bbdf4c8d657e3123bd009ab086758bfd707f9b8c7f5fabb22783c4cb81784ca8

Analysis

max time kernel
459s
max time network
450s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-es
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-eslocale:es-esos:windows10-ltsc 2021-x64systemwindows
submitted
22-01-2025 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Apache_OpenOffice_4.1.15_Win_x86_install_es.exe
Size

125.6MB
MD5

bbe59728aaa6b2647abce7d07c14417d
SHA1

0cd604617b54550b236acba507202ef1531e78bc
SHA256

bbdf4c8d657e3123bd009ab086758bfd707f9b8c7f5fabb22783c4cb81784ca8
SHA512

eb3db0f8543c58c7882b20f995aa28981297af5ac00a3fe00ac7f704897efd16125edf3739dfc28c4151477ccb0fc23bc1ff4ac69de41ce58c25d0f0df2f4c11
SSDEEP

3145728:5GHXeD6lphGi7zgp0Jub3DUAAGaSNl3+MeWXi3Fmqa:c3zlpbzW0JubwI7+lii3sB

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.15\Desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\OpenOffice 4\share\registry\lingucomponent.xcd	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\sg19.sdv	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\ucpdav1.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\modulefinder.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\simpress\toolbar\3dobjectsbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\basic\FormWizard\Layouter.xba	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\diagrams\Section-Pasters01.svg	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\people\Detective1.png	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\simpress\toolbar\mediaobjectbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\basic\Tutorials\Functions.xba	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\dtd\officedocument\1_0\office.dtd	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\resource\pdffilteres.res	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\classes\XSLTFilter.jar	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\onlinecheck.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\help\es\schart.idxl\segments_2	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\help\es\simpress.tree	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sweb\toolbar\tableobjectbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swreport\toolbar\alignmentbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\sg18.sdv	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\help\es\simpress.key	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\uuid.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\Scripts\java\Highlight\parcel-descriptor.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swxform\toolbar\insertobjectbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\encodings\cp737.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\idlelib\Icons\idle_32.png	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\resource\sfxes.res	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\scalc\toolbar\starshapes.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\encodings\iso8859_8.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\formtextobjectbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\wizard\form\styles\ibg.css	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\bullets\Bullet09-Diamond-Red.svg	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\basctl.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\sot.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\arrows\A19-CircleArrow.png	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\help\es\smath.key	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\wizard\letter\km\off-elegant_l.ott	msiexec.exe
File opened for modification	C:\Program Files (x86)\OpenOffice 4\program\version.ini	soffice.bin
File created	C:\Program Files (x86)\OpenOffice 4\share\basic\Euro\DlgConvert.xdl	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\rulers\blkballs.gif	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\textshapes\Rectangle04-DarkRed.svg	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\www-graf\ylwleft.gif	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\basic\Depot\Lang_fr.xba	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\basic\ImportWizard\FilesModul.xba	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\sg1.sdv	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\wizard\letter\da\off-office_l.ott	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\wizard\letter\en-US\off-modern_l.ott	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\help\es\sdatabase.idxl\_0.cfs	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\_pyio.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\diagrams\Venn06-Blue.svg	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\www-graf\redquest.gif	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\encodings\iso2022_jp_2004.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\encodings\utf_8.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\finance\Agreement.png	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\www-graf\orgmail.gif	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\cui.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\encodings\cp874.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\ime.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\include\python2.7\cobject.h	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\ooofilt_x64.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\sm.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\lib-tk\FileDialog.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\_osx_support.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\help\es\sbasic.idxl\_0.cfx	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\resource\chartcontrolleres.res	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI35D4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerif-Bold.ttf	msiexec.exe
File created	C:\Windows\assembly\pubpol28.dat	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerif.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\LIXCYVRM\cli_cppuhelper.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol29.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI865B.tmp	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansCondensed-Oblique.ttf	msiexec.exe
File created	C:\Windows\Installer\{E1270A5B-F9DF-4A30-AFB4-B353C3E3ABB4}\soffice.ico	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol24.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI869D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F99.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\2G0ZV2RM\cli_basetypes.dll	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansMono-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\opens___.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\9UE5KLZS\QHWULD76	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol25.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI86AE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2FB9.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\ICK2YJ8V\cli_uretypes.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\2TIRE698\policy.1.0.cli_ure.dll	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSans-Bold.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\2TIRE698\ECE5HQ18	msiexec.exe
File created	C:\Windows\assembly\tmp\L2CJN2O9\policy.1.0.cli_uretypes.dll	msiexec.exe
File created	C:\Windows\Fonts\Carlito-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansMono-Oblique.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSans-Oblique.ttf	msiexec.exe
File created	C:\Windows\Fonts\GenBkBasR.ttf	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F59.tmp	msiexec.exe
File created	C:\Windows\Fonts\Caladea-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\Carlito-Regular.ttf	msiexec.exe
File created	C:\Windows\Fonts\GenBkBasB.ttf	msiexec.exe
File created	C:\Windows\assembly\pubpol27.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI868C.tmp	msiexec.exe
File created	C:\Windows\Installer\e582d54.msi	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerifCondensed-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\GenBasR.ttf	msiexec.exe
File created	C:\Windows\Fonts\GenBkBasI.ttf	msiexec.exe
File created	C:\Windows\assembly\pubpol25.dat	msiexec.exe
File opened for modification	C:\Windows\assembly\PublisherPolicy.tme	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol26.dat	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol27.dat	msiexec.exe
File created	C:\Windows\assembly\tmp\05H5PSTN\cli_ure.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\NUCRO3VO\policy.1.0.cli_basetypes.dll	msiexec.exe
File created	C:\Windows\Fonts\Caladea-BoldItalic.ttf	msiexec.exe
File created	C:\Windows\Fonts\Caladea-Regular.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerif-Italic.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\9UE5KLZS\policy.1.0.cli_cppuhelper.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI866B.tmp	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerif-BoldItalic.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\F0RF5KQ5\cli_oootypes.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\e582d54.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\assembly\GACLock.dat	msiexec.exe
File created	C:\Windows\Fonts\Caladea-Italic.ttf	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI80D9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI863A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2DF1.tmp	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSans.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerifCondensed.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerifCondensed-BoldItalic.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerifCondensed-Italic.ttf	msiexec.exe

Executes dropped EXE 5 IoCs

pid	Process
3896	setup.exe
1172	unopkg.exe
2108	unopkg.bin
4500	soffice.exe
5112	soffice.bin

Loads dropped DLL 64 IoCs

pid	Process
4740	Apache_OpenOffice_4.1.15_Win_x86_install_es.exe
4740	Apache_OpenOffice_4.1.15_Win_x86_install_es.exe
4728	MsiExec.exe
4728	MsiExec.exe
4728	MsiExec.exe
4728	MsiExec.exe
4728	MsiExec.exe
4728	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
2108	unopkg.bin
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
3588	Process not Found
5112	soffice.bin
5112	soffice.bin

