Analysis
-
max time kernel
1800s -
max time network
1800s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
28-11-2021 00:27
General
-
Target
AutoInstall_zNvtuIFmBw.exe
-
Size
734KB
-
MD5
f4f038efc2ad27ff5406cbdcbcb94599
-
SHA1
7146519f2ffcb928d55ab3b66ab4572389e18fe9
-
SHA256
5d2eb0daffb9b5b49ef89add1c9140a66acb2e354fdb97e7b46fdb92e7d63818
-
SHA512
87f232e92e3c4afa58febce58b18e84e6274b1985b920211cd55c178015c43095236c2adf9f1b5fd8b79cf926ab8c6be0edd50a19b97d06eaa153cb7b38080b4
Score
10/10
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 4 IoCs
-
Registers COM server for autorun 1 TTPs
-
Blocklisted process makes network request 1 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 20 IoCs
-
Sets file execution options in registry 2 TTPs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 64 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in System32 directory 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 27 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 27 IoCs
-
Modifies Internet Explorer settings 1 TTPs 64 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoInstall_zNvtuIFmBw.exe"C:\Users\Admin\AppData\Local\Temp\AutoInstall_zNvtuIFmBw.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Test\Office365.exe"C:\Test\Office365.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} "3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} "3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeOfficeClickToRun.exe platform=x86 culture=en-us productstoadd=O365ProPlusRetail.16_en-us_x-none cdnbaseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version.16=16.0.12527.22060 mediatype.16=CDN sourcetype.16=CDN O365ProPlusRetail.excludedapps.16=groove bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft Office\root\integration\Addons\OneDriveSetup.exe"C:\Program Files (x86)\Microsoft Office\root\integration\Addons\OneDriveSetup.exe" /silent4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Office\root\integration\Addons\OneDriveSetup.exe"C:\Program Files (x86)\Microsoft Office\root\integration\Addons\OneDriveSetup.exe" C:\Program Files (x86)\Microsoft Office\root\integration\Addons\OneDriveSetup.exe /silent /permachine /silent /childprocess /cusid:S-1-5-21-103686315-404690609-2047157615-10005⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Program Files (x86)\Microsoft Office\root\integration\Addons\OneDriveSetup.exe /silent /peruser /childprocess5⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe"6⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
-
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exeOLicenseHeartbeat.exe tokenactivate4⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exeintegrator.exe /U /Extension /Msi /License PRIDName= PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files (x86)\Microsoft Office\root"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\Office Feature Updates" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates.xml"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates Logon"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\Office Feature Updates Logon" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates Logon.xml"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentLogOn2016"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\OfficeTelemetryAgentLogOn2016" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentFallBack2016"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\OfficeTelemetryAgentFallBack2016" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man" /rf:"C:\Program Files (x86)\Microsoft Office\root\Office16\wwlib.dll" /mf:"C:\Program Files (x86)\Microsoft Office\root\Office16\wwlib.dll"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man" /rf:"C:\Program Files (x86)\Microsoft Office\root\Office16\wwlib.dll" /mf:"C:\Program Files (x86)\Microsoft Office\root\Office16\wwlib.dll" /fromwow644⤵
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man" /rf:"C:\Program Files (x86)\Microsoft Office\root\Office16\msoetwres.dll" /mf:"C:\Program Files (x86)\Microsoft Office\root\Office16\msoetwres.dll"3⤵
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man" /rf:"C:\Program Files (x86)\Microsoft Office\root\Office16\msoetwres.dll" /mf:"C:\Program Files (x86)\Microsoft Office\root\Office16\msoetwres.dll" /fromwow644⤵
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man" /rf:"C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\mso.dll" /mf:"C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\mso.dll"3⤵
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man" /rf:"C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\mso.dll" /mf:"C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\mso.dll" /fromwow644⤵
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man" /rf:"C:\Program Files (x86)\Microsoft Office\root\Office16\wwlib.dll" /mf:"C:\Program Files (x86)\Microsoft Office\root\Office16\wwlib.dll"3⤵
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man" /rf:"C:\Program Files (x86)\Microsoft Office\root\Office16\wwlib.dll" /mf:"C:\Program Files (x86)\Microsoft Office\root\Office16\wwlib.dll" /fromwow644⤵
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man" /rf:"C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\mso.dll" /mf:"C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\mso.dll"3⤵
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man" /rf:"C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\mso.dll" /mf:"C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\mso.dll" /fromwow644⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office ClickToRun Service Monitor"2⤵
-
