Win_x86_install_es.exe
1984	setup.exe
1984	setup.exe
1984	setup.exe
1560	MsiExec.exe
1560	MsiExec.exe
1560	MsiExec.exe
1560	MsiExec.exe
1560	MsiExec.exe
1560	MsiExec.exe
1072	MsiExec.exe
1072	MsiExec.exe
1072	MsiExec.exe
1072	MsiExec.exe
1072	MsiExec.exe
1072	MsiExec.exe
1072	MsiExec.exe
1228	unopkg.exe
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin
1524	unopkg.bin

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.13\Desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\simpress\toolbar\masterviewtoolbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\xslt\export\common\styles\style_collector.xsl	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\exp.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\include\python2.7\graminit.h	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\encodings\ascii.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\encodings\cp950.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\scalc\toolbar\formdesign.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\registry\math.xcd	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\es\internal\url_transfer.htm	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\wizard\letter\nl\off-elegant_l.ott	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\bullets\Bullet06-Square-Purple.svg	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\symbols\Emotion01-Laughing.svg	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\bdb.py	msiexec.exe
File opened for modification	C:\Program Files (x86)\OpenOffice 4\share\prereg\bundled\registry\com.sun.star.comp.deployment.configuration.PackageRegistryBackend\registered_packages.pmap	unopkg.bin
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\dbtable\toolbar\toolbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sdraw\toolbar\connectorsbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\autocorr\acor_es-ES.dat	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\wizard\letter\ru\bus-modern_l.ott	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\encodings\cp862.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\encodings\koi8_u.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\resource\minimizeres.res	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\sg13.sdv	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\rptxml.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\vos3MSC.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\xml\sax\xmlreader.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\arrows\A06-Arrow-Red-Right.svg	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\heapq.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\new.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swform\toolbar\extrusionobjectbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\diagrams\Section-Gears01.svg	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\wizard\bitmap\china.gif	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\wizard\letter\it\pri-mail_l.ott	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\encodings\euc_jisx0213.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\BaseHTTPServer.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sweb\toolbar\frameobjectbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\es\wizard\report\stl-09.ott	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\compileall.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\profile.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\simpress\toolbar\rectanglesbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\htmlexpo\simlast.gif	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\xmlsecurity.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\dbapp\statusbar\statusbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\rulers\grnrulr3.gif	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\fingerprint\quechua.lm	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\SimpleHTTPServer.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\stringprep.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\wsgiref\simple_server.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\Scripts\beanshell\HelloWorld\helloworld.bsh	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\wizard\letter\eu\bus-office_l.ott	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sdraw\toolbar\3dobjectsbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\registry\draw.xcd	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\presets\config\web.soc	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\wizard\bitmap\euro_3.bmp	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\schart\toolbar\symbolshapes.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\fingerprint\tagalog.lm	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\idlelib\macosxSupport.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\formdesign.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\javavm.uno.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\wizard\letter\eu\pri-marine_l.ott	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\wizard\letter\pt\bus-office_l.ott	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\sm.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\writerfilter.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\namingservice.uno.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\finance\Balance-Balanced1.png	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\tmp\5VH089LT\policy.1.0.cli_ure.dll	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerifCondensed-Italic.ttf	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSans.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansMono-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\GenBasR.ttf	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol42.dat	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\assembly\GACLock.dat	msiexec.exe
File created	C:\Windows\assembly\tmp\CXJZISMC\policy.1.0.cli_uretypes.dll	msiexec.exe
File created	C:\Windows\Fonts\Carlito-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSans-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerif.ttf	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol38.dat	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol39.dat	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol40.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF40B.tmp	msiexec.exe
File created	C:\Windows\Fonts\Caladea-BoldItalic.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansCondensed-BoldOblique.ttf	msiexec.exe
File created	C:\Windows\Fonts\GenBasBI.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\8N3EQA6L\Q2XVD6WH	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI45BC.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\MT1HEGY0\cli_uretypes.dll	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansMono-BoldOblique.ttf	msiexec.exe
File created	C:\Windows\assembly\pubpol39.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF46B.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3B01.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4659.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\FDB989OH\policy.1.0.cli_basetypes.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF3FB.tmp	msiexec.exe
File created	C:\Windows\Fonts\Caladea-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\Caladea-Italic.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\8N3EQA6L\policy.1.0.cli_oootypes.dll	msiexec.exe
File created	C:\Windows\Installer\{82948F92-EF8A-4751-BD59-A85CF3343EFB}\soffice.ico	msiexec.exe
File created	C:\Windows\assembly\pubpol38.dat	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol4.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF47C.tmp	msiexec.exe
File created	C:\Windows\Installer\6d37f4.ipi	msiexec.exe
File created	C:\Windows\assembly\tmp\6FGHIZ72\cli_ure.dll	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerif-Italic.ttf	msiexec.exe
File created	C:\Windows\Installer\6d37f6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3959.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3AA2.tmp	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansCondensed.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansMono.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerifCondensed.ttf	msiexec.exe
File created	C:\Windows\Fonts\GenBasI.ttf	msiexec.exe
File created	C:\Windows\Fonts\GenBkBasB.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\O6JI7NRL\policy.1.0.cli_cppuhelper.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\PublisherPolicy.tme	msiexec.exe
File created	C:\Windows\assembly\tmp\LLN1NKTL\cli_basetypes.dll	msiexec.exe
File created	C:\Windows\Fonts\Carlito-Italic.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerif-BoldItalic.ttf	msiexec.exe
File created	C:\Windows\Fonts\opens___.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\KGA0NDRL\cli_cppuhelper.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol41.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\6d37f4.ipi	msiexec.exe
File created	C:\Windows\assembly\tmp\CXJZISMC\FM552B2Y	msiexec.exe
