a6f33d935bd9c016b3d0914fd35d0985fbfb52018048a90e93f83984be09da9d

Analysis

max time kernel
76s
max time network
67s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09/03/2025, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Apache_OpenOffice_4.1.15_Win_x86_install_fr.exe
Size

127.7MB
MD5

3c5cf11baee9861a6fb78f642c17e3d1
SHA1

9c0944a1c8dce201c7034f2e71e3cd5f12e023ff
SHA256

a6f33d935bd9c016b3d0914fd35d0985fbfb52018048a90e93f83984be09da9d
SHA512

68c4e7e932ecd76c3c48b40939bb2e9a9e92f8465fbd01737cf136bde19518ec445c8f3ab47d33c5ea9a45a68570712612cae4f90a2799f5b3a008405eeb5753
SSDEEP

3145728:6yDn6qlCIvN+cNqo7pxV1zkthAqUWSnA3BJw+3FmqE:xDn6CkcNqorzMZUWKWBJR3sF

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.15\Desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swform\toolbar\extrusionobjectbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\juhx.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\finance\Chart-Plateau.png	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\www-graf\redplus.gif	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\resource\t602filterfr.res	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\autocorr\acor_sv-SE.dat	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\symbols\Key02.svg	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\classes\ScriptProviderForJavaScript.jar	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\ctypes\macholib\framework.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\bullets\redarrow.gif	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\idx.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\fingerprint\belarus.lm	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\transport\Boat.png	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\wizard\letter\da\off-modern_l.ott	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\cppu3.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\bullets\whtpearl.gif	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\pyuno.pyd	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sweb\toolbar\basicshapes.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\basic\Tutorials\RoadMap.xba	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\environment\Earth.png	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\encodings\cp1258.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\genericpath.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\lib2to3\refactor.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\transport\Helicopter-Blue.png	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\wizard\letter\pl\off-elegant_l.ott	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sdraw\toolbar\calloutshapes.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\simpress\toolbar\fullscreenbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\xslt\import\wordml\wordml2ooo_draw.xsl	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\chunk.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\subprocess.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swreport\toolbar\tableobjectbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\fr\wizard\report\cnt-default.ott	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\chartview.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\wizard\letter\tr\pri-redline_l.ott	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\help\fr\scalc.idxl\segments.gen	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\pythonloader.uno.ini	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\wizard\letter\de\bus-elegant_l.ott	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\encodings\shift_jis_2004.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\sg9.thm	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\textshapes\Hexagon03-Green.svg	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\dtd\math\1_01\w3c_ipr_software_notice.html	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\textshapes\Leaf05-Orange.svg	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\encodings\iso8859_1.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\autotext\fr\template.bau	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\wizard\web\images\html.gif	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\people\Presenter-Female2.png	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\template\wizard\bitmap\italia.gif	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\finance\Balance-Balanced1.png	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\nssckbi.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\pydoc.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\BasicIDE\menubar\menubar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\htmlexpo\gretext.gif	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\www-back\stone-dark.jpg	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\gallery\www-graf\bludisk.gif	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\resource\analysisfr.res	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\presets\gallery\sg100.thm	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swform\toolbar\colorbar.xml	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\ipb.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\unordf.dll	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\fingerprint\polish.lm	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\python-core-2.7.18\lib\encodings\iso8859_4.py	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\share\Scripts\javascript\Highlight\ShowDialog.js	msiexec.exe
File created	C:\Program Files (x86)\OpenOffice 4\program\xsltfilter.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\f777e35.msi	msiexec.exe
File created	C:\Windows\assembly\tmp\82LA1UZ0\policy.1.0.cli_basetypes.dll	msiexec.exe
File created	C:\Windows\Fonts\Carlito-BoldItalic.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansMono-BoldOblique.ttf	msiexec.exe
File created	C:\Windows\Fonts\GenBasBI.ttf	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol38.dat	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\assembly\tmp\KWBGJ092\policy.1.0.cli_ure.dll	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerifCondensed.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\IKQVYA12\policy.1.0.cli_cppuhelper.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol39.dat	msiexec.exe
File created	C:\Windows\assembly\pubpol41.dat	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol42.dat	msiexec.exe
File created	C:\Windows\assembly\tmp\4HPJSKJX\VR8RMCEN	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansMono.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\T5AFECV7\cli_oootypes.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol40.dat	msiexec.exe
File created	C:\Windows\assembly\pubpol40.dat	msiexec.exe
File created	C:\Windows\assembly\pubpol42.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC77D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC78D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7ED1.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\82LA1UZ0\QVK4BFHN	msiexec.exe
File created	C:\Windows\Fonts\Caladea-Bold.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansCondensed-Oblique.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerif.ttf	msiexec.exe
File created	C:\Windows\Fonts\GenBkBasI.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\PKO6151F\policy.1.0.cli_oootypes.dll	msiexec.exe
File created	C:\Windows\Installer\{DC8B4E0E-87B2-46D7-9FBA-B55470DC3B9A}\soffice.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F8E.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\KWBGJ092\ME4P0JKS	msiexec.exe
File created	C:\Windows\assembly\tmp\4HPJSKJX\policy.1.0.cli_uretypes.dll	msiexec.exe
File created	C:\Windows\Fonts\GenBasR.ttf	msiexec.exe
File created	C:\Windows\assembly\pubpol39.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC79E.tmp	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansCondensed-BoldOblique.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\4JZ4J8E3\cli_cppuhelper.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC79F.tmp	msiexec.exe
File created	C:\Windows\Fonts\Carlito-Regular.ttf	msiexec.exe
File created	C:\Windows\Fonts\GenBasB.ttf	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol41.dat	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerif-BoldItalic.ttf	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI856A.tmp	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSansMono-Oblique.ttf	msiexec.exe
File created	C:\Windows\assembly\pubpol38.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7E1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8069.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8470.tmp	msiexec.exe
File created	C:\Windows\Fonts\Carlito-Italic.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSans-ExtraLight.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSans-BoldOblique.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerifCondensed-BoldItalic.ttf	msiexec.exe
File created	C:\Windows\Fonts\DejaVuSerif-Italic.ttf	msiexec.exe
File created	C:\Windows\assembly\tmp\IKQVYA12\U24N3ATF	msiexec.exe
File created	C:\Windows\assembly\tmp\IA9JYCZ3\cli_basetypes.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC23D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7D0.tmp	msiexec.exe
File created	C:\Windows\Installer\f777e35.msi	msiexec.exe
File created	C:\Windows\assembly\tmp\61BFQWLR\cli_ure.dll	msiexec.exe
File created	C:\Windows\Fonts\GenBasI.ttf	msiexec.exe
File created	C:\Windows\Fonts\opens___.ttf	msiexec.exe
File opened for modification	C:\Windows\assembly\PublisherPolicy.tme	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7CF.tmp	msiexec.exe

Executes dropped EXE 5 IoCs

pid	Process
1572	setup.exe
888	unopkg.exe
1036	unopkg.bin
2288	soffice.exe
2052	soffice.bin

Loads dropped DLL 64 IoCs

pid	Process
2388	Apache_OpenOffice_4.1.15_Win_x86_install_fr.exe
2388	Apache_OpenOffice_4.1.15_Win_x86_install_fr.exe
2388	Apache_OpenOffice_4.1.15_Win_x86_install_fr.exe
1572	setup.exe
1572	setup.exe
1572	setup.exe
1760	MsiExec.exe
1760	MsiExec.exe
1760	MsiExec.exe
1760	MsiExec.exe
1760	MsiExec.exe
1760	MsiExec.exe
1972	MsiExec.exe
1972	MsiExec.exe
1972	MsiExec.exe
1972	MsiExec.exe
1972	MsiExec.exe
1972	MsiExec.exe
1972	MsiExec.exe
888	unopkg.exe
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin
1036	unopkg.bin