C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exeintegrator.exe /I /Msi MsiName=SPPRedist.msi,SPPRedist64.msi PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files (x86)\Microsoft Office\root"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\schtasks.exeschtasks.exe /change /tn "Microsoft\Office\Office ClickToRun Service Monitor" /enable2⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\Office ClickToRun Service Monitor" /XML "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ServiceWatcherSchedule.xml"2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /change /tn "Microsoft\Office\Office ClickToRun Service Monitor" /enable2⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /change /tn "Microsoft\Office\Office Automatic Updates" /enable2⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Automatic Updates 2.0"2⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /change /tn "Microsoft\Office\Office Automatic Updates 2.0" /enable2⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\Office Automatic Updates 2.0" /XML "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\FrequentOfficeUpdateSchedule.xml"2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /change /tn "Microsoft\Office\Office Automatic Updates 2.0" /enable2⤵
-
C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exeintegrator.exe /I /License PRIDName=O365ProPlusRetail.16 PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files (x86)\Microsoft Office\root"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exeintegrator.exe /I /Extension /Sunrise PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files (x86)\Microsoft Office\root"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft Office\root\Office16\perfboost.exeperfboost.exe EnsureVE2⤵
- Executes dropped EXE
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe"2⤵
- Executes dropped EXE
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exeintegrator.exe /I /Extension /Msi /StreamFull MsiName=C2RInt.16.msi,C2RInt64.16.msi,C2RIntLoc.en-us.16.msi,* PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files (x86)\Microsoft Office\root"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\Office Feature Updates" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates.xml"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates Logon"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\Office Feature Updates Logon" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates Logon.xml"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man" /rf:"C:\Program Files (x86)\Microsoft Office\root\Office16\msoetwres.dll" /mf:"C:\Program Files (x86)\Microsoft Office\root\Office16\msoetwres.dll"3⤵
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man" /rf:"C:\Program Files (x86)\Microsoft Office\root\Office16\msoetwres.dll" /mf:"C:\Program Files (x86)\Microsoft Office\root\Office16\msoetwres.dll" /fromwow644⤵
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man" /rf:"C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\mso.dll" /mf:"C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\mso.dll"3⤵
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man" /rf:"C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\mso.dll" /mf:"C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\mso.dll" /fromwow644⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /progressandlaunch AppTargets="root\office16\excel.exe|root\office16\lync.exe|root\office16\msaccess.exe|root\office16\mspub.exe|root\office16\onenote.exe|root\office16\outlook.exe|root\office16\powerpnt.exe|root\office16\teams.exe|root\office16\winword.exe" ManualUpgrade=False ScenarioToTrack="Scenario:{FB9843BB-0D8A-4347-A227-C759C3FC9103}@INSTALL"1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "8" "C:\Windows\TEMP\{566965a4-e065-5285-9f4e-175ade09de59}\prnms006.inf" "9" "6c684210b" "000000000000005C" "Service-0x0-3e7$\Default" "00000000000005AC" "208" "C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OneNote"1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "8" "C:\Windows\TEMP\{07c8c364-ab32-39d4-35ee-ec5adc9f2842}\prnSendToOneNote_Win7.inf" "9" "60e91ee2f" "00000000000005AC" "Service-0x0-3e7$\Default" "00000000000003DC" "208" "C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OneNote"1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding 99D9C93CB65443094703E9BBA731DC4E M Global\MSI00002⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe"c:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe" -PipelineRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe"c:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe" -AddInRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild3⤵
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding 96B28CE174F3A74D2ED7BC12B6861752 M Global\MSI00002⤵
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding AD0F03A1D0451C9176E9FC179FF424B8 M Global\MSI00002⤵
-
\??\c:\Program Files (x86)\Microsoft Office\Office14\bcssync.exe"c:\Program Files (x86)\Microsoft Office\Office14\bcssync.exe" /shutdown3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe"c:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe" -PipelineRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe"c:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe" -AddInRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild3⤵
-
\??\c:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe"c:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" /regserverfp2⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding 15C1D4DC8985138E0E817129DDFC5E51 M Global\MSI00002⤵
-
\??\c:\Program Files (x86)\Microsoft Office\Office14\bcssync.exe"c:\Program Files (x86)\Microsoft Office\Office14\bcssync.exe" /shutdown3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe"c:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe" -PipelineRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe"c:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe" -AddInRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild3⤵
-
\??\c:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe"c:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" /regserverfp2⤵
- Modifies Internet Explorer settings
-