File created	C:\Windows\Fonts\Carlito-Regular.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansCondensed-Bold.ttf	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF49D.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\assembly\tmp\5VH089LT\SFOPW2FS	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.ImpressTemplate.1\shellex\PropertySheetHandlers	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\opendocument.CalcDocument.1\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\opendocument.MathDocument.1\Insertable	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenOffice.Xlsm\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.stc\shellex\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\29F84928A8FE1574DB958AC53F43E3BF\gm_r_Ure_Hidden	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32\ = "C:\\Program Files (x86)\\OpenOffice 4\\program\\shlxthdl\\shlxthdl.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\soffice.StarImpressDocument.6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Xls\ = "Hoja de trabajo de Microsoft Excel 97-2003"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Doc	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Potx\DefaultIcon\ = "C:\\Program Files (x86)\\OpenOffice 4\\program\\soffice.exe,34"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenOffice.Pptx\shell\new	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{D2D59CD1-0A6A-4D36-AE20-47817077D57C}\Programmable	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.DrawTemplate.1\shellex\PropertySheetHandlers\MyPropSheet1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.DatabaseDocument.1\ = "Base de datos de OpenDocument"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.ott	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\soffice.StarImpressDocument.6\protocol\StdFileEditing\verb\-2	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarImpressDocument.6\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\opendocument.CalcTemplate.1\shellex\PropertySheetHandlers\MyPropSheet1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{EE5D1EA4-D445-4289-B2FC-55FC93693917}\AuxUserType\3	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{EE5D1EA4-D445-4289-B2FC-55FC93693917}\verb\-2	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.dotx\OpenWithProgIDs	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.DrawDocument.1\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.MathDocument.1\protocol\StdFileEditing\verb\-1\ = "&Show"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Rtf\shell\printto\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\soffice.StarWriterDocument.6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Potx\shell\ = "new"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Potx\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenOffice.Pptm\shell\new\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Pptm\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{448BB771-CFE2-47C4-BCDF-1FBF378E202C}\MiscStatus\ = "16"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.sxc\OpenWithProgIDs	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.CalcDocument.1\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.DatabaseDocument.1\shell\open\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\sbase.exe\" -o \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.WriterDocument.1\shell\print\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\soffice.exe\" -p \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\opendocument.WriterTemplate.1\shellex\PropertySheetHandlers\MyPropSheet1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\29F84928A8FE1574DB958AC53F43E3BF\gm_p_Wrt_MSO_Reg = "gm_p_Wrt"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{7B342DC4-139A-4a46-8A93-DB0827CCEE9C}\DataFormats\GetSet\1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.CalcTemplate.1\ = "Plantilla de hoja de cálculo de OpenDocument"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenOffice.Xlsb	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\29F84928A8FE1574DB958AC53F43E3BF\gm_o_Onlineupdate = "gm_Optional"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.odf\shellex\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}\ = "{3B092F0C-7696-40E3-A80F-68D74DA84210}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Xltx\ = "Plantilla de Microsoft Excel"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Docm\shell\open\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\\\swriter.exe\" -o \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{41662FC2-0D57-4aff-AB27-AD2E12E7C273}\DataFormats\GetSet\2\ = "2,1,16,1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2D59CD1-0A6A-4D36-AE20-47817077D57C}\Insertable\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\opendocument.ImpressTemplate.1\shell\print\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.sxd\PersistentHandler	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{D0484DE6-AAEE-468a-991F-8D4B0737B57A}\verb\0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Ppt\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xba\ = "soffice.StarConfigFile.6"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7FA8AE11-B3E3-4D88-AABF-255526CD1CE8}\VersionIndependentProgID\ = "opendocument.CalcDocument.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.DrawDocument.1\shell\print	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenOffice.Xlt\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Xltm\DefaultIcon\ = "C:\\Program Files (x86)\\OpenOffice 4\\program\\soffice.exe,30"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Xltm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\29F84928A8FE1574DB958AC53F43E3BF\gm_r_Reg_Ppt = "gm_p_Impress_MSO_Reg"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlsm\OpenWithProgIDs\OpenOffice.Xlsm	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.DrawDocument.1\protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Pptx	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarDrawTemplate.6\shell\print\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\soffice.StarMathDocument.6\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7FA8AE11-B3E3-4D88-AABF-255526CD1CE8}\AuxUserType\2\ = "OpenOffice"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1916	msiexec.exe
1916	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1640	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1916	msiexec.exe
Token: SeTakeOwnershipPrivilege	1916	msiexec.exe
Token: SeSecurityPrivilege	1916	msiexec.exe
Token: SeCreateTokenPrivilege	1640	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1640	msiexec.exe
Token: SeLockMemoryPrivilege	1640	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1640	msiexec.exe
Token: SeMachineAccountPrivilege	1640	msiexec.exe
Token: SeTcbPrivilege	1640	msiexec.exe
Token: SeSecurityPrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeLoadDriverPrivilege	1640	msiexec.exe
Token: SeSystemProfilePrivilege	1640	msiexec.exe
Token: SeSystemtimePrivilege	1640	msiexec.exe
Token: SeProfSingleProcessPrivilege	1640	msiexec.exe
Token: SeIncBasePriorityPrivilege	1640	msiexec.exe
Token: SeCreatePagefilePrivilege	1640	msiexec.exe
Token: SeCreatePermanentPrivilege	1640	msiexec.exe
Token: SeBackupPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeShutdownPrivilege	1640	msiexec.exe
Token: SeDebugPrivilege	1640	msiexec.exe
Token: SeAuditPrivilege	1640	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1640	msiexec.exe
Token: SeChangeNotifyPrivilege	1640	msiexec.exe
Token: SeRemoteShutdownPrivilege	1640	msiexec.exe
Token: SeUndockPrivilege	1640	msiexec.exe
Token: SeSyncAgentPrivilege	1640	msiexec.exe
Token: SeEnableDelegationPrivilege	1640	msiexec.exe
Token: SeManageVolumePrivilege	1640	msiexec.exe
Token: SeImpersonatePrivilege	1640	msiexec.exe
Token: SeCreateGlobalPrivilege	1640	msiexec.exe
Token: SeCreateTokenPrivilege	1640	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1640	msiexec.exe
Token: SeLockMemoryPrivilege	1640	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1640	msiexec.exe
Token: SeMachineAccountPrivilege	1640	msiexec.exe
Token: SeTcbPrivilege	1640	msiexec.exe
Token: SeSecurityPrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeLoadDriverPrivilege	1640	msiexec.exe
Token: SeSystemProfilePrivilege	1640	msiexec.exe
Token: SeSystemtimePrivilege	1640	msiexec.exe
Token: SeProfSingleProcessPrivilege	1640	msiexec.exe
Token: SeIncBasePriorityPrivilege	1640	msiexec.exe
Token: SeCreatePagefilePrivilege	1640	msiexec.exe
Token: SeCreatePermanentPrivilege	1640	msiexec.exe
Token: SeBackupPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeShutdownPrivilege	1640	msiexec.exe
Token: SeDebugPrivilege	1640	msiexec.exe
Token: SeAuditPrivilege	1640	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1640	msiexec.exe
Token: SeChangeNotifyPrivilege	1640	msiexec.exe
Token: SeRemoteShutdownPrivilege	1640	msiexec.exe
Token: SeUndockPrivilege	1640	msiexec.exe
Token: SeSyncAgentPrivilege	1640	msiexec.exe
Token: SeEnableDelegationPrivilege	1640	msiexec.exe
Token: SeManageVolumePrivilege	1640	msiexec.exe
Token: SeImpersonatePrivilege	1640	msiexec.exe
Token: SeCreateGlobalPrivilege	1640	msiexec.exe
Token: SeCreateTokenPrivilege	1640	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1640	msiexec.exe
1640	msiexec.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1984	1696	Apache_OpenOffice_4.1.13_Win_x86_install_es.exe	27
PID 1696 wrote to memory of 1984	1696	Apache_OpenOffice_4.1.13_Win_x86_install_es.exe	27
PID 1696 wrote to memory of 1984	1696	Apache_OpenOffice_4.1.13_Win_x86_install_es.exe	27
PID 1696 wrote to memory of 1984	1696	Apache_OpenOffice_4.1.13_Win_x86_install_es.exe	27
PID 1696 wrote to memory of 1984	1696	Apache_OpenOffice_4.1.13_Win_x86_install_es.exe	27
PID 1696 wrote to memory of 1984	1696	Apache_OpenOffice_4.1.13_Win_x86_install_es.exe	27
PID 1696 wrote to memory of 1984	1696	Apache_OpenOffice_4.1.13_Win_x86_install_es.exe	27
PID 1984 wrote to memory of 1640	1984	setup.exe	29
PID 1984 wrote to memory of 1640	1984	setup.exe	29
PID 1984 wrote to memory of 1640	1984	setup.exe	29
PID 1984 wrote to memory of 1640	1984	setup.exe	29
PID 1984 wrote to memory of 1640	1984	setup.exe	29
PID 1984 wrote to memory of 1640	1984	setup.exe	29
PID 1984 wrote to memory of 1640	1984	setup.exe	29
PID 1916 wrote to memory of 1560	1916	msiexec.exe	31
PID 1916 wrote to memory of 1560	1916	msiexec.exe	31
PID 1916 wrote to memory of 1560	1916	msiexec.exe	31
PID 1916 wrote to memory of 1560	1916	msiexec.exe	31
PID 1916 wrote to memory of 1560	1916	msiexec.exe	31
PID 1916 wrote to memory of 1560	1916	msiexec.exe	31
PID 1916 wrote to memory of 1560	1916	msiexec.exe	31
PID 1916 wrote to memory of 1072	1916	msiexec.exe	35
PID 1916 wrote to memory of 1072	1916	msiexec.exe	35
PID 1916 wrote to memory of 1072	1916	msiexec.exe	35
PID 1916 wrote to memory of 1072	1916	msiexec.exe	35
PID 1916 wrote to memory of 1072	1916	msiexec.exe	35
PID 1916 wrote to memory of 1072	1916	msiexec.exe	35
PID 1916 wrote to memory of 1072	1916	msiexec.exe	35
PID 1072 wrote to memory of 1228	1072	MsiExec.exe	37
PID 1072 wrote to memory of 1228	1072	MsiExec.exe	37
PID 1072 wrote to memory of 1228	1072	MsiExec.exe	37
PID 1072 wrote to memory of 1228	1072	MsiExec.exe	37
PID 1228 wrote to memory of 1524	1228	unopkg.exe	38
PID 1228 wrote to memory of 1524	1228	unopkg.exe	38
PID 1228 wrote to memory of 1524	1228	unopkg.exe	38
PID 1228 wrote to memory of 1524	1228	unopkg.exe	38
PID 976 wrote to memory of 1880	976	soffice.exe	41
PID 976 wrote to memory of 1880	976	soffice.exe	41
PID 976 wrote to memory of 1880	976	soffice.exe	41
PID 976 wrote to memory of 1880	976	soffice.exe	41