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	soffice.bin
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apache_OpenOffice_4.1.15_Win_x86_install_fr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unopkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unopkg.bin
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	soffice.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Pot\shell\print	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2D59CD1-0A6A-4D36-AE20-47817077D57C}\MiscStatus\ = "16"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.WriterTemplate.1\shell\print\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\soffice.exe\" -p \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarWriterGlobalDocument.6\shell\new\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\soffice.exe\" -n \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{448BB771-CFE2-47C4-BCDF-1FBF378E202C}\DataFormats\GetSet	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MIME\Database\Content Type\application/vnd.oasis.opendocument.formula	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.DrawDocument.1\shell\print\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\soffice.exe\" -p \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Potm\shell\print	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Docm\shell\printto\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\\\swriter.exe\" -pt \"%2\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenOffice.Potm\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\soffice.StarCalcTemplate.6\shell\new\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarCalcTemplate.6\shellex\PropertySheetHandlers\MyPropSheet1\ = "{63542C48-9552-494A-84F7-73AA6A7C99C1}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7FA8AE11-B3E3-4D88-AABF-255526CD1CE8}\ = "Classeur OpenDocument"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{7FA8AE11-B3E3-4D88-AABF-255526CD1CE8}\verb\-2	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenOffice.Potm	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Docx\shell\printto	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.DrawDocument.1\Insertable\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Pptx\shell\new\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\\\simpress.exe\" -n \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithProgIds\soffice.StarCalcDocument.6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Pptm\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenOffice.Xltm\shell\print\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\OpenOffice	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wk1\OpenWithProgIDs\soffice.StarCalcDocument.6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.WriterWebTemplate.1\shell\print	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.oth\PersistentHandler	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.otp\PersistentHandler\ = "{7BC0E713-5703-45BE-A29D-5D46D8B39262}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{D0484DE6-AAEE-468a-991F-8D4B0737B57A}\DataFormats\GetSet\1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.MathDocument.1\protocol\StdFileEditing\verb\0\ = "&Edit"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Pptm\shell\printto	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarCalcDocument.6\protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{41662FC2-0D57-4aff-AB27-AD2E12E7C273}\AuxUserType\2	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{D2D59CD1-0A6A-4D36-AE20-47817077D57C}\MiscStatus	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.DrawTemplate.1\shellex\PropertySheetHandlers\MyPropSheet1\ = "{63542C48-9552-494A-84F7-73AA6A7C99C1}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.odm\shellex\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sxi\shellex\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}\ = "{3B092F0C-7696-40E3-A80F-68D74DA84210}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E0E4B8CD2B787D64F9AB5B4507CDB3A9\gm_Brand_p_Wrt = "gm_p_Wrt"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenOffice.Docx\shell\new	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarImpressTemplate.6\shell\open\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\simpress.exe\" -o \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarWriterTemplate.6\shell\print\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\soffice.exe\" -p \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E0E4B8CD2B787D64F9AB5B4507CDB3A9\gm_Langpack_Calc_fr = "gm_Langpack_r_fr"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{30A2652A-DDF7-45e7-ACA6-3EAB26FC8A4E}\Insertable	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\soffice.StarDrawDocument.6\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Docm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.DrawTemplate.1\shell\open\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\sdraw.exe\" -o \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Pptx\shell\ = "open"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{448BB771-CFE2-47C4-BCDF-1FBF378E202C}\verb\-2\ = "Open,0,0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\opendocument.CalcDocument.1\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.WriterTemplate.1\shell\print	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sxg\shellex\{00021500-0000-0000-C000-000000000046}\ = "{087B3AE3-E237-4467-B8DB-5A38AB959AC9}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F616B81F-7BB8-4F22-B8A5-47428D59F8AD}\verb\0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenOffice.Dot\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarImpressTemplate.6\shell\new\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\soffice.exe\" -n \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{30A2652A-DDF7-45e7-ACA6-3EAB26FC8A4E}\DataFormats\GetSet\0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.MathDocument.1\shellex\PropertySheetHandlers	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.DrawTemplate.1\shell\print	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Pps\shell\open\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\\\simpress.exe\" -o \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\soffice.StarImpressTemplate.6\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{448BB771-CFE2-47C4-BCDF-1FBF378E202C}\AuxUserType\3\ = "Dessin OpenDocument"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.stw\OpenWithProgIDs\soffice.StarWriterTemplate.6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\opendocument.CalcDocument.1\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenOffice.Docm\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\opendocument.MathDocument.1\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Pot\shell\printto\command\ = "\"C:\\Program Files (x86)\\OpenOffice 4\\program\\\\simpress.exe\" -pt \"%2\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenOffice.Xlt\shell\print	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
764	msiexec.exe
764	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2388	Apache_OpenOffice_4.1.15_Win_x86_install_fr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeSecurityPrivilege	764	msiexec.exe
Token: SeCreateTokenPrivilege	3020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3020	msiexec.exe
Token: SeLockMemoryPrivilege	3020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3020	msiexec.exe
Token: SeMachineAccountPrivilege	3020	msiexec.exe
Token: SeTcbPrivilege	3020	msiexec.exe
Token: SeSecurityPrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeLoadDriverPrivilege	3020	msiexec.exe
Token: SeSystemProfilePrivilege	3020	msiexec.exe
Token: SeSystemtimePrivilege	3020	msiexec.exe
Token: SeProfSingleProcessPrivilege	3020	msiexec.exe
Token: SeIncBasePriorityPrivilege	3020	msiexec.exe
Token: SeCreatePagefilePrivilege	3020	msiexec.exe
Token: SeCreatePermanentPrivilege	3020	msiexec.exe
Token: SeBackupPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeShutdownPrivilege	3020	msiexec.exe
Token: SeDebugPrivilege	3020	msiexec.exe
Token: SeAuditPrivilege	3020	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3020	msiexec.exe
Token: SeChangeNotifyPrivilege	3020	msiexec.exe
Token: SeRemoteShutdownPrivilege	3020	msiexec.exe
Token: SeUndockPrivilege	3020	msiexec.exe
Token: SeSyncAgentPrivilege	3020	msiexec.exe
Token: SeEnableDelegationPrivilege	3020	msiexec.exe
Token: SeManageVolumePrivilege	3020	msiexec.exe
Token: SeImpersonatePrivilege	3020	msiexec.exe
Token: SeCreateGlobalPrivilege	3020	msiexec.exe
Token: SeCreateTokenPrivilege	3020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3020	msiexec.exe
Token: SeLockMemoryPrivilege	3020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3020	msiexec.exe
Token: SeMachineAccountPrivilege	3020	msiexec.exe
Token: SeTcbPrivilege	3020	msiexec.exe
Token: SeSecurityPrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeLoadDriverPrivilege	3020	msiexec.exe
Token: SeSystemProfilePrivilege	3020	msiexec.exe
Token: SeSystemtimePrivilege	3020	msiexec.exe
Token: SeProfSingleProcessPrivilege	3020	msiexec.exe
Token: SeIncBasePriorityPrivilege	3020	msiexec.exe
Token: SeCreatePagefilePrivilege	3020	msiexec.exe
Token: SeCreatePermanentPrivilege	3020	msiexec.exe
Token: SeBackupPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeShutdownPrivilege	3020	msiexec.exe
Token: SeDebugPrivilege	3020	msiexec.exe
Token: SeAuditPrivilege	3020	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3020	msiexec.exe
Token: SeChangeNotifyPrivilege	3020	msiexec.exe
Token: SeRemoteShutdownPrivilege	3020	msiexec.exe
Token: SeUndockPrivilege	3020	msiexec.exe
Token: SeSyncAgentPrivilege	3020	msiexec.exe
Token: SeEnableDelegationPrivilege	3020	msiexec.exe
Token: SeManageVolumePrivilege	3020	msiexec.exe
Token: SeImpersonatePrivilege	3020	msiexec.exe
Token: SeCreateGlobalPrivilege	3020	msiexec.exe
Token: SeCreateTokenPrivilege	3020	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3020	msiexec.exe
3020	msiexec.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1572	2388	Apache_OpenOffice_4.1.15_Win_x86_install_fr.exe	32
PID 2388 wrote to memory of 1572	2388	Apache_OpenOffice_4.1.15_Win_x86_install_fr.exe	32
PID 2388 wrote to memory of 1572	2388	Apache_OpenOffice_4.1.15_Win_x86_install_fr.exe	32
PID 2388 wrote to memory of 1572	2388	Apache_OpenOffice_4.1.15_Win_x86_install_fr.exe	32
PID 2388 wrote to memory of 1572	2388	Apache_OpenOffice_4.1.15_Win_x86_install_fr.exe	32
PID 2388 wrote to memory of 1572	2388	Apache_OpenOffice_4.1.15_Win_x86_install_fr.exe	32
PID 2388 wrote to memory of 1572	2388	Apache_OpenOffice_4.1.15_Win_x86_install_fr.exe	32
PID 1572 wrote to memory of 3020	1572	setup.exe	33
PID 1572 wrote to memory of 3020	1572	setup.exe	33
PID 1572 wrote to memory of 3020	1572	setup.exe	33
PID 1572 wrote to memory of 3020	1572	setup.exe	33
PID 1572 wrote to memory of 3020	1572	setup.exe	33
PID 1572 wrote to memory of 3020	1572	setup.exe	33
PID 1572 wrote to memory of 3020	1572	setup.exe	33
PID 764 wrote to memory of 1760	764	msiexec.exe	35
PID 764 wrote to memory of 1760	764	msiexec.exe	35
PID 764 wrote to memory of 1760	764	msiexec.exe	35
PID 764 wrote to memory of 1760	764	msiexec.exe	35
PID 764 wrote to memory of 1760	764	msiexec.exe	35
PID 764 wrote to memory of 1760	764	msiexec.exe	35
PID 764 wrote to memory of 1760	764	msiexec.exe	35
PID 764 wrote to memory of 1972	764	msiexec.exe	40
PID 764 wrote to memory of 1972	764	msiexec.exe	40
PID 764 wrote to memory of 1972	764	msiexec.exe	40
PID 764 wrote to memory of 1972	764	msiexec.exe	40
PID 764 wrote to memory of 1972	764	msiexec.exe	40
PID 764 wrote to memory of 1972	764	msiexec.exe	40
PID 764 wrote to memory of 1972	764	msiexec.exe	40
PID 1972 wrote to memory of 888	1972	MsiExec.exe	42
PID 1972 wrote to memory of 888	1972	MsiExec.exe	42
PID 1972 wrote to memory of 888	1972	MsiExec.exe	42
PID 1972 wrote to memory of 888	1972	MsiExec.exe	42
PID 888 wrote to memory of 1036	888	unopkg.exe	43
PID 888 wrote to memory of 1036	888	unopkg.exe	43
PID 888 wrote to memory of 1036	888	unopkg.exe	43
PID 888 wrote to memory of 1036	888	unopkg.exe	43
PID 2288 wrote to memory of 2052	2288	soffice.exe	45
PID 2288 wrote to memory of 2052	2288	soffice.exe	45
PID 2288 wrote to memory of 2052	2288	soffice.exe	45
PID 2288 wrote to memory of 2052	2288	soffice.exe	45