\??\c:\Windows\system32\MsiExec.exec:\Windows\system32\MsiExec.exe -Embedding D0A333DDA8DE81E3DB0EC1DB5C00DFC8 M Global\MSI00002⤵
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding 5E24DFA88136496BFC974294F8AD26A4 M Global\MSI00002⤵
-
\??\c:\Windows\system32\WBEM\mofcomp.exe"c:\Windows\system32\WBEM\mofcomp.exe" "c:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF"3⤵
- Drops file in System32 directory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B1560E1C6FDDC0C1BF69E6BAEE7F4818 M Global\MSI00002⤵
-
C:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe"C:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild3⤵
-
C:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe"C:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild3⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 715D34FE81DCF54E3C90AA1FDB20D94B M Global\MSI00002⤵
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding D70BA4277D0A9229895957C7DDC46796 M Global\MSI00002⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe"c:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe" -PipelineRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe"c:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe" -AddInRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild3⤵
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding DB0BAF3DCF77D0632C2D41B7E1770E2C M Global\MSI00002⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C2535E3BCC1BB118488543B585F64F40 M Global\MSI00002⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI75A5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_260076988 9394 SetupConfigCustomAction!Squirrel.SetupConfigCustomAction.SettingsCustomActions.RemoveRegKeyFromPreviousInstall3⤵
- Drops file in Windows directory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5DBA910BA6F13F9D7EAE15A2F251D5322⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI7FF4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_260079687 9400 SetupConfigCustomAction!Squirrel.SetupConfigCustomAction.SettingsCustomActions.CopyConfig3⤵
- Drops file in Windows directory
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dllMD5
6399ccd325a0fc4fd77fc977b5c2edf3
SHA1b98d1beaf8c35bc9aa8581ca8e5e1b45881e5644
SHA256b183efd63e40a3c4e6fda92d3aeb77824f33e639a30e0442546f1e1efb7f0215
SHA512535b243239bcda36ba0381bfcd31d819ba830e8f6c2297adbbf7c0d00f2e05499442ed725f32849d1a179065e77309327f3355bcc48cffd558a34d03999e6aae
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dllMD5
124f00340102764fdde69b8b49307805
SHA1e2c08d41e9f932d404bdff14ff32c5cec59832f9
SHA25659b150896d68f2df14ae9918265b2d9d1940135b71be0d1f171d09889b4e1e46
SHA512c532f7e77d6aa3ccbf76e18a1c86479a77069041bddb0c0e9f23058ba86853c28135a309009ef6a30324b3663cc33edd931bf331cda6a027ad3b1b626a263562
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RUI.dllMD5
a6efced588b5e7c0ab75977056f93fcb
SHA1def790ace07211cf129bbc405c5b6b6f16813803
SHA25653f0535dbecc27d405acc1cf6302f3987ab4f6ce28fe1b5b913f4ef895033176
SHA5125d542747f05402e3021ea2644296c733e45e3def75099cd6283456fbd50a7702e46f8a4e334f92489e6bf28860bc04126c32060ec0696e5179603d4b65f6aefd
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\MSVCP140.dllMD5
c1b066f9e3e2f3a6785161a8c7e0346a
SHA18b3b943e79c40bc81fdac1e038a276d034bbe812
SHA25699e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd
SHA51236f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeMD5
9371a1ae6ef91f1cae723f81ec2bf069
SHA1c49db635656c1cfa4f3e6b2d3f1247e040386c8b
SHA2567111372454ff333cc8be668a3a53c8a9feac26c99fd7359f74ae5b9e207236b4
SHA512b51c63272b1b3d49eaaf5cee0c61b5c4502805007d1ce5e58555398d5b8d5d7df513112fd745325b8f019a8010ce2e623342aa052ec74d0cf4113288044578fe
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeMD5
9371a1ae6ef91f1cae723f81ec2bf069
SHA1c49db635656c1cfa4f3e6b2d3f1247e040386c8b
SHA2567111372454ff333cc8be668a3a53c8a9feac26c99fd7359f74ae5b9e207236b4
SHA512b51c63272b1b3d49eaaf5cee0c61b5c4502805007d1ce5e58555398d5b8d5d7df513112fd745325b8f019a8010ce2e623342aa052ec74d0cf4113288044578fe
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\VCRUNTIME140.dllMD5
1453290db80241683288f33e6dd5e80e
SHA129fb9af50458df43ef40bfc8f0f516d0c0a106fd
SHA2562b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c
SHA5124ea48a11e29ea7ac3957dcab1a7912f83fd1c922c43d7b7d78523178fe236b4418729455b78ac672bb5632ecd5400746179802c6a9690adb025270b0ade84e91
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-file-l1-2-0.dllMD5
19df2b0f78dc3d8c470e836bae85e1ff
SHA103f2b5b848a51ee52980bf8595c559b89865de07
SHA256bd9e07bbc62ce82dbc30c23069a17fbfa17f1c26a9c19e50fe754d494e6cd0b1
SHA512c1c2b97f484e640bfdda17f7ed604d0583c3d4eaf21abf35491ccedc37fa4866480b59a692776687e5fda3eaeafb4c7bdb34dec91f996fd377a328a89c8d5724
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-file-l2-1-0.dllMD5
adb3471f89e47cd93b6854d629906809
SHA12cfc0c379fd7f23db64d15bdff2925778ff65188
SHA256355633a84db0816ab6a340a086fb41c65854c313bd08d427a17389c42a1e5b69
SHA512f53e11aa35911d226b676d454e873d0e84c189dd1caea8a0fe54d738933cd6b139eca48630f37f5979ef898950d99f3277cba6c7a697103f505d876bea62818c
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dllMD5
6b4f2ca3efceb2c21e93f92cdc150a9d
SHA12532af7a64ef4b5154752f61290dcf9ebeea290f
SHA256b39a515b9e48fc6589703d45e14dcea2273a02d7fa6f2e1d17985c0228d32564
SHA51263a42dd1cb95fd38ddde562108c78e39cb5d7c9406bf749339e717c2cd866f26268d49b6bd966b338de1c557a426a01a24c2480f64762fef587bc09d44ada53b
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dllMD5
247061d7c5542286aeddade76897f404
SHA17285f85440b6eff8731943b73502f58ae40e95a2
SHA256ccb974c24ddfa7446278ca55fc8b236d0605d2caaf273db8390d1813fc70cd5b
SHA51223ef467f6bb336d3e8c38000d30a92dac68e2662891863475ff18dbddbbbce909c12d241b86dbdea085e7d19c82cd20d80a60ffb2845f6afebedf06507afe5bc
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dllMD5
b9bc664a451424342a73a8b12918f88d
SHA1c65599def1e69aed55ea557847d78bb3717d1d62
SHA2560c5c4dfea72595fb7ae410f8fa8da983b53a83ce81aea144fa20cab613e641b7