C:\Users\Admin\AppData\Local\Temp\Apache_OpenOffice_4.1.13_Win_x86_install_es.exe
"C:\Users\Admin\AppData\Local\Temp\Apache_OpenOffice_4.1.13_Win_x86_install_es.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\Desktop\OpenOffice 4.1.13 (es) Installation Files\setup.exe
  "C:\Users\Admin\Desktop\OpenOffice 4.1.13 (es) Installation Files\setup.exe" -lang 1034
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\SysWOW64\\msiexec.exe SETUP_USED=1 /I "C:\Users\Admin\Desktop\OpenOffice 4.1.13 (es) Installation Files\openoffice4113.msi"
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1640

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4EDBA1A4B1180047D0AD81B2DF0314D4 C
  2⤵
  - Loads dropped DLL
  PID:1560
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 22B793CE8AA4C7CE0EA0F5C842291B15
  2⤵
  - Registers COM server for autorun
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Program Files (x86)\OpenOffice 4\program\unopkg.exe
    "C:\Program Files (x86)\OpenOffice 4\program\unopkg.exe" sync
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Program Files (x86)\OpenOffice 4\program\unopkg.bin
      "C:\Program Files (x86)\OpenOffice 4\program\unopkg.exe" sync "-env:INIFILENAME=vnd.sun.star.pathname:C:\Program Files (x86)\OpenOffice 4\program\redirect.ini" "-env:OOO_CWD=2C:\\Windows\\SysWOW64"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      PID:1524

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1928

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000304" "0000000000000340"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1484

C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
"C:\Program Files (x86)\OpenOffice 4\program\soffice.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976
- C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
  "C:\Program Files (x86)\OpenOffice 4\program\soffice.exe" "-env:OOO_CWD=2C:\\Program Files (x86)\\OpenOffice 4"
  2⤵
  - Executes dropped EXE
  PID:1880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\OpenOffice 4\program\comphelpMSC.dll

Filesize
1.1MB

MD5
1b6d27e6cc652806494eabcc94677f62

SHA1
d018b46262dd64a0d5daf274614cc3a37aa15307

SHA256
668062b5d57af7d42a8f7dba4044dd6eb6be3e29656abc4ff91334c76a475631

SHA512
a2335c52680a5ef06a74f85614e9cc543fb96f81d9fb70eeb06ba595585bde9945d8128344fe34b32bae830989971c47420ad282e2df514ddfa39a4e3941f8aa

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\cppu3.dll

Filesize
232KB

MD5
0671282f3da01c57ba0945af8e7133ba

SHA1
a9046c0d848a20b018d4369799489a18f070ba4e

SHA256
72e82a9461a67e4636e802d3e85d8ae3041e75b33b6e612221046b4e8097e009

SHA512
2411f7e93434f121a947850abec1684e5357dab12b2a7960fdb6ad444f056a19f46930158596ee9be9e896bc65b1a5a25951ae7777416ff46c46f08fec8d42fe

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\cppuhelper3MSC.dll

Filesize
574KB

MD5
e669a99d5f3643eedd940635dc333cc0

SHA1
1c41b7e04f4118b94466933a623406e9b03a8c30

SHA256
89d5cb7183ef7752e34dc47ae1bd0f466201dca0c213d456be1b1dcd61783b5a

SHA512
0f457e7d044ed964cae769601efbe1343db8364b1de6102c80cf1533e5ba2e7eaa2a2f452365f424ccaf1d0b625cc2a872e0b4b26edb72a2003ed9778f0ec5c6

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\i18nisolang1MSC.dll

Filesize
26KB

MD5
ca02711921797c8dfc99a2d3577bd181

SHA1
f310a410321ce866860cf729a760ba52c875af15

SHA256
afa436a57ce57c1e05f2109086680e9a4f7e387cd16bf70075edba7c075debd4

SHA512
3c8b4379a6fb64d13104fe762c02fea57d896514a319e9611c7f1ae3b3c8687aba5a8dd3b438c1359210443fc59ffc8e572ec58d3d3b580ffe3ba14a30724940

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\redirect.ini

Filesize
54B

MD5
472e9bc3de46961d70744c1ad932f44f

SHA1
94e39e169b64f363a36e64721f6f07c6444c5d34

SHA256
27e2c33328e4e6b117f41deccc7be249e0f2b8f9120a3e3eecd3c852d0c3293e

SHA512
c3e99efd3510319db52eccbd265a49c221aa8ee283e7693474953b442fbdd3531495d4f4bdf6073c5c2cf738cae6fa10b7cf1e3ee93aede9dc1398cd84ecc188

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\sal3.dll

Filesize
1.7MB

MD5
0ba711682f332d92277f5d78bb77e476

SHA1
643f0b17ea7eb615b9607dae80c1119b6cf6a792

SHA256
35683decb6facca5cf1ddb618ff7b1eed31fe51a9e0c6dfabfadab203cc791d0

SHA512
e7f695db220abb824ed934386c7a5ffc99ea3cc53c7d677e4cb3ecd3b56a805ae1606888410f60bf64f6ae1d6d64eb01d4926af4f2c647e9b71a948e05d126d7