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Apache_OpenOffice_4.1.15_Win_x86_install_fr.exe
"C:\Users\Admin\AppData\Local\Temp\Apache_OpenOffice_4.1.15_Win_x86_install_fr.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\Desktop\New folder\setup.exe
  "C:\Users\Admin\Desktop\New folder\setup.exe" -lang 1036
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\SysWOW64\\msiexec.exe SETUP_USED=1 /I "C:\Users\Admin\Desktop\New folder\openoffice4115.msi"
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3020

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DBAD0E81128112A7DE245C966EFC4E27 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1760
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 15DD38CF1BD98CE14771C25EC62E590C
  2⤵
  - Drops desktop.ini file(s)
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Program Files (x86)\OpenOffice 4\program\unopkg.exe
    "C:\Program Files (x86)\OpenOffice 4\program\unopkg.exe" sync
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\Program Files (x86)\OpenOffice 4\program\unopkg.bin
      "C:\Program Files (x86)\OpenOffice 4\program\unopkg.exe" sync "-env:INIFILENAME=vnd.sun.star.pathname:C:\Program Files (x86)\OpenOffice 4\program\redirect.ini" "-env:OOO_CWD=2C:\\Windows\\SysWOW64"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2192

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003CC" "000000000000055C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1852

C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
"C:\Program Files (x86)\OpenOffice 4\program\soffice.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
  "C:\Program Files (x86)\OpenOffice 4\program\soffice.exe" "-env:OOO_CWD=2C:\\Program Files (x86)\\OpenOffice 4"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f777e37.rbs

Filesize
583KB

MD5
bde02ea2305766dec1793863f4a997ef

SHA1
3c7797782e0e4626370defc71a9e72083fc73318

SHA256
fd475f5772d2d91284775dfd19f33807e844d0f3f87e8ec3feab55133de3f186

SHA512
83fd53ab594af66fb269d9a5f8ca9cb9f86b19adaf366bcc6c11d19fe001c4788ce9ee106de5b47edfa0164c6a3d6c435bbc760cd20b0d08b0ee81bf88527296

Download Submit
C:\Program Files (x86)\OpenOffice 4\help\fr\sdraw.idxl\segments.gen

Filesize
20B

MD5
2eb2668d2bf13379fa3584b9a9867b46

SHA1
86ee9f040505bb2f9ad01472bfc6c3f10f6f0091

SHA256
ab308562fd6f5404d34e923152ee70ff7bddaab2f421a6c58730ba731bd09182

SHA512
15dec785f3fd190336f8561a827566d90865d174f33f6c7947da7b298734aad887f522d2fc625353c8a798e4c6cfeef27bec59131fdab3384dba0fcdd50f8415

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\cppu3.dll

Filesize
232KB

MD5
d650dbf1f44940d3114f2dbafacdb105

SHA1
340ead6c2b39bdc69089f6e53ea3b8790bb5a8d2

SHA256
6e8fe7fd334fac60303c90dc2147f5c47bc4237d4f465ec0d74a97e9d288ed65

SHA512
b51ae9aa03580d7f8dee1d631c5789b6dd76f15375298df873d418463b51929af4a109ae3c7fb647533d03385ba4eb5ba6e6b154bb5ba16856c8de3bfe6e8c32

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\i18nisolang1MSC.dll

Filesize
26KB

MD5
91051b92ad6398cafe44cf773a3c806d

SHA1
e551a53bafb10eeabb54c23f8612ab364d1d4089

SHA256
4b110f525dfe923d785130fa579edd7e8c58a6e8f48c095be871505789cfe62b

SHA512
f4955fa3db35feb4d1c8eb6f2913fb6f1cb25405f863e9365415210c8f80c78351f46bbf77997f20d02b694501c6c63cc2d98a29c0f9e7a319711c91f399c6f3

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\redirect.ini

Filesize
54B

MD5
472e9bc3de46961d70744c1ad932f44f

SHA1
94e39e169b64f363a36e64721f6f07c6444c5d34

SHA256
27e2c33328e4e6b117f41deccc7be249e0f2b8f9120a3e3eecd3c852d0c3293e

SHA512
c3e99efd3510319db52eccbd265a49c221aa8ee283e7693474953b442fbdd3531495d4f4bdf6073c5c2cf738cae6fa10b7cf1e3ee93aede9dc1398cd84ecc188

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\soffice.ini

Filesize
239B

MD5
4af36e1feb3d5ff03fccadba70971809

SHA1
b52e530a5d673a03ee6d13df6f4b5950c5b2a287

SHA256
e65f23d7c58f4035b728904a47f54da1c5a3e89fc89b5cd6a77624e6f143b4fb

SHA512
e606c771e3c0e209af1d7a84fda5b695e087fc5f9057b3871587bea70ee4d15cee7fd4d04fd3c629d8ab8300b46bcb7723280b153b0883f8a69a185f28202ad3

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\unopkg.bin

Filesize
40KB

MD5
37815aea72dfc0e856694661328efe88

SHA1
b4fa6e91dc004b9ac2bdcf12e0cb3f6de5aff5cd

SHA256
f8d063b0dfa642599af36c0716367d965a5ef7822d23903b95dad422cbd6e67a

SHA512
0bb609d45fef9cc1f1165254d6237c0756cf2978edda37c235d9427a001e5812344e87b79d2129aaa6c6366d60618da8dabdb4c4d93c9bc8d4277e75d0917180