SHA512fe3f393fd61d35b368e42c3333656298a8243ba91b8242ee356950f8925317bf32ce4f37670b16a5a5ab5091903e61ae9c49c03fdc5f93193f215a58d80b9311
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dllMD5
bdd63ea2508c27b43e6d52b10da16915
SHA12a379a1ac406f70002f200e1af4fed95b62e7cb8
SHA2567d4252ab1b79c5801b58a08ce16efd3b30d8235733028e5823f3709bd0a98bcf
SHA512b0393f0d2eb2173766238d2139ae7dea7a456606f7cb1b0e8bc0375a405bc25d28ef1c804802dddb5c3dbd88cfd047bfa5c93cbb475d1d6b5a9a893b51e25128
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dllMD5
afc20d2ef1f6042f34006d01bfe82777
SHA1a13adfc0d03bb06d4a8fe7fb4516f3e21258c333
SHA256cd5256b2fb46deaa440950e4a68466b2b0ff61f28888383094182561738d10a9
SHA5122c9f87d50d60ebe4c56257caf4dcf3db4d36739768274acc1d41d98676c3dd1527a9fdc998bfa00227d599fb9893aa20756bc34623fa9b678da5c10a0d0d2550
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dllMD5
fe93c3825a95b48c27775664dc54cae4
SHA1bae2925776e15081f445fbdd708e0179869b126d
SHA256c4ed8f65c5a0dbf325482a69ab9f8cbd8c97d6120b87ce90ac4cba54ac7d377a
SHA51223a7bc53b35de4893219a3b864c2355fd08f297b3c096000e1621ca0db974aa4b4799fd037f3a25b023e9ee81f304d351f92409aa6d9623bf27b5a8971b58a23
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dllMD5
d76f73be5b6a2b5e2fa47bc39eccdfe5
SHA1dfed2b210e65d61bf08847477a28a09b7765e900
SHA2566c86e40c956eb6a77313fa8dd9c46579c5421fa890043f724c004a66796d37a6
SHA51272a048fd647ba22d25f7680884ec7f9216c6bdbb7011869731b221d844a9a493dd502770d08dabb04f867c47ece29ca89b8762d97d71afe6788d72e3f8a30bb7
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dllMD5
5d409d47f9aebd6015f7c71d526028c3
SHA10da61111b1e3dbb957162705aa2dbc4e693efb35
SHA2567050043b0362c928aa63dd7800e5b123c775425eba21a5c57cbc052ebc1b0ba2
SHA51262d2e5a6399f3cbd432e233cea8db0199df5c534870c29d7f5b30f935154cb9b756977d865514e57f52ff8b9be37f25cce5118d83c9039e47d9e8f95aa2575ce
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dllMD5
0d50a16c2b3ec10b4d4e80ffeb0c1074
SHA1b81f1639d62dfc7be7ae4d51dd3fae7f29a1a297
SHA256fab41a942f623590402e4150a29d0f6f918ee096dba1e8b320ade3ec286c7475
SHA512bfee8b2fa8bc5d95e699a82d01a6841a9ac210c288b9dd0aba20b7ebbcfb4363adde439404fe98dc03a6db38873902a335bca77e484fb46f04218696395f1877
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dllMD5
877c5ff146078466ff4370f3c0f02100
SHA185cf4c4a59f3b0442cdc346956b377bae5b9ca76
SHA2569b05a43fdc185497e8c2cea3c6b9eb0d74327bd70913a298a6e8af64514190e8
SHA5124bc5116d160c31aa24264f02e5d8ba0bd33e26e9632f9ad9018f5bb1964a5c99b325b19db9895483efb82f173962c8dfe70a857db3dfd11796cba82c0d9acd8d
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dllMD5
c25321fe3a7244736383842a7c2c199f
SHA1427ea01fc015a67ffd057a0e07166b7cd595dcfd
SHA256bf55134f17b93d8ac4d8159a952bee17cb0c925f5256aa7f747c13e5f2d00661
SHA5123aa08138a4bba4d5619e894e3ec66cc540db9f5fe94e226c9b4fc8a068ddb13039335aa72731e5dbdb89dfc6550c9f5d8f03441001c8fd43a77795a2197a8c60
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dllMD5
53e23e326c11191a57ddf7ada5aa3c17
SHA1af60bcca74f5b4b65c2b322ac7a5cedb9609c238
SHA256293c76a26fbc0c86dcf5906dd9d9ddc77a5609ea8c191e88bdc907c03b80a3a5
SHA51282c71b003332006beeafb99306dbcc6517a0f31f9659ea6b1607a88d6a2b15420aef6c47dfaf21fd3bd7502135fb37ba7a9321fc2a9b82c7deb85a75d43a6f58
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dllMD5
3a96f417129d6e26232dc64e8fee89a0
SHA147f9d89ea1694b94f4f8c5558311a915eca45379
SHA25601e3c0aa24ce9f8d62753702df5d7a827c390af5e2b76d1f1a5b96c777fd1a4e
SHA5120898c2c8751a6a0f75417c54157228ccf0e9f3facbfecc1268ecbd3d50eca69a3909c39ca788d9e2d5ccbf3b5ebcdc960df49e40a9c945fc8007d2dc4474f718
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dllMD5
05af3f787a38ed1974ff3bda3d752e69
SHA1c88117f16a0ae4ccb4f3d3c8e733d213de654b04
SHA256f4163cbc464a82fce47442447351265a287561c8d64ecc2f2f97f5e73bcb4347
SHA5129bc364a4361e6ce3e9fc85317e8a252516006d1bae4bf8d2e0273337bbb7fe4a068a3e29966ff2707e974af323dd9ab7b086582504d3caed2ceb1e14d4a37559
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dllMD5
f440dc5623419e013d07dd1fcd197156
SHA10e717f3ab9ccf1826a61eeccda9551d122730713
SHA256bba068f29609630e8c6547f1e9219e11077426c4f1e4a93b712bfba11a149358
SHA512e3fc916011d0caa0f8e194464d719e25eec62f48282c2bf815e4257d68eddb35e2e88cb44983fe2f202ee56af12bb026da90a5261a99272dabf2a13794a69898
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\c2rintl.en-us.dllMD5
0fb5653e2685519ec8b2b03ee5414f0d
SHA184fcd9ea81d55f5037e801047007d67797da2e46
SHA25668ded621a84f5bf0b5b76c9d905cedce248cb7f62985276504dbeaf4542e181d
SHA512c1a707811e61181deb732b7276fb16c3739368fde2b37c327f60e220571b3b98be31710f17344812a30512c2bd43ea78da2cb15a16ee394d2bc94961f2aeff6f
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ucrtbase.DLLMD5
ed27c615d14dadbe15581e8cb7abbe1c
SHA1c0f27e244eb98b0008ad9fe8cfdf27c8eeb656b0
SHA2561ca33187b0e81cd0b181a554718cafff2d17c3f6795e6e0824f844abfbaddc07
SHA512b0a47e66b975913be04096bd7af57b64cd57eff9ccaa2f44115a75799f5791ff9f85c8b31d6ebcf3b9706a91a4df12b720749c67e8f1c89b6951c0524daf1d31
-
C:\Test\Office365.exeMD5
f8fbe5f1b0214436b8d531a88a3a15f9
SHA1676e4285348089cd09a8bb8ccbe7eb43258e9d38
SHA256e252fa969d83e249335d527f209be0d0fe58fa031df656b724e59d195f7b2e7c
SHA5127def594467a4e5b5b05764d214b9f965bb46671057a4e725a8444a336bf265a421d57ff81106def56974bb3abb0761a153795856b5d1775fc0e1a5fc6eab260c
-
C:\Test\Office365.exeMD5
f8fbe5f1b0214436b8d531a88a3a15f9
SHA1676e4285348089cd09a8bb8ccbe7eb43258e9d38
SHA256e252fa969d83e249335d527f209be0d0fe58fa031df656b724e59d195f7b2e7c
SHA5127def594467a4e5b5b05764d214b9f965bb46671057a4e725a8444a336bf265a421d57ff81106def56974bb3abb0761a153795856b5d1775fc0e1a5fc6eab260c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
9917f2994281bbb9c9c5c42e41b3a70a
SHA1714437cc2b6e222c675d7f2e88f89df8644ce30d
SHA2567e185784324ddfd65b58255de7d55d6da47934f01276533d4386e29181494645
SHA5129ffda3c787bd88753e1054432be820e4de187fb6030cdbf6ecf556bc2fe9f5ce72cf92b66dc5be44c3c70c2503902fb77e2901adc076715788d7d9fe15e3282c
-