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\salhelper3MSC.dll

Filesize
13KB

MD5
a1ed9b03ba50b68be220855bda319a24

SHA1
bc224db8baa65375dd31ddc3b63d09b17c520094

SHA256
eb903a80f2cd5ace2d0370219b62355c443f4a35ce98e1485303d6e93e7a65ac

SHA512
ee1e47859224887135e4dbd5d6f168cc49af40c9e8b3d470f66f2a934f58638973745a40c535b45742cff1493a962464562940897799c4afe880a91c64b0bb65

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\ucbhelper4MSC.dll

Filesize
379KB

MD5
c7ab283ba4ab7559788ffa567c197d52

SHA1
f7372ed5df8e4342e8494b5b69f4ac4b365570fd

SHA256
b495aae8c8bb02c03934ab2e64c7cf8355e4d7276fe18f319de1c93bd724d8ac

SHA512
2aaf52df17abfc1c39cc74c69c81e9ea697c508f4992e2eb1040a509f4899efcd9c493097d7cbb6b147185faba6df9826d89fc269f2765a8ef279daf0073f31e

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\unopkg.bin

Filesize
40KB

MD5
bff6305ad0ef959bb2b5c4d71d8e553a

SHA1
794f3056813ee3bb906e062db74f6a922f416b43

SHA256
6d174ef2680285da4d48c0fabf67237793c6239fe79528435f5038a9e56e6842

SHA512
df95b1db4694ac1c65ce247a0b0a33f47df6793819d959866e68d86f0b1dd776438567f2debd6892198ae2bcc3ef5b28fb01000a033cc7313a10d8a4c4b18dd3

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\unopkg.bin

Filesize
40KB

MD5
bff6305ad0ef959bb2b5c4d71d8e553a

SHA1
794f3056813ee3bb906e062db74f6a922f416b43

SHA256
6d174ef2680285da4d48c0fabf67237793c6239fe79528435f5038a9e56e6842

SHA512
df95b1db4694ac1c65ce247a0b0a33f47df6793819d959866e68d86f0b1dd776438567f2debd6892198ae2bcc3ef5b28fb01000a033cc7313a10d8a4c4b18dd3

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\unopkg.exe

Filesize
11KB

MD5
9c081349b4eda95e0cbe7d7fae52d74d

SHA1
0e8b01d2c0bf7d82f4d0cd0c7ac74edd671d4604

SHA256
d529fe00e7651336f2aac557165107aaf5b578cda8f209dfcc9adff6dce56943

SHA512
bede9b7be41d7deecde46da5e78f0fdf510755c2aeeaa692263f31d1494647c298d094b75e6cf51670401dbfc05f6a0fee2f2b3e63907872b68c36b34d6fd1f2

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\unopkg.exe

Filesize
11KB

MD5
9c081349b4eda95e0cbe7d7fae52d74d

SHA1
0e8b01d2c0bf7d82f4d0cd0c7ac74edd671d4604

SHA256
d529fe00e7651336f2aac557165107aaf5b578cda8f209dfcc9adff6dce56943

SHA512
bede9b7be41d7deecde46da5e78f0fdf510755c2aeeaa692263f31d1494647c298d094b75e6cf51670401dbfc05f6a0fee2f2b3e63907872b68c36b34d6fd1f2

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\unopkgapp.dll

Filesize
111KB

MD5
239799b41f37d929dc30a96ab7bc5531

SHA1
58a684de318215aa601fe8eb9594e6491d44fbe9

SHA256
8e05a8d7330bcd654febb1d805b45cd500f699e10bac78b2f3aa12212cc7b2b5

SHA512
bec2706e65c3c4b4ce6247122734fa40c74faa8956880e1494444279f510318ae3a137ef0ffb7b81cb3370558ff31b2a51368af5ab806eff2009599109888fdf

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\utl.dll

Filesize
1.1MB

MD5
0e593b6d6ab80c07251e1e00a8839bce

SHA1
1883330c164d57944aba5b8b473d8e29d84bb6b8

SHA256
2780321e3ac8fd8f8895ddf597ea8d7d44b63cd3ae8c604859388510d27dd93c

SHA512
c21bd821cd41c53cc41c012c83348bd844daa240db5f94e2a02c6362699376c88f4b201ee804a35e22f8ede8d923bb3aae729fcae3c981b8fea8678a669af568

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\uwinapi.dll

Filesize
83KB

MD5
72a9d2eaa9f6a1d5e6d895bac340c218

SHA1
11df71fbc35c0abc4a5cd021ffa5d2b2dd19a144

SHA256
da1cc18db2dfbbfd47189e5eb3b0a9541b093a889e55f3ff80fcf6280c1abfc1

SHA512
6379fc2a87a661be473fc908fcdb6028a2f1a3d398a8a0d4898c0408edccd6bc6b9607f94cdb1051d3f81076b5a595bf157e11e934ce6f5575218cb230d06e7f

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\vos3MSC.dll

Filesize
97KB

MD5
f75036808b03a7dc79474cd77d27cb38

SHA1
04ad26252e5362d74dbf41f6f5f70ec6623f3796

SHA256
e42a2b43a3fa274785db18eea6e2b529c36bb97cb8403cac72e83971f25d9d2a

SHA512
4739417ea8f6562b5cf16cdb727f19b60987e8ce91371900d2de9739b6ed9308b837e4e95812e9f0bf4a2d340f5545b153b0505b14fd56afa065b4a2fddfc4ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI84F9.tmp

Filesize
164KB

MD5
cd1a6d212672f41231c357abb0731a72

SHA1
978d2fb2a6b46a8c97413a2b90ab541ef6b0fcaf

SHA256
e5b31d39e5728cf3af45bdbdfa80de21cdbb6cda8fc4680f76fa7fb810751355

SHA512
5ece22a2b15fb30b7319a48ee9ca9434fba6b20161083f033a0bdccf677d0a77f18116bb08200821b170e0ffe51215b6e972bcc899df86ee0223bfb1836f5f94

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8642.tmp

Filesize
164KB

MD5
cd1a6d212672f41231c357abb0731a72

SHA1
978d2fb2a6b46a8c97413a2b90ab541ef6b0fcaf

SHA256
e5b31d39e5728cf3af45bdbdfa80de21cdbb6cda8fc4680f76fa7fb810751355

SHA512
5ece22a2b15fb30b7319a48ee9ca9434fba6b20161083f033a0bdccf677d0a77f18116bb08200821b170e0ffe51215b6e972bcc899df86ee0223bfb1836f5f94

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI89EB.tmp

Filesize
88KB

MD5
6e81766d09bedaf675e37d997fa85124

SHA1
5187f9b0dc88a67cb7523521517505362ff59946

SHA256
885b60e0c9feee08061c678ff11bf4c8aafd13338dfbc7e3d63c52a6398b79a7

SHA512
9c2215ec7754b46f40cc116f8adead17e40119f93146f81cd1243a9e00e518276f24fa61f8c0dd4c22c0268c8287a7cec7554a9512f2fcbb782705bba0462f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8B33.tmp