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	soffice.bin
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unopkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unopkg.bin
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	soffice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apache_OpenOffice_4.1.15_Win_x86_install_es.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000057ded11c23971b510000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000057ded11c0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090057ded11c000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d57ded11c000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000057ded11c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\opendocument.MathDocument.1\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Xlsm\shell\new\ = "&Nuevo"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenOffice.Dot	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.odp\OpenWithProgIDs\opendocument.ImpressDocument.1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\opendocument.WriterWebTemplate.1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\soffice.StarDrawTemplate.6\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarWriterDocument.6\shell\new\ = "&Nuevo"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xdl\ = "soffice.StarConfigFile.6"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{448BB771-CFE2-47C4-BCDF-1FBF378E202C}\DataFormats\GetSet\2\ = "2,1,16,1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.CalcTemplate.1\shell\new\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\soffice.exe\" -n \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.DrawDocument.1\shell\printto\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\soffice.exe\" -pt \"%2\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarWriterTemplate.6\shell\ = "new"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Potx\shell\open\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\\\simpress.exe\" -o \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.WriterGlobalDocument.1\shell\printto\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\soffice.exe\" -pt \"%2\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Xlt\shell\open\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\\\scalc.exe\" -o \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{D2D59CD1-0A6A-4D36-AE20-47817077D57C}\Programmable	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarDrawDocument.6\shell\print\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Xltx\shell\print\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{E5A0B632-DFBA-4549-9346-E414DA06E6F8}\Programmable	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Dot\shell\open\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\\\swriter.exe\" -o \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.WriterDocument.1\protocol\StdFileEditing\verb\0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.WriterTemplate.1\shell\printto\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenOffice.Xlsm\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Ppt\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Ppt\shell\printto\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\\\simpress.exe\" -pt \"%2\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MIME\Database\Content Type\application/vnd.oasis.opendocument.presentation	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Dotx\ = "Plantilla de Microsoft Word"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\opendocument.ImpressTemplate.1\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.WriterTemplate.1\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Xlsm\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{30A2652A-DDF7-45e7-ACA6-3EAB26FC8A4E}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7FA8AE11-B3E3-4D88-AABF-255526CD1CE8}\verb	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.otg\shellex\{00021500-0000-0000-C000-000000000046}\ = "{087B3AE3-E237-4467-B8DB-5A38AB959AC9}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rtf\OpenWithProgIDs\soffice.StarCalcDocument.6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.DrawDocument.1\Insertable\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\soffice.StarImpressDocument.6\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\ImmutableMuiCache\Strings\63C768CF\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programas y características"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7FA8AE11-B3E3-4D88-AABF-255526CD1CE8}\DataFormats\GetSet\0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.doc\OpenWithProgIDs\OpenOffice.Doc	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.ImpressDocument.1\shell\print\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.oth	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\soffice.StarCalcDocument.6\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarWriterTemplate.6\shell\open\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\swriter.exe\" -o \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7FA8AE11-B3E3-4D88-AABF-255526CD1CE8}\AuxUserType\2\ = "OpenOffice"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\office.Extension.1\shell\open\ = "&Instalar"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Dotx\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarImpressDocument.6\shellex\PropertySheetHandlers\MyPropSheet1\ = "{63542C48-9552-494A-84F7-73AA6A7C99C1}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarWriterGlobalDocument.6\shellex\PropertySheetHandlers\MyPropSheet1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B5A0721EFD9F03A4FA4B3B353C3EBA4B\gm_p_Impress = "gm_Prg"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B5A0721EFD9F03A4FA4B3B353C3EBA4B\gm_Langpack_r_es = "gm_Langpack_Languageroot"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30A2652A-DDF7-45e7-ACA6-3EAB26FC8A4E}\MiscStatus\ = "16"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.oasis.opendocument.presentation\Extension = ".odp"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenOffice.Dotm\shell\printto\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarCalcTemplate.6\ = "Plantilla de hoja de cálculo OpenOffice.org XML 1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.CalcTemplate.1\shell\printto\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\soffice.exe\" -pt \"%2\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarWriterTemplate.6\shellex	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\soffice.StarConfigFile.6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7FA8AE11-B3E3-4D88-AABF-255526CD1CE8}\VersionIndependentProgID\ = "opendocument.CalcDocument.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F616B81F-7BB8-4F22-B8A5-47428D59F8AD}\AuxUserType\3\ = "Texto de OpenDocument"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Xls	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Xlt\shell\print\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarWriterTemplate.6\shell\open	msiexec.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	soffice.bin
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	soffice.bin
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	soffice.bin

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2440	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4708	msiexec.exe
4708	msiexec.exe
5112	soffice.bin
5112	soffice.bin

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4740	Apache_OpenOffice_4.1.15_Win_x86_install_es.exe
2440	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2848	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2848	msiexec.exe
Token: SeSecurityPrivilege	4708	msiexec.exe
Token: SeCreateTokenPrivilege	2848	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2848	msiexec.exe
Token: SeLockMemoryPrivilege	2848	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2848	msiexec.exe
Token: SeMachineAccountPrivilege	2848	msiexec.exe
Token: SeTcbPrivilege	2848	msiexec.exe
Token: SeSecurityPrivilege	2848	msiexec.exe
Token: SeTakeOwnershipPrivilege	2848	msiexec.exe
Token: SeLoadDriverPrivilege	2848	msiexec.exe
Token: SeSystemProfilePrivilege	2848	msiexec.exe
Token: SeSystemtimePrivilege	2848	msiexec.exe
Token: SeProfSingleProcessPrivilege	2848	msiexec.exe
Token: SeIncBasePriorityPrivilege	2848	msiexec.exe
Token: SeCreatePagefilePrivilege	2848	msiexec.exe
Token: SeCreatePermanentPrivilege	2848	msiexec.exe
Token: SeBackupPrivilege	2848	msiexec.exe
Token: SeRestorePrivilege	2848	msiexec.exe
Token: SeShutdownPrivilege	2848	msiexec.exe
Token: SeDebugPrivilege	2848	msiexec.exe
Token: SeAuditPrivilege	2848	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2848	msiexec.exe
Token: SeChangeNotifyPrivilege	2848	msiexec.exe
Token: SeRemoteShutdownPrivilege	2848	msiexec.exe
Token: SeUndockPrivilege	2848	msiexec.exe
Token: SeSyncAgentPrivilege	2848	msiexec.exe
Token: SeEnableDelegationPrivilege	2848	msiexec.exe
Token: SeManageVolumePrivilege	2848	msiexec.exe
Token: SeImpersonatePrivilege	2848	msiexec.exe
Token: SeCreateGlobalPrivilege	2848	msiexec.exe
Token: SeCreateTokenPrivilege	2848	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2848	msiexec.exe
Token: SeLockMemoryPrivilege	2848	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2848	msiexec.exe
Token: SeMachineAccountPrivilege	2848	msiexec.exe
Token: SeTcbPrivilege	2848	msiexec.exe
Token: SeSecurityPrivilege	2848	msiexec.exe
Token: SeTakeOwnershipPrivilege	2848	msiexec.exe
Token: SeLoadDriverPrivilege	2848	msiexec.exe
Token: SeSystemProfilePrivilege	2848	msiexec.exe
Token: SeSystemtimePrivilege	2848	msiexec.exe
Token: SeProfSingleProcessPrivilege	2848	msiexec.exe
Token: SeIncBasePriorityPrivilege	2848	msiexec.exe
Token: SeCreatePagefilePrivilege	2848	msiexec.exe
Token: SeCreatePermanentPrivilege	2848	msiexec.exe
Token: SeBackupPrivilege	2848	msiexec.exe
Token: SeRestorePrivilege	2848	msiexec.exe
Token: SeShutdownPrivilege	2848	msiexec.exe
Token: SeDebugPrivilege	2848	msiexec.exe
Token: SeAuditPrivilege	2848	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2848	msiexec.exe
Token: SeChangeNotifyPrivilege	2848	msiexec.exe
Token: SeRemoteShutdownPrivilege	2848	msiexec.exe
Token: SeUndockPrivilege	2848	msiexec.exe
Token: SeSyncAgentPrivilege	2848	msiexec.exe
Token: SeEnableDelegationPrivilege	2848	msiexec.exe
Token: SeManageVolumePrivilege	2848	msiexec.exe
Token: SeImpersonatePrivilege	2848	msiexec.exe
Token: SeCreateGlobalPrivilege	2848	msiexec.exe
Token: SeCreateTokenPrivilege	2848	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2848	msiexec.exe
Token: SeLockMemoryPrivilege	2848	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2848	msiexec.exe
2440	explorer.exe
2440	explorer.exe
2440	explorer.exe
2848	msiexec.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 3896	4740	Apache_OpenOffice_4.1.15_Win_x86_install_es.exe	90
PID 4740 wrote to memory of 3896	4740	Apache_OpenOffice_4.1.15_Win_x86_install_es.exe	90
PID 4740 wrote to memory of 3896	4740	Apache_OpenOffice_4.1.15_Win_x86_install_es.exe	90
PID 3896 wrote to memory of 2848	3896	setup.exe	91
PID 3896 wrote to memory of 2848	3896	setup.exe	91
PID 3896 wrote to memory of 2848	3896	setup.exe	91
PID 4708 wrote to memory of 4728	4708	msiexec.exe	94
PID 4708 wrote to memory of 4728	4708	msiexec.exe	94
PID 4708 wrote to memory of 4728	4708	msiexec.exe	94
PID 4708 wrote to memory of 1728	4708	msiexec.exe	105
PID 4708 wrote to memory of 1728	4708	msiexec.exe	105
PID 4708 wrote to memory of 4160	4708	msiexec.exe	108
PID 4708 wrote to memory of 4160	4708	msiexec.exe	108
PID 4708 wrote to memory of 4160	4708	msiexec.exe	108
PID 4160 wrote to memory of 1172	4160	MsiExec.exe	111
PID 4160 wrote to memory of 1172	4160	MsiExec.exe	111
PID 4160 wrote to memory of 1172	4160	MsiExec.exe	111
PID 1172 wrote to memory of 2108	1172	unopkg.exe	112
PID 1172 wrote to memory of 2108	1172	unopkg.exe	112
PID 1172 wrote to memory of 2108	1172	unopkg.exe	112
PID 4500 wrote to memory of 5112	4500	soffice.exe	115
PID 4500 wrote to memory of 5112	4500	soffice.exe	115
PID 4500 wrote to memory of 5112	4500	soffice.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Apache_OpenOffice_4.1.15_Win_x86_install_es.exe
"C:\Users\Admin\AppData\Local\Temp\Apache_OpenOffice_4.1.15_Win_x86_install_es.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files\setup.exe
  "C:\Program Files\setup.exe" -lang 1034
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\SysWOW64\\msiexec.exe SETUP_USED=1 /I "C:\Program Files\openoffice4115.msi"
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2848