C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratchMD5
1ae329ffb84d24de563f2d50ae4bd134
SHA136b6f9d7a632441bd1bbfafb8b4df22f51829289
SHA256ade0f5595f9c07b7c4578009a082c76db9fb82989230ebd6889bff120ba76e0f
SHA51263e769656424e2a0015716f43749dc488fffa8e9ebfa1c42cc2930dc2a909ee047e3ef55d2f6aa4d287daee36cc169cfc4aec046473c8f5051b2958a9aa5ed3c
-
C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratchMD5
1ae329ffb84d24de563f2d50ae4bd134
SHA136b6f9d7a632441bd1bbfafb8b4df22f51829289
SHA256ade0f5595f9c07b7c4578009a082c76db9fb82989230ebd6889bff120ba76e0f
SHA51263e769656424e2a0015716f43749dc488fffa8e9ebfa1c42cc2930dc2a909ee047e3ef55d2f6aa4d287daee36cc169cfc4aec046473c8f5051b2958a9aa5ed3c
-
C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratchMD5
21438ef4b9ad4fc266b6129a2f60de29
SHA15eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA25613bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
SHA51237436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
-
C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratchMD5
21438ef4b9ad4fc266b6129a2f60de29
SHA15eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA25613bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
SHA51237436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
f1ef2aac61ef638a6626b486958c2dac
SHA171a088517c5f5d10ecd36a56cebdcac0856e0801
SHA256e03b80b4e6acaf39616aa1470b0fcb076e22c36661423c6b9dc0017d715aae00
SHA5121ac9f8198e77ec0e7a22f830f29e19d5573ad3de459809067ab493fd180dc4def0f7d0470d995421d18f8e29d9f97ffe4f91a7381a2d871b92da5a0a8920aace
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dllMD5
6399ccd325a0fc4fd77fc977b5c2edf3
SHA1b98d1beaf8c35bc9aa8581ca8e5e1b45881e5644
SHA256b183efd63e40a3c4e6fda92d3aeb77824f33e639a30e0442546f1e1efb7f0215
SHA512535b243239bcda36ba0381bfcd31d819ba830e8f6c2297adbbf7c0d00f2e05499442ed725f32849d1a179065e77309327f3355bcc48cffd558a34d03999e6aae
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dllMD5
124f00340102764fdde69b8b49307805
SHA1e2c08d41e9f932d404bdff14ff32c5cec59832f9
SHA25659b150896d68f2df14ae9918265b2d9d1940135b71be0d1f171d09889b4e1e46
SHA512c532f7e77d6aa3ccbf76e18a1c86479a77069041bddb0c0e9f23058ba86853c28135a309009ef6a30324b3663cc33edd931bf331cda6a027ad3b1b626a263562
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dllMD5
124f00340102764fdde69b8b49307805
SHA1e2c08d41e9f932d404bdff14ff32c5cec59832f9
SHA25659b150896d68f2df14ae9918265b2d9d1940135b71be0d1f171d09889b4e1e46
SHA512c532f7e77d6aa3ccbf76e18a1c86479a77069041bddb0c0e9f23058ba86853c28135a309009ef6a30324b3663cc33edd931bf331cda6a027ad3b1b626a263562
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.en-us.dllMD5
0fb5653e2685519ec8b2b03ee5414f0d
SHA184fcd9ea81d55f5037e801047007d67797da2e46
SHA25668ded621a84f5bf0b5b76c9d905cedce248cb7f62985276504dbeaf4542e181d
SHA512c1a707811e61181deb732b7276fb16c3739368fde2b37c327f60e220571b3b98be31710f17344812a30512c2bd43ea78da2cb15a16ee394d2bc94961f2aeff6f
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RUI.dllMD5
a6efced588b5e7c0ab75977056f93fcb
SHA1def790ace07211cf129bbc405c5b6b6f16813803
SHA25653f0535dbecc27d405acc1cf6302f3987ab4f6ce28fe1b5b913f4ef895033176
SHA5125d542747f05402e3021ea2644296c733e45e3def75099cd6283456fbd50a7702e46f8a4e334f92489e6bf28860bc04126c32060ec0696e5179603d4b65f6aefd
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeMD5
9371a1ae6ef91f1cae723f81ec2bf069
SHA1c49db635656c1cfa4f3e6b2d3f1247e040386c8b
SHA2567111372454ff333cc8be668a3a53c8a9feac26c99fd7359f74ae5b9e207236b4
SHA512b51c63272b1b3d49eaaf5cee0c61b5c4502805007d1ce5e58555398d5b8d5d7df513112fd745325b8f019a8010ce2e623342aa052ec74d0cf4113288044578fe
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-file-l1-2-0.dllMD5
19df2b0f78dc3d8c470e836bae85e1ff
SHA103f2b5b848a51ee52980bf8595c559b89865de07
SHA256bd9e07bbc62ce82dbc30c23069a17fbfa17f1c26a9c19e50fe754d494e6cd0b1
SHA512c1c2b97f484e640bfdda17f7ed604d0583c3d4eaf21abf35491ccedc37fa4866480b59a692776687e5fda3eaeafb4c7bdb34dec91f996fd377a328a89c8d5724
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-file-l2-1-0.dllMD5
adb3471f89e47cd93b6854d629906809
SHA12cfc0c379fd7f23db64d15bdff2925778ff65188
SHA256355633a84db0816ab6a340a086fb41c65854c313bd08d427a17389c42a1e5b69
SHA512f53e11aa35911d226b676d454e873d0e84c189dd1caea8a0fe54d738933cd6b139eca48630f37f5979ef898950d99f3277cba6c7a697103f505d876bea62818c
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dllMD5
6b4f2ca3efceb2c21e93f92cdc150a9d
SHA12532af7a64ef4b5154752f61290dcf9ebeea290f
SHA256b39a515b9e48fc6589703d45e14dcea2273a02d7fa6f2e1d17985c0228d32564
SHA51263a42dd1cb95fd38ddde562108c78e39cb5d7c9406bf749339e717c2cd866f26268d49b6bd966b338de1c557a426a01a24c2480f64762fef587bc09d44ada53b
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dllMD5
247061d7c5542286aeddade76897f404
SHA17285f85440b6eff8731943b73502f58ae40e95a2
SHA256ccb974c24ddfa7446278ca55fc8b236d0605d2caaf273db8390d1813fc70cd5b
SHA51223ef467f6bb336d3e8c38000d30a92dac68e2662891863475ff18dbddbbbce909c12d241b86dbdea085e7d19c82cd20d80a60ffb2845f6afebedf06507afe5bc
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dllMD5
b9bc664a451424342a73a8b12918f88d
SHA1c65599def1e69aed55ea557847d78bb3717d1d62
SHA2560c5c4dfea72595fb7ae410f8fa8da983b53a83ce81aea144fa20cab613e641b7
SHA512fe3f393fd61d35b368e42c3333656298a8243ba91b8242ee356950f8925317bf32ce4f37670b16a5a5ab5091903e61ae9c49c03fdc5f93193f215a58d80b9311
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dllMD5
bdd63ea2508c27b43e6d52b10da16915
SHA12a379a1ac406f70002f200e1af4fed95b62e7cb8
SHA2567d4252ab1b79c5801b58a08ce16efd3b30d8235733028e5823f3709bd0a98bcf
SHA512b0393f0d2eb2173766238d2139ae7dea7a456606f7cb1b0e8bc0375a405bc25d28ef1c804802dddb5c3dbd88cfd047bfa5c93cbb475d1d6b5a9a893b51e25128
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dllMD5
afc20d2ef1f6042f34006d01bfe82777
SHA1a13adfc0d03bb06d4a8fe7fb4516f3e21258c333
SHA256cd5256b2fb46deaa440950e4a68466b2b0ff61f28888383094182561738d10a9