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\unopkg.exe

Filesize
11KB

MD5
564c34f6e73bf473e931c1d45fe26b8f

SHA1
d29e0634c9ab20fd098e57566592d2b326f7d846

SHA256
97bf1e50b602e869be5152f52660d343cfdb1899f11887bedf6732eac5bf6277

SHA512
1843009a0139afd866a46e74e9a51207f28af18b5e122d7b90b2b391b008317788472f49ad6e46a8b29819cad8f68708f1f56e1c2596dc72d87122c9b654ab9b

Download Submit
C:\Program Files (x86)\OpenOffice 4\program\uwinapi.dll

Filesize
83KB

MD5
d2b30fb435960e7fc4b1e6daf9527963

SHA1
36ed32ddd6138df3b0ba6ae26b91cab347adf21d

SHA256
b3b47351245f0d5275eda88f9e5f97ab172a23da7446fae9e06e406f4d7e27e0

SHA512
cb1602008afecace94f89aaf8fd9648a5148855b5e86f5ef669e2cb6ef03d5324922f99866f1844e7c44ba4d6f0aba7a2cfb62e7bc27938e596eefeaeb03e221

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sglobal\toolbar\arrowshapes.xml

Filesize
3KB

MD5
30f29f8bc2364c8825209311c23a9400

SHA1
800fab986f8ce90305505c8a7ed8fb888148f2cf

SHA256
5d0513e99b61a44590b1166002fdb7718d0df17d2d530586674d42f8adfe3f86

SHA512
c6859ba265381b45e2a219486dfd9b3ef9a21f53527acf371743c8d7bbf3a1e21cac9bbf50ae664cd9aca459afbfdb1638af528b78413cc0a2cc26c00a41e4b8

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sglobal\toolbar\basicshapes.xml

Filesize
2KB

MD5
7d8b3a8516f8f4ccaabb651abfba6d54

SHA1
df4601c32d49d8fc92d8445a8e72588d089a0704

SHA256
dee7c013eb81edaf12552a3c29d38daec3f43130425a9b5346170c713509fb53

SHA512
3e399ac089b5d014f433dc97dae4d83fa85f8aab72a48817ee0ecda441e6529fca2f4d21512fc191dd5ac3f24c47300ac575a4e32dfffe3d9ccba8db411bceef

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sglobal\toolbar\calloutshapes.xml

Filesize
1KB

MD5
1a247cb922bdecd9c81adff1f9e8112a

SHA1
33fe2b304e13aa169c17a566bf48094645006073

SHA256
16b646eeb085201568673b1344f4773043e6b3f3cdb2e52182b359672128de20

SHA512
d5afd85d828ddbdb6f013284f404b13aebc1b46ddaffbeffa9e89c10998d8ec14813a718f20ef4dcad2554092c4574ef96bb46813e96802c22d25c27ceb65641

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sglobal\toolbar\flowchartshapes.xml

Filesize
3KB

MD5
a745ac650ef734d5da5623e2aa2b05f8

SHA1
4f44caa998bf1195620f209bb134c8e0ae09fd35

SHA256
41e78588d8a63dd70ef7d8ab47b8a4d9b0e48fac5c8afc23e0d95244de25e5e9

SHA512
eb16d59a51db0660472c37de1f0b7eaf88820206785e6a5fd75e3b905ca89e45f336dca6a08e15e36de11be9e34d41d8fe7c59e8e585b53fd46b36396d7b2ae3

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sglobal\toolbar\starshapes.xml

Filesize
1KB

MD5
1366f772d261555879c5e9712a25a9e6

SHA1
5746a20b7b50b7f7ce4eac7c1e1ce7b7990201e2

SHA256
bbebfb9f8e8849ad7c5a6e7a0707a0e9ee0ddcc3ba2138d95475e795c44edca5

SHA512
8a53e85260baf8be9a77707ada423d6521ae04852b87411c21177b5e0bac23150b62e288647b97b5577deb2941ed00a3a293d8f489907976199bae09b8424f7d

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sglobal\toolbar\symbolshapes.xml

Filesize
2KB

MD5
1ae3802ebd301b83e3e38ef3edf746c8

SHA1
c1e8dfe5b54a7af090b234c84427f1126ae674f9

SHA256
4b81cbcfab864659d749b4cff35723af6088294f96ab0c5fd5ffa05d21c6db48

SHA512
bb3910b4adcafe8ca5d4a938df04f3bc7c0e35f636d7753289dcb48369e297ecce48911cec4a509a1675193f7a6a37a97e908c9bab3d38e2bf602ddc3e7121b3

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\simpress\toolbar\alignmentbar.xml

Filesize
1KB

MD5
d1c31fd7d4ddf6ce3000b10f34023229

SHA1
e9ceffd1dc84fbfef3ae7b68dc58c1a83ea6eb07

SHA256
f7f015edf3c24fae02e45f559a479136b04e44effbb81974bde81806f3f825d9

SHA512
e06d6c54ce1b048fd4f4aada8d2c14b5ac08d3ba37ce28ae39b2f5a369572679929d0e7c30ed35e3ffb78f50877c63ee790cfe08fa8a26980f2616c2041cfd00

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\simpress\toolbar\fullscreenbar.xml

Filesize
1KB

MD5
00fdc7b8e6d9b0c1d388b76d78eaebaa

SHA1
060617eff9cfde962240b4352e6451aaee786cfa

SHA256
f97afab08fa6a00d709218dea414455e8e6c864558984bb479d4d51b1d3b4ade

SHA512
7db0648674b3353882ae530aee6dd40964b3dfe1b71968bba1c62069c0db2d5a167be12ee7070e01018b5ebb08fe18eb5ec434fab0e5f28e5d0c646767d8a0dd

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sweb\toolbar\extrusionobjectbar.xml

Filesize
1KB

MD5
fc3d5734821626bec8a4bc02353e83a2

SHA1
a7a1a26e7293f5ea98c53d9816d5f42f35ec1cd5

SHA256
808ffa548becc0f938037c1bc7bc42454931034cdc7a0b95f77857f8ed0cc459

SHA512
bdfe34a57a8d98c72c9ecfbd1d8d1e896d01807f972bc0b8456c015837bacb303efe890edc5647a87eacacfd06c782a93e0929a443fd36feed7e1e78e6bdf8a3

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sweb\toolbar\fontworkshapetype.xml

Filesize
3KB

MD5
706be7ccec83c53ca9d95fd121b86ae4

SHA1
7d98669581173da1b4bb5a48c22e497810988162

SHA256
f5654328a53e761cfcf8c65a5cb142a31c11256dc59dd3af335078c63de7bede

SHA512
d7eb8e1bc26cb6e5c14310e0a67d6aa55f009e9f3f92d5aee130050a6473b2060dcc4f1c4b4c0dfe3286c12daa667154a31800bcded9eca0cf871600b6477394

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sweb\toolbar\formtextobjectbar.xml

Filesize
2KB

MD5
b0f92b9f81fab83e9866a56428b7d7b6

SHA1
e02b296282b0a2aa63dc4c33bf041ae4aa82d638

SHA256
02ba423d57d621d501500f9c196db6556e73db0431061b21b781c4c895b4aa79

SHA512
322520cc7bc82d73d77fb692c4f0d344ea4f4a603f18de180a96d53787a495acc3aa5d76e92c8b1c162aeaaac7eacef32f2d3031b1cd5c1fca4201ac12039aec

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sweb\toolbar\graffilterbar.xml

Filesize
1KB

MD5
a07c7cec7aedf6f61b7dc3d7694061b9

SHA1
d8a6a629513096652686ba51ce4284ae2575a2e1

SHA256
8b2e3b9abb67c6db5696a0d68bd600bcb3458731cf2ea616fe0e0ff3eff843b3

SHA512
ca5428bfcefd86ec280c256e35ea9c68a255bd3b8fd90b0190080b05bdb5f1fd7686b2bc19a536b1350a1192866fff4aabc5902ff238ea17e284b9d0b2e7f00d

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\sweb\toolbar\mediaobjectbar.xml

Filesize
1KB

MD5
72beb1f519e22b6a9677c58c91298140

SHA1
a253196b6b1ab392af2397a5591e0e732f817658

SHA256
5d6f0eee652fc4651764980e0baf885d8771e7af759874d888c6ff1c6591cc26

SHA512
c1f0376aac7335021053da1516b97240de4f114514b6f6121835405702a926aaf87a3145f49789d2184a77aaf4cbade84f6d3a4197e100ac5d3728ca5ee2a5a0