Filesize
164KB

MD5
cd1a6d212672f41231c357abb0731a72

SHA1
978d2fb2a6b46a8c97413a2b90ab541ef6b0fcaf

SHA256
e5b31d39e5728cf3af45bdbdfa80de21cdbb6cda8fc4680f76fa7fb810751355

SHA512
5ece22a2b15fb30b7319a48ee9ca9434fba6b20161083f033a0bdccf677d0a77f18116bb08200821b170e0ffe51215b6e972bcc899df86ee0223bfb1836f5f94

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8B63.tmp

Filesize
164KB

MD5
cd1a6d212672f41231c357abb0731a72

SHA1
978d2fb2a6b46a8c97413a2b90ab541ef6b0fcaf

SHA256
e5b31d39e5728cf3af45bdbdfa80de21cdbb6cda8fc4680f76fa7fb810751355

SHA512
5ece22a2b15fb30b7319a48ee9ca9434fba6b20161083f033a0bdccf677d0a77f18116bb08200821b170e0ffe51215b6e972bcc899df86ee0223bfb1836f5f94

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA72E.tmp

Filesize
164KB

MD5
cd1a6d212672f41231c357abb0731a72

SHA1
978d2fb2a6b46a8c97413a2b90ab541ef6b0fcaf

SHA256
e5b31d39e5728cf3af45bdbdfa80de21cdbb6cda8fc4680f76fa7fb810751355

SHA512
5ece22a2b15fb30b7319a48ee9ca9434fba6b20161083f033a0bdccf677d0a77f18116bb08200821b170e0ffe51215b6e972bcc899df86ee0223bfb1836f5f94

Download Submit
C:\Users\Admin\Desktop\OpenOffice 4.1.13 (es) Installation Files\openoffice1.cab

Filesize
115.8MB

MD5
53a03161ef99899b095d37f2215ab607

SHA1
7304a4a6cb3c96eb9e44d39efe6f554685fa72b3

SHA256
6c682d13a6f1aeafabe6523061896d8bcbdda44b50f133181c49e1105b69c3bd

SHA512
5fb4f1af26fa02a5ed7a3d1b03a59bac1f652b2688060bf66edb28f9277d1e3d90fd71d33825cd2e7f350514776e63b7859eb2ef4f3d29a91958607f4448300b

Download Submit
C:\Users\Admin\Desktop\OpenOffice 4.1.13 (es) Installation Files\openoffice4113.msi

Filesize
2.4MB

MD5
513d57a48400c8a0ba3cdfea466bff0d

SHA1
14b8deea86977719384485767b769e90c29317e5

SHA256
0696278593a9ce17bbcef311f1e32798a7e72f4cab5a77b21e5cbc3a321496cf

SHA512
df7580e3859fd4eda5042b5797a6dd8053353b5358d9fe58c5b023c822e348147985c91a08af232b5a3ced28e834a5ce62b3f379ab799a15586afbe8c69aa66d

Download Submit
C:\Users\Admin\Desktop\OpenOffice 4.1.13 (es) Installation Files\setup.exe

Filesize
468KB

MD5
d5c6a89f1417cdd3a1045a3c64ddaf40

SHA1
c8f44df2de8c60670789a9841378549787e4bb8d

SHA256
f4e79ca6cb06b55dc521b2c65d1fb7c50c3a71e60c594cf160f89ce61f195c75

SHA512
56e5bca809a4bfe865e9690b60c82c1e17a0b4fac0f3ac18d07c1ac69abbc8d1476e9bc0d8d89e7257de0dbd63bbf87eb848906fe2b03a04ff5edf3c7ddd8418

Download Submit
C:\Users\Admin\Desktop\OpenOffice 4.1.13 (es) Installation Files\setup.exe

Filesize
468KB

MD5
d5c6a89f1417cdd3a1045a3c64ddaf40

SHA1
c8f44df2de8c60670789a9841378549787e4bb8d

SHA256
f4e79ca6cb06b55dc521b2c65d1fb7c50c3a71e60c594cf160f89ce61f195c75

SHA512
56e5bca809a4bfe865e9690b60c82c1e17a0b4fac0f3ac18d07c1ac69abbc8d1476e9bc0d8d89e7257de0dbd63bbf87eb848906fe2b03a04ff5edf3c7ddd8418

Download Submit
C:\Users\Admin\Desktop\OpenOffice 4.1.13 (es) Installation Files\setup.ini

Filesize
282B

MD5
45a97f57a8ae9544f0c14d95b6bf6fcc

SHA1
e76260e10a233171d0fae4225b2141ee38ac270f

SHA256
6f9c194c5aff22ef43b7fc83f4c61afe699c466ec6d50a069f88fca06ab8b6eb

SHA512
ad238217436c297ae52108c4db01721652a2d6e85c4c8cecd7a47af0a980fdd7ff6150e82b14c98fa5ca1900bf0a82eed7eb0ce0e20eb49271dbf05f6c95fc0d

Download Submit
C:\Windows\Installer\MSI3959.tmp

Filesize
164KB

MD5
cd1a6d212672f41231c357abb0731a72

SHA1
978d2fb2a6b46a8c97413a2b90ab541ef6b0fcaf

SHA256
e5b31d39e5728cf3af45bdbdfa80de21cdbb6cda8fc4680f76fa7fb810751355

SHA512
5ece22a2b15fb30b7319a48ee9ca9434fba6b20161083f033a0bdccf677d0a77f18116bb08200821b170e0ffe51215b6e972bcc899df86ee0223bfb1836f5f94

Download Submit
C:\Windows\Installer\MSI3AA2.tmp

Filesize
129KB

MD5
e39572d0b4e5da5eee254c7b99759f0c

SHA1
8e2ad7f60ca121953f117c624f7d472836e79fef

SHA256
e07c181c8aad5f0080dbe3e421347b488eb06cb7e44511368ac31e28ae14e5a3

SHA512
71cd8ea93015370126b6b5e0c540af1ee7d0b2fe2fc92649bb0a742453590e9cd2e4a6e0fad0d5888bf7a32209af913d3e492534cdd15f3d8d551d20cb44616c

Download Submit
C:\Windows\Installer\MSI3B01.tmp

Filesize
164KB

MD5
cd1a6d212672f41231c357abb0731a72

SHA1
978d2fb2a6b46a8c97413a2b90ab541ef6b0fcaf

SHA256
e5b31d39e5728cf3af45bdbdfa80de21cdbb6cda8fc4680f76fa7fb810751355

SHA512
5ece22a2b15fb30b7319a48ee9ca9434fba6b20161083f033a0bdccf677d0a77f18116bb08200821b170e0ffe51215b6e972bcc899df86ee0223bfb1836f5f94

Download Submit
C:\Windows\Installer\MSI3B5F.tmp

Filesize
131KB

MD5
56f5894b2648d7a12d2570107653a73c

SHA1
2e0b00970e8a88f84b4e0dba9f89fc678d6af2e3

SHA256
310839ebbf6105fc6cd042c4f2580aff69b473c08b57afab67154235511d2a37

SHA512
5e93f044fdfd028ee798c404062fe27cb3856137b09130c25a86faf9981271911dd94dae6ada19a965754c5e4de6c95c8fc097fc85eb81d1d5b35e7ce26b12e0