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BBBA3BDBB2336F54C349711052EBBF91 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4728
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:4
  2⤵
  PID:1728
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6CD5C503DB3FC900D590094D8D3FDE33
  2⤵
  - Drops desktop.ini file(s)
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Program Files (x86)\OpenOffice 4\program\unopkg.exe
    "C:\Program Files (x86)\OpenOffice 4\program\unopkg.exe" sync
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Program Files (x86)\OpenOffice 4\program\unopkg.bin
      "C:\Program Files (x86)\OpenOffice 4\program\unopkg.exe" sync "-env:INIFILENAME=vnd.sun.star.pathname:C:\Program Files (x86)\OpenOffice 4\program\redirect.ini" "-env:OOO_CWD=2C:\\Windows\\SysWOW64"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2108

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2888

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2440

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:3080

C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
"C:\Program Files (x86)\OpenOffice 4\program\soffice.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
  "C:\Program Files (x86)\OpenOffice 4\program\soffice.exe" "-env:OOO_CWD=2C:\\Program Files (x86)\\OpenOffice 4"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e582d55.rbs

Filesize
590KB

MD5
42ce4e01f61403032b124e8b8008ee10

SHA1
c1994264905d085c74bab1f6c0f7282cd60f5994

SHA256
e843aaad2369f3b8a92d0f6c8c26f69c99213ddbd4f6537f1d852e9249909aab

SHA512
d8cf3a80892bcec7e79b0d409592363ce1de6deb6a6f994f30902bd65a7273556a9e4ee6b45c0af3e9e1b85a5ea7d693ded0b873a4b6627b807fb8a516765aa3

Download Submit
C:\Program Files (x86)\OpenOffice 4\help\es\sdraw.idxl\segments.gen

Filesize
20B

MD5
2eb2668d2bf13379fa3584b9a9867b46

SHA1
86ee9f040505bb2f9ad01472bfc6c3f10f6f0091

SHA256
ab308562fd6f5404d34e923152ee70ff7bddaab2f421a6c58730ba731bd09182

SHA512
15dec785f3fd190336f8561a827566d90865d174f33f6c7947da7b298734aad887f522d2fc625353c8a798e4c6cfeef27bec59131fdab3384dba0fcdd50f8415

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\comphelpMSC.dll

Filesize
1.1MB

MD5
38f45383cc9a369b23b86815a9848e88

SHA1
46dacb428de5a9603e317e0dc10130241731904d

SHA256
511e0c3d947b554142e1b11878fe0818f5002ecb49e8c989a95c022b1189f017

SHA512
674526655b6086e22b59839ea59d966dfee64ad16f9950698f35a37fb028870d61ee0300458b9daa5f9f3e12387239758e247286bce2e1a59c68d44381c62b07

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\cppu3.dll

Filesize
232KB

MD5
d650dbf1f44940d3114f2dbafacdb105

SHA1
340ead6c2b39bdc69089f6e53ea3b8790bb5a8d2

SHA256
6e8fe7fd334fac60303c90dc2147f5c47bc4237d4f465ec0d74a97e9d288ed65

SHA512
b51ae9aa03580d7f8dee1d631c5789b6dd76f15375298df873d418463b51929af4a109ae3c7fb647533d03385ba4eb5ba6e6b154bb5ba16856c8de3bfe6e8c32

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\cppuhelper3MSC.dll

Filesize
574KB

MD5
7dc9eb02bffbf2dd2557ee3a630d15d3

SHA1
9ce3df6926c60c37ae5e936fa9ada3b78a5a3cce

SHA256
7e3edffa25e66df403bc51ff4ea4b68befaa143a82c192869a4126a8847f8200

SHA512
8ddfdc05c0418f8ae1118f9432c1663bff72c7216f6858e2d09445176adf2b130ee7909e3abeb3940812339fbff3720a02891c11bc2088b8a7d17012620cf7d4

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\deploymentmisc.dll

Filesize
148KB

MD5
fd69bb98c100a8605f818790c08687ce

SHA1
3571ed42ea8f4a371fa42419d8b770fb3e9c131c

SHA256
dcb3020f2f2fcfca9008594844906f4e135b394055f85ee4a5e0e31541fc4eee

SHA512
27615ec8f7fb52d0de3dec7da7984f8fe74182b77c101179a976aed6ab1c6a0f93ce2eb475222aa67ebf108558f0d0153d4b1c1e9ab0b47b2175303978a1df16

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\redirect.ini

Filesize
54B

MD5
472e9bc3de46961d70744c1ad932f44f

SHA1
94e39e169b64f363a36e64721f6f07c6444c5d34

SHA256
27e2c33328e4e6b117f41deccc7be249e0f2b8f9120a3e3eecd3c852d0c3293e

SHA512
c3e99efd3510319db52eccbd265a49c221aa8ee283e7693474953b442fbdd3531495d4f4bdf6073c5c2cf738cae6fa10b7cf1e3ee93aede9dc1398cd84ecc188

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\sal3.dll

Filesize
1.7MB

MD5
d895c2f13e00e10af300e4364c531899

SHA1
7a1dbd58c588f2d2ceb18049318f249a2a4c0701

SHA256
0481b9512896fdb60de5700afc2cd266550f029d02ce116ecaabff15bc7f4267

SHA512
83f159ae299b14325130760b1abe0abc18d0d17feb95e9c82ad5dbd205ca6cd4f774bea01f6c98c8681e3695d94efb589dc2e5f84331c11782b26f448715b954

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\salhelper3MSC.dll

Filesize
13KB

MD5
6871465535c0a4fe0170ebdf2a67846e

SHA1
e00ff18f22893a620b00678ec02b14563a051f1e

SHA256
8bb6f552ab55faba1ad3176d49b1bce5504b57befc0cc406e24d4bd79befcb6e

SHA512
20024dc15c382147e556c7e1b50bbb899d5aab3654f37f4632b131c6c1a1c78bc78fad72b2d5c1ae5418379bfc860334b65f8de138aee3f5ec009ae6d0a0067f