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swform\toolbar\colorbar.xml

Filesize
1KB

MD5
14fe0fb9e4e9e65665dda5a29d07e86a

SHA1
b8e994ec3c393216d1cc70d567a7f8f526e26232

SHA256
81f3f2ec040df98abbc94f145473690cb235ae9ac6e59328bef0d85c8709e4ac

SHA512
b7b0d3b0fee487b641e08cf5911ddae5cfdd9689e55d624c4e1b700e6b6a004301a26c050aa33a08d3384c30e15f798d6319b91f6575a10447163b82d2a23a4e

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swform\toolbar\fontworkobjectbar.xml

Filesize
1KB

MD5
f188ef8ec133668e1fad929841f1b62b

SHA1
8a32d62ff456f9005b779c9a6d8fd2bb37a285af

SHA256
bc3d21918a05255ac829190edb88fa7a0267a67268c16639fc89c8b91a5e1d0f

SHA512
c683c609366da53e42c453df92403953398b0d6ed7667d7a538c15c3aa0f61700a247d28c0d9e360b2c016a7e18aa8b6bb5c69bc190cda11d091f8a9d2b9ac91

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swform\toolbar\viewerbar.xml

Filesize
1KB

MD5
7b3a2c5315329dbeb486324baec32c12

SHA1
c4f3184baea574d6f4b353f655234d575e701b2a

SHA256
7570333d0d991e73d4636fd58d48753953b8428937035deff2acf164acadc0b9

SHA512
7c7b7e51e1df8af637ca0de4cb49c854f10ff533a400b16dc16dd3b1d3ec963687faca641fc259793292bfaf519520e3fdc0cf3edc0faca9448d4c7d6b1bba1b

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swreport\toolbar\formsfilterbar.xml

Filesize
1KB

MD5
1e44ad8078e1ebe7605a4aa76bdc2d90

SHA1
6b50ee854e5b768beb23379b0c793f807ce30882

SHA256
b6b088657c5bc989e2eeff22e570a4ff6369beee17ab4d16b84ef55fd6892d61

SHA512
dc97358a4169652a123ad2a03da0cc0fcd71a89996291a629041d269aed73fe8111e870b0f47efcd63fed913d023711c5c4ac93abe92ec03584b1757caf83203

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swreport\toolbar\formsnavigationbar.xml

Filesize
2KB

MD5
b1f3cb470ba66617f3a2ddeda085d9ef

SHA1
6a8fe23317da1515ac8c700cfb2c224c62e12eb8

SHA256
559abb8e5c82de5bd7ea5e583d688314811ca936443303db9d4d9cb3606ecf1f

SHA512
2d38adb199e5c3e50065d5ddf6b39b3cb7d481828f645e81b6c790b8b4f94f8e865b45780c436a4aa3ad3cb0356b3cd731b3414d877e16d55fbea94a8e0d8d78

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\bezierobjectbar.xml

Filesize
2KB

MD5
fc98b5953c38b1fbe98f10b40d023d9c

SHA1
5df9b7b56182d635b8c9dd0897930377f80c3e42

SHA256
12d3e8010994824400d82e727f515362b089eaa9de9864a8432ea1a887f04362

SHA512
e7db8cba0bdb056d213a47c822c62d28d5be9d5a53fe6df2ee6803226078ced14f646953fe4ebd5ea96b7c4b823643dbbc3d8cd3f2e7a5de1b267006fea7891f

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\drawbar.xml

Filesize
2KB

MD5
3f67ff4d745e46ab22fcb45cbd959e6c

SHA1
5e1c6b87314f4c7f64a1533e57b48607d31b0467

SHA256
fb4dbd459dc0d9f9f2f4f8b416d0342ebdfb1ed5a12307e5b3ac38f584fd0a89

SHA512
981a213cb63443d41f2cb09e66eb4aee2cbcc79b94a50a3f3ed88aa8f1d8ddce4f06f6b67e1a5170851ebebbddb28e6aafe671815b6b661bae49946198f93085

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\drawtextobjectbar.xml

Filesize
2KB

MD5
d27a50775647f0c6be6cb113b789cf1a

SHA1
e0dd5e3af2f7b19dfe9002c9468636540564d581

SHA256
8ac250b5ac870e3380c861f1456a46359bfe17a2745078cb9dd10e9f7942e87d

SHA512
efb087341b5bc6123f7e886533b5991c1f84f5d58cb6985f65be3464ec27182550dced73b9bff52237c8f68c0ca71fca766ce508dead645e83472ce1b0d11345

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\frameobjectbar.xml

Filesize
2KB

MD5
e47929623d3455afeb35b23b51e2b97d

SHA1
a11df2e2c65cb67c54a4d08db05755667c9332d6

SHA256
400da96f17ec52ab6291ce9707334b7b85db728a6a08e2869ac1328557bbf9f7

SHA512
2f398343df03e7cc967cabb1b77049984d7e73fd34d844acc8a35ed3dd9ce8616b13c3644439cbb7678a905574374ac7caa173ecfbd650f265a41ca6be66dcff

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\numobjectbar.xml

Filesize
2KB

MD5
ea1675555d11147963a6c761d162ee84

SHA1
115285b4c32fd6295a6bda4f27c97d4db0932c76

SHA256
aa9b2afbd4d8c3402bd16691b957b9a4a97c8f7f1de98d3ff60a2e49f7f22bd0

SHA512
430960b3ceed3556192b0610797269be9ac82a9e8feb9ba081a4a93462dddd2cd55c36ce94b499a713762fc136845013f41a6e2ee5e73921593ef8b5fc080d93

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\oleobjectbar.xml

Filesize
2KB

MD5
a7ad2c06c538b44af1e34d9c62d27aeb

SHA1
4e1ffa158711aa5729eb22e272d7369d2bf5c2aa

SHA256
a11119c981fc23eaabd207022cb94c9adf0f6e1cef12f85eb1b0003551e0fadb

SHA512
77f8758590d45af207d9a067d4fc5e15a8c27c6f9d13cc009364ca102ae78dd007ad1d36a47550571805c3b6c8a63c2c946e2b6a34973647b70300ae1c738c12

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\optimizetablebar.xml

Filesize
1KB

MD5
f38dde850334bfaf560a8beb427ea479

SHA1
34de34784782775f4e7c182e288f0ffb9667594f

SHA256
8347cd391d8e3735f97b2c99fe4ba13180224afce87c9abf96c05fc2eaa5c12c

SHA512
a7eea3a67da2751e931691cbe2ca139ea85fb541dce221ea7f71f99719a3ca59840938ceea3b28175466e8788a544d220d4152f56721dffdc62bfc0d1a0a9531

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\previewobjectbar.xml

Filesize
2KB

MD5
e3a6f8ecd58e5bfe0a7744d9edd595b8

SHA1
a4d19de35f3fe89ad38e5e6c028dfa659ccfc2da

SHA256
c46892997c975aeef2ad1f7d42be0ddf162febde321f8c4ca9585804193a170c

SHA512
98d14e430658dc665c5b942a7bd65aec7d33fa816be87eda4bdfc6af2ac02df1f07f8caeb6602c1b7580d5bf5075674c1db6273fc43743f6cbc32d2356915bfa

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swriter\toolbar\tableobjectbar.xml

Filesize
2KB

MD5
239c15a89a05b82e3ebef46a1b7a90d1

SHA1
2d9dcffa44a102473ab322701a563b385c126851

SHA256
f5ad2d306ea4f031123b6a8dc2da3bdeb0ed848e603a1aeca122409789e3301a

SHA512
c26222f45a2009c10a526298d9da48b7f979c87fc94bcb4fe9d6897e78bb206669093bf8dd5c7fda6dc47c7459a046a4c39c721909b0175b3dbaeb2f974a6b7f

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swxform\toolbar\drawingobjectbar.xml

Filesize
3KB

MD5
7165ffb260809d3b568c68b96b8d265d

SHA1
ed1cf5f68e975c7babc382283f986ba9bb84b777

SHA256
f4e1f4ad94dbfa9c5c433959ea6328bdaa58e204cfebb4417e897d7817928738

SHA512
1ac6e32e342ae9a298a81e17bc468517da7387e78906fb60df1fb6233ca6e8b48b5f7321d4804d4b8870614ccf133175dda906d751efcec76f22a30b3f16c470