SHA5122c9f87d50d60ebe4c56257caf4dcf3db4d36739768274acc1d41d98676c3dd1527a9fdc998bfa00227d599fb9893aa20756bc34623fa9b678da5c10a0d0d2550
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dllMD5
fe93c3825a95b48c27775664dc54cae4
SHA1bae2925776e15081f445fbdd708e0179869b126d
SHA256c4ed8f65c5a0dbf325482a69ab9f8cbd8c97d6120b87ce90ac4cba54ac7d377a
SHA51223a7bc53b35de4893219a3b864c2355fd08f297b3c096000e1621ca0db974aa4b4799fd037f3a25b023e9ee81f304d351f92409aa6d9623bf27b5a8971b58a23
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dllMD5
d76f73be5b6a2b5e2fa47bc39eccdfe5
SHA1dfed2b210e65d61bf08847477a28a09b7765e900
SHA2566c86e40c956eb6a77313fa8dd9c46579c5421fa890043f724c004a66796d37a6
SHA51272a048fd647ba22d25f7680884ec7f9216c6bdbb7011869731b221d844a9a493dd502770d08dabb04f867c47ece29ca89b8762d97d71afe6788d72e3f8a30bb7
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dllMD5
5d409d47f9aebd6015f7c71d526028c3
SHA10da61111b1e3dbb957162705aa2dbc4e693efb35
SHA2567050043b0362c928aa63dd7800e5b123c775425eba21a5c57cbc052ebc1b0ba2
SHA51262d2e5a6399f3cbd432e233cea8db0199df5c534870c29d7f5b30f935154cb9b756977d865514e57f52ff8b9be37f25cce5118d83c9039e47d9e8f95aa2575ce
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dllMD5
0d50a16c2b3ec10b4d4e80ffeb0c1074
SHA1b81f1639d62dfc7be7ae4d51dd3fae7f29a1a297
SHA256fab41a942f623590402e4150a29d0f6f918ee096dba1e8b320ade3ec286c7475
SHA512bfee8b2fa8bc5d95e699a82d01a6841a9ac210c288b9dd0aba20b7ebbcfb4363adde439404fe98dc03a6db38873902a335bca77e484fb46f04218696395f1877
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dllMD5
877c5ff146078466ff4370f3c0f02100
SHA185cf4c4a59f3b0442cdc346956b377bae5b9ca76
SHA2569b05a43fdc185497e8c2cea3c6b9eb0d74327bd70913a298a6e8af64514190e8
SHA5124bc5116d160c31aa24264f02e5d8ba0bd33e26e9632f9ad9018f5bb1964a5c99b325b19db9895483efb82f173962c8dfe70a857db3dfd11796cba82c0d9acd8d
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dllMD5
c25321fe3a7244736383842a7c2c199f
SHA1427ea01fc015a67ffd057a0e07166b7cd595dcfd
SHA256bf55134f17b93d8ac4d8159a952bee17cb0c925f5256aa7f747c13e5f2d00661
SHA5123aa08138a4bba4d5619e894e3ec66cc540db9f5fe94e226c9b4fc8a068ddb13039335aa72731e5dbdb89dfc6550c9f5d8f03441001c8fd43a77795a2197a8c60
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dllMD5
c25321fe3a7244736383842a7c2c199f
SHA1427ea01fc015a67ffd057a0e07166b7cd595dcfd
SHA256bf55134f17b93d8ac4d8159a952bee17cb0c925f5256aa7f747c13e5f2d00661
SHA5123aa08138a4bba4d5619e894e3ec66cc540db9f5fe94e226c9b4fc8a068ddb13039335aa72731e5dbdb89dfc6550c9f5d8f03441001c8fd43a77795a2197a8c60
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dllMD5
53e23e326c11191a57ddf7ada5aa3c17
SHA1af60bcca74f5b4b65c2b322ac7a5cedb9609c238
SHA256293c76a26fbc0c86dcf5906dd9d9ddc77a5609ea8c191e88bdc907c03b80a3a5
SHA51282c71b003332006beeafb99306dbcc6517a0f31f9659ea6b1607a88d6a2b15420aef6c47dfaf21fd3bd7502135fb37ba7a9321fc2a9b82c7deb85a75d43a6f58
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dllMD5
3a96f417129d6e26232dc64e8fee89a0
SHA147f9d89ea1694b94f4f8c5558311a915eca45379
SHA25601e3c0aa24ce9f8d62753702df5d7a827c390af5e2b76d1f1a5b96c777fd1a4e
SHA5120898c2c8751a6a0f75417c54157228ccf0e9f3facbfecc1268ecbd3d50eca69a3909c39ca788d9e2d5ccbf3b5ebcdc960df49e40a9c945fc8007d2dc4474f718
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dllMD5
05af3f787a38ed1974ff3bda3d752e69
SHA1c88117f16a0ae4ccb4f3d3c8e733d213de654b04
SHA256f4163cbc464a82fce47442447351265a287561c8d64ecc2f2f97f5e73bcb4347
SHA5129bc364a4361e6ce3e9fc85317e8a252516006d1bae4bf8d2e0273337bbb7fe4a068a3e29966ff2707e974af323dd9ab7b086582504d3caed2ceb1e14d4a37559
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dllMD5
f440dc5623419e013d07dd1fcd197156
SHA10e717f3ab9ccf1826a61eeccda9551d122730713
SHA256bba068f29609630e8c6547f1e9219e11077426c4f1e4a93b712bfba11a149358
SHA512e3fc916011d0caa0f8e194464d719e25eec62f48282c2bf815e4257d68eddb35e2e88cb44983fe2f202ee56af12bb026da90a5261a99272dabf2a13794a69898
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\msvcp140.dllMD5
c1b066f9e3e2f3a6785161a8c7e0346a
SHA18b3b943e79c40bc81fdac1e038a276d034bbe812
SHA25699e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd
SHA51236f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\ucrtbase.dllMD5
ed27c615d14dadbe15581e8cb7abbe1c
SHA1c0f27e244eb98b0008ad9fe8cfdf27c8eeb656b0
SHA2561ca33187b0e81cd0b181a554718cafff2d17c3f6795e6e0824f844abfbaddc07
SHA512b0a47e66b975913be04096bd7af57b64cd57eff9ccaa2f44115a75799f5791ff9f85c8b31d6ebcf3b9706a91a4df12b720749c67e8f1c89b6951c0524daf1d31
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\ucrtbase.dllMD5
ed27c615d14dadbe15581e8cb7abbe1c
SHA1c0f27e244eb98b0008ad9fe8cfdf27c8eeb656b0
SHA2561ca33187b0e81cd0b181a554718cafff2d17c3f6795e6e0824f844abfbaddc07
SHA512b0a47e66b975913be04096bd7af57b64cd57eff9ccaa2f44115a75799f5791ff9f85c8b31d6ebcf3b9706a91a4df12b720749c67e8f1c89b6951c0524daf1d31
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\vcruntime140.dllMD5
1453290db80241683288f33e6dd5e80e
SHA129fb9af50458df43ef40bfc8f0f516d0c0a106fd
SHA2562b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c
SHA5124ea48a11e29ea7ac3957dcab1a7912f83fd1c922c43d7b7d78523178fe236b4418729455b78ac672bb5632ecd5400746179802c6a9690adb025270b0ade84e91
-
\Program Files\Common Files\Microsoft Shared\ClickToRun\vcruntime140.dllMD5
1453290db80241683288f33e6dd5e80e
SHA129fb9af50458df43ef40bfc8f0f516d0c0a106fd
SHA2562b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c
SHA5124ea48a11e29ea7ac3957dcab1a7912f83fd1c922c43d7b7d78523178fe236b4418729455b78ac672bb5632ecd5400746179802c6a9690adb025270b0ade84e91
-
\Test\Office365.exeMD5
f8fbe5f1b0214436b8d531a88a3a15f9
SHA1676e4285348089cd09a8bb8ccbe7eb43258e9d38
SHA256e252fa969d83e249335d527f209be0d0fe58fa031df656b724e59d195f7b2e7c
SHA5127def594467a4e5b5b05764d214b9f965bb46671057a4e725a8444a336bf265a421d57ff81106def56974bb3abb0761a153795856b5d1775fc0e1a5fc6eab260c
-
memory/364-375-0x0000000000000000-mapping.dmp
-
memory/524-394-0x0000000000AF0000-0x0000000000AF2000-memory.dmpFilesize
8KB
-