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\tl.dll

Filesize
609KB

MD5
846b168a95bbcf31bd6d8800c218f6d4

SHA1
b8532131ccfdf439cf38fe74affca886afc30d07

SHA256
f32ec0777f18e4388d94838f815a087a529db374133a0cb18ee188cee773e162

SHA512
34fd34ec057e6734d12a2980f53631fab9e7557c299a113b6410ce42c416da03e30b200fae5940493565eee0973983fe1a9b2eb0d9153df01ef58e92c189ff3b

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\ucbhelper4MSC.dll

Filesize
379KB

MD5
609f5c9f2d4fd3500cfd1e3116820b23

SHA1
237f08a760ccc9f00fb7851184f2def577323ec3

SHA256
3f9ee91f2d766113d549c7def7e6db13363934f88e32b2764958bf784497b72b

SHA512
76181686beb70cd84236b1cd1dc26ff1e7ed68b1fcc6ba05b25f42356ec17e81aa46985085c39268306239d7713746c1ab16e8fe414310892d8ee03d1d8c71f6

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\unopkg.bin

Filesize
40KB

MD5
37815aea72dfc0e856694661328efe88

SHA1
b4fa6e91dc004b9ac2bdcf12e0cb3f6de5aff5cd

SHA256
f8d063b0dfa642599af36c0716367d965a5ef7822d23903b95dad422cbd6e67a

SHA512
0bb609d45fef9cc1f1165254d6237c0756cf2978edda37c235d9427a001e5812344e87b79d2129aaa6c6366d60618da8dabdb4c4d93c9bc8d4277e75d0917180

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\unopkg.exe

Filesize
11KB

MD5
564c34f6e73bf473e931c1d45fe26b8f

SHA1
d29e0634c9ab20fd098e57566592d2b326f7d846

SHA256
97bf1e50b602e869be5152f52660d343cfdb1899f11887bedf6732eac5bf6277

SHA512
1843009a0139afd866a46e74e9a51207f28af18b5e122d7b90b2b391b008317788472f49ad6e46a8b29819cad8f68708f1f56e1c2596dc72d87122c9b654ab9b

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\unopkgapp.dll

Filesize
111KB

MD5
b45f243e52acfaf2a903fbb299395840

SHA1
b7f52d19edf6eb2f9896b634e6736e5164dfbbca

SHA256
20b772d1a63b32fbbf39f24dae9d7a2491897c062bfe13041eb4fd19a6140c0d

SHA512
9dfcca4205364ea7de23d33884399c3a251af13ef357cc76640c2323d393787005e4755f282372146c685f3cc43a6ea020d7119bb7dd960d3c1d50b8f9c1ece2

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\utl.dll

Filesize
1.1MB

MD5
0df2ad123334e7200f8a2d60c4c8c646

SHA1
ab5bdbba6147bbd7a63425b7214d3cb273aec744

SHA256
b421a6406eb3c030244b0204879dd80e265ccc316f4797a564bee59fa9002477

SHA512
87af291256bcf3948ab374aa4345d0116fd832f23b1ecb3860e88a6c36204981cdc3d05026038ccdc255c3a9dcc63c08cb866eeae67b6ea50c34f942fabda440

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\uwinapi.dll

Filesize
83KB

MD5
d2b30fb435960e7fc4b1e6daf9527963

SHA1
36ed32ddd6138df3b0ba6ae26b91cab347adf21d

SHA256
b3b47351245f0d5275eda88f9e5f97ab172a23da7446fae9e06e406f4d7e27e0

SHA512
cb1602008afecace94f89aaf8fd9648a5148855b5e86f5ef669e2cb6ef03d5324922f99866f1844e7c44ba4d6f0aba7a2cfb62e7bc27938e596eefeaeb03e221

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\vcl.dll

Filesize
4.0MB

MD5
35183f64332bb994ec8b98c8d27e9e3d

SHA1
94fff14da37853a910b373a41032aba2328ec0d3

SHA256
62e956cd1aab9bf08316aed78c0ee24d1df1ffa7b2a840ed4806728cf4f5a7c7

SHA512
5816d9a94c0a27c9658148fb01790be09af6a4bfaf1f1207fb6d26d06cd2345f852946639cb7ba1b9a1bf47e6dd06d9f6d5fcf4fdbfc596423554b726a4e5156

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\vos3MSC.dll

Filesize
97KB

MD5
722cf591ebd85349879aba089df13cf2

SHA1
e94ad53bbc856052de24573bbdb5351e79143467

SHA256
331f45f20536dc2507559454009682090cd8e6469b0846e38fef687757e372a5

SHA512
2ecedf7ed9bc43c2fac3583a881d1c8e456d5aef810bf2a9d51675a8be713b23bc86f6b57bccf444db8eea73ba06f787eab7d94f0b0de03bffe39214b7d38878

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sglobal\toolbar\arrowshapes.xml

Filesize
3KB

MD5
30f29f8bc2364c8825209311c23a9400

SHA1
800fab986f8ce90305505c8a7ed8fb888148f2cf

SHA256
5d0513e99b61a44590b1166002fdb7718d0df17d2d530586674d42f8adfe3f86

SHA512
c6859ba265381b45e2a219486dfd9b3ef9a21f53527acf371743c8d7bbf3a1e21cac9bbf50ae664cd9aca459afbfdb1638af528b78413cc0a2cc26c00a41e4b8

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sglobal\toolbar\basicshapes.xml

Filesize
2KB

MD5
7d8b3a8516f8f4ccaabb651abfba6d54

SHA1
df4601c32d49d8fc92d8445a8e72588d089a0704

SHA256
dee7c013eb81edaf12552a3c29d38daec3f43130425a9b5346170c713509fb53

SHA512
3e399ac089b5d014f433dc97dae4d83fa85f8aab72a48817ee0ecda441e6529fca2f4d21512fc191dd5ac3f24c47300ac575a4e32dfffe3d9ccba8db411bceef

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sglobal\toolbar\calloutshapes.xml

Filesize
1KB

MD5
1a247cb922bdecd9c81adff1f9e8112a

SHA1
33fe2b304e13aa169c17a566bf48094645006073

SHA256
16b646eeb085201568673b1344f4773043e6b3f3cdb2e52182b359672128de20

SHA512
d5afd85d828ddbdb6f013284f404b13aebc1b46ddaffbeffa9e89c10998d8ec14813a718f20ef4dcad2554092c4574ef96bb46813e96802c22d25c27ceb65641

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sglobal\toolbar\flowchartshapes.xml

Filesize
3KB

MD5
a745ac650ef734d5da5623e2aa2b05f8

SHA1
4f44caa998bf1195620f209bb134c8e0ae09fd35

SHA256
41e78588d8a63dd70ef7d8ab47b8a4d9b0e48fac5c8afc23e0d95244de25e5e9

SHA512
eb16d59a51db0660472c37de1f0b7eaf88820206785e6a5fd75e3b905ca89e45f336dca6a08e15e36de11be9e34d41d8fe7c59e8e585b53fd46b36396d7b2ae3

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sglobal\toolbar\starshapes.xml

Filesize
1KB

MD5
1366f772d261555879c5e9712a25a9e6

SHA1
5746a20b7b50b7f7ce4eac7c1e1ce7b7990201e2

SHA256
bbebfb9f8e8849ad7c5a6e7a0707a0e9ee0ddcc3ba2138d95475e795c44edca5

SHA512
8a53e85260baf8be9a77707ada423d6521ae04852b87411c21177b5e0bac23150b62e288647b97b5577deb2941ed00a3a293d8f489907976199bae09b8424f7d