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swxform\toolbar\findbar.xml

Filesize
1KB

MD5
d53725e2d4d5bc5b9f57416b7e8f4dd7

SHA1
fe51dc0a181c2f12876e7216c6d8c13cea418326

SHA256
258e1ee7154758d023542bee788036a9c3de06fb41010122baecc285ac5d587b

SHA512
9f80441294ccca1ce70ca9fca6c20f2055ef7cc9cba1e57ae0451fb11f80ad72c0f48fcde4fba0ee7ed41013b1ae5d46774cccf6dbffd5b136fc04028c4fa337

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\config\soffice.cfg\modules\swxform\toolbar\textobjectbar.xml

Filesize
3KB

MD5
cb901c53f8a48785f9aa1f0de1c24b76

SHA1
52eb883554ef8fbed3e88859dde1698463ddb8de

SHA256
03a2db3b9149c2c68919ca7fb2980e1bd1874f2af2b79e49fde542619c81902f

SHA512
2da355c2de1f25236d71385d59f7c64c254e84bc4fde8451ff7c730293a41da5a53f51d52ef34e90dce933a802369b4d81ee8be160beb506faecbb9c323eaeeb

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\gallery\diagrams\Component-Gear05-Orange.svg

Filesize
38KB

MD5
51aa9946e7844c63a8888f2634c0ff83

SHA1
d7d21ae072d571bd98b827fdab0da536ff19a59a

SHA256
8999caecd70b2a6c51be6dd549cdec59f74d333d5ef22767902fc7b1682cd541

SHA512
594f9dac7a2642e91b4857a7fa84e96d6ad9909831dc7309b72aaa9edf5301f91ab65d7fae302c3bc25ac4723b9135475cfbbc206d7939ecf99ee5e09c798522

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\gallery\sg12.sdv

Filesize
2KB

MD5
58b26eb6ab03be973425381f1de81aeb

SHA1
83c8ac739ac0069d7b6fefd84b9317c457b9a821

SHA256
65365530165a871772e21962a5d7dda107d8d010f329bf59c878eabc3465bbe4

SHA512
837b1ef7212aed8b8f8106a40a9ea61b14b97f03e455aff35847ea609023fb4ddd454c9546f0cb61acaa434fefa3330069993d7b0ee17102e4fd40d0e4a556b7

Download Submit
C:\Program Files (x86)\OpenOffice 4\share\gallery\sg3.sdv

Filesize
2KB

MD5
a2e85f463600039026ff7fb5374991a1

SHA1
86eb0eb3038f602f4c3b769b7f330cbcb536341a

SHA256
b11bb3e78931d10e339748d89ca60269021df5ca963d117d137a0b70b6195103

SHA512
30a56b1cb62795ef7475c8ccdd4c3220c0e4c64be93993edef21b6e8ab64029b04ef0bbf853503b6b6e49b31dd5434b9c0c8652969945e5bc3ebb5f00a9b4a31

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI29FD.tmp

Filesize
164KB

MD5
34480728b3a659a7bc4bea865c25668d

SHA1
4ca4a1a5df7cb116ffa35e106705f2a2c20b0738

SHA256
a5b9ccf58eab9e907a151860f5630da52ae939625fd7065a05947c5e4376a09a

SHA512
6c6bf290e20d57477b9ee366e44d6c2559f27364063b03c23cf1687e41d5b9b44547f53751ea6b920bcb6471431443deafe4b0a638cd0ec4d7de903260cd978e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI2B66.tmp

Filesize
88KB

MD5
55b453d7a244d96e10754ab033c45728

SHA1
7f927a511987022bb009f48ee152a4e91aa877f0

SHA256
f8da2aac476ad890fd32a25e7e3ebd85a352b92f8134092d8df0b6a7702b1c32

SHA512
21df0e08f5f3c05e6caf8085dab94dd9eb1248141cda974e7af9ec47d0249909c55bc599a88930f7421576cb834b44b84f8d858cbea770c3f11a5d397e30b731

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjE35E.tmp\ioSpecial.ini

Filesize
1KB

MD5
9ab07f63c64d72e3e776580c5a11a1d1

SHA1
6c7a60826814c611e06f724e38a15c6bbcde128e

SHA256
0af8610e0b0259b7c370bb36937b931ebe7167e7d6f586bef08cc442bc48d8d2

SHA512
9f0dd56d75023ff07428f5b8cf844e92e4b01a320003f3dba9a02f82797ab9ba34d7ce64e7cb431fd0021abf0e77fd2e1ce9d4776e9ce95fbb69f4511decd75d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjE35E.tmp\ioSpecial.ini

Filesize
1KB

MD5
812befbf15b651a64c5986ab4fcb96c3

SHA1
84d7185e79901e1937b29dc3a1433be747cd27ad

SHA256
488e32634be5be1e1d33d58bdd8e185a60c01228c45ef4ab6f18fb4eeb21ef32

SHA512
1edfa561affa1bf99bed5a7d1b9a1cab488a60aa1d72968d5d435b5f28f053cb8e2d87940df0b271202c9530fcb7c58466d4de5ff7761cfe41f34c97f2065f02

Download Submit
C:\Users\Admin\AppData\Roaming\OpenOffice\4\user\extensions\bundled\lastsynchronized

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\OpenOffice\4\user\uno_packages\cache\registry\com.sun.star.comp.deployment.configuration.PackageRegistryBackend\backenddb.xml

Filesize
135B

MD5
2bf6ff815e43fff74544416742bbf888

SHA1
8b157b0e33dbf8b374bb6bf874b656c4c040b81d

SHA256
ac6f585621eb04b34549a95c99e015ad5810a4156e021df46c46731e7a087698

SHA512
0737375e0308017c2f310e76d0605305feafeb874fa3df970be58d8792732ede009b53bec488e4d5d03080d664b6bd0a71e19c1da7025fef90be560d08aef73c

Download Submit
C:\Users\Admin\AppData\Roaming\OpenOffice\4\user\uno_packages\cache\registry\com.sun.star.comp.deployment.help.PackageRegistryBackend\backenddb.xml

Filesize
117B

MD5
9071cb6e373825c7757e03c0390edb51

SHA1
844c752db36f30c13ced0a09bcdd19ab86cb95f3

SHA256
845041424286d5b794c11ff0a59d3df289dcb1567fb448ef0b85297108675b46

SHA512
941851d9e73bfa5af6526a035a608425685f470f82bdf20aaa9b7a4724a5ab486e867d7f199a0799b16f4330101a52610635b78c4408d2fcfe5653925ecde1a2

Download Submit
C:\Users\Admin\Desktop\New folder\openoffice4115.msi

Filesize
2.4MB

MD5
785fffe87d2102cdaaebd0b075b9f427

SHA1
ea2474a9c91b0c970ce95953f4a6ade8803575d3

SHA256
9f9cbbfc38b142fa2e4092742eece8182ef09d346b380ea91bd97bfba99ba6ef

SHA512
8eae23ebe553d5669cce73109e8d02d33db13e1abca61f3aa80ad471867da9c8a527f612dc46d16f9b48ddc008fab179be48bacaac4e2a3dd45e6f42cb277c51

Download Submit
C:\Users\Admin\Desktop\New folder\setup.ini

Filesize
282B

MD5
4f621ffdde42a76bf7f725c4f3ed7c11

SHA1
682be602c0dab3a6e8bd50bf92f35a489f101998

SHA256
e7bf8aaadfe8f3b7fb08eb9d8d40295ea433312867e1c442caa3502285d9daac

SHA512
128a6d21eef6fbc592a54558e1f67907e32e27eebae13c804fcf016e6c5a7b2979b0bcde2a762cc18cddd70512bd168a7fd9fe49d035b019661bb40404245e89