Download Submit
C:\Windows\Installer\MSI45BC.tmp

Filesize
130KB

MD5
a19eeb58a920971c79dc1aa9e7e7b139

SHA1
5f26c713be69a17b66a44f87d8432a593ca465f8

SHA256
81796d5cbcd2758ff1930b780d94952c3274cb7bd729cd8568e8c531cef221c4

SHA512
ea069e40c15f0fb3e24a0cc876eeeabe7f90ad7c18fd685430c74d70c353e408ad8ac7046676d71ec4c880aed7ad5d1a2b301921472007a3be7835fc0d123863

Download Submit
C:\Windows\Installer\MSIE9EA.tmp

Filesize
164KB

MD5
cd1a6d212672f41231c357abb0731a72

SHA1
978d2fb2a6b46a8c97413a2b90ab541ef6b0fcaf

SHA256
e5b31d39e5728cf3af45bdbdfa80de21cdbb6cda8fc4680f76fa7fb810751355

SHA512
5ece22a2b15fb30b7319a48ee9ca9434fba6b20161083f033a0bdccf677d0a77f18116bb08200821b170e0ffe51215b6e972bcc899df86ee0223bfb1836f5f94

Download Submit
\Program Files (x86)\OpenOffice 4\program\comphelpMSC.dll

Filesize
1.1MB

MD5
1b6d27e6cc652806494eabcc94677f62

SHA1
d018b46262dd64a0d5daf274614cc3a37aa15307

SHA256
668062b5d57af7d42a8f7dba4044dd6eb6be3e29656abc4ff91334c76a475631

SHA512
a2335c52680a5ef06a74f85614e9cc543fb96f81d9fb70eeb06ba595585bde9945d8128344fe34b32bae830989971c47420ad282e2df514ddfa39a4e3941f8aa

Download Submit
\Program Files (x86)\OpenOffice 4\program\cppu3.dll

Filesize
232KB

MD5
0671282f3da01c57ba0945af8e7133ba

SHA1
a9046c0d848a20b018d4369799489a18f070ba4e

SHA256
72e82a9461a67e4636e802d3e85d8ae3041e75b33b6e612221046b4e8097e009

SHA512
2411f7e93434f121a947850abec1684e5357dab12b2a7960fdb6ad444f056a19f46930158596ee9be9e896bc65b1a5a25951ae7777416ff46c46f08fec8d42fe

Download Submit
\Program Files (x86)\OpenOffice 4\program\cppuhelper3MSC.dll

Filesize
574KB

MD5
e669a99d5f3643eedd940635dc333cc0

SHA1
1c41b7e04f4118b94466933a623406e9b03a8c30

SHA256
89d5cb7183ef7752e34dc47ae1bd0f466201dca0c213d456be1b1dcd61783b5a

SHA512
0f457e7d044ed964cae769601efbe1343db8364b1de6102c80cf1533e5ba2e7eaa2a2f452365f424ccaf1d0b625cc2a872e0b4b26edb72a2003ed9778f0ec5c6

Download Submit
\Program Files (x86)\OpenOffice 4\program\i18nisolang1MSC.dll

Filesize
26KB

MD5
ca02711921797c8dfc99a2d3577bd181

SHA1
f310a410321ce866860cf729a760ba52c875af15

SHA256
afa436a57ce57c1e05f2109086680e9a4f7e387cd16bf70075edba7c075debd4

SHA512
3c8b4379a6fb64d13104fe762c02fea57d896514a319e9611c7f1ae3b3c8687aba5a8dd3b438c1359210443fc59ffc8e572ec58d3d3b580ffe3ba14a30724940

Download Submit
\Program Files (x86)\OpenOffice 4\program\sal3.dll

Filesize
1.7MB

MD5
0ba711682f332d92277f5d78bb77e476

SHA1
643f0b17ea7eb615b9607dae80c1119b6cf6a792

SHA256
35683decb6facca5cf1ddb618ff7b1eed31fe51a9e0c6dfabfadab203cc791d0

SHA512
e7f695db220abb824ed934386c7a5ffc99ea3cc53c7d677e4cb3ecd3b56a805ae1606888410f60bf64f6ae1d6d64eb01d4926af4f2c647e9b71a948e05d126d7

Download Submit
\Program Files (x86)\OpenOffice 4\program\salhelper3MSC.dll

Filesize
13KB

MD5
a1ed9b03ba50b68be220855bda319a24

SHA1
bc224db8baa65375dd31ddc3b63d09b17c520094

SHA256
eb903a80f2cd5ace2d0370219b62355c443f4a35ce98e1485303d6e93e7a65ac

SHA512
ee1e47859224887135e4dbd5d6f168cc49af40c9e8b3d470f66f2a934f58638973745a40c535b45742cff1493a962464562940897799c4afe880a91c64b0bb65

Download Submit
\Program Files (x86)\OpenOffice 4\program\ucbhelper4MSC.dll

Filesize
379KB

MD5
c7ab283ba4ab7559788ffa567c197d52

SHA1
f7372ed5df8e4342e8494b5b69f4ac4b365570fd

SHA256
b495aae8c8bb02c03934ab2e64c7cf8355e4d7276fe18f319de1c93bd724d8ac

SHA512
2aaf52df17abfc1c39cc74c69c81e9ea697c508f4992e2eb1040a509f4899efcd9c493097d7cbb6b147185faba6df9826d89fc269f2765a8ef279daf0073f31e

Download Submit
\Program Files (x86)\OpenOffice 4\program\unopkg.bin

Filesize
40KB

MD5
bff6305ad0ef959bb2b5c4d71d8e553a

SHA1
794f3056813ee3bb906e062db74f6a922f416b43

SHA256
6d174ef2680285da4d48c0fabf67237793c6239fe79528435f5038a9e56e6842

SHA512
df95b1db4694ac1c65ce247a0b0a33f47df6793819d959866e68d86f0b1dd776438567f2debd6892198ae2bcc3ef5b28fb01000a033cc7313a10d8a4c4b18dd3

Download Submit
\Program Files (x86)\OpenOffice 4\program\unopkg.exe

Filesize
11KB

MD5
9c081349b4eda95e0cbe7d7fae52d74d

SHA1
0e8b01d2c0bf7d82f4d0cd0c7ac74edd671d4604

SHA256
d529fe00e7651336f2aac557165107aaf5b578cda8f209dfcc9adff6dce56943

SHA512
bede9b7be41d7deecde46da5e78f0fdf510755c2aeeaa692263f31d1494647c298d094b75e6cf51670401dbfc05f6a0fee2f2b3e63907872b68c36b34d6fd1f2

Download Submit
\Program Files (x86)\OpenOffice 4\program\unopkgapp.dll

Filesize
111KB

MD5
239799b41f37d929dc30a96ab7bc5531

SHA1
58a684de318215aa601fe8eb9594e6491d44fbe9

SHA256
8e05a8d7330bcd654febb1d805b45cd500f699e10bac78b2f3aa12212cc7b2b5

SHA512
bec2706e65c3c4b4ce6247122734fa40c74faa8956880e1494444279f510318ae3a137ef0ffb7b81cb3370558ff31b2a51368af5ab806eff2009599109888fdf