memory/564-340-0x0000000000000000-mapping.dmp
-
memory/592-454-0x0000000000B60000-0x0000000000B62000-memory.dmpFilesize
8KB
-
memory/592-455-0x000007FFFFF10000-0x000007FFFFF11000-memory.dmpFilesize
4KB
-
memory/672-345-0x0000000000000000-mapping.dmp
-
memory/784-161-0x0000000000000000-mapping.dmp
-
memory/792-84-0x0000000000000000-mapping.dmp
-
memory/820-162-0x0000000000000000-mapping.dmp
-
memory/872-148-0x0000000000000000-mapping.dmp
-
memory/928-80-0x00000000022D1000-0x00000000022D2000-memory.dmpFilesize
4KB
-
memory/928-79-0x00000000022D0000-0x00000000022D1000-memory.dmpFilesize
4KB
-
memory/928-81-0x00000000022D2000-0x00000000022D4000-memory.dmpFilesize
8KB
-
memory/928-74-0x0000000000000000-mapping.dmp
-
memory/972-146-0x0000000000000000-mapping.dmp
-
memory/980-159-0x0000000000000000-mapping.dmp
-
memory/1008-364-0x0000000000000000-mapping.dmp
-
memory/1040-338-0x0000000000000000-mapping.dmp
-
memory/1040-374-0x0000000000000000-mapping.dmp
-
memory/1044-370-0x0000000000000000-mapping.dmp
-
memory/1052-59-0x00000000023E5000-0x00000000023F6000-memory.dmpFilesize
68KB
-
memory/1052-61-0x00000000023F6000-0x00000000023F7000-memory.dmpFilesize
4KB
-
memory/1052-60-0x0000000008650000-0x00000000086FC000-memory.dmpFilesize
688KB
-
memory/1052-55-0x0000000000E50000-0x0000000000E51000-memory.dmpFilesize
4KB
-
memory/1052-58-0x00000000023E0000-0x00000000023E1000-memory.dmpFilesize
4KB
-
memory/1052-57-0x0000000074E51000-0x0000000074E53000-memory.dmpFilesize
8KB
-
memory/1100-336-0x0000000000000000-mapping.dmp
-
memory/1116-153-0x0000000000000000-mapping.dmp
-
memory/1404-367-0x0000000000000000-mapping.dmp
-
memory/1408-456-0x0000000000B10000-0x0000000000B12000-memory.dmpFilesize
8KB
-
memory/1416-355-0x0000000000000000-mapping.dmp
-
memory/1492-151-0x000007FEFB931000-0x000007FEFB933000-memory.dmpFilesize
8KB
-
memory/1492-150-0x0000000000000000-mapping.dmp
-
memory/1560-393-0x0000000000A00000-0x0000000000A02000-memory.dmpFilesize
8KB
-
memory/1564-341-0x0000000000000000-mapping.dmp
-
memory/1568-434-0x00000000FF690000-0x00000000FFB77000-memory.dmpFilesize
4.9MB
-
memory/1616-70-0x00000000025E0000-0x000000000322A000-memory.dmpFilesize
12.3MB
-
memory/1616-67-0x0000000000000000-mapping.dmp
-
memory/1616-69-0x00000000025E0000-0x000000000322A000-memory.dmpFilesize
12.3MB
-
memory/1616-71-0x00000000025E0000-0x000000000322A000-memory.dmpFilesize
12.3MB
-
memory/1624-189-0x00000000010C0000-0x00000000010C1000-memory.dmpFilesize
4KB
-
memory/1624-205-0x0000000002EB0000-0x0000000002EB1000-memory.dmpFilesize
4KB
-
memory/1624-174-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1624-175-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1624-176-0x0000000002D00000-0x0000000002D01000-memory.dmpFilesize
4KB
-
memory/1624-177-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/1624-178-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1624-179-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/1624-180-0x0000000000BA0000-0x0000000000BA1000-memory.dmpFilesize
4KB
-
memory/1624-181-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/1624-182-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/1624-183-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB
-
memory/1624-184-0x0000000001050000-0x0000000001051000-memory.dmpFilesize
4KB
-
memory/1624-185-0x0000000000F70000-0x0000000000F71000-memory.dmpFilesize
4KB
-
memory/1624-186-0x0000000002060000-0x0000000002061000-memory.dmpFilesize
4KB
-
memory/1624-187-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1624-188-0x0000000000BE0000-0x0000000000BE1000-memory.dmpFilesize
4KB
-
memory/1624-171-0x0000000002B30000-0x0000000002B31000-memory.dmpFilesize
4KB
-
memory/1624-190-0x00000000005C0000-0x00000000005C1000-memory.dmpFilesize
4KB
-
memory/1624-191-0x00000000021A0000-0x00000000021A1000-memory.dmpFilesize
4KB
-
memory/1624-192-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/1624-193-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/1624-194-0x00000000013A0000-0x00000000013A1000-memory.dmpFilesize
4KB
-
memory/1624-195-0x0000000002740000-0x0000000002741000-memory.dmpFilesize
4KB
-
memory/1624-196-0x0000000001F40000-0x0000000001F41000-memory.dmpFilesize
4KB
-
memory/1624-197-0x00000000020B0000-0x00000000020B1000-memory.dmpFilesize
4KB
-
memory/1624-198-0x00000000010F0000-0x00000000010F1000-memory.dmpFilesize
4KB
-
memory/1624-199-0x0000000002220000-0x0000000002221000-memory.dmpFilesize
4KB
-
memory/1624-200-0x00000000027A0000-0x00000000027A1000-memory.dmpFilesize
4KB
-
memory/1624-201-0x0000000002240000-0x0000000002241000-memory.dmpFilesize
4KB
-
memory/1624-202-0x0000000001280000-0x0000000001281000-memory.dmpFilesize
4KB
-
memory/1624-203-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/1624-204-0x0000000002E90000-0x0000000002E91000-memory.dmpFilesize
4KB
-
memory/1624-173-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1624-206-0x0000000002EE0000-0x0000000002EE1000-memory.dmpFilesize
4KB
-
memory/1624-207-0x0000000002F50000-0x0000000002F51000-memory.dmpFilesize
4KB
-
memory/1624-208-0x0000000001310000-0x0000000001311000-memory.dmpFilesize
4KB
-
memory/1624-209-0x0000000002FB0000-0x0000000002FB1000-memory.dmpFilesize
4KB
-
memory/1624-210-0x0000000002FD0000-0x0000000002FD1000-memory.dmpFilesize
4KB
-
memory/1624-211-0x0000000003030000-0x0000000003031000-memory.dmpFilesize
4KB
-
memory/1624-212-0x0000000003060000-0x0000000003061000-memory.dmpFilesize
4KB
-
memory/1624-213-0x00000000022B0000-0x00000000022B1000-memory.dmpFilesize
4KB
-
memory/1624-214-0x0000000002820000-0x0000000002821000-memory.dmpFilesize
4KB
-
memory/1624-215-0x00000000030C0000-0x00000000030C1000-memory.dmpFilesize
4KB
-
memory/1624-170-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/1624-169-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/1624-172-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1684-63-0x0000000000000000-mapping.dmp
-
memory/1704-368-0x0000000000000000-mapping.dmp
-