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sglobal\toolbar\symbolshapes.xml

Filesize
2KB

MD5
1ae3802ebd301b83e3e38ef3edf746c8

SHA1
c1e8dfe5b54a7af090b234c84427f1126ae674f9

SHA256
4b81cbcfab864659d749b4cff35723af6088294f96ab0c5fd5ffa05d21c6db48

SHA512
bb3910b4adcafe8ca5d4a938df04f3bc7c0e35f636d7753289dcb48369e297ecce48911cec4a509a1675193f7a6a37a97e908c9bab3d38e2bf602ddc3e7121b3

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\simpress\toolbar\alignmentbar.xml

Filesize
1KB

MD5
d1c31fd7d4ddf6ce3000b10f34023229

SHA1
e9ceffd1dc84fbfef3ae7b68dc58c1a83ea6eb07

SHA256
f7f015edf3c24fae02e45f559a479136b04e44effbb81974bde81806f3f825d9

SHA512
e06d6c54ce1b048fd4f4aada8d2c14b5ac08d3ba37ce28ae39b2f5a369572679929d0e7c30ed35e3ffb78f50877c63ee790cfe08fa8a26980f2616c2041cfd00

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\simpress\toolbar\fullscreenbar.xml

Filesize
1KB

MD5
00fdc7b8e6d9b0c1d388b76d78eaebaa

SHA1
060617eff9cfde962240b4352e6451aaee786cfa

SHA256
f97afab08fa6a00d709218dea414455e8e6c864558984bb479d4d51b1d3b4ade

SHA512
7db0648674b3353882ae530aee6dd40964b3dfe1b71968bba1c62069c0db2d5a167be12ee7070e01018b5ebb08fe18eb5ec434fab0e5f28e5d0c646767d8a0dd

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sweb\toolbar\extrusionobjectbar.xml

Filesize
1KB

MD5
fc3d5734821626bec8a4bc02353e83a2

SHA1
a7a1a26e7293f5ea98c53d9816d5f42f35ec1cd5

SHA256
808ffa548becc0f938037c1bc7bc42454931034cdc7a0b95f77857f8ed0cc459

SHA512
bdfe34a57a8d98c72c9ecfbd1d8d1e896d01807f972bc0b8456c015837bacb303efe890edc5647a87eacacfd06c782a93e0929a443fd36feed7e1e78e6bdf8a3

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sweb\toolbar\fontworkshapetype.xml

Filesize
3KB

MD5
706be7ccec83c53ca9d95fd121b86ae4

SHA1
7d98669581173da1b4bb5a48c22e497810988162

SHA256
f5654328a53e761cfcf8c65a5cb142a31c11256dc59dd3af335078c63de7bede

SHA512
d7eb8e1bc26cb6e5c14310e0a67d6aa55f009e9f3f92d5aee130050a6473b2060dcc4f1c4b4c0dfe3286c12daa667154a31800bcded9eca0cf871600b6477394

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sweb\toolbar\formtextobjectbar.xml

Filesize
2KB

MD5
b0f92b9f81fab83e9866a56428b7d7b6

SHA1
e02b296282b0a2aa63dc4c33bf041ae4aa82d638

SHA256
02ba423d57d621d501500f9c196db6556e73db0431061b21b781c4c895b4aa79

SHA512
322520cc7bc82d73d77fb692c4f0d344ea4f4a603f18de180a96d53787a495acc3aa5d76e92c8b1c162aeaaac7eacef32f2d3031b1cd5c1fca4201ac12039aec

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sweb\toolbar\graffilterbar.xml

Filesize
1KB

MD5
a07c7cec7aedf6f61b7dc3d7694061b9

SHA1
d8a6a629513096652686ba51ce4284ae2575a2e1

SHA256
8b2e3b9abb67c6db5696a0d68bd600bcb3458731cf2ea616fe0e0ff3eff843b3

SHA512
ca5428bfcefd86ec280c256e35ea9c68a255bd3b8fd90b0190080b05bdb5f1fd7686b2bc19a536b1350a1192866fff4aabc5902ff238ea17e284b9d0b2e7f00d

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sweb\toolbar\mediaobjectbar.xml

Filesize
1KB

MD5
72beb1f519e22b6a9677c58c91298140

SHA1
a253196b6b1ab392af2397a5591e0e732f817658

SHA256
5d6f0eee652fc4651764980e0baf885d8771e7af759874d888c6ff1c6591cc26

SHA512
c1f0376aac7335021053da1516b97240de4f114514b6f6121835405702a926aaf87a3145f49789d2184a77aaf4cbade84f6d3a4197e100ac5d3728ca5ee2a5a0

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swform\toolbar\colorbar.xml

Filesize
1KB

MD5
14fe0fb9e4e9e65665dda5a29d07e86a

SHA1
b8e994ec3c393216d1cc70d567a7f8f526e26232

SHA256
81f3f2ec040df98abbc94f145473690cb235ae9ac6e59328bef0d85c8709e4ac

SHA512
b7b0d3b0fee487b641e08cf5911ddae5cfdd9689e55d624c4e1b700e6b6a004301a26c050aa33a08d3384c30e15f798d6319b91f6575a10447163b82d2a23a4e

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swform\toolbar\fontworkobjectbar.xml

Filesize
1KB

MD5
f188ef8ec133668e1fad929841f1b62b

SHA1
8a32d62ff456f9005b779c9a6d8fd2bb37a285af

SHA256
bc3d21918a05255ac829190edb88fa7a0267a67268c16639fc89c8b91a5e1d0f

SHA512
c683c609366da53e42c453df92403953398b0d6ed7667d7a538c15c3aa0f61700a247d28c0d9e360b2c016a7e18aa8b6bb5c69bc190cda11d091f8a9d2b9ac91

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swform\toolbar\viewerbar.xml

Filesize
1KB

MD5
7b3a2c5315329dbeb486324baec32c12

SHA1
c4f3184baea574d6f4b353f655234d575e701b2a

SHA256
7570333d0d991e73d4636fd58d48753953b8428937035deff2acf164acadc0b9

SHA512
7c7b7e51e1df8af637ca0de4cb49c854f10ff533a400b16dc16dd3b1d3ec963687faca641fc259793292bfaf519520e3fdc0cf3edc0faca9448d4c7d6b1bba1b

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swreport\toolbar\formsfilterbar.xml

Filesize
1KB

MD5
1e44ad8078e1ebe7605a4aa76bdc2d90

SHA1
6b50ee854e5b768beb23379b0c793f807ce30882

SHA256
b6b088657c5bc989e2eeff22e570a4ff6369beee17ab4d16b84ef55fd6892d61

SHA512
dc97358a4169652a123ad2a03da0cc0fcd71a89996291a629041d269aed73fe8111e870b0f47efcd63fed913d023711c5c4ac93abe92ec03584b1757caf83203

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swreport\toolbar\formsnavigationbar.xml

Filesize
2KB

MD5
b1f3cb470ba66617f3a2ddeda085d9ef

SHA1
6a8fe23317da1515ac8c700cfb2c224c62e12eb8

SHA256
559abb8e5c82de5bd7ea5e583d688314811ca936443303db9d4d9cb3606ecf1f

SHA512
2d38adb199e5c3e50065d5ddf6b39b3cb7d481828f645e81b6c790b8b4f94f8e865b45780c436a4aa3ad3cb0356b3cd731b3414d877e16d55fbea94a8e0d8d78

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\bezierobjectbar.xml

Filesize
2KB

MD5
fc98b5953c38b1fbe98f10b40d023d9c

SHA1
5df9b7b56182d635b8c9dd0897930377f80c3e42

SHA256
12d3e8010994824400d82e727f515362b089eaa9de9864a8432ea1a887f04362

SHA512
e7db8cba0bdb056d213a47c822c62d28d5be9d5a53fe6df2ee6803226078ced14f646953fe4ebd5ea96b7c4b823643dbbc3d8cd3f2e7a5de1b267006fea7891f

