Analysis
-
max time kernel
1799s -
max time network
1568s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
28-11-2021 00:27
Static task
static1
Behavioral task
behavioral1
Sample
AutoInstall_zNvtuIFmBw.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
AutoInstall_zNvtuIFmBw.exe
Resource
win11
Behavioral task
behavioral3
Sample
AutoInstall_zNvtuIFmBw.exe
Resource
win10-en-20211014
General
-
Target
AutoInstall_zNvtuIFmBw.exe
-
Size
734KB
-
MD5
f4f038efc2ad27ff5406cbdcbcb94599
-
SHA1
7146519f2ffcb928d55ab3b66ab4572389e18fe9
-
SHA256
5d2eb0daffb9b5b49ef89add1c9140a66acb2e354fdb97e7b46fdb92e7d63818
-
SHA512
87f232e92e3c4afa58febce58b18e84e6274b1985b920211cd55c178015c43095236c2adf9f1b5fd8b79cf926ab8c6be0edd50a19b97d06eaa153cb7b38080b4
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 21 IoCs
Processes:
Office365.exeOfficeClickToRun.exeOfficeClickToRun.exeOfficeC2RClient.exeintegrator.exeConhost.exeose00000.exeAppVShNotify.exengen.exeintegrator.exeintegrator.exeOLicenseHeartbeat.exeMicrosoftTeams.exeUpdate.exeSquirrel.exeTeams.exeUpdate.exeTeams.exeTeams.exeOfficeC2RClient.exeOfficeC2RClient.exepid process 1772 Office365.exe 2060 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3952 OfficeC2RClient.exe 2672 integrator.exe 1280 Conhost.exe 3076 ose00000.exe 2688 AppVShNotify.exe 1648 ngen.exe 1348 integrator.exe 2820 integrator.exe 2472 OLicenseHeartbeat.exe 2740 MicrosoftTeams.exe 352 Update.exe 696 Squirrel.exe 3852 Teams.exe 3888 Update.exe 2640 Teams.exe 3328 Teams.exe 604 OfficeC2RClient.exe 2932 OfficeC2RClient.exe -
Sets file execution options in registry 2 TTPs
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
OfficeClickToRun.exeOfficeC2RClient.exeTeams.exeOffice365.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation OfficeC2RClient.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Teams.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Office365.exe -
Loads dropped DLL 64 IoCs
Processes:
OfficeClickToRun.exeOfficeClickToRun.exeOfficeC2RClient.exeintegrator.exeMsiExec.exeMsiExec.exeMsiExec.exengen.exengen.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exerundll32.exepid process 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3952 OfficeC2RClient.exe 3952 OfficeC2RClient.exe 3952 OfficeC2RClient.exe 3952 OfficeC2RClient.exe 3952 OfficeC2RClient.exe 3952 OfficeC2RClient.exe 3952 OfficeC2RClient.exe 2672 integrator.exe 2672 integrator.exe 2672 integrator.exe 404 MsiExec.exe 1480 MsiExec.exe 404 MsiExec.exe 1480 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 1480 MsiExec.exe 1480 MsiExec.exe 1480 MsiExec.exe 3864 MsiExec.exe 3888 ngen.exe 3888 ngen.exe 3888 ngen.exe 1368 MsiExec.exe 1368 MsiExec.exe 3052 MsiExec.exe 1368 MsiExec.exe 1368 MsiExec.exe 3052 MsiExec.exe 3052 MsiExec.exe 3208 MsiExec.exe 3208 MsiExec.exe 3208 MsiExec.exe 3208 MsiExec.exe 2452 MsiExec.exe 2452 MsiExec.exe 2248 MsiExec.exe 1944 rundll32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TeamsMachineInstaller = "%ProgramFiles%\\Teams Installer\\Teams.exe --checkInstall --source=PROPLUS" msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in System32 directory 64 IoCs
Processes:
msiexec.exeDrvInst.exeintegrator.exeOfficeClickToRun.exeintegrator.exeintegrator.exeaddinutil.exeOfficeC2RClient.exengen.exedescription ioc process File created C:\Windows\system32\concrt140.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNote-manifest.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\prnms006.inf DrvInst.exe File opened for modification C:\Windows\SysWOW64\msvcp140_2.dll msiexec.exe File created C:\Windows\SysWOW64\msvcp140_2.dll msiexec.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db integrator.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-shm integrator.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-wal integrator.exe File opened for modification C:\Windows\SysWOW64\concrt140.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNote.gpd DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat integrator.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vccorlib140.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{35a59ac8-0e9e-214c-9d9d-8a1357eb0938}\SendToOneNote.gpd DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\integrator.exe_Rules.xml integrator.exe File created C:\Windows\SysWOW64\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{35a59ac8-0e9e-214c-9d9d-8a1357eb0938}\SET5F0D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNoteFilter.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\prnSendToOneNote.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNoteNames.gpd DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNote-pipelineconfig.xml DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-wal OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-shm integrator.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File created C:\Windows\system32\vcruntime140.dll msiexec.exe File created C:\Windows\System32\DriverStore\Temp\{35a59ac8-0e9e-214c-9d9d-8a1357eb0938}\SET5F0D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{35a59ac8-0e9e-214c-9d9d-8a1357eb0938}\SendToOneNoteFilter.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{35a59ac8-0e9e-214c-9d9d-8a1357eb0938}\SET5F21.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-shm OfficeClickToRun.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt OfficeClickToRun.exe File created C:\Windows\SysWOW64\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-wal integrator.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{35a59ac8-0e9e-214c-9d9d-8a1357eb0938}\prnSendToOneNote.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{35a59ac8-0e9e-214c-9d9d-8a1357eb0938}\SET5F20.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\addinutil.exe.log addinutil.exe File created C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\System32\DriverStore\Temp\{35a59ac8-0e9e-214c-9d9d-8a1357eb0938}\SET5F0E.tmp DrvInst.exe File opened for modification C:\Windows\system32\vcruntime140_1.dll msiexec.exe File created C:\Windows\SysWOW64\vccorlib140.dll msiexec.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml OfficeC2RClient.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\FeatureFlags\Settings\37\internal_config.json OfficeClickToRun.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File created C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat integrator.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{35a59ac8-0e9e-214c-9d9d-8a1357eb0938}\SET5F0E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{35a59ac8-0e9e-214c-9d9d-8a1357eb0938}\SendToOneNote-pipelineconfig.xml DrvInst.exe File opened for modification C:\Windows\SysWOW64\vcruntime140.dll msiexec.exe File created C:\Windows\SysWOW64\msvcp140.dll msiexec.exe File created C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-wal ngen.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat integrator.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db integrator.exe File created C:\Windows\SysWOW64\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{35a59ac8-0e9e-214c-9d9d-8a1357eb0938}\SendToOneNoteNames.gpd DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{35a59ac8-0e9e-214c-9d9d-8a1357eb0938}\SET5F20.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat OfficeClickToRun.exe File created C:\Windows\SysWOW64\concrt140.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{35a59ac8-0e9e-214c-9d9d-8a1357eb0938}\prnms006.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{35a59ac8-0e9e-214c-9d9d-8a1357eb0938}\SET5F1E.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{35a59ac8-0e9e-214c-9d9d-8a1357eb0938}\SET5F1E.tmp DrvInst.exe -
Drops file in Program Files directory 64 IoCs
Processes:
OfficeClickToRun.exemsiexec.exeOfficeClickToRun.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\CLIPART\PUB60COR\DD01630_.WMF OfficeClickToRun.exe File created C:\Program Files\Microsoft Office\root\vfs\programfilesx86\microsoft analysis services\PipelineWriteValidator OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\Excel2021R_OEM_Perp-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\ProjectProR_Trial-pl.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\CLIPART\PUB60COR\J0107502.WMF OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\CLIPART\PUB60COR\NA00809_.WMF OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\CLIPART\PUB60COR\PE02120_.WMF OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\sdxs\FA000000002\OfflineFiles\oteljs_agave_1dc45f7a7be81b74944d97fb2754ebde.js OfficeClickToRun.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll msiexec.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\1033\PUBSPAPR\ZPDIR35F.GIF OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\lynchtmlconv.exe OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\CLIPART\PUB60COR\J0105272.WMF OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\CLIPART\Publisher\Backgrounds\J0143758.GIF OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\PUBWIZ\DGBORDER.DPV OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\sdxs\FA000000070\assets\src\assets\images\word-support.png OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\sdxs\FA000000076\manifest.xml OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\CLIPART\PUB60COR\J0212685.WMF OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\PUBWIZ\DGATNGET.XML OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\CLIPART\PUB60COR\WB01239_.GIF OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\Data\Delta\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\NativeShim.Resources.dll\16.0.11126.20074.delta OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\FORMS\1033\EXITEM.CFG OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\ProPlus2021VL_MAK_AE2-pl.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\xmsrv.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\ONENOTE.VisualElementsManifest.xml OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\CLIPART\PUB60COR\NA00530_.WMF OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.14527.20276OfficeC2R0B976E58-54F3-4495-BE38-524954258A8E\api-ms-win-core-processthreads-l1-1-1.dll OfficeClickToRun.exe File created C:\Program Files\Microsoft Office\root\vfs\programfilescommonx64\microsoft shared\office16\en-us\PipelineWriteValidator OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\Excel2019VL_MAK_AE-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\MondoR_Subscription2-pl.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.AnalysisServices.Excel.BackEnd.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\CLIPART\PUB60COR\J0107468.WMF OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\CLIPART\Publisher\Backgrounds\J0143743.GIF OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\PUBWIZ\DGCAL.DPV OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\sdxs\FA000000062\GoalsStrings.resjson OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as90.xsl OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\1033\LYNC_COL.HXT OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\1033\OutlookMeetingReqSendNaiveBayesCommandRanker.txt OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\1033\PUBSPAPR\ZPDIR31F.GIF OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\vfs\Fonts\private\LFAXD.TTF OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\OMSXP32.DLL OfficeClickToRun.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\adodb.dll msiexec.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\1033\PUBSPAPR\PDIR26F.GIF OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\api-ms-win-crt-heap-l1-1-0.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\vfs\Fonts\private\MOD20.TTF OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\CLIPART\PUB60COR\PAPER_01.MID OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\PUBWIZ\BIZCARD.XML OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Office16\msvcp140.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0051D944-EC73-4D98-935E-B2A49441C51C\root\CLIPART\PUB60COR\J0287018.WMF OfficeClickToRun.exe -