Download Submit
\Program Files (x86)\OpenOffice 4\program\utl.dll

Filesize
1.1MB

MD5
0e593b6d6ab80c07251e1e00a8839bce

SHA1
1883330c164d57944aba5b8b473d8e29d84bb6b8

SHA256
2780321e3ac8fd8f8895ddf597ea8d7d44b63cd3ae8c604859388510d27dd93c

SHA512
c21bd821cd41c53cc41c012c83348bd844daa240db5f94e2a02c6362699376c88f4b201ee804a35e22f8ede8d923bb3aae729fcae3c981b8fea8678a669af568

Download Submit
\Program Files (x86)\OpenOffice 4\program\uwinapi.dll

Filesize
83KB

MD5
72a9d2eaa9f6a1d5e6d895bac340c218

SHA1
11df71fbc35c0abc4a5cd021ffa5d2b2dd19a144

SHA256
da1cc18db2dfbbfd47189e5eb3b0a9541b093a889e55f3ff80fcf6280c1abfc1

SHA512
6379fc2a87a661be473fc908fcdb6028a2f1a3d398a8a0d4898c0408edccd6bc6b9607f94cdb1051d3f81076b5a595bf157e11e934ce6f5575218cb230d06e7f

Download Submit
\Program Files (x86)\OpenOffice 4\program\vos3MSC.dll

Filesize
97KB

MD5
f75036808b03a7dc79474cd77d27cb38

SHA1
04ad26252e5362d74dbf41f6f5f70ec6623f3796

SHA256
e42a2b43a3fa274785db18eea6e2b529c36bb97cb8403cac72e83971f25d9d2a

SHA512
4739417ea8f6562b5cf16cdb727f19b60987e8ce91371900d2de9739b6ed9308b837e4e95812e9f0bf4a2d340f5545b153b0505b14fd56afa065b4a2fddfc4ec

Download Submit
\Users\Admin\AppData\Local\Temp\MSI84F9.tmp

Filesize
164KB

MD5
cd1a6d212672f41231c357abb0731a72

SHA1
978d2fb2a6b46a8c97413a2b90ab541ef6b0fcaf

SHA256
e5b31d39e5728cf3af45bdbdfa80de21cdbb6cda8fc4680f76fa7fb810751355

SHA512
5ece22a2b15fb30b7319a48ee9ca9434fba6b20161083f033a0bdccf677d0a77f18116bb08200821b170e0ffe51215b6e972bcc899df86ee0223bfb1836f5f94

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8642.tmp

Filesize
164KB

MD5
cd1a6d212672f41231c357abb0731a72

SHA1
978d2fb2a6b46a8c97413a2b90ab541ef6b0fcaf

SHA256
e5b31d39e5728cf3af45bdbdfa80de21cdbb6cda8fc4680f76fa7fb810751355

SHA512
5ece22a2b15fb30b7319a48ee9ca9434fba6b20161083f033a0bdccf677d0a77f18116bb08200821b170e0ffe51215b6e972bcc899df86ee0223bfb1836f5f94

Download Submit
\Users\Admin\AppData\Local\Temp\MSI89EB.tmp

Filesize
88KB

MD5
6e81766d09bedaf675e37d997fa85124

SHA1
5187f9b0dc88a67cb7523521517505362ff59946

SHA256
885b60e0c9feee08061c678ff11bf4c8aafd13338dfbc7e3d63c52a6398b79a7

SHA512
9c2215ec7754b46f40cc116f8adead17e40119f93146f81cd1243a9e00e518276f24fa61f8c0dd4c22c0268c8287a7cec7554a9512f2fcbb782705bba0462f95

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8B33.tmp

Filesize
164KB

MD5
cd1a6d212672f41231c357abb0731a72

SHA1
978d2fb2a6b46a8c97413a2b90ab541ef6b0fcaf

SHA256
e5b31d39e5728cf3af45bdbdfa80de21cdbb6cda8fc4680f76fa7fb810751355

SHA512
5ece22a2b15fb30b7319a48ee9ca9434fba6b20161083f033a0bdccf677d0a77f18116bb08200821b170e0ffe51215b6e972bcc899df86ee0223bfb1836f5f94

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8B63.tmp

Filesize
164KB

MD5
cd1a6d212672f41231c357abb0731a72

SHA1
978d2fb2a6b46a8c97413a2b90ab541ef6b0fcaf

SHA256
e5b31d39e5728cf3af45bdbdfa80de21cdbb6cda8fc4680f76fa7fb810751355

SHA512
5ece22a2b15fb30b7319a48ee9ca9434fba6b20161083f033a0bdccf677d0a77f18116bb08200821b170e0ffe51215b6e972bcc899df86ee0223bfb1836f5f94

Download Submit
\Users\Admin\AppData\Local\Temp\MSIA72E.tmp

Filesize
164KB

MD5
cd1a6d212672f41231c357abb0731a72

SHA1
978d2fb2a6b46a8c97413a2b90ab541ef6b0fcaf

SHA256
e5b31d39e5728cf3af45bdbdfa80de21cdbb6cda8fc4680f76fa7fb810751355

SHA512
5ece22a2b15fb30b7319a48ee9ca9434fba6b20161083f033a0bdccf677d0a77f18116bb08200821b170e0ffe51215b6e972bcc899df86ee0223bfb1836f5f94

Download Submit
\Users\Admin\AppData\Local\Temp\nst4FA8.tmp\InstallOptions.dll

Filesize
15KB

MD5
ece25721125d55aa26cdfe019c871476

SHA1
b87685ae482553823bf95e73e790de48dc0c11ba

SHA256
c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

SHA512
4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

Download Submit
\Users\Admin\AppData\Local\Temp\nst4FA8.tmp\InstallOptions.dll

Filesize
15KB

MD5
ece25721125d55aa26cdfe019c871476

SHA1
b87685ae482553823bf95e73e790de48dc0c11ba

SHA256
c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

SHA512
4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

Download Submit
\Users\Admin\Desktop\OpenOffice 4.1.13 (es) Installation Files\setup.exe

Filesize
468KB

MD5
d5c6a89f1417cdd3a1045a3c64ddaf40

SHA1
c8f44df2de8c60670789a9841378549787e4bb8d

SHA256
f4e79ca6cb06b55dc521b2c65d1fb7c50c3a71e60c594cf160f89ce61f195c75

SHA512
56e5bca809a4bfe865e9690b60c82c1e17a0b4fac0f3ac18d07c1ac69abbc8d1476e9bc0d8d89e7257de0dbd63bbf87eb848906fe2b03a04ff5edf3c7ddd8418

Download Submit
\Users\Admin\Desktop\OpenOffice 4.1.13 (es) Installation Files\setup.exe

Filesize
468KB

MD5
d5c6a89f1417cdd3a1045a3c64ddaf40

SHA1
c8f44df2de8c60670789a9841378549787e4bb8d

SHA256
f4e79ca6cb06b55dc521b2c65d1fb7c50c3a71e60c594cf160f89ce61f195c75

SHA512
56e5bca809a4bfe865e9690b60c82c1e17a0b4fac0f3ac18d07c1ac69abbc8d1476e9bc0d8d89e7257de0dbd63bbf87eb848906fe2b03a04ff5edf3c7ddd8418