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\drawbar.xml

Filesize
2KB

MD5
3f67ff4d745e46ab22fcb45cbd959e6c

SHA1
5e1c6b87314f4c7f64a1533e57b48607d31b0467

SHA256
fb4dbd459dc0d9f9f2f4f8b416d0342ebdfb1ed5a12307e5b3ac38f584fd0a89

SHA512
981a213cb63443d41f2cb09e66eb4aee2cbcc79b94a50a3f3ed88aa8f1d8ddce4f06f6b67e1a5170851ebebbddb28e6aafe671815b6b661bae49946198f93085

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\drawtextobjectbar.xml

Filesize
2KB

MD5
d27a50775647f0c6be6cb113b789cf1a

SHA1
e0dd5e3af2f7b19dfe9002c9468636540564d581

SHA256
8ac250b5ac870e3380c861f1456a46359bfe17a2745078cb9dd10e9f7942e87d

SHA512
efb087341b5bc6123f7e886533b5991c1f84f5d58cb6985f65be3464ec27182550dced73b9bff52237c8f68c0ca71fca766ce508dead645e83472ce1b0d11345

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\frameobjectbar.xml

Filesize
2KB

MD5
e47929623d3455afeb35b23b51e2b97d

SHA1
a11df2e2c65cb67c54a4d08db05755667c9332d6

SHA256
400da96f17ec52ab6291ce9707334b7b85db728a6a08e2869ac1328557bbf9f7

SHA512
2f398343df03e7cc967cabb1b77049984d7e73fd34d844acc8a35ed3dd9ce8616b13c3644439cbb7678a905574374ac7caa173ecfbd650f265a41ca6be66dcff

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\numobjectbar.xml

Filesize
2KB

MD5
ea1675555d11147963a6c761d162ee84

SHA1
115285b4c32fd6295a6bda4f27c97d4db0932c76

SHA256
aa9b2afbd4d8c3402bd16691b957b9a4a97c8f7f1de98d3ff60a2e49f7f22bd0

SHA512
430960b3ceed3556192b0610797269be9ac82a9e8feb9ba081a4a93462dddd2cd55c36ce94b499a713762fc136845013f41a6e2ee5e73921593ef8b5fc080d93

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\oleobjectbar.xml

Filesize
2KB

MD5
a7ad2c06c538b44af1e34d9c62d27aeb

SHA1
4e1ffa158711aa5729eb22e272d7369d2bf5c2aa

SHA256
a11119c981fc23eaabd207022cb94c9adf0f6e1cef12f85eb1b0003551e0fadb

SHA512
77f8758590d45af207d9a067d4fc5e15a8c27c6f9d13cc009364ca102ae78dd007ad1d36a47550571805c3b6c8a63c2c946e2b6a34973647b70300ae1c738c12

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\optimizetablebar.xml

Filesize
1KB

MD5
f38dde850334bfaf560a8beb427ea479

SHA1
34de34784782775f4e7c182e288f0ffb9667594f

SHA256
8347cd391d8e3735f97b2c99fe4ba13180224afce87c9abf96c05fc2eaa5c12c

SHA512
a7eea3a67da2751e931691cbe2ca139ea85fb541dce221ea7f71f99719a3ca59840938ceea3b28175466e8788a544d220d4152f56721dffdc62bfc0d1a0a9531

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\previewobjectbar.xml

Filesize
2KB

MD5
e3a6f8ecd58e5bfe0a7744d9edd595b8

SHA1
a4d19de35f3fe89ad38e5e6c028dfa659ccfc2da

SHA256
c46892997c975aeef2ad1f7d42be0ddf162febde321f8c4ca9585804193a170c

SHA512
98d14e430658dc665c5b942a7bd65aec7d33fa816be87eda4bdfc6af2ac02df1f07f8caeb6602c1b7580d5bf5075674c1db6273fc43743f6cbc32d2356915bfa

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\tableobjectbar.xml

Filesize
2KB

MD5
239c15a89a05b82e3ebef46a1b7a90d1

SHA1
2d9dcffa44a102473ab322701a563b385c126851

SHA256
f5ad2d306ea4f031123b6a8dc2da3bdeb0ed848e603a1aeca122409789e3301a

SHA512
c26222f45a2009c10a526298d9da48b7f979c87fc94bcb4fe9d6897e78bb206669093bf8dd5c7fda6dc47c7459a046a4c39c721909b0175b3dbaeb2f974a6b7f

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swxform\toolbar\drawingobjectbar.xml

Filesize
3KB

MD5
7165ffb260809d3b568c68b96b8d265d

SHA1
ed1cf5f68e975c7babc382283f986ba9bb84b777

SHA256
f4e1f4ad94dbfa9c5c433959ea6328bdaa58e204cfebb4417e897d7817928738

SHA512
1ac6e32e342ae9a298a81e17bc468517da7387e78906fb60df1fb6233ca6e8b48b5f7321d4804d4b8870614ccf133175dda906d751efcec76f22a30b3f16c470

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swxform\toolbar\findbar.xml

Filesize
1KB

MD5
d53725e2d4d5bc5b9f57416b7e8f4dd7

SHA1
fe51dc0a181c2f12876e7216c6d8c13cea418326

SHA256
258e1ee7154758d023542bee788036a9c3de06fb41010122baecc285ac5d587b

SHA512
9f80441294ccca1ce70ca9fca6c20f2055ef7cc9cba1e57ae0451fb11f80ad72c0f48fcde4fba0ee7ed41013b1ae5d46774cccf6dbffd5b136fc04028c4fa337

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swxform\toolbar\textobjectbar.xml

Filesize
3KB

MD5
cb901c53f8a48785f9aa1f0de1c24b76

SHA1
52eb883554ef8fbed3e88859dde1698463ddb8de

SHA256
03a2db3b9149c2c68919ca7fb2980e1bd1874f2af2b79e49fde542619c81902f

SHA512
2da355c2de1f25236d71385d59f7c64c254e84bc4fde8451ff7c730293a41da5a53f51d52ef34e90dce933a802369b4d81ee8be160beb506faecbb9c323eaeeb

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\gallery\diagrams\Component-Gear05-Orange.svg

Filesize
38KB

MD5
51aa9946e7844c63a8888f2634c0ff83

SHA1
d7d21ae072d571bd98b827fdab0da536ff19a59a

SHA256
8999caecd70b2a6c51be6dd549cdec59f74d333d5ef22767902fc7b1682cd541

SHA512
594f9dac7a2642e91b4857a7fa84e96d6ad9909831dc7309b72aaa9edf5301f91ab65d7fae302c3bc25ac4723b9135475cfbbc206d7939ecf99ee5e09c798522

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\gallery\sg12.sdv

Filesize
2KB

MD5
58b26eb6ab03be973425381f1de81aeb

SHA1
83c8ac739ac0069d7b6fefd84b9317c457b9a821

SHA256
65365530165a871772e21962a5d7dda107d8d010f329bf59c878eabc3465bbe4

SHA512
837b1ef7212aed8b8f8106a40a9ea61b14b97f03e455aff35847ea609023fb4ddd454c9546f0cb61acaa434fefa3330069993d7b0ee17102e4fd40d0e4a556b7

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\gallery\sg3.sdv

Filesize
2KB

MD5
a2e85f463600039026ff7fb5374991a1

SHA1
86eb0eb3038f602f4c3b769b7f330cbcb536341a

SHA256
b11bb3e78931d10e339748d89ca60269021df5ca963d117d137a0b70b6195103

SHA512
30a56b1cb62795ef7475c8ccdd4c3220c0e4c64be93993edef21b6e8ab64029b04ef0bbf853503b6b6e49b31dd5434b9c0c8652969945e5bc3ebb5f00a9b4a31