Drops file in Windows directory 64 IoCs
Processes:
OfficeClickToRun.exemsiexec.exengen.exengen.exengen.exengen.exeConhost.exengen.exengen.exengen.exengen.exeConhost.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exeaddinutil.exeConhost.exeConhost.exengen.exeConhost.exengen.exengen.exengen.exeConhost.exengen.exengen.exengen.exeConhost.exengen.exengen.exengen.exedescription ioc process File created C:\Windows\fonts\VLADIMIR.TTF OfficeClickToRun.exe File created C:\Windows\assembly\pubpol61.dat msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log ngen.exe File opened for modification C:\Windows\assembly\temp\202Z0EJ3QS\Policy.12.0.Microsoft.Vbe.Interop.dll msiexec.exe File opened for modification C:\Windows\Installer\MSI98D8.tmp msiexec.exe File created C:\Windows\fonts\BOD_PSTC.TTF OfficeClickToRun.exe File opened for modification C:\Windows\Installer\MSI2302.tmp msiexec.exe File created C:\Windows\fonts\ROCCB___.TTF OfficeClickToRun.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log ngen.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat ngen.exe File created C:\Windows\fonts\CALIFR.TTF OfficeClickToRun.exe File created C:\Windows\fonts\LFAXI.TTF OfficeClickToRun.exe File opened for modification C:\Windows\assembly\pubpol61.dat msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat ngen.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log Conhost.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat ngen.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat ngen.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log ngen.exe File created C:\Windows\assembly\tmp\HZWBKH48\2JGWW8CE msiexec.exe File opened for modification C:\Windows\assembly\pubpol31.dat msiexec.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log ngen.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat Conhost.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat ngen.exe File created C:\Windows\fonts\HTOWERTI.TTF OfficeClickToRun.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat ngen.exe File created C:\Windows\assembly\tmp\9EC3NKVX\extensibility.dll msiexec.exe File created C:\Windows\assembly\pubpol78.dat msiexec.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log ngen.exe File created C:\Windows\assembly\pubpol73.dat msiexec.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat ngen.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat ngen.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log ngen.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat ngen.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat ngen.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat ngen.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat addinutil.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat Conhost.exe File opened for modification C:\Windows\assembly\temp\D9HF0ZRYJP\__AssemblyInfo__.ini msiexec.exe File opened for modification C:\Windows\assembly\temp\A668YIC77H\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat Conhost.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat ngen.exe File created C:\Windows\fonts\LCALLIG.TTF OfficeClickToRun.exe File opened for modification C:\Windows\assembly\pubpol41.dat msiexec.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat Conhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log ngen.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat ngen.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log ngen.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log Conhost.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat ngen.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat ngen.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat ngen.exe File created C:\Windows\fonts\SCRIPTBL.TTF OfficeClickToRun.exe File opened for modification C:\Windows\assembly\tmp\9EC3NKVX\__AssemblyInfo__.ini msiexec.exe File created C:\Windows\assembly\pubpol63.dat msiexec.exe File created C:\Windows\assembly\tmp\VZUA4FMY\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll msiexec.exe File created C:\Windows\assembly\tmp\DF5QYYZA\IGG25KYH msiexec.exe File created C:\Windows\assembly\pubpol50.dat msiexec.exe File opened for modification C:\Windows\assembly\temp\IFMEPPGXAG\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat Conhost.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat ngen.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat ngen.exe File created C:\Windows\fonts\GIL_____.TTF OfficeClickToRun.exe File opened for modification C:\Windows\assembly\tmp\4X215SCT\__AssemblyInfo__.ini msiexec.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat ngen.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 14 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svchost.exeDrvInst.exengen.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 ngen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 ngen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags DrvInst.exe -
Checks processor information in registry 2 TTPs 33 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
OfficeClickToRun.exeintegrator.exeintegrator.exeOLicenseHeartbeat.exeTeams.exeOfficeClickToRun.exeOfficeClickToRun.exengen.exeOffice365.exeintegrator.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OLicenseHeartbeat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Teams.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Teams.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Teams.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ngen.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ngen.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Office365.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString integrator.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 integrator.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Office365.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ngen.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Teams.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz integrator.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OLicenseHeartbeat.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Teams.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Teams.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Office365.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OLicenseHeartbeat.exe -
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1368 schtasks.exe 404 schtasks.exe 3996 schtasks.exe 2220 schtasks.exe 3208 schtasks.exe 3112 schtasks.exe -
Enumerates system info in registry 2 TTPs 27 IoCs
Processes:
ngen.exeOfficeClickToRun.exeOLicenseHeartbeat.exeOfficeClickToRun.exeOffice365.exeintegrator.exeintegrator.exeintegrator.exeOfficeClickToRun.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ngen.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ngen.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OLicenseHeartbeat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Office365.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU integrator.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily integrator.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS integrator.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OLicenseHeartbeat.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Office365.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OLicenseHeartbeat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily Office365.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ngen.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS integrator.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe -
Processes:
integrator.exemsiexec.exeintegrator.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A} integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}\AppPath = "C:\\Program Files\\Microsoft Office\\root\\Office16\\" integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\MenuText = "OneNote Lin&ked Notes" integrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{72C8AC02-75E8-4444-9422-02FB7B43EC45} integrator.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT\VSTOInstaller.exe = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING\VSTOInstaller.exe = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_WINDOWEDSELECTCONTROL integrator.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A}\Policy = "3" integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{279D6C9A-652E-4833-BEFC-312CA8887857}\AlternateCLSID = "{F8CF7A98-2C45-4c8d-9151-2D716989DDAB}" integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\ = "Lync Click to Call" integrator.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING\VSTOInstaller.exe = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_WINDOWEDSELECTCONTROL\winword.exe = "0" integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}\AppName = "IEContentService.exe" integrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\mspub.exe = "13" integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\Default Visible = "Yes" integrator.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_WINDOWEDSELECTCONTROL\powerpnt.exe = "0" integrator.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}\Policy = "19" integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" integrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\VSTOInstaller.exe = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A}\AppPath = "C:\\Program Files\\Microsoft Office\\root\\Office16\\" integrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_UNC_SAVEDFILECHECK msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\ButtonText = "OneNote Lin&ked Notes" integrator.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\msoasb.exe = "11000" integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\ClsidExtension = "{48E73304-E1D6-4330-914C-F5F514E3486C}" integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\Icon = "C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.exe,1" integrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\VSTOInstaller.exe = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\ButtonText = "Send to OneNote" integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}\AppName = "onenote.exe" integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\Default Visible = "Yes" integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{72C8AC02-75E8-4444-9422-02FB7B43EC45}\AppName = "lync.exe" integrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\VSTOInstaller.exe = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\LICLUA.EXE = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\onenote.exe = "13" integrator.