Download Submit
C:\Windows\Installer\MSI8069.tmp

Filesize
131KB

MD5
fa028a08b632c119c5a5453b3621405e

SHA1
29533c0c61481437ee3814ead2f5624df75eeade

SHA256
e69292a514323845102a259e13120cef141e47720c293eec371cc353bc821959

SHA512
96ca62726a703037fad84c389371f7ea7df7690df0c0a025c6e8a62fe75c793b8d5673749e7719c0decd4bdb1d93a47d4060608ac78c70d44c5eac23c724fbeb

Download Submit
C:\Windows\Installer\MSI8470.tmp

Filesize
130KB

MD5
0abd8f295cf152549ec2d10bf42ea4da

SHA1
9b340f7d5b1ff63707ceed76c2cb8fb1a63d82da

SHA256
90d0d29557e125d135c71e784bf2bf38a5faf77fa2f0e8fccf3dbc456d721eb9

SHA512
574e1e8707ee21d0a113c72e91cade4b83b101d72cd843211467c039ede7527bc555cbbefcbc59adb5145b126463127668817282a962e49845ee77bab52b004b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
109KB

MD5
2a099f29456136039ba54b87002a30b5

SHA1
5fe2a695a445c3e3153b88023b6928ee17b35216

SHA256
62f0ba0d9bcfefa2401cf43ec41e34c28e95cc4668af889937ceee373bd385d0

SHA512
39ebdf40eb649cbb714c42a570e333ea2b087190e47e96cd599b4d81831f53f94048fa0b20417cb306e5b4a8f943510db68e735aefbf53f4cb6301118d82310b

Download Submit
C:\Windows\assembly\GAC_32\cli_cppuhelper\1.0.23.0__ce2cb7e279207b9e\cli_cppuhelper.dll

Filesize
62KB

MD5
b42e2c2c7a485fbbd9875759fe5a9273

SHA1
984ba604de1ee95cb5648b4aa3a357b971fef9c6

SHA256
3b33ebec8b9995835744e7f9f1b1af280b00a632bfe84f3ce499dc05c4af1f39

SHA512
fa5b58a1e18de1461066c110f486ca156c4999314d586bbb38400c0911e92cded2d530afbf977c96b2054aa1cebe081e2d3836ebfebc0eca6d8d808cea45ba76

Download Submit
C:\Windows\assembly\GAC_32\policy.1.0.cli_cppuhelper\23.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_cppuhelper.dll

Filesize
3KB

MD5
4ddd77ae0a79345ced2b6c9c731942d1

SHA1
59d5e897dc8e4336eed32097e5638c617a2363fb

SHA256
4637d65b2fe3f996d22631d166fdc0cc61cf8d4f0341446c656f775cf5aa28ee

SHA512
264a406bb00f860154a5949d29b73ccf0a9166e3e91719bd93a8f61d31e6e370a3d4c1312cc998c520ec20a6bccee6527c5e4a6622cba9845301a6d51199ff61

Download Submit
C:\Windows\assembly\GAC_MSIL\cli_basetypes\1.0.20.0__ce2cb7e279207b9e\cli_basetypes.dll

Filesize
11KB

MD5
18e98b063506b375a54e113b7f945f84

SHA1
b5914c9b02456d2fdfa4a0231e803bf0bd8e53ed

SHA256
b2e8d6a390d881b9ea2c28e62755b96754ce3ec7fa72235d2b481e1648699ee5

SHA512
3ef6c365a4a28e74fc3153165f9b2445733d4e7c63601720e3abed4e36cd6026af5aca02cc7d4752bf847ef1e8885f08f8a7e485baeca20441c7d0d757ab60bf

Download Submit
C:\Windows\assembly\GAC_MSIL\cli_oootypes\1.0.9.0__ce2cb7e279207b9e\cli_oootypes.dll

Filesize
900KB

MD5
e0ba423ac13e36040527df8b5b4f093b

SHA1
0388b7bda223fa277759fd20fcb61e12947c29ee

SHA256
2cf7eb8d6892792649e1bf7194c3e0d8afe322a950d02d07dfd71dd105c029d5

SHA512
c625b61583a3d70aeaa66c606ebb620d0f489c3a0f62a4d763f3c7f687b1465f2cae4f4bcd096dffa958295c3307335a9703ca0e417f15d989563d1c487981b9

Download Submit
C:\Windows\assembly\GAC_MSIL\cli_uretypes\1.0.9.0__ce2cb7e279207b9e\cli_uretypes.dll

Filesize
116KB

MD5
c1d21f68dff9d4da6846fae26fbb3c16

SHA1
4e2640df166ae9a48ea61057a38ca73d130b5b1f

SHA256
dfd9faf0daa2b8050da074f0243802eb6fabecc24e6df935217170a64ba8f4a4

SHA512
083e45fc1fffd234eaf3e28f13aee02b231be847b6ca9783d88dde70b894596f076540b8e36979ac6c84db31d776149cc64de3157e02b71054257655b24eff60

Download Submit
C:\Windows\assembly\GAC_MSIL\policy.1.0.cli_basetypes\20.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_basetypes.dll

Filesize
3KB

MD5
0cbeff6d0f2fda424e0049898b932c09

SHA1
e757f28aa9ef4127e1f26a4cc0d53652164040cc

SHA256
3e01851239de69293260b99157107aaa30ce243d5eecbc89a67b32edf97621e0

SHA512
a37014cfb571240b196ffb8fb74525dd48ebaac975ad2ba5da5569e3d334bbda733f2e78ef5f1a403c38601b368284c5b1a940bfe14c0546767c08341f9d422c

Download Submit
C:\Windows\assembly\GAC_MSIL\policy.1.0.cli_oootypes\9.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_oootypes.dll

Filesize
3KB

MD5
ce60498f9fc82d24a74557d95c7eba5a

SHA1
5c363a2efcfd9cd2fd4fa2b96b5538ff8296ae72

SHA256
f7478ab31b8b7bfa4e4f6a57595e56613452f4f66464141a2b7492c37de25aa8

SHA512
d7097fc3e27f73f59c8533fd15fe806efd56f79882b574247195aa03a5455c7f3c2a991007459a4fc6303e8a8c89b7d545ad1be00acc85dddf0aa4f32c7bb9a4

Download Submit
C:\Windows\assembly\GAC_MSIL\policy.1.0.cli_ure\23.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_ure.dll

Filesize
3KB

MD5
a3144e4a2f1850dc9c2ffae0a9af03a0

SHA1
2ee97f32b7ffc2dfafbaceab73d1297e3b22dd55

SHA256
f415214842b735fa6c37a905b74c76256b37fd1b8cf0e10fbcd82d670dffcff3

SHA512
f6456137dc8918712075f6491173bd9827ad4dd645008148c9c21d73091586911dd6c963722aa44c79a083e13a5768e615a3c7663a92ea8583af3df185f88487

Download Submit
C:\Windows\assembly\GAC_MSIL\policy.1.0.cli_uretypes\9.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_uretypes.dll

Filesize
3KB

MD5
56d751cce5ec5b50878ea1a1e8ef9ac7

SHA1
c14e1ec041cd257731ad2006702278e93e8d50e2

SHA256
0e19af4b97f962e36d6d8f05fff8b19d3642805d4e40d96addc872f82a76b063

SHA512
71347f90075874fd9feb9d371edceb7a7fe0f404372b0ab3ce7e4c8b7f0ea92ef3e0d44a03a3ffc670b2e13a14eb70d80f09abbb41182319677c4340fda7df55

Download Submit
\Program Files (x86)\OpenOffice 4\program\comphelpMSC.dll

Filesize
1.1MB

MD5
38f45383cc9a369b23b86815a9848e88

SHA1
46dacb428de5a9603e317e0dc10130241731904d

SHA256
511e0c3d947b554142e1b11878fe0818f5002ecb49e8c989a95c022b1189f017

SHA512
674526655b6086e22b59839ea59d966dfee64ad16f9950698f35a37fb028870d61ee0300458b9daa5f9f3e12387239758e247286bce2e1a59c68d44381c62b07

Download Submit
\Program Files (x86)\OpenOffice 4\program\cppuhelper3MSC.dll

Filesize
574KB

MD5
7dc9eb02bffbf2dd2557ee3a630d15d3

SHA1
9ce3df6926c60c37ae5e936fa9ada3b78a5a3cce

SHA256
7e3edffa25e66df403bc51ff4ea4b68befaa143a82c192869a4126a8847f8200

SHA512
8ddfdc05c0418f8ae1118f9432c1663bff72c7216f6858e2d09445176adf2b130ee7909e3abeb3940812339fbff3720a02891c11bc2088b8a7d17012620cf7d4