Download Submit
\Users\Admin\Desktop\OpenOffice 4.1.13 (es) Installation Files\setup.exe

Filesize
468KB

MD5
d5c6a89f1417cdd3a1045a3c64ddaf40

SHA1
c8f44df2de8c60670789a9841378549787e4bb8d

SHA256
f4e79ca6cb06b55dc521b2c65d1fb7c50c3a71e60c594cf160f89ce61f195c75

SHA512
56e5bca809a4bfe865e9690b60c82c1e17a0b4fac0f3ac18d07c1ac69abbc8d1476e9bc0d8d89e7257de0dbd63bbf87eb848906fe2b03a04ff5edf3c7ddd8418

Download Submit
\Users\Admin\Desktop\OpenOffice 4.1.13 (es) Installation Files\setup.exe

Filesize
468KB

MD5
d5c6a89f1417cdd3a1045a3c64ddaf40

SHA1
c8f44df2de8c60670789a9841378549787e4bb8d

SHA256
f4e79ca6cb06b55dc521b2c65d1fb7c50c3a71e60c594cf160f89ce61f195c75

SHA512
56e5bca809a4bfe865e9690b60c82c1e17a0b4fac0f3ac18d07c1ac69abbc8d1476e9bc0d8d89e7257de0dbd63bbf87eb848906fe2b03a04ff5edf3c7ddd8418

Download Submit
\Windows\Installer\MSI3959.tmp

Filesize
164KB

MD5
cd1a6d212672f41231c357abb0731a72

SHA1
978d2fb2a6b46a8c97413a2b90ab541ef6b0fcaf

SHA256
e5b31d39e5728cf3af45bdbdfa80de21cdbb6cda8fc4680f76fa7fb810751355

SHA512
5ece22a2b15fb30b7319a48ee9ca9434fba6b20161083f033a0bdccf677d0a77f18116bb08200821b170e0ffe51215b6e972bcc899df86ee0223bfb1836f5f94

Download Submit
\Windows\Installer\MSI3AA2.tmp

Filesize
129KB

MD5
e39572d0b4e5da5eee254c7b99759f0c

SHA1
8e2ad7f60ca121953f117c624f7d472836e79fef

SHA256
e07c181c8aad5f0080dbe3e421347b488eb06cb7e44511368ac31e28ae14e5a3

SHA512
71cd8ea93015370126b6b5e0c540af1ee7d0b2fe2fc92649bb0a742453590e9cd2e4a6e0fad0d5888bf7a32209af913d3e492534cdd15f3d8d551d20cb44616c

Download Submit
\Windows\Installer\MSI3B01.tmp

Filesize
164KB

MD5
cd1a6d212672f41231c357abb0731a72

SHA1
978d2fb2a6b46a8c97413a2b90ab541ef6b0fcaf

SHA256
e5b31d39e5728cf3af45bdbdfa80de21cdbb6cda8fc4680f76fa7fb810751355

SHA512
5ece22a2b15fb30b7319a48ee9ca9434fba6b20161083f033a0bdccf677d0a77f18116bb08200821b170e0ffe51215b6e972bcc899df86ee0223bfb1836f5f94

Download Submit
\Windows\Installer\MSI3B5F.tmp

Filesize
131KB

MD5
56f5894b2648d7a12d2570107653a73c

SHA1
2e0b00970e8a88f84b4e0dba9f89fc678d6af2e3

SHA256
310839ebbf6105fc6cd042c4f2580aff69b473c08b57afab67154235511d2a37

SHA512
5e93f044fdfd028ee798c404062fe27cb3856137b09130c25a86faf9981271911dd94dae6ada19a965754c5e4de6c95c8fc097fc85eb81d1d5b35e7ce26b12e0

Download Submit
\Windows\Installer\MSI45BC.tmp

Filesize
130KB

MD5
a19eeb58a920971c79dc1aa9e7e7b139

SHA1
5f26c713be69a17b66a44f87d8432a593ca465f8

SHA256
81796d5cbcd2758ff1930b780d94952c3274cb7bd729cd8568e8c531cef221c4

SHA512
ea069e40c15f0fb3e24a0cc876eeeabe7f90ad7c18fd685430c74d70c353e408ad8ac7046676d71ec4c880aed7ad5d1a2b301921472007a3be7835fc0d123863

Download Submit
\Windows\Installer\MSIE9EA.tmp

Filesize
164KB

MD5
cd1a6d212672f41231c357abb0731a72

SHA1
978d2fb2a6b46a8c97413a2b90ab541ef6b0fcaf

SHA256
e5b31d39e5728cf3af45bdbdfa80de21cdbb6cda8fc4680f76fa7fb810751355

SHA512
5ece22a2b15fb30b7319a48ee9ca9434fba6b20161083f033a0bdccf677d0a77f18116bb08200821b170e0ffe51215b6e972bcc899df86ee0223bfb1836f5f94

Download Submit
memory/1696-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1880-149-0x0000000072340000-0x0000000072905000-memory.dmp

Filesize
5.8MB

Download
memory/1880-150-0x000000006FCA0000-0x000000006FFB9000-memory.dmp

Filesize
3.1MB

Download
memory/1880-151-0x000000006FFC0000-0x000000007070B000-memory.dmp

Filesize
7.3MB

Download
memory/1916-141-0x0000000000AE0000-0x0000000000AE8000-memory.dmp

Filesize
32KB

Download
memory/1916-142-0x0000000000AE0000-0x0000000000AE8000-memory.dmp

Filesize
32KB

Download
memory/1916-98-0x0000000000AF0000-0x0000000000AF8000-memory.dmp

Filesize
32KB

Download
memory/1916-97-0x0000000000AE0000-0x0000000000AEA000-memory.dmp

Filesize
40KB

Download
memory/1916-106-0x0000000000EE0000-0x0000000000EE8000-memory.dmp

Filesize
32KB

Download
memory/1916-105-0x0000000000ED0000-0x0000000000ED8000-memory.dmp

Filesize
32KB

Download
memory/1916-99-0x0000000000B00000-0x0000000000B20000-memory.dmp

Filesize
128KB

Download
memory/1916-100-0x0000000000E00000-0x0000000000E08000-memory.dmp

Filesize
32KB

Download
memory/1916-104-0x00000000036D0000-0x00000000037B4000-memory.dmp

Filesize
912KB

Download
memory/1916-103-0x0000000000E30000-0x0000000000E43000-memory.dmp

Filesize
76KB

Download
memory/1916-143-0x0000000000AE0000-0x0000000000AE8000-memory.dmp

Filesize
32KB

Download
memory/1916-144-0x0000000000AE0000-0x0000000000AE8000-memory.dmp

Filesize
32KB

Download
memory/1916-145-0x0000000000AE0000-0x0000000000AE8000-memory.dmp

Filesize
32KB

Download
memory/1916-69-0x000007FEFB641000-0x000007FEFB643000-memory.dmp

Filesize
8KB

Download
memory/1916-101-0x0000000000E10000-0x0000000000E18000-memory.dmp

Filesize
32KB

Download
memory/1916-102-0x0000000000E20000-0x0000000000E28000-memory.dmp

Filesize
32KB

Download