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A}\Policy = "3" integrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71} integrator.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\VSTOInstaller.exe = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_ENABLE_HTTP2\powerpnt.exe = "1" integrator.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\outlook.exe = "13" integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\MenuText = "Lync Click to Call" integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" integrator.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\VSTOInstaller.exe = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\OSPPREARM.EXE = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_ENABLE_HTTP2\msoasb.exe = "1" integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\Icon = "C:\\Program Files\\Microsoft Office\\root\\Office16\\ONBttnIE.dll,103" integrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71} integrator.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}\Policy = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A} integrator.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL\LICLUA.EXE = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND\LICLUA.EXE = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\HotIcon = "C:\\Program Files\\Microsoft Office\\root\\Office16\\ONBttnIELinkedNotes.dll,103" integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}\AppPath = "C:\\Program Files\\Microsoft Office\\root\\Office16\\" integrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING\LICLUA.EXE = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}\AppName = "IEContentService.exe" integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\Icon = "C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\ONBttnIELinkedNotes.dll,103" integrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{72C8AC02-75E8-4444-9422-02FB7B43EC45} integrator.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_ENABLE_HTTP2\msaccess.exe = "1" integrator.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
OfficeClickToRun.exeintegrator.exengen.exeintegrator.exeOfficeC2RClient.exemsiexec.exeintegrator.exeOfficeC2RClient.exeDrvInst.exengen.exengen.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|7" OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe integrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ngen.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe\ULSMonitor integrator.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1C\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d\52C64B7E OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" integrator.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|8" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ngen.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.7 = 79557365725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c224f666669636553746172745c22203a207b205c224576656e74735c22203a207b205c22536574757054656d706c61746550726f706572746965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243757272656e745549416374697665506c6163654368616e67655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22547269676765725468756d626e61696c416374696f6e52756e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22446f63756d656e744e6f74696669636174696f6e735c22203a207b205c224576656e74735c22203a207b205c2252656769737465724f6e49646c65466561747572654761746544697361626c65645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d7275536572766963654170695c22203a207b205c225375624e616d657370616365735c22203a207b205c22446f63756d656e74735c22203a207b205c224576656e74735c22203a207b205c2252656164526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225772697465526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6e526571756573745375636365656465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22506c616365735c22203a207b205c224576656e74735c22203a207b205c2252656164526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225772697465526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6e526571756573745375636365656465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c224d736f53686172696e675c22203a207b205c224576656e74735c22203a207b205c22434d736f53686172696e675365727669636548656c706572456e64476574486f73744361706162696c69746965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572476574486f73744361706162696c69746965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572456e6447657455736572417474726962757465735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c70657247657455736572417474726962757465735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572456e644765744c696e6b735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c7065724765744c696e6b735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572456e645365744c696e6b735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c7065725365744c696e6b735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572456e644765745065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c7065724765745065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572456e645365745065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c7065725365745065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572436865636b5065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c70657247657453686172696e67496e666f726d6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572426567696e5365745065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c70657247657453686172696e6756657273696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d6f6465726e4261636b73746167655c22203a207b205c224576656e74735c22203a207b205c224261636b737461676550616765436f6e74726f6c55736572437265617465436f6e74726f6c557365725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224465736b746f704261636b73746167654e617669676174696f6e5c22203a207b205c224576656e74735c22203a207b205c224e617669676174696f6e5461736b496e766f6b655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224465736b746f7053686172696e675c22203a207b205c224576656e74735c22203a207b205c22436f6c6c616250616e6555736572536574436f6c6c616250616e654d6f64655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6c6c616250616e6555736572436c69636b53686172696e674c696e6b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6c6c616250616e6555736572497343757272656e74446f63456e746572707269736550726f7465637465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22446f63756d656e7473536861726564576974684d655c22203a207b205c224576656e74735c22203a207b205c22446f63756d656e7473536861726564576974684d6552657175657374446f63756d656e7473536861726564576974684d654173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7473536861726564576974684d6552657175657374436163686564446f63756d656e7473536861726564576974684d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7473536861726564576974684d654964656e74697479436163686552657175657374526573756c745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7473536861726564576974684d6552657175657374436163686564446f63756d656e7473466f724661696c757265735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22486973746f727955585c22203a207b205c224576656e74735c22203a207b205c224163746976697479506167654d616e6167657252656769737465725669736962696c697479436f6e74726f6c6c65725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224275734261724f70656e4c6f63616c56657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434163746976697469657341676772656761746f72496e69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434163746976697469657341676772656761746f7252657475726e4572726f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243437369446f63756d656e74537461746545787465726e616c556e7265676973746572446f63756d656e744c697374656e65725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243486973746f727941637469766974696573466163746f727952656672657368416674657252656e616d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f62616c744163746976697469657346696c6556657273696f6e4c697374557064617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243536f61704461746150726f7669646572496e69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616765436c6f73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616765436f707956657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616765436f707956657273696f6e496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f7279506167654372656174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616765526573746f726556657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f72795061676553656c65637456657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616e654e6f6e436c69636b61626c654974656d53656c65637465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f63616c41637469766974696573426567696e526566726573685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6666696365436f6c6c61624163746976697479436f6d6d616e644d534f446f63756d656e7450726f76696465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225368617265506f696e74436865636b4f757446696c65546f4c6f63616c466f6c6465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546f67676c65486964655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546f67676c6553686f775c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225759574143616c6c6f757453686f7743616c6c6f75745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7365656e416374697669747943616c6c6f757450726573656e7443616c6c6f75745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7365656e41637469766974794765744c6173745669657754696d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7365656e416374697669747946696e6443757272656e74557365724c6f67696e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7365656e416374697669747943616c6c6f7574436c69636b65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253686f77536d616c6c53637265656e435759574143616c6c6f75745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d7275416461707465725c22203a207b205c224576656e74735c22203a207b205c224872416464446f63756d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872416464506c6163655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872416464446f63756d656e74576974684f7074696f6e7357697468436f6e746578745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872416464506c616365576974684f7074696f6e7357697468436f6e746578745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872416464446f63756d656e745061746857697468436f6e746578745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872416464506c6163655061746857697468436f6e746578745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872416464446f63756d656e74496e6465785c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872416464506c616365496e6465785c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22487252656d6f7665506174685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872416464576974684f7074696f6e7357697468436f6e746578745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22417070446f63735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745c22203a207b205c225375624e616d657370616365735c22203a207b205c2241637469766174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6173744f70656e6564446f63756d656e744d657461646174615c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d6f6465726e446f6354656d706c617465536572766963655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