memory/1716-369-0x0000000000000000-mapping.dmp
-
memory/1740-459-0x0000000000A20000-0x0000000000A22000-memory.dmpFilesize
8KB
-
memory/1756-155-0x0000000000000000-mapping.dmp
-
memory/1772-385-0x00000000005C0000-0x00000000005C2000-memory.dmpFilesize
8KB
-
memory/1800-342-0x0000000000000000-mapping.dmp
-
memory/1812-344-0x0000000000000000-mapping.dmp
-
memory/1832-149-0x0000000000000000-mapping.dmp
-
memory/2060-339-0x0000000000000000-mapping.dmp
-
memory/2072-474-0x0000000002251000-0x0000000002252000-memory.dmpFilesize
4KB
-
memory/2072-473-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/2072-475-0x0000000002253000-0x0000000002254000-memory.dmpFilesize
4KB
-
memory/2072-476-0x0000000002254000-0x0000000002255000-memory.dmpFilesize
4KB
-
memory/2084-147-0x0000000000000000-mapping.dmp
-
memory/2088-361-0x0000000000000000-mapping.dmp
-
memory/2132-145-0x0000000000000000-mapping.dmp
-
memory/2140-372-0x0000000000000000-mapping.dmp
-
memory/2148-362-0x0000000000000000-mapping.dmp
-
memory/2168-363-0x0000000000000000-mapping.dmp
-
memory/2212-343-0x0000000000000000-mapping.dmp
-
memory/2228-407-0x000000005D340000-0x000000005D346000-memory.dmpFilesize
24KB
-
memory/2228-424-0x00000000E9D90000-0x00000000E9D96000-memory.dmpFilesize
24KB
-
memory/2228-432-0x000000004F2E0000-0x000000004F2E6000-memory.dmpFilesize
24KB
-
memory/2228-433-0x0000000065B70000-0x0000000065B76000-memory.dmpFilesize
24KB
-
memory/2228-430-0x00000000ADE60000-0x00000000ADE66000-memory.dmpFilesize
24KB
-
memory/2228-431-0x0000000011B50000-0x0000000011B56000-memory.dmpFilesize
24KB
-
memory/2228-422-0x00000000A69A0000-0x00000000A69A6000-memory.dmpFilesize
24KB
-
memory/2228-428-0x0000000077DC0000-0x0000000077DC6000-memory.dmpFilesize
24KB
-
memory/2228-429-0x00000000A8FE0000-0x00000000A8FE6000-memory.dmpFilesize
24KB
-
memory/2228-426-0x00000000E2830000-0x00000000E2836000-memory.dmpFilesize
24KB
-
memory/2228-427-0x000000001D5A0000-0x000000001D5A6000-memory.dmpFilesize
24KB
-
memory/2228-425-0x00000000C93E0000-0x00000000C93E6000-memory.dmpFilesize
24KB
-
memory/2228-423-0x0000000098900000-0x0000000098906000-memory.dmpFilesize
24KB
-
memory/2228-418-0x00000000B9440000-0x00000000B9446000-memory.dmpFilesize
24KB
-
memory/2228-420-0x00000000872F0000-0x00000000872F6000-memory.dmpFilesize
24KB
-
memory/2228-421-0x000000003E630000-0x000000003E636000-memory.dmpFilesize
24KB
-
memory/2228-419-0x0000000013030000-0x0000000013036000-memory.dmpFilesize
24KB
-
memory/2228-412-0x000000005C660000-0x000000005C666000-memory.dmpFilesize
24KB
-
memory/2228-416-0x00000000E1510000-0x00000000E1516000-memory.dmpFilesize
24KB
-
memory/2228-417-0x00000000AB5F0000-0x00000000AB5F6000-memory.dmpFilesize
24KB
-
memory/2228-414-0x0000000070C40000-0x0000000070C46000-memory.dmpFilesize
24KB
-
memory/2228-415-0x000000000D7B0000-0x000000000D7B6000-memory.dmpFilesize
24KB
-
memory/2228-413-0x0000000007360000-0x0000000007366000-memory.dmpFilesize
24KB
-
memory/2228-408-0x0000000042610000-0x0000000042616000-memory.dmpFilesize
24KB
-
memory/2228-397-0x00000000100E0000-0x00000000100E6000-memory.dmpFilesize
24KB
-
memory/2228-396-0x0000000014C30000-0x0000000014C36000-memory.dmpFilesize
24KB
-
memory/2228-399-0x000000007E000000-0x000000007E006000-memory.dmpFilesize
24KB
-
memory/2228-398-0x000000003F220000-0x000000003F226000-memory.dmpFilesize
24KB
-
memory/2228-401-0x00000000A2F60000-0x00000000A2F66000-memory.dmpFilesize
24KB
-
memory/2228-400-0x000000004ED40000-0x000000004ED46000-memory.dmpFilesize
24KB
-
memory/2228-402-0x00000000684F0000-0x00000000684F6000-memory.dmpFilesize
24KB
-
memory/2228-403-0x00000000CB6D0000-0x00000000CB6D6000-memory.dmpFilesize
24KB
-
memory/2228-404-0x000000008CEC0000-0x000000008CEC6000-memory.dmpFilesize
24KB
-
memory/2228-405-0x000000009E4F0000-0x000000009E4F6000-memory.dmpFilesize
24KB
-
memory/2228-406-0x000000009FC10000-0x000000009FC16000-memory.dmpFilesize
24KB
-
memory/2228-410-0x000000007DBA0000-0x000000007DBA6000-memory.dmpFilesize
24KB
-
memory/2228-409-0x0000000028500000-0x0000000028506000-memory.dmpFilesize
24KB
-
memory/2228-411-0x00000000C4660000-0x00000000C4666000-memory.dmpFilesize
24KB
-
memory/2260-365-0x0000000000000000-mapping.dmp
-
memory/2268-360-0x0000000000000000-mapping.dmp
-
memory/2292-460-0x0000000000AD0000-0x0000000000AD2000-memory.dmpFilesize
8KB
-
memory/2296-152-0x0000000000000000-mapping.dmp
-
memory/2300-371-0x0000000000000000-mapping.dmp
-
memory/2320-337-0x0000000000000000-mapping.dmp
-
memory/2320-373-0x0000000000000000-mapping.dmp
-
memory/2336-156-0x0000000000000000-mapping.dmp
-
memory/2344-158-0x0000000000000000-mapping.dmp
-
memory/2360-386-0x0000000000C10000-0x0000000000C12000-memory.dmpFilesize
8KB
-
memory/2396-165-0x0000000000000000-mapping.dmp
-
memory/2396-167-0x00000000001A1000-0x00000000001A8000-memory.dmpFilesize
28KB
-
memory/2436-366-0x0000000000000000-mapping.dmp
-
memory/2512-348-0x0000000000000000-mapping.dmp
-
memory/2540-349-0x0000000000000000-mapping.dmp
-
memory/2556-379-0x0000000000A70000-0x0000000000A72000-memory.dmpFilesize
8KB
-
memory/2568-350-0x0000000000000000-mapping.dmp
-
memory/2596-351-0x0000000000000000-mapping.dmp
-
memory/2624-352-0x0000000000000000-mapping.dmp
-
memory/2652-353-0x0000000000000000-mapping.dmp
-
memory/2704-377-0x000007FFFFF10000-0x000007FFFFF11000-memory.dmpFilesize
4KB
-
memory/2704-376-0x0000000000C40000-0x0000000000C42000-memory.dmpFilesize
8KB
-
memory/2708-347-0x0000000000000000-mapping.dmp
-
memory/2724-346-0x0000000000000000-mapping.dmp
-
memory/2744-354-0x0000000000000000-mapping.dmp
-
memory/2760-139-0x0000000000000000-mapping.dmp
-
memory/2940-141-0x0000000000000000-mapping.dmp
-
memory/2960-356-0x0000000000000000-mapping.dmp
-
memory/2980-357-0x0000000000000000-mapping.dmp
-
memory/2992-142-0x0000000000000000-mapping.dmp
-
memory/2996-358-0x0000000000000000-mapping.dmp
-
memory/3032-143-0x0000000000000000-mapping.dmp
-
memory/3052-359-0x0000000000000000-mapping.dmp
-
memory/3060-144-0x0000000000000000-mapping.dmp