Download Submit
\Program Files (x86)\OpenOffice 4\program\sal3.dll

Filesize
1.7MB

MD5
d895c2f13e00e10af300e4364c531899

SHA1
7a1dbd58c588f2d2ceb18049318f249a2a4c0701

SHA256
0481b9512896fdb60de5700afc2cd266550f029d02ce116ecaabff15bc7f4267

SHA512
83f159ae299b14325130760b1abe0abc18d0d17feb95e9c82ad5dbd205ca6cd4f774bea01f6c98c8681e3695d94efb589dc2e5f84331c11782b26f448715b954

Download Submit
\Program Files (x86)\OpenOffice 4\program\salhelper3MSC.dll

Filesize
13KB

MD5
6871465535c0a4fe0170ebdf2a67846e

SHA1
e00ff18f22893a620b00678ec02b14563a051f1e

SHA256
8bb6f552ab55faba1ad3176d49b1bce5504b57befc0cc406e24d4bd79befcb6e

SHA512
20024dc15c382147e556c7e1b50bbb899d5aab3654f37f4632b131c6c1a1c78bc78fad72b2d5c1ae5418379bfc860334b65f8de138aee3f5ec009ae6d0a0067f

Download Submit
\Program Files (x86)\OpenOffice 4\program\ucbhelper4MSC.dll

Filesize
379KB

MD5
609f5c9f2d4fd3500cfd1e3116820b23

SHA1
237f08a760ccc9f00fb7851184f2def577323ec3

SHA256
3f9ee91f2d766113d549c7def7e6db13363934f88e32b2764958bf784497b72b

SHA512
76181686beb70cd84236b1cd1dc26ff1e7ed68b1fcc6ba05b25f42356ec17e81aa46985085c39268306239d7713746c1ab16e8fe414310892d8ee03d1d8c71f6

Download Submit
\Program Files (x86)\OpenOffice 4\program\unopkgapp.dll

Filesize
111KB

MD5
b45f243e52acfaf2a903fbb299395840

SHA1
b7f52d19edf6eb2f9896b634e6736e5164dfbbca

SHA256
20b772d1a63b32fbbf39f24dae9d7a2491897c062bfe13041eb4fd19a6140c0d

SHA512
9dfcca4205364ea7de23d33884399c3a251af13ef357cc76640c2323d393787005e4755f282372146c685f3cc43a6ea020d7119bb7dd960d3c1d50b8f9c1ece2

Download Submit
\Program Files (x86)\OpenOffice 4\program\utl.dll

Filesize
1.1MB

MD5
0df2ad123334e7200f8a2d60c4c8c646

SHA1
ab5bdbba6147bbd7a63425b7214d3cb273aec744

SHA256
b421a6406eb3c030244b0204879dd80e265ccc316f4797a564bee59fa9002477

SHA512
87af291256bcf3948ab374aa4345d0116fd832f23b1ecb3860e88a6c36204981cdc3d05026038ccdc255c3a9dcc63c08cb866eeae67b6ea50c34f942fabda440

Download Submit
\Program Files (x86)\OpenOffice 4\program\vos3MSC.dll

Filesize
97KB

MD5
722cf591ebd85349879aba089df13cf2

SHA1
e94ad53bbc856052de24573bbdb5351e79143467

SHA256
331f45f20536dc2507559454009682090cd8e6469b0846e38fef687757e372a5

SHA512
2ecedf7ed9bc43c2fac3583a881d1c8e456d5aef810bf2a9d51675a8be713b23bc86f6b57bccf444db8eea73ba06f787eab7d94f0b0de03bffe39214b7d38878

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE35E.tmp\InstallOptions.dll

Filesize
15KB

MD5
d095b082b7c5ba4665d40d9c5042af6d

SHA1
2220277304af105ca6c56219f56f04e894b28d27

SHA256
b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

SHA512
61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

Download Submit
\Users\Admin\Desktop\New folder\setup.exe

Filesize
468KB

MD5
5b8919735858ed14281644d2c240100e

SHA1
7f6375515e18679cf457f2bad67892db5a217555

SHA256
b78712b6fbe78bbdb57b25f985262e38e061811e244aa39297fd5a0c91d80ffa

SHA512
34d8faa0a71f02afff0699be326962938c36c55ba175a35f6a214bc1038f0bd1731f9a2566651a4dc932fc7814aa11bfec4533e5fe499dba3dfef910547c8ad4

Download Submit
\Windows\Installer\MSI7F20.tmp

Filesize
129KB

MD5
ca1c1ddd6fd657ce959be32ef8e706e7

SHA1
7e0e3a3f50aa45589d563c660414a732bd3f9780

SHA256
5a5d8f15e421dd540c19dc1face44b251a65db75b52c16f5e9c5c92297c248cd

SHA512
fc146703f7173a19fabda6237e836ab5eb5c745588e51e30339a85560b2f74c29ce21838914c85e40816c0debc739c9f8006efdc7d050f8d4dcac2c052ac8c15

Download Submit
memory/764-310-0x0000000000EB0000-0x0000000000EB8000-memory.dmp

Filesize
32KB

Download
memory/764-3925-0x0000000000EB0000-0x0000000000EB8000-memory.dmp

Filesize
32KB

Download
memory/764-2162-0x0000000001030000-0x0000000001038000-memory.dmp

Filesize
32KB

Download
memory/764-306-0x0000000000E20000-0x0000000000E2A000-memory.dmp

Filesize
40KB

Download
memory/764-3955-0x0000000000EB0000-0x0000000000EB8000-memory.dmp

Filesize
32KB

Download
memory/764-2046-0x0000000003240000-0x0000000003324000-memory.dmp

Filesize
912KB

Download
memory/764-4119-0x0000000000E20000-0x0000000000E28000-memory.dmp

Filesize
32KB

Download
memory/764-3962-0x0000000000EB0000-0x0000000000EB8000-memory.dmp

Filesize
32KB

Download
memory/764-313-0x0000000000EC0000-0x0000000000EE0000-memory.dmp

Filesize
128KB

Download
memory/764-2166-0x00000000011C0000-0x00000000011C8000-memory.dmp

Filesize
32KB

Download
memory/764-4040-0x0000000000EB0000-0x0000000000EB8000-memory.dmp

Filesize
32KB

Download
memory/764-2043-0x0000000001010000-0x0000000001023000-memory.dmp

Filesize
76KB

Download
memory/764-336-0x0000000000EE0000-0x0000000000EE8000-memory.dmp

Filesize
32KB

Download
memory/764-340-0x0000000000FF0000-0x0000000000FF8000-memory.dmp

Filesize
32KB

Download
memory/764-344-0x0000000001000000-0x0000000001008000-memory.dmp

Filesize
32KB

Download
memory/1036-3912-0x00000000020F0000-0x0000000002100000-memory.dmp

Filesize
64KB

Download
memory/1036-3909-0x00000000020F0000-0x0000000002100000-memory.dmp

Filesize
64KB

Download
memory/1036-3913-0x00000000020F0000-0x0000000002100000-memory.dmp

Filesize
64KB

Download
memory/1036-3911-0x00000000020F0000-0x0000000002100000-memory.dmp

Filesize
64KB

Download
memory/1036-3910-0x00000000020F0000-0x0000000002100000-memory.dmp

Filesize
64KB

Download
memory/2052-4149-0x0000000072C80000-0x0000000073245000-memory.dmp

Filesize
5.8MB

Download
memory/2052-4190-0x00000000040E0000-0x00000000040F0000-memory.dmp

Filesize
64KB

Download
memory/2052-4189-0x00000000040E0000-0x00000000040F0000-memory.dmp

Filesize
64KB

Download
memory/2052-4188-0x00000000040E0000-0x00000000040F0000-memory.dmp

Filesize
64KB

Download
memory/2052-4187-0x00000000040E0000-0x00000000040F0000-memory.dmp

Filesize
64KB

Download
memory/2052-4186-0x00000000040E0000-0x00000000040F0000-memory.dmp

Filesize
64KB

Download