225361766550726f6d707448656c7065725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e74436861745c22203a207b205c224576656e74735c22203a207b205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e6572436f6e6e65637465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e6572436f6e6e656374696e674576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e6572446973636f6e6e65637465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e6572446973636f6e6e656374696e674576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e65725265667265736850657273697374656e7453746174654173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e65725265667265736850657273697374656e7453746174654173796e63496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e65725265667265736850657273697374656e7453746174654173796e6352657472795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e657253746172745265616c74696d65436f6e6e656374696f6e4c697374656e696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e657253746f705265616c74696d65436f6e6e656374696f6e4c697374656e696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572436f6e6e65637465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572436f6e6e656374696e674576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572446973636f6e6e65637465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572446973636f6e6e656374696e674576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e7453746174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e745374617465496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e74537461746552657472795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e7453746174655265747279496e6e65724c6f6f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f61646361737465725265667265736850657273697374656e7453746174654173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f616463617374657253746172745265616c74696d65436f6e6e656374696f6e4c697374656e696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f616463617374657253746f705265616c74696d65436f6e6e656374696f6e4c697374656e696e675c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253686172696e6755495c22203a207b205c225375624e616d657370616365735c22203a207b205c22436f6c6c616250616e65557365725c22203a207b205c224576656e74735c22203a207b205c22536861726550616e65436f6d706c657465446973706c61795c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2253686172654469616c6f675c22203a207b205c224576656e74735c22203a207b205c224e61766967617465546f5765624469616c6f675c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253656e6441734174746163686d656e745c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d2c205c224544505c22203a207b205c224576656e OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile ngen.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe integrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 integrator.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" integrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\CrashPersistence\OFFICEC2 OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSessionUpgradeCandidate OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigIds = "std::wstring|P-R-76757-1-2,P-R-54903-1-3,P-R-26146-7-15,P-D-29635-1-1,P-D-27087-1-9,P-R-79688-1-3,P-R-99366-4-6,P-X-98518-3-7,P-X-86111-1-3,P-X-76549-1-3,blockedgraphicsadapter_rev2:151106,aiuse174:119311,aimic582:115675,P-X-85665-1-7,aprou370:157665,P-X-79775-1-7,apexp148:113214,P-R-58640-1-3,P-R-35099-2-4,P-X-50506-1-3,P-R-34843-4-6,chpre575:67433,P-X-80678-1-5,P-X-76393-1-7,P-X-87237-1-3,P-X-87167-1-3,P-X-81823-1-5,P-X-70135-1-5,P-R-45483-16-53,P-R-87587-4-4,P-R-75069-1-3,P-R-75001-1-3,P-R-53005-22-21,P-R-68152-18-21,P-R-52316-C17-37,P-R-49162-18-13,P-R-49161-18-13,P-R-48550-2-2,P-R-40646-19-54,P-R-40253-6-19,P-R-40254-6-18,P-R-38974-6-21,P-R-35412-4-3,P-R-35401-6-7,P-R-35086-2-3,P-R-34777-4-4,P-R-32107-22-22,P-R-32704-1-4,P-R-26006-3-5,clrep308:103534,cladd357:82425,cldon215:104761,clint660:129394,repairsanitize:129393,c2rrestreamfilesinstreampipeline:74107,P-R-28546-6-10,P-R-24980-8-48,P-R-24390-5-10,P-R-19046-2-19,P-R-18279-2-65,P-R-58525-18-44,P-R-56232-18-19,P-R-52982-18-34,P-R-51145-2-7,P-X-71449-1-3,P-X-66590-1-5,P-R-95616-8-4,P-R-79616-1-3,P-R-77621-1-3,P-R-77204-1-3,P-R-76107-1-3,P-R-74334-1-3,P-R-74439-1-3,P-R-73642-1-3,P-R-69812-1-3,P-R-68938-1-4,P-R-62875-2-4,P-R-60579-2-2,P-R-60333-1-3,P-R-58107-2-2,P-R-55743-1-3,P-R-51958-1-5,P-R-38085-12-9,domod898:60719,enableactronodc:48605,P-X-85064-1-5,P-X-87535-1-3,P-X-75669-1-3,P-X-73891-1-3,P-X-69527-1-3,P-E-28677-C1-3,P-R-55122-8-8,P-R-50255-10-9,P-R-45314-10-16,exdis204:118935,powerqueryavoidoverridefillsessionmashupresource:110099,exocs695:94447,exena229:122664,exlea890:75122,P-E-38231-2-4,P-R-94560-14-12,P-R-94189-14-13,P-R-93882-14-26,P-R-81499-12-41,P-R-61147-18-2,P-R-54728-16-23,P-R-54698-16-16,P-R-54658-18-19,P-R-38306-18-3,P-R-34019-4-3,P-R-35109-4-3,P-X-83918-1-5,P-X-80537-1-11,P-X-72602-3-13,P-X-69189-1-7,P-X-66537-1-7,P-X-63134-1-7,P-X-98655-2-5,P-X-86265-2-3,P-X-84464-1-5,P-X-81043-1-5,P-X-78402-1-3,P-X-72950-1-3,P-X-67585-1-3,P-X-66364-1-5,P-X-62261-1-3,P-X-58678-1-5,P-X-58493-1-9,P-X-56274-1-9,P-X-56154-1-5,P-X-56147-1-5,P-X-55832-1-6,P-X-54358-1-7,P-X-54212-1-5,P-X-53975-3-9,P-X-53845-1-9,P-X-52591-1-11,P-X-51262-1-11,P-E-42700-C1-4,P-R-107021-4-4,P-R-99655-4-5,P-R-98283-17-19,P-R-95082-8-4,P-R-93970-8-4,P-R-90511-4-4,P-R-78293-1-3,P-R-74441-1-3,P-R-69065-1-3,P-R-62464-18-9,P-R-59808-26-29,P-R-59193-1-3,P-R-48699-C17-18,P-R-48047-18-29,P-R-45609-14-6,P-R-45197-2-6,P-R-40980-18-16,P-R-39029-5-18,P-R-38162-58-62,P-R-36310-4-4,P-R-35945-10-4,P-R-29809-1-6,P-R-26968-3-9,fisha719:153517,ficlp360:110401,16mbfragment:115145,fiena903:65944,fienf552:69426,ficac841:49664,onedriveconvergenceenlightenedrolloutcf:155736,acb23962:125753,fiomi293:118081,fimoc497:115374,fisha109:104700,fihalwaysinitcache:115163,fisyn285:63948,fiena631:91186,fiena340:60251,fiena415:38780,fileiosharingsuggestion:69876,fidav265:55035,fiena276:41004,remotemovedevice:42500,fiena490:34181,fiena947:30635,fiena381:49997,fista407:61027,fiser190:49498,fimoc589:28979,firef346:34525,P-R-53545-4-5,P-R-49736-6-22,P-R-32106-7-28,P-R-30085-1-9,P-R-25009-1-8,P-R-24363-1-10,P-R-19898-1-20,P-R-19814-1-62,P-R-19012-1-56,P-R-33555-1-5,P-X-86395-1-5,P-X-85628-1-3,P-X-84321-1-5,P-X-83388-1-3,P-X-79079-1-3,P-X-77742-1-5,P-X-75876-1-5,P-X-75210-1-3,P-X-75198-1-5,P-X-65301-1-3,P-X-59793-1-5,P-X-59792-1-5,P-X-50220-1-3,P-X-49730-1-3,P-X-47943-1-3,P-X-47754-1-3,P-R-98983-4-5,P-R-98097-4-6,P-R-65312-18-12,P-R-64841-22-15,P-R-63100-28-10,P-R-62183-18-21,P-R-55589-6-4,P-R-40990-12-15,P-R-32744-14-15,P-R-32741-32-16,P-D-34269-2-4,grsvg960:152257,grtes215:117679,gruse444:124091,graut130:111576,grisw569:112168,grdel347:127628,grrem245:111953,gralt888:111717,gralt817:111716,grsvg156:58147,grisa112:50610,grish568:50609,gruse488:19772,grico406:19777,P-X-69692-2-11,P-X-69688-2-3,ofhfbs355oyp4d31:59558,P-R-50429-18-8,P-X-71668-1-11,P-R-100851-8-5,P-R-63710-18-12,P-R-65295-18-23,P-R-53421-28-14,P-R-50764-18-13,P-R-40475-28-28,P-R-35985-14-20,P-R-32004-2-5,idfea766:129381,P-X-88035-1-5,lalan231:140781,P-R-66895-18-17,P-R-61248-18-6,P-R-60117-18-52,P-R-51995-18-28,P-X-89024-1-9,P-X-95000-1-5,P-X-72042-5-20,P-X-99279-6-15,P-X-96905-2-3,P-X-87562-2-3,P-X-79907-2-5,P-X-77394-2-5,P-X-75959-1-5,P-R-109885-4-5,P-R-98110-4-5,P-R-79963-1-2,P-R-65186-1-4,P-R-60816-10-19,P-R-51764-1-4,P-R-42392-2-4,P-R-39073-1-5,8j74a631:152197,ee7h3287:128858,useasviewertreatment:87580,g0727402:150309,9614g445:133948,f4eb1467:105522,49j5f427:85311,bha5f878:98779,3ic9f496:89277,P-R-38410-18-22,P-X-87584-2-9,P-X-78423-1-5,P-X-77783-1-5,P-X-81579-1-3,P-X-76796-1-3,P-X-51759-1-3,P-R-96725-6-4,P-R-66436-1-3,P-R-65296-1-3,P-R-59534-1-3,P-R-54557-1-3,P-R-52452-18-20,P-R-51751-18-21,P-R-36649-8-8,oeapp215cf:156858,oenew698:134882,oemou494:146004,oenew789:146006,oesam997:156622,oemac358:20502,P-R-71360-18-19,P-X-85638-1-7,omadd175:157411,P-X-76555-1-3,onmap366:81740,P-R-44803-8-17,P-R-38510-2-9,P-R-82473-1-4,P-R-56618-1-3,P-R-62574-18-10,P-R-61718-18-3,P-R-55661-18-11,P-R-33892-1-7,P-R-33696-1-5,P-R-68433-1-3,P-R-39912-1-2,P-R-50380-18-18,P-X-81132-1-5,P-X-73315-1-9,P-X-94306-1-3,P-X-92934-1-3,P-X-84061-1-5,P-X-78444-1-3,P-R-107972-4-7,P-R-73521-1-3,P-R-63338-18-11,P-R-58251-18-11,P-R-33737-1-4,seclp948:105472,seclp879:86520,seclp663:154901,sedlp604:146117,sefis830:145446,seclp723:90375,P-X-74234-1-9,P-X-93040-1-5,P-X-93029-1-5,P-X-93024-1-3,P-X-93023-1-3,P-X-93022-1-3,P-X-93020-1-3,P-X-78545-1-3,P-X-73718-1-3,P-X-65368-4-12,P-E-29662-2-3,P-R-74526-1-3,P-R-63947-18-2,P-R-47752-2-10,P-R-47242-18-11,P-R-44991-18-9,P-R-45550-18-46,P-R-44096-2-10,P-R-42512-1-2,P-R-41549-18-20,P-R-40169-8-11,P-R-36664-4-3,P-R-35407-4-3,P-R-30292-4-5,P-R-28644-1-4,P-R-24037-1-6,P-R-23445-3-6,P-R-23434-3-7,P-R-23403-3-6,P-R-18513-1-30,shgra747:86677,shgra418:125208,shgra688:125213,shgra447:125209,shgra443:125210,shgra765:125211,shgra597:125215,shaut596:92107,shicr317:94521,shwri875cf:150159,P-R-65011-1-3,P-R-50541-2-7,P-X-71568-1-5,P-R-69232-38-12,P-R-23681-2-7,P-D-32502-2-3,P-D-32501-2-3,P-D-32415-2-3,taena576:90265,P-X-96557-2-5,P-X-83304-1-3,P-X-71671-1-5,P-R-64513-18-10,P-R-51916-84-31,teari680cf:152330,teuae310:138428,uaecallstack:84401,P-R-105731-26-28,P-R-104435-10-12,P-R-100294-1-3,P-R-99633-1-3,P-R-98929-1-3,P-R-98926-1-3,P-R-98837-1-3,P-R-98250-1-3,P-R-95181-2-4,P-R-94809-1-3,P-R-94556-2-4,P-R-94299-1-3,P-R-93096-2-4,P-R-93077-1-3,P-R-90553-2-4,P-R-89283-2-4,P-R-88309-2-4,P-R-87451-2-4,P-R-86118-1-3,P-R-85960-2-4,P-R-80517-3-5,P-R-79793-1-3,P-R-79633-1-3,P-R-79238-7-9,P-R-78852-3-5,P-R-78112-1-3,P-R-77290-1-3,P-R-76955-2-4,P-R-76918-1-3,P-R-76721-1-3,P-R-76544-6-8,P-R-76253-1-3,P-R-75440-2-4,P-R-75436-1-3,P-R-75434-1-3,P-R-75433-1-3,P-R-72449-3-6,P-R-46041-4-8,P-R-46062-4-8,P-R-46066-4-8,P-R-46058-4-8,P-R-46055-3-7,P-R-46065-4-8,P-R-46067-4-8,P-R-46064-4-8,P-R-46054-4-8,P-R-23746-25-31,P-R-71346-1-3,P-R-49435-9-21,P-R-56209-5-11,P-R-68864-2-4,P-R-68069-2-4,P-R-67544-2-5,P-R-66975-1-3,P-R-66757-7-9,P-R-66140-3-5,P-R-65567-1-3,P-R-60602-1-3,P-R-53309-1-3,P-R-52633-1-3,P-R-52171-2-4,P-R-51921-8-10,P-R-51258-5-7,P-R-50752-2-4,P-R-50681-2-4,P-R-50599-4-6,P-R-50596-4-8,P-R-50553-1-3,P-R-49597-3-5,P-R-49458-2-4,P-R-48530-5-7,P-R-47948-1-4,P-R-47564-4-6,P-R-46580-3-5,P-R-46484-9-11,P-R-46122-1-3,P-R-45858-2-4,P-R-43966-2-4,P-R-43502-18-20,P-R-38248-14-18,P-R-41430-1-3,P-R-40751-8-10,P-R-40273-4-6,P-R-39238-2-4,P-R-38682-3-5,P-R-37588-2-4,P-R-34355-5-7,P-R-26266-4-9,P-R-26834-3-8,P-R-24662-15-21,P-R-27479-6-11,P-R-26056-7-15,P-R-27006-7-12,P-R-30338-3-7,P-R-30178-66-68,P-R-30053-7-9,P-R-27458-1-5,P-R-25822-9-12,P-R-25653-3-6,P-R-25083-6-9,P-R-24690-29-33,P-R-24689-2-5,P-R-24666-2-5,P-R-24663-6-11,P-R-24659-7-10,P-R-23744-7-9,P-R-23739-7-9,P-R-23736-13-16,P-R-23734-7-9,P-R-23730-16-19,P-R-23723-8-10,P-R-23714-9-11,P-D-32588-1-3,P-D-32534-1-3,P-D-32524-1-3,P-D-32518-1-3,P-D-32512-1-3,P-D-32509-1-3,P-D-32486-1-3,P-D-32485-1-4,P-D-32484-1-4,P-D-32405-1-3,P-X-88291-1-5,P-X-93760-2-3,P-X-71999-3-11,P-R-47601-18-13,P-R-33916-1-5,P-R-33580-8-9,ucsha489:131462,ucsha306cf:135245,ucsha660:76558,P-X-94701-3-9,P-X-82382-1-3,P-X-79922-1-5,P-X-77252-1-5,P-X-71712-1-5,P-R-99175-4-4,P-R-95434-8-9,P-R-95350-4-6,P-R-85919-4-4,P-R-77634-1-4,P-R-61426-18-6,P-R-59426-1-3,P-R-46913-18-6,P-R-37449-18-15,new_atboxparaoptionsenabled:146023,ux488646:95333,reactfilterpointerevents:105513,uxpro637:147594,checkoutdeviceonpaint:122110,P-R-19262-1-12,P-X-77184-1-3,P-E-44774-2-8,wocol936:80031,P-R-81720-1-2,P-R-58406-1-5,P-D-50697-2-4,P-D-29719-1-1,P-D-29718-1-1,P-D-29593-1-4" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ngen.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" ngen.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t|1637892124" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c\52C64B7E integrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe\ULSMonitor\ULSTagIds0 = "18679566,5804129,7202269,23978014,39965824,7692557,5850525,34198423,41484365,17962391,17962392" integrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 ngen.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.14 OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.12 = 677c7b205c225375624e616d657370616365735c22203a207b205c22474449417373697374616e745c22203a207b205c224576656e74735c22203a207b205c225265676973746572436c6f7564466f6e7443616c6c6261636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2248616e646c6543616c6c6261636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22466f6e744d616e6167657244657374727563746f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464436c6f7564466f6e745265736f757263655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225265736f75726365436c69656e745c22203a207b205c224576656e74735c22203a207b205c2252656164466f6e74456c656d656e74735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2250757267654d756c7469706c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526561645265736f757263654d657461446174615c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2257726974655265736f757263654d657461446174615c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22466f6e74537562737469747574696f6e5c22203a207b205c224576656e74735c22203a207b205c22436f6c6c656374466f6e74537562737469747574696f6e55736167655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e5558222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22416363436865636b65725c22203a207b205c224576656e74735c22203a207b205c2246697849744d656e754974656d53656c656374696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224163636573736962696c6974794973737565734e6f74696669636174696f6e496e666f506c6163655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224163636573736962696c6974794973737565734e6f74696669636174696f6e556e6b6e6f776e506c6163655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22416363436865636b657246696e616c56696f6c6174696f6e436f756e7450657252756c655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2246697849744d656e754f70656e436c6f73655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224163636573736962696c6974794973737565734e6f74696669636174696f6e536176654173506c6163655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224261636b73746167655570636f6e76657274486967686c6967687465645c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224163636573736962696c6974794973737565734e6f74696669636174696f6e4578706f7274506c6163655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2256696f6c6174696f6e53656c65637465645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c225465616368696e6743616c6c6f75745c22203a207b205c224576656e74735c22203a207b205c225465616368696e6743616c6c6f7574416c726561647953686f776e4d617854696d65735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465616368696e6743616c6c6f7574416c726561647953686f776e5468697353657373696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465616368696e6743616c6c6f7574546f6f4d616e7953686f776e5468697353657373696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2244796e616d69634470695c22203a207b205c224576656e74735c22203a207b205c22446973706c6179546f706f6c6f6779456e756d65726174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446973706c6179546f706f6c6f67794368616e6765645c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22446f63756d656e745265636f766572795c22203a207b205c224576656e74735c22203a207b205c22496e76616c696461746550616e65735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22546f6f6c746970735c22203a207b205c224576656e74735c22203a207b205c2253686f77546f6f6c7469705c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22416e63686f7252656769737472795c22203a207b205c224576656e74735c22203a207b205c224765744f72437265617465416e63686f7252656769737472795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22526962626f6e546162735c22203a207b205c224576656e74735c22203a207b205c22526962626f6e5461624163746976617465645f466c6f6f64676174655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d2c205c224576656e74735c22203a207b205c22436f6d696e67536f6f6e54435348574e445c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e6f46696c65457874656e73696f6e49636f6e4d617070696e675c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e576f7264222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224c696e6b6564496e5c22203a207b205c224576656e74735c22203a207b205c224372656174654c696e6b6564496e526573756d65417373697374616e745461736b50616e655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c2246696c65536176655c22203a207b205c224576656e74735c22203a207b205c225361766541735361766546696c655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22416374436d64476f7375625361766541735c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22436d645361766546696c65436f7265325c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2246696c654f70656e5c22203a207b205c224576656e74735c22203a207b205c22446f634e6f7469667943616c6c6261636b5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22446f4e6f746966794d657267654469616c6f675c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22464e4d45696453657446726f6d5873747a46747970466e6d4469725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436f417574686f72696e675c22203a207b205c224576656e74735c22203a207b205c2253686f77526573747269637465644d6163726f45646974696e674275734261725c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2246586c7255736572507265666572656e63655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f63735472616e736974696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22436f617574684d657267655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225365745464725265616479466f725472616e736974696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f6373446f776e6c6f6164526566557064617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244796e616d696353617665496e697469616c496e666f5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22466f726d735c22203a207b205c224576656e74735c22203a207b205c224c6561726e696e67546f6f6c73576b4f6e446f63756d656e744f70656e5c22203a207b205c224576656e74466c61675c22203a203439343038207d207d207d2c205c22446961676e6f737469635c22203a207b205c224576656e74735c22203a207b205c22566563416c6c6f634661696c7572655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c224f4353425c22203a207b205c224576656e74735c22203a207b205c2256636c6f6b4f6e446f63446973706c61795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2256636c6f6b4f6e53617665436f6d706c6574655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2256636c6f6b4f6e55706c6f6164436f6d706c6574655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c22536176655c22203a207b205c224576656e74735c22203a207b205c22436f61757468436f6e74656e744c6174656e6379496e536176655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22436d64446f53617665446f63436f7265436f6d6d616e64416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436d64446f53617665446f63436f7265416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22464d617953746172745472616e73616374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224669726553746174654f664175746f536176654f6e436c6f73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456964456e737572654f70656e466f72536176655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2242475361766546616c6c6261636b546f46475c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224544505c22203a207b205c224576656e74735c22203a207b205c22446f63756d656e744964656e746974794368616e67655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2250726f6f66696e675c22203a207b205c224576656e74735c22203a207b205c2250726f6f66696e674e6f50726f6f66526567696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225453706c4c6f61644c6962726172795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c6f75645370656c6c6572436865636b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e6f50726f6f6652756e4469666665727346726f6d5061726150726f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c617373696669636174696f6e4372697469717565526573706f6e7365506572664d61704578636565645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224772616d6d6172436865636b657243616c6c5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22576f72645c22203a207b205c225375624e616d657370616365735c22203a207b205c22426f6f745c22203a207b205c225375624e616d657370616365735c22203a207b205c2254696d696e675c22203a207b205c224576656e74735c22203a207b205c22446174615c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d2c205c22426f6f745c22203a207b205c224576656e74735c22203a207b205c22416464696e4d6f6e69746f7256616c6964617465426f6f745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464696e44697361626c65644469616c6f675c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22576f72644d61696c5c22203a207b205c224576656e74735c22203a207b205c2248724c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872536176655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22446f6354696c696e675c22203a207b205c224576656e74735c22203a207b205c2254696c696e6749646c6542756e646c654576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2254696c696e6749646c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2254696c696e6749646c654865617274626561745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2254696c696e6749646c654669726542756e646c65644576656e74735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465787454696c65446f63756d656e7456696577476574456e756d657261746f724576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465787454696c65446f63756d656e7456696577446973636f6e6e6563745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465787454696c65446f63756d656e745669657753696e6b52656769737465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465787454696c65446f63756d656e745669657753696e6b556e72656769737465725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2254687265655761794d657267655c22203a207b205c224576656e74735c22203a207b205c22435254435265766572745265706c61794b706f7353636f70654475726174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2255494d5c22203a207b205c224576656e74735c22203a207b205c224655494d426567696e556e646f4265666f726546426567696e556e646f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224655494d426567696e556e646f416674657246426567696e556e646f5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e456e61626c654c6f63616c697a6174696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e526573656172636865722e4e6f64654a5357656250616765457874726163746f72222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e536861726564536572706c657446656174757265476174653134222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e536861726564536572706c6574466561747572654761746534222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e536861726564536572706c6574466561747572654761746536222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e48656c7050726f7669646572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e506172616d657465725465726d50726564696374696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e53686f756c6453686f7748656c70416374696f6e73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e34383831323634222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e41646a7573744469616c6f67506f736974696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4174626f78506172614f7074696f6e73456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e436865636b6f75744465766963654f6e5061696e74496e76616c696447616467657473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e46697833383934383832222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e466c75656e744652454469616c6f67456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e466c75656e7453564d656e7552656672657368222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4c6f6767696e674f6e41646a7573744469616c6f67506f736974696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e50726f63657373446570656e64656e7444504352734669727374222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e526561637446696c746572506f696e7465724576656e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e53686f775377697463684c6162656c222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5569614e6f74696669636174696f6e73466f72427573426172456e61626c6564222c20225622203a2022626f6f OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections ngen.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\RulesLastAudienceReported\officec2rclient.exe = "Production" OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" integrator.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" integrator.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\integrator.exe = "Sun, 28 Nov 2021 00:32:42 GMT" integrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=integrator.exe&Version=16.0.14527.20144&ClientId={74924EAD-DE92-43F1-A52F-1513AA7D4DF5}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.14527.20144&" integrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\CrashPersistence\OFFICEC2\604 OfficeC2RClient.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1 = 4d736f3a3a436865636b73756d52656769737472793a3a446174617c75696e7436345f747c2d333639353436343233353833363835323736393b456373436f6e666967526573706f6e7365446174617c7b202256657222203a2022696e7433325f747c30222c2022436f6e6649647322203a20227374643a3a77737472696e677c502d522d37363735372d312d322c502d522d35343930332d312d332c502d522d32363134362d372d31352c502d442d32393633352d312d312c502d442d32373038372d312d392c502d522d37393638382d312d332c502d522d39393336362d342d362c502d582d39383531382d332d372c502d582d38363131312d312d332c502d582d37363534392d312d332c626c6f636b65646772617068696373616461707465725f726576323a3135313130362c61697573653137343a3131393331312c61696d69633538323a3131353637352c502d582d38353636352d312d372c6170726f753337303a3135373636352c502d582d37393737352d312d372c61706578703134383a3131333231342c502d522d35383634302d312d332c502d522d33353039392d322d342c502d582d35303530362d312d332c502d522d33343834332d342d362c63687072653537353a36373433332c502d582d38303637382d312d352c502d582d37363339332d312d372c502d582d38373233372d312d332c502d582d38373136372d312d332c502d582d38313832332d312d352c502d582d37303133352d312d352c502d522d34353438332d31362d35332c502d522d38373538372d342d342c502d522d37353036392d312d332c502d522d37353030312d312d332c502d522d35333030352d32322d32312c502d522d36383135322d31382d32312c502d522d35323331362d4331372d33372c502d522d34393136322d31382d31332c502d522d34393136312d31382d31332c502d522d34383535302d322d322c502d522d34303634362d31392d35342c502d522d34303235332d362d31392c502d522d34303235342d362d31382c502d522d33383937342d362d32312c502d522d33353431322d342d332c502d522d33353430312d362d372c502d522d33353038362d322d332c502d522d33343737372d342d342c502d522d33323130372d32322d32322c502d522d33323730342d312d342c502d522d32363030362d332d352c636c7265703330383a3130333533342c636c6164643335373a38323432352c636c646f6e3231353a3130343736312c636c696e743636303a3132393339342c72657061697273616e6974697a653a3132393339332c633272726573747265616d66696c6573696e73747265616d706970656c696e653a37343130372c502d522d32383534362d362d31302c502d522d32343938302d382d34382c502d522d32343339302d352d31302c502d522d31393034362d322d31392c502d522d31383237392d322d36352c502d522d35383532352d31382d34342c502d522d35363233322d31382d31392c502d522d35323938322d31382d33342c502d522d35313134352d322d372c502d582d37313434392d312d332c502d582d36363539302d312d352c502d522d39353631362d382d342c502d522d37393631362d312d332c502d522d37373632312d312d332c502d522d37373230342d312d332c502d522d37363130372d312d332c502d522d37343333342d312d332c502d522d37343433392d312d332c502d522d37333634322d312d332c502d522d36393831322d312d332c502d522d36383933382d312d342c502d522d36323837352d322d342c502d522d36303537392d322d322c502d522d36303333332d312d332c502d522d35383130372d322d322c502d522d35353734332d312d332c502d522d35313935382d312d352c502d522d33383038352d31322d392c646f6d6f643839383a36303731392c656e61626c65616374726f6e6f64633a34383630352c502d582d38353036342d312d352c502d582d38373533352d312d332c502d582d37353636392d312d332c502d582d37333839312d312d332c502d582d36393532372d312d332c502d452d32383637372d43312d332c502d522d35353132322d382d382c502d522d35303235352d31302d392c502d522d34353331342d31302d31362c65786469733230343a3131383933352c706f776572717565727961766f69646f7665727269646566696c6c73657373696f6e6d61736875707265736f757263653a3131303039392c65786f63733639353a39343434372c6578656e613232393a3132323636342c65786c65613839303a37353132322c502d452d33383233312d322d342c502d522d39343536302d31342d31322c502d522d39343138392d31342d31332c502d522d39333838322d31342d32362c502d522d38313439392d31322d34312c502d522d36313134372d31382d322c502d522d35343732382d31362d32332c502d522d35343639382d31362d31362c502d522d35343635382d31382d31392c502d522d33383330362d31382d332c502d522d33343031392d342d332c502d522d33353130392d342d332c502d582d38333931382d312d352c502d582d38303533372d312d31312c502d582d37323630322d332d31332c502d582d36393138392d312d372c502d582d36363533372d312d372c502d582d36333133342d312d372c502d582d39383635352d322d352c502d582d38363236352d322d332c502d582d38343436342d312d352c502d582d38313034332d312d352c502d582d37383430322d312d332c502d582d37323935302d312d332c502d582d36373538352d312d332c502d582d36363336342d312d352c502d582d36323236312d312d332c502d582d35383637382d312d352c502d582d35383439332d312d392c502d582d35363237342d312d392c502d582d35363135342d312d352c502d582d35363134372d312d352c502d582d35353833322d312d362c502d582d35343335382d312d372c502d582d35343231322d312d352c502d582d35333937352d332d392c502d582d35333834352d312d392c502d582d35323539312d312d31312c502d582d35313236322d312d31312c502d452d34323730302d43312d342c502d522d3130373032312d342d342c502d522d39393635352d342d352c502d522d39383238332d31372d31392c502d522d39353038322d382d342c502d522d39333937302d382d342c502d522d39303531312d342d342c502d522d37383239332d312d332c502d522d37343434312d312d332c502d522d36393036352d312d332c502d522d36323436342d31382d392c502d522d35393830382d32362d32392c502d522d35393139332d312d332c502d522d34383639392d4331372d31382c502d522d34383034372d31382d32392c502d522d34353630392d31342d362c502d522d34353139372d322d362c502d522d34303938302d31382d31362c502d522d33393032392d352d31382c502d522d33383136322d35382d36322c502d522d33363331302d342d342c502d522d33353934352d31302d342c502d522d32393830392d312d362c502d522d32363936382d332d392c66697368613731393a3135333531372c6669636c703336303a3131303430312c31366d62667261676d656e743a3131353134352c6669656e613930333a36353934342c6669656e663535323a36393432362c66696361633834313a34393636342c6f6e656472697665636f6e76657267656e6365656e6c69676874656e6564726f6c6c6f757463663a3135353733362c61636232333936323a3132353735332c66696f6d693239333a3131383038312c66696d6f633439373a3131353337342c66697368613130393a3130343730302c666968616c77617973696e697463616368653a3131353136332c666973796e3238353a36333934382c6669656e613633313a39313138362c6669656e613334303a36303235312c6669656e613431353a33383738302c66696c65696f73686172696e6773756767657374696f6e3a36393837362c66696461763236353a35353033352c6669656e613237363a34313030342c72656d6f74656d6f76656465766963653a34323530302c6669656e613439303a33343138312c6669656e613934373a33303633352c6669656e613338313a34393939372c66697374613430373a36313032372c66697365723139303a34393439382c66696d6f633538393a32383937392c66697265663334363a33343532352c502d522d35333534352d342d352c502d522d34393733362d362d32322c502d522d33323130362d372d32382c502d522d33303038352d312d392c502d522d32353030392d312d382c502d522d32343336332d312d31302c502d522d31393839382d312d32302c502d522d31393831342d312d36322c502d522d31393031322d312d35362c502d522d33333535352d312d352c502d582d38363339352d312d352c502d582d38353632382d312d332c502d582d38343332312d312d352c502d582d38333338382d312d332c502d582d37393037392d312d332c502d582d37373734322d312d352c502d582d37353837362d312d352c502d582d37353231302d312d332c502d582d37353139382d312d352c502d582d36353330312d312d332c502d582d35393739332d312d352c502d582d35393739322d312d352c502d582d35303232302d312d332c502d582d34393733302d312d332c502d582d34373934332d312d332c502d582d34373735342d312d332c502d522d39383938332d342d352c502d522d39383039372d342d362c502d522d36353331322d31382d31322c502d522d36343834312d32322d31352c502d522d36333130302d32382d31302c502d522d36323138332d31382d32312c502d522d35353538392d362d342c502d522d34303939302d31322d31352c502d522d33323734342d31342d31352c502d522d33323734312d33322d31362c502d442d33343236392d322d342c67727376673936303a3135323235372c67727465733231353a3131373637392c67727573653434343a3132343039312c67726175743133303a3131313537362c67726973773536393a3131323136382c677264656c3334373a3132373632382c677272656d3234353a3131313935332c6772616c743838383a3131313731372c6772616c743831373a3131313731362c67727376673135363a35383134372c67726973613131323a35303631302c67726973683536383a35303630392c67727573653438383a31393737322c677269636f3430363a31393737372c502d582d36393639322d322d31312c502d582d36393638382d322d332c6f66686662733335356f7970346433313a35393535382c502d522d35303432392d31382d382c502d582d37313636382d312d31312c502d522d3130303835312d382d352c502d522d36333731302d31382d31322c502d522d36353239352d31382d32332c502d522d35333432312d32382d31342c502d522d35303736342d31382d31332c502d522d34303437352d32382d32382c502d522d33353938352d31342d32302c502d522d33323030342d322d352c69646665613736363a3132393338312c502d582d38383033352d312d352c6c616c616e3233313a3134303738312c502d522d36363839352d31382d31372c502d522d36313234382d31382d362c502d522d36303131372d31382d35322c502d522d35313939352d31382d32382c502d582d38393032342d312d392c502d582d39353030302d312d352c502d582d37323034322d352d32302c502d582d39393237392d362d31352c502d582d39363930352d322d332c502d582d38373536322d322d332c502d582d37393930372d322d352c502d582d37373339342d322d352c502d582d37353935392d312d352c502d522d3130393838352d342d352c502d522d39383131302d342d352c502d522d37393936332d312d322c502d522d36353138362d312d342c502d522d36303831362d31302d31392c502d522d35313736342d312d342c502d522d34323339322d322d342c502d522d33393037332d312d352c386a3734613633313a3135323139372c65653768333238373a3132383835382c757365617376696577657274726561746d656e743a38373538302c67303732373430323a3135303330392c39363134673434353a3133333934382c66346562313436373a3130353532322c34396a35663432373a38353331312c62686135663837383a39383737392c33696339663439363a38393237372c502d522d33383431302d31382d32322c502d582d38373538342d322d392c502d582d37383432332d312d352c502d582d37373738332d312d352c502d582d38313537392d312d332c502d582d37363739362d312d332c502d582d35313735392d312d332c502d522d39363732352d362d342c502d522d36363433362d312d332c502d522d36353239362d312d332c502d522d35393533342d312d332c502d522d35343535372d312d332c502d522d35323435322d31382d32302c502d522d35313735312d31382d32312c502d522d33363634392d382d382c6f6561707032313563663a3135363835382c6f656e65773639383a3133343838322c6f656d6f753439343a3134363030342c6f656e65773738393a3134363030362c6f6573616d3939373a3135363632322c6f656d61633335383a32303530322c502d522d37313336302d31382d31392c502d582d38353633382d312d372c6f6d6164643137353a3135373431312c502d582d37363535352d312d332c6f6e6d61703336363a38313734302c502d522d34343830332d382d31372c502d522d33383531302d322d392c502d522d38323437332d312d342c502d522d35363631382d312d332c502d522d36323537342d31382d31302c502d522d36313731382d31382d332c502d522d35353636312d31382d31312c502d522d33333839322d312d372c502d522d33333639362d312d352c502d522d36383433332d312d332c502d522d33393931322d312d322c502d522d35303338302d31382d31382c502d582d38313133322d312d352c502d582d37333331352d312d392c502d582d39343330362d312d332c502d582d39323933342d312d332c502d582d38343036312d312d352c502d582d37383434342d312d332c502d522d3130373937322d342d372c502d522d37333532312d312d332c502d522d36333333382d31382d31312c502d522d35383235312d31382d31312c502d522d33333733372d312d342c7365636c703934383a3130353437322c7365636c703837393a38363532302c7365636c703636333a3135343930312c7365646c703630343a3134363131372c73656669733833303a3134353434362c7365636c703732333a39303337352c502d582d37343233342d312d392c502d582d39333034302d312d352c502d582d39333032392d312d352c502d582d39333032342d312d332c502d582d39333032332d312d332c502d582d39333032322d312d332c502d582d39333032302d312d332c502d582d37383534352d312d332c502d582d37333731382d312d332c502d582d36353336382d342d31322c502d452d32393636322d322d332c502d522d37343532362d312d332c502d522d36333934372d31382d322c502d522d34373735322d322d31302c502d522d34373234322d31382d31312c502d522d34343939312d31382d392c502d522d34353535302d31382d34362c502d522d34343039362d322d31302c502d522d34323531322d312d322c502d522d34313534392d31382d32302c502d522d34303136392d382d31312c502d522d33363636342d342d332c502d522d33353430372d342d332c502d522d33303239322d342d352c502d522d32383634342d312d342c502d522d32343033372d312d362c502d522d32333434352d332d362c502d522d32333433342d332d372c502d522d32333430332d332d362c502d522d31383531332d312d33302c73686772613734373a38363637372c73686772613431383a3132353230382c73686772613638383a3132353231332c73686772613434373a3132353230392c73686772613434333a3132353231302c73686772613736353a3132353231312c73686772613539373a3132353231352c73686175743539363a39323130372c73686963723331373a39343532312c736877726938373563663a3135303135392c502d522d36353031312d312d332c502d522d35303534312d322d372c502d582d37313536382d312d352c502d522d36393233322d33382d31322c502d522d32333638312d322d372c502d442d33323530322d322d332c502d442d33323530312d322d332c502d442d33323431352d322d332c7461656e613537363a39303236352c502d582d39363535372d322d352c502d582d38333330342d312d332c502d582d37313637312d312d352c502d522d36343531332d31382d31302c502d522d35313931362d38342d33312c746561726936383063663a3135323333302c74657561653331303a3133383432382c75616563616c6c737461636b3a38343430312c502d522d3130353733312d32362d32382c502d522d3130343433352d31302d31322c502d522d3130303239342d312d332c502d522d39393633332d312d332c502d522d39383932392d312d332c502d522d39383932362d312d332c502d522d39383833372d312d332c502d522d39383235302d312d332c502d522d39353138312d322d342c502d522d39343830392d312d332c502d522d39343535362d322d342c502d522d39343239392d312d332c502d522d39333039362d322d342c502d522d39333037372d312d332c502d522d39303535332d322d342c502d522d38393238332d322d342c502d522d38383330392d322d342c502d522d38373435312d322d342c502d522d38363131382d312d332c502d522d38353936302d322d342c502d522d38303531372d332d352c502d522d37393739332d312d332c502d522d37393633332d312d332c502d522d37393233382d372d392c502d522d37383835322d332d352c502d522d37383131322d312d332c502d522d37373239302d312d332c502d522d37363935352d322d342c502d522d37363931382d312d332c502d522d37363732312d312d332c502d522d37363534342d362d382c502d522d37363235332d312d332c502d522d37353434302d322d342c502d522d37353433362d312d332c502d522d37353433342d312d332c502d522d37353433332d312d332c502d522d37323434392d332d362c502d522d34363034312d342d382c502d522d34363036322d342d382c502d522d34363036362d342d382c502d522d34363035382d342d382c502d522d34363035352d332d372c502d522d34363036352d342d382c502d522d34363036372d342d382c502d522d34363036342d342d382c502d522d34363035342d342d382c502d522d32333734362d32352d33312c502d522d37313334362d312d332c502d522d34393433352d392d32312c502d522d35363230392d352d31312c502d522d36383836342d322d342c502d522d36383036392d322d342c502d522d36373534342d322d352c502d522d36363937352d312d332c502d522d36363735372d372d392c502d522d36363134302d332d352c502d522d36353536372d312d332c502d522d36303630322d312d332c502d522d35333330392d312d332c502d522d35323633332d312d332c502d522d35323137312d322d342c502d522d35313932312d382d31302c502d522d35313235382d352d372c502d522d35303735322d322d342c502d522d35303638312d322d342c502d522d35303539392d342d362c502d522d35303539362d342d382c502d52 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" integrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" ngen.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" integrator.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache ngen.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix integrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" integrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe -
Modifies registry class 64 IoCs
Processes:
Update.exeOfficeClickToRun.exemsiexec.exeintegrator.exeintegrator.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{C413A27F-601E-4261-B9E3-0EB966F4E7D1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" Update.exe Key created \REGISTRY\MACHINE\Software\Classes\Access.BlankProjectTemplate OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CommunicatorMeetingJoinAx.JoinManager\CurVer\ = "CommunicatorMeetingJoinAx.JoinManager.2" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E705279-92D1-43CC-A57B-ED48BCCC711D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020812-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0\Assembly = "Microsoft.Office.Interop.Excel, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8472D0A9-03EA-3253-8BC8-F66718CF09A6}\15.0.0.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32\RuntimeVersion = "v2.0.50727" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Record\{EEEC37A7-495B-30F5-8404-37644FC0358F}\15.0.0.0 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|Common Files|Microsoft Shared|VSTA|Pipeline.v10.0|AddInSideAdapters|Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9 = 7a006e003d004200560060002400210021002100340021002100210021004d004b004b0053006b005600530054004f0043004c005200330035003e007b002700310044002e005300380027005e0038005d007800610034004f00670042004f0067002b0000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{3DEBDC7E-811F-4304-BDD7-7D98C732026C}\ProxyStubClsid32 Update.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{FB67275C-4D9E-4C32-9793-A96749884FC1} Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.12\shell\Printto\ddeexec\ OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F04E-0000-0000-C000-000000000046}\Control\ OfficeClickToRun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F8FB4BD4-ECE4-4009-9FA6-AC93191315EB}\15.0.0.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B06E967-E47C-11CD-8701-00AA003F0F07}\InprocServer32\Assembly = "Microsoft.Office.Interop.Access, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Outlook.URL.stssync.15\URL Protocol OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E70526C-92D1-43CC-A57B-ED48BCCC711D}\TypeLib\ = "{4AFFC9A0-5F99-101B-AF4E-00AA003F0F07}" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{37B3B0AF-44B5-11D3-B65B-00C04F8EF32D}\TypeLib\Version = "2.3" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C03A5-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08F6C81A-3CFD-11D1-98BC-006008197D41}\InprocServer32\Assembly = "Microsoft.Office.Interop.Access, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{E664682C-CBA5-4C7C-A65B-9CD046F24CBD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" Update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Access.MDBFile\CLSID OfficeClickToRun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{37B3B0B3-44B5-11D3-B65B-00C04F8EF32D}\ProxyStubClsid32 OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Lync.LyncEndorser.1\CLSID\ = "{79048A75-A3E1-4AE3-A5FE-CA9A8FC7E307}" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{26C8D96D-7D22-4E9E-948A-EDCCB4CA9C64}\TypeLib\ = "{B9AA1F11-F480-4054-A84E-B5D9277E40A8}" OfficeClickToRun.exe Key created \REGISTRY\MACHINE\Software\Classes\Record\{B4ED5791-7C3D-3153-BB79-B40038BA385D}\15.0.0.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20C139DB-3671-481C-B905-8A6173317D72}\TypeLib\Version = "2.8" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C0322-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F8D807EA-F63F-3F6E-9FF3-BDE91DC97279}\15.0.0.0\RuntimeVersion = "v2.0.50727" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{C98EDB61-013C-3FC6-B38B-F54A342D79D1}\15.0.0.0 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{D9D04B55-D820-4D5B-A690-658A49368478}\ProxyStubClsid32 Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8625CD1C-B19C-3ECB-8A29-2E12449FE6CA}\15.0.0.0\RuntimeVersion = "v2.0.50727" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0006F04C-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0\Assembly = "Microsoft.Office.Interop.Outlook, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{919317EA-D59A-492E-9860-8B45E82CEC0C}\TypeLib\Version = "2.3" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002095B-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A159F27-21F3-4DB7-84E1-57E37765C402}\ = "IApplicationSharingModality2" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B06E94B-E47C-11CD-8701-00AA003F0F07}\InprocServer32\Assembly = "Microsoft.Office.Interop.Access, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{0002E170-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00020952-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000CDB0B-0000-0000-C000-000000000046}\TypeLib\Version = "2.8" OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{3417D640-3976-4CB6-BC82-54E5E2E10784}\ProxyStubClsid32 Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ods\ = "Excel.OpenDocumentSpreadsheet.12" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{356B06EC-4908-42A4-81FC-4B5A51F3483B}\ = "XMLSchemaReferences" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000CDB03-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C033D-0000-0000-C000-000000000046}\TypeLib\Version = "2.8" OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{9D4D3D10-DEBC-40C6-ACF9-527986CB42BC}\ProxyStubClsid32 Update.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{AAF90EC3-32B8-33B9-A5BC-6549F1F7451A}\15.0.0.0 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Record\{8DBAA8CB-E1D0-3531-AD9E-9E8F08E651CA}\15.0.0.0 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{02DD541F-C863-4295-92AB-A4CF29F5D841}\TypeLib Update.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{37C7F935-E215-46D2-82A3-A451840EC733}\ = "IConversation2" Update.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4039B326-9F27-4B4A-B460-47A0C6A39D5C} integrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Outlook.File.nk2.15\ = "Outlook Nickname File" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E6-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{84A6A663-AEF4-4FCD-83FD-9BB707F157CA}\ = "DownBars" OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{000CDB0D-0000-0000-C000-000000000046}\InprocServer32\Assembly = "office, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A683C93-BA84-11CF-8110-00A0C9030074} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Outlook.Application\CurVer\ = "Outlook.Application.16" OfficeClickToRun.exe Key created \REGISTRY\MACHINE\Software\Classes\OCHelper.BrowserHelper\CurVer OfficeClickToRun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SharePoint.StssyncHandler.3\ = "SharePoint Stssync Handler" integrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{08DDF5C4-FA12-4978-B26E-C6D23C453413}\TypeLib\ = "{B9AA1F11-F480-4054-A84E-B5D9277E40A8}" Update.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F269-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002E18B-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0\Class = "Microsoft.Vbe.Interop.PropertiesClass" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{41C8F6EA-0AF0-4A4F-99E9-5EB01EBFC9A3}\15.0.0.0 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
powershell.exepowershell.exemsiexec.exeTeams.exepid process 712 powershell.exe 712 powershell.exe 712 powershell.exe 916 powershell.exe 916 powershell.exe 916 powershell.exe 3420 msiexec.exe 3420 msiexec.exe 3328 Teams.exe 3328 Teams.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AutoInstall_zNvtuIFmBw.exepowershell.exepowershell.exeOfficeClickToRun.exewevtutil.exewevtutil.exewevtutil.exeintegrator.exemsiexec.exedescription pid process Token: SeDebugPrivilege 2620 AutoInstall_zNvtuIFmBw.exe Token: SeDebugPrivilege 712 powershell.exe Token: SeDebugPrivilege 916 powershell.exe Token: SeBackupPrivilege 2060 OfficeClickToRun.exe Token: SeRestorePrivilege 2060 OfficeClickToRun.exe Token: 35 2060 OfficeClickToRun.exe Token: 35 2060 OfficeClickToRun.exe Token: 35 2060 OfficeClickToRun.exe Token: 35 2060 OfficeClickToRun.exe Token: 35 2060 OfficeClickToRun.exe Token: 35 2060 OfficeClickToRun.exe Token: 35 2060 OfficeClickToRun.exe Token: 35 2060 OfficeClickToRun.exe Token: SeSecurityPrivilege 3700 wevtutil.exe Token: SeBackupPrivilege 3700 wevtutil.exe Token: SeSecurityPrivilege 1892 wevtutil.exe Token: SeBackupPrivilege 1892 wevtutil.exe Token: SeSecurityPrivilege 1156 wevtutil.exe Token: SeBackupPrivilege 1156 wevtutil.exe Token: SeShutdownPrivilege 2672 integrator.exe Token: SeIncreaseQuotaPrivilege 2672 integrator.exe Token: SeSecurityPrivilege 3420 msiexec.exe Token: SeCreateTokenPrivilege 2672 integrator.exe Token: SeAssignPrimaryTokenPrivilege 2672 integrator.exe Token: SeLockMemoryPrivilege 2672 integrator.exe Token: SeIncreaseQuotaPrivilege 2672 integrator.exe Token: SeMachineAccountPrivilege 2672 integrator.exe Token: SeTcbPrivilege 2672 integrator.exe Token: SeSecurityPrivilege 2672 integrator.exe Token: SeTakeOwnershipPrivilege 2672 integrator.exe Token: SeLoadDriverPrivilege 2672 integrator.exe Token: SeSystemProfilePrivilege 2672 integrator.exe Token: SeSystemtimePrivilege 2672 integrator.exe Token: SeProfSingleProcessPrivilege 2672 integrator.exe Token: SeIncBasePriorityPrivilege 2672 integrator.exe Token: SeCreatePagefilePrivilege 2672 integrator.exe Token: SeCreatePermanentPrivilege 2672 integrator.exe Token: SeBackupPrivilege 2672 integrator.exe Token: SeRestorePrivilege 2672 integrator.exe Token: SeShutdownPrivilege 2672 integrator.exe Token: SeDebugPrivilege 2672 integrator.exe Token: SeAuditPrivilege 2672 integrator.exe Token: SeSystemEnvironmentPrivilege 2672 integrator.exe Token: SeChangeNotifyPrivilege 2672 integrator.exe Token: SeRemoteShutdownPrivilege 2672 integrator.exe Token: SeUndockPrivilege 2672 integrator.exe Token: SeSyncAgentPrivilege 2672 integrator.exe Token: SeEnableDelegationPrivilege 2672 integrator.exe Token: SeManageVolumePrivilege 2672 integrator.exe Token: SeImpersonatePrivilege 2672 integrator.exe Token: SeCreateGlobalPrivilege 2672 integrator.exe Token: SeRestorePrivilege 3420 msiexec.exe Token: SeTakeOwnershipPrivilege 3420 msiexec.exe Token: SeRestorePrivilege 3420 msiexec.exe Token: SeTakeOwnershipPrivilege 3420 msiexec.exe Token: SeRestorePrivilege 3420 msiexec.exe Token: SeTakeOwnershipPrivilege 3420 msiexec.exe Token: SeRestorePrivilege 3420 msiexec.exe Token: SeTakeOwnershipPrivilege 3420 msiexec.exe Token: SeRestorePrivilege 3420 msiexec.exe Token: SeTakeOwnershipPrivilege 3420 msiexec.exe Token: SeRestorePrivilege 3420 msiexec.exe Token: SeTakeOwnershipPrivilege 3420 msiexec.exe Token: SeRestorePrivilege 3420 msiexec.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
OfficeClickToRun.exeOfficeC2RClient.exepid process 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3952 OfficeC2RClient.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
OfficeClickToRun.exepid process 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3748 OfficeClickToRun.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
Office365.exeOfficeClickToRun.exeOfficeClickToRun.exeOfficeClickToRun.exeOfficeC2RClient.exeintegrator.exengen.exeintegrator.exeintegrator.exeOLicenseHeartbeat.exeOfficeC2RClient.exeOfficeC2RClient.exepid process 1772 Office365.exe 2100 OfficeClickToRun.exe 2060 OfficeClickToRun.exe 3748 OfficeClickToRun.exe 3952 OfficeC2RClient.exe 3952 OfficeC2RClient.exe 2672 integrator.exe 1648 ngen.exe 1348 integrator.exe 2820 integrator.exe 2472 OLicenseHeartbeat.exe 604 OfficeC2RClient.exe 2932 OfficeC2RClient.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AutoInstall_zNvtuIFmBw.exeOffice365.exeOfficeClickToRun.exeintegrator.exemsiexec.exeMsiExec.exeConhost.exeMsiExec.exedescription pid process target process PID 2620 wrote to memory of 1772 2620 AutoInstall_zNvtuIFmBw.exe Office365.exe PID 2620 wrote to memory of 1772 2620 AutoInstall_zNvtuIFmBw.exe Office365.exe PID 2620 wrote to memory of 1772 2620 AutoInstall_zNvtuIFmBw.exe Office365.exe PID 1772 wrote to memory of 712 1772 Office365.exe powershell.exe PID 1772 wrote to memory of 712 1772 Office365.exe powershell.exe PID 1772 wrote to memory of 712 1772 Office365.exe powershell.exe PID 1772 wrote to memory of 916 1772 Office365.exe powershell.exe PID 1772 wrote to memory of 916 1772 Office365.exe powershell.exe PID 1772 wrote to memory of 916 1772 Office365.exe powershell.exe PID 1772 wrote to memory of 2100 1772 Office365.exe OfficeClickToRun.exe PID 1772 wrote to memory of 2100 1772 Office365.exe OfficeClickToRun.exe PID 1772 wrote to memory of 3748 1772 Office365.exe OfficeClickToRun.exe PID 1772 wrote to memory of 3748 1772 Office365.exe OfficeClickToRun.exe PID 2060 wrote to memory of 2672 2060 OfficeClickToRun.exe integrator.exe PID 2060 wrote to memory of 2672 2060 OfficeClickToRun.exe integrator.exe PID 2672 wrote to memory of 1244 2672 integrator.exe schtasks.exe PID 2672 wrote to memory of 1244 2672 integrator.exe schtasks.exe PID 2672 wrote to memory of 1040 2672 integrator.exe schtasks.exe PID 2672 wrote to memory of 1040 2672 integrator.exe schtasks.exe PID 2672 wrote to memory of 3712 2672 integrator.exe schtasks.exe PID 2672 wrote to memory of 3712 2672 integrator.exe schtasks.exe PID 2672 wrote to memory of 2172 2672 integrator.exe schtasks.exe PID 2672 wrote to memory of 2172 2672 integrator.exe schtasks.exe PID 2672 wrote to memory of 3700 2672 integrator.exe wevtutil.exe PID 2672 wrote to memory of 3700 2672 integrator.exe wevtutil.exe PID 2672 wrote to memory of 1892 2672 integrator.exe wevtutil.exe PID 2672 wrote to memory of 1892 2672 integrator.exe wevtutil.exe PID 2672 wrote to memory of 1156 2672 integrator.exe wevtutil.exe PID 2672 wrote to memory of 1156 2672 integrator.exe wevtutil.exe PID 3420 wrote to memory of 404 3420 msiexec.exe MsiExec.exe PID 3420 wrote to memory of 404 3420 msiexec.exe MsiExec.exe PID 3420 wrote to memory of 404 3420 msiexec.exe MsiExec.exe PID 3420 wrote to memory of 1480 3420 msiexec.exe MsiExec.exe PID 3420 wrote to memory of 1480 3420 msiexec.exe MsiExec.exe PID 1480 wrote to memory of 1280 1480 MsiExec.exe Conhost.exe PID 1480 wrote to memory of 1280 1480 MsiExec.exe Conhost.exe PID 1280 wrote to memory of 3076 1280 Conhost.exe ose00000.exe PID 1280 wrote to memory of 3076 1280 Conhost.exe ose00000.exe PID 404 wrote to memory of 3296 404 MsiExec.exe Conhost.exe PID 404 wrote to memory of 3296 404 MsiExec.exe Conhost.exe PID 404 wrote to memory of 3296 404 MsiExec.exe Conhost.exe PID 404 wrote to memory of 712 404 MsiExec.exe ngen.exe PID 404 wrote to memory of 712 404 MsiExec.exe ngen.exe PID 404 wrote to memory of 1120 404 MsiExec.exe Conhost.exe PID 404 wrote to memory of 1120 404 MsiExec.exe Conhost.exe PID 404 wrote to memory of 1120 404 MsiExec.exe Conhost.exe PID 404 wrote to memory of 3320 404 MsiExec.exe ngen.exe PID 404 wrote to memory of 3320 404 MsiExec.exe ngen.exe PID 404 wrote to memory of 3560 404 MsiExec.exe Conhost.exe PID 404 wrote to memory of 3560 404 MsiExec.exe Conhost.exe PID 404 wrote to memory of 3560 404 MsiExec.exe Conhost.exe PID 404 wrote to memory of 2020 404 MsiExec.exe ngen.exe PID 404 wrote to memory of 2020 404 MsiExec.exe ngen.exe PID 404 wrote to memory of 2688 404 MsiExec.exe Conhost.exe PID 404 wrote to memory of 2688 404 MsiExec.exe Conhost.exe PID 404 wrote to memory of 2688 404 MsiExec.exe Conhost.exe PID 404 wrote to memory of 2028 404 MsiExec.exe ngen.exe PID 404 wrote to memory of 2028 404 MsiExec.exe ngen.exe PID 404 wrote to memory of 1840 404 MsiExec.exe Conhost.exe PID 404 wrote to memory of 1840 404 MsiExec.exe Conhost.exe PID 404 wrote to memory of 1840 404 MsiExec.exe Conhost.exe PID 404 wrote to memory of 3360 404 MsiExec.exe ngen.exe PID 404 wrote to memory of 3360 404 MsiExec.exe ngen.exe PID 404 wrote to memory of 396 404 MsiExec.exe ngen.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoInstall_zNvtuIFmBw.exe"C:\Users\Admin\AppData\Local\Temp\AutoInstall_zNvtuIFmBw.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Test\Office365.exe"C:\Test\Office365.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} "3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} "3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeOfficeClickToRun.exe platform=x64 culture=en-us productstoadd=O365ProPlusRetail.16_en-us_x-none cdnbaseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version=16.0.14527.20276 mediatype=CDN sourcetype=CDN O365ProPlusRetail.excludedapps=groove updatesenabled=False bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown scenario=CLIENTUPDATE3⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeOfficeClickToRun.exe platform=x64 culture=en-us productstoadd=O365ProPlusRetail.16_en-us_x-none cdnbaseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version.16=16.0.14527.20276 mediatype.16=CDN sourcetype.16=CDN O365ProPlusRetail.excludedapps.16=groove updatesenabled.16=False bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exeOLicenseHeartbeat.exe tokenactivate4⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
C