Download Submit
C:\Program Files\openoffice4115.msi

Filesize
2.4MB

MD5
63d6263904b3783c61f70232bc6b0749

SHA1
140cc43faf463b74a60805aa80711a75b352ae18

SHA256
a63fc1a0b7664e6c62d5f4d277c8bb46c3ddbf2c941c92ebe97a452e0a493590

SHA512
3c6ed5d9a830801fff7fc0013de4e4f60b9fc00c3c43351a1739228e5278bd95d226b022e0341ec7cd0fe6faa7934ac517f11a116cf3d00b9f35bae1c7dab31d

Download Submit
C:\Program Files\setup.exe

Filesize
468KB

MD5
5b8919735858ed14281644d2c240100e

SHA1
7f6375515e18679cf457f2bad67892db5a217555

SHA256
b78712b6fbe78bbdb57b25f985262e38e061811e244aa39297fd5a0c91d80ffa

SHA512
34d8faa0a71f02afff0699be326962938c36c55ba175a35f6a214bc1038f0bd1731f9a2566651a4dc932fc7814aa11bfec4533e5fe499dba3dfef910547c8ad4

Download Submit
C:\Program Files\setup.ini

Filesize
282B

MD5
fdb76ba148e889abc8cab4273642650b

SHA1
d94725b164727efe57c7f575ea637ecb4ba229b1

SHA256
371107fa4ea41b4f6f3d4b1e67520569e8849814dfb8fb7885ed1cec16f76594

SHA512
a5367c9ca489729b861f4fb323b58850877464399448631b2c18d0896e2bde0aedf6f9a495f05103fca1825fb1e7c5c4c19b207e84534ef6288ef64f1537ceb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC062.tmp

Filesize
164KB

MD5
34480728b3a659a7bc4bea865c25668d

SHA1
4ca4a1a5df7cb116ffa35e106705f2a2c20b0738

SHA256
a5b9ccf58eab9e907a151860f5630da52ae939625fd7065a05947c5e4376a09a

SHA512
6c6bf290e20d57477b9ee366e44d6c2559f27364063b03c23cf1687e41d5b9b44547f53751ea6b920bcb6471431443deafe4b0a638cd0ec4d7de903260cd978e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC16D.tmp

Filesize
88KB

MD5
55b453d7a244d96e10754ab033c45728

SHA1
7f927a511987022bb009f48ee152a4e91aa877f0

SHA256
f8da2aac476ad890fd32a25e7e3ebd85a352b92f8134092d8df0b6a7702b1c32

SHA512
21df0e08f5f3c05e6caf8085dab94dd9eb1248141cda974e7af9ec47d0249909c55bc599a88930f7421576cb834b44b84f8d858cbea770c3f11a5d397e30b731

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc6717.tmp\InstallOptions.dll

Filesize
15KB

MD5
d095b082b7c5ba4665d40d9c5042af6d

SHA1
2220277304af105ca6c56219f56f04e894b28d27

SHA256
b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

SHA512
61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc6717.tmp\ioSpecial.ini

Filesize
1KB

MD5
f59fd4313d5cdf95745996051f9ff008

SHA1
efb9ea819a5364a8b6a58b3d4b472c0888e89cb9

SHA256
1062d40762bcf40e5de146bb3e06d69d41c3187da1d623d7eb4f284f820c8c09

SHA512
af93394af3180f8d37f7663729fd9d399740903f6d0085b25d33eca63757b628d3b317cfd8bfae847d2f4385df57106d06d6836b471e5893a0bd1eeffb3c9f45

Download Submit
C:\Users\Admin\AppData\Roaming\OpenOffice\4\user\extensions\bundled\lastsynchronized

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\OpenOffice\4\user\extensions\tmp\extensions\sv3zb73w.tmp_\dict-es_es.oxt\description.xml

Filesize
788B

MD5
5dea246061e9429063cad08d2f21eb32

SHA1
8e41dfc2a344118f976a808c548889c3640f3428

SHA256
602a87d30ad43317cf286a45689de0f4f99ac226af03fc0342a14cfa22c568ae

SHA512
90e7fed936d0bb2df4a816b17a44d77ba2db30bdaf66f29a0a3502b74c8b45cf6af8e6a223bc1584ed0344a270c45de46094fdecefb07db6d05857c7f4ee84e0

Download Submit
C:\Windows\Installer\MSI2F59.tmp

Filesize
129KB

MD5
ca1c1ddd6fd657ce959be32ef8e706e7

SHA1
7e0e3a3f50aa45589d563c660414a732bd3f9780

SHA256
5a5d8f15e421dd540c19dc1face44b251a65db75b52c16f5e9c5c92297c248cd

SHA512
fc146703f7173a19fabda6237e836ab5eb5c745588e51e30339a85560b2f74c29ce21838914c85e40816c0debc739c9f8006efdc7d050f8d4dcac2c052ac8c15

Download Submit
C:\Windows\Installer\MSI2FB9.tmp

Filesize
131KB

MD5
fa028a08b632c119c5a5453b3621405e

SHA1
29533c0c61481437ee3814ead2f5624df75eeade

SHA256
e69292a514323845102a259e13120cef141e47720c293eec371cc353bc821959

SHA512
96ca62726a703037fad84c389371f7ea7df7690df0c0a025c6e8a62fe75c793b8d5673749e7719c0decd4bdb1d93a47d4060608ac78c70d44c5eac23c724fbeb

Download Submit
C:\Windows\Installer\MSI35D4.tmp

Filesize
130KB

MD5
0abd8f295cf152549ec2d10bf42ea4da

SHA1
9b340f7d5b1ff63707ceed76c2cb8fb1a63d82da

SHA256
90d0d29557e125d135c71e784bf2bf38a5faf77fa2f0e8fccf3dbc456d721eb9

SHA512
574e1e8707ee21d0a113c72e91cade4b83b101d72cd843211467c039ede7527bc555cbbefcbc59adb5145b126463127668817282a962e49845ee77bab52b004b

Download Submit
C:\Windows\assembly\GAC_32\cli_cppuhelper\1.0.23.0__ce2cb7e279207b9e\cli_cppuhelper.dll

Filesize
62KB

MD5
b42e2c2c7a485fbbd9875759fe5a9273

SHA1
984ba604de1ee95cb5648b4aa3a357b971fef9c6

SHA256
3b33ebec8b9995835744e7f9f1b1af280b00a632bfe84f3ce499dc05c4af1f39

SHA512
fa5b58a1e18de1461066c110f486ca156c4999314d586bbb38400c0911e92cded2d530afbf977c96b2054aa1cebe081e2d3836ebfebc0eca6d8d808cea45ba76

Download Submit
C:\Windows\assembly\GAC_32\policy.1.0.cli_cppuhelper\23.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_cppuhelper.dll

Filesize
3KB

MD5
4ddd77ae0a79345ced2b6c9c731942d1

SHA1
59d5e897dc8e4336eed32097e5638c617a2363fb

SHA256
4637d65b2fe3f996d22631d166fdc0cc61cf8d4f0341446c656f775cf5aa28ee

SHA512
264a406bb00f860154a5949d29b73ccf0a9166e3e91719bd93a8f61d31e6e370a3d4c1312cc998c520ec20a6bccee6527c5e4a6622cba9845301a6d51199ff61

Download Submit
C:\Windows\assembly\GAC_MSIL\cli_oootypes\1.0.9.0__ce2cb7e279207b9e\cli_oootypes.dll

Filesize
900KB

MD5
e0ba423ac13e36040527df8b5b4f093b

SHA1
0388b7bda223fa277759fd20fcb61e12947c29ee

SHA256
2cf7eb8d6892792649e1bf7194c3e0d8afe322a950d02d07dfd71dd105c029d5

SHA512
c625b61583a3d70aeaa66c606ebb620d0f489c3a0f62a4d763f3c7f687b1465f2cae4f4bcd096dffa958295c3307335a9703ca0e417f15d989563d1c487981b9

Download Submit
C:\Windows\assembly\GAC_MSIL\cli_ure\1.0.23.0__ce2cb7e279207b9e\cli_ure.dll

Filesize
7KB

MD5
6fb15505a647517c46f9ce8d7d0fea01

SHA1
4c9e3c7c2bab9f09919a18eead2ea551207ffd23

SHA256
a7570364bccd6f10c7de0f51a092d4a19b425c680abfc0e9a3d22c96fa891500

SHA512
116b12e5fce5edb7a01aa36ae44ca08d20596c80b3bf4bf443cfbf341d1d6b9b49c20152d0b0f12f4006faefdac194dbadc06947ef1ba9b64e20fdc6a5996150

Download Submit
C:\Windows\assembly\GAC_MSIL\cli_uretypes\1.0.9.0__ce2cb7e279207b9e\cli_uretypes.dll

Filesize
116KB

MD5
c1d21f68dff9d4da6846fae26fbb3c16

SHA1
4e2640df166ae9a48ea61057a38ca73d130b5b1f

SHA256
dfd9faf0daa2b8050da074f0243802eb6fabecc24e6df935217170a64ba8f4a4

SHA512
083e45fc1fffd234eaf3e28f13aee02b231be847b6ca9783d88dde70b894596f076540b8e36979ac6c84db31d776149cc64de3157e02b71054257655b24eff60

Download Submit
C:\Windows\assembly\GAC_MSIL\policy.1.0.cli_basetypes\20.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_basetypes.dll

Filesize
3KB

MD5
0cbeff6d0f2fda424e0049898b932c09

SHA1
e757f28aa9ef4127e1f26a4cc0d53652164040cc

SHA256
3e01851239de69293260b99157107aaa30ce243d5eecbc89a67b32edf97621e0

SHA512
a37014cfb571240b196ffb8fb74525dd48ebaac975ad2ba5da5569e3d334bbda733f2e78ef5f1a403c38601b368284c5b1a940bfe14c0546767c08341f9d422c

Download Submit
C:\Windows\assembly\GAC_MSIL\policy.1.0.cli_oootypes\9.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_oootypes.dll

Filesize
3KB

MD5
ce60498f9fc82d24a74557d95c7eba5a

SHA1
5c363a2efcfd9cd2fd4fa2b96b5538ff8296ae72

SHA256
f7478ab31b8b7bfa4e4f6a57595e56613452f4f66464141a2b7492c37de25aa8

SHA512
d7097fc3e27f73f59c8533fd15fe806efd56f79882b574247195aa03a5455c7f3c2a991007459a4fc6303e8a8c89b7d545ad1be00acc85dddf0aa4f32c7bb9a4

Download Submit
C:\Windows\assembly\GAC_MSIL\policy.1.0.cli_ure\23.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_ure.dll

Filesize
3KB

MD5
a3144e4a2f1850dc9c2ffae0a9af03a0

SHA1
2ee97f32b7ffc2dfafbaceab73d1297e3b22dd55

SHA256
f415214842b735fa6c37a905b74c76256b37fd1b8cf0e10fbcd82d670dffcff3

SHA512
f6456137dc8918712075f6491173bd9827ad4dd645008148c9c21d73091586911dd6c963722aa44c79a083e13a5768e615a3c7663a92ea8583af3df185f88487

Download Submit
C:\Windows\assembly\GAC_MSIL\policy.1.0.cli_uretypes\9.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_uretypes.dll

Filesize
3KB

MD5
56d751cce5ec5b50878ea1a1e8ef9ac7

SHA1
c14e1ec041cd257731ad2006702278e93e8d50e2

SHA256
0e19af4b97f962e36d6d8f05fff8b19d3642805d4e40d96addc872f82a76b063

SHA512
71347f90075874fd9feb9d371edceb7a7fe0f404372b0ab3ce7e4c8b7f0ea92ef3e0d44a03a3ffc670b2e13a14eb70d80f09abbb41182319677c4340fda7df55

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.9MB

MD5
23dcd0a7a64c0336477c9940768dd038

SHA1
327a8755d9f532b6d6784989e2a50bf9903b8ed8

SHA256
2ef8a466d6455a9ef76afa19d5d26b37f487fbc41544a2073b95cef228826f12

SHA512
56ad6581ffb14ddd6e520340e5233acd50f9c0fc4058b79e5a10491d61c648c0ff9aa636411ca5caa0a4ddadbceda908120e82b43efb7c72de045f77c0c51763

Download Submit
\??\Volume{1cd1de57-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6ac0510c-a31c-4e3d-8e55-d4a9a0021294}_OnDiskSnapshotProp

Filesize
6KB

MD5
353a4a2652f3e6512c50bc38ff1b8771

SHA1
8f3eb8a7477f53d0c49b24a453a5fc4c812c9e1b

SHA256
eab58a5d10c1d4cae36716ccf549aca5ab081944f8ed2a1de9a439b222507e1b

SHA512
0669347f8c1eec7e784cdc93a41a58404f9059b1a6c9aac951bf3433a3ac23a445d7722ef17e902bb052dc8a426e50f69178a9ad1b2972629099a5797ca58256

Download Submit
memory/2108-3913-0x0000000003F50000-0x0000000003F60000-memory.dmp

Filesize
64KB

Download
memory/2108-3910-0x0000000003F50000-0x0000000003F60000-memory.dmp

Filesize
64KB

Download
memory/2108-3909-0x0000000003F50000-0x0000000003F60000-memory.dmp

Filesize
64KB

Download
memory/2108-3911-0x0000000003F50000-0x0000000003F60000-memory.dmp

Filesize
64KB

Download
memory/2108-3912-0x0000000003F50000-0x0000000003F60000-memory.dmp

Filesize
64KB

Download
memory/4708-334-0x0000024D82C00000-0x0000024D82C08000-memory.dmp

Filesize
32KB

Download
memory/4708-308-0x0000024D82BC0000-0x0000024D82BC8000-memory.dmp

Filesize
32KB

Download
memory/4708-2043-0x0000024D83FD0000-0x0000024D840B4000-memory.dmp

Filesize
912KB

Download
memory/4708-2040-0x0000000000630000-0x0000000000643000-memory.dmp

Filesize
76KB

Download
memory/4708-342-0x0000024D82C20000-0x0000024D82C28000-memory.dmp

Filesize
32KB

Download
memory/4708-338-0x0000024D82C10000-0x0000024D82C18000-memory.dmp

Filesize
32KB

Download
memory/4708-2163-0x0000024D82C80000-0x0000024D82C88000-memory.dmp

Filesize
32KB

Download
memory/4708-311-0x0000024D82C50000-0x0000024D82C70000-memory.dmp

Filesize
128KB

Download
memory/4708-304-0x0000024D82B80000-0x0000024D82B8A000-memory.dmp

Filesize
40KB

Download
memory/4708-2159-0x0000024D82C70000-0x0000024D82C78000-memory.dmp

Filesize
32KB

Download
memory/5112-4006-0x0000000008820000-0x0000000008830000-memory.dmp

Filesize
64KB

Download
memory/5112-4005-0x0000000008820000-0x0000000008830000-memory.dmp

Filesize
64KB

Download
memory/5112-4004-0x0000000008820000-0x0000000008830000-memory.dmp

Filesize
64KB

Download
memory/5112-4008-0x0000000008820000-0x0000000008830000-memory.dmp

Filesize
64KB

Download
memory/5112-4029-0x000000000BEC0000-0x000000000BED0000-memory.dmp

Filesize
64KB

Download
memory/5112-4027-0x000000000BEC0000-0x000000000BED0000-memory.dmp

Filesize
64KB

Download
memory/5112-4028-0x000000000BEC0000-0x000000000BED0000-memory.dmp

Filesize
64KB

Download
memory/5112-4007-0x0000000008820000-0x0000000008830000-memory.dmp

Filesize
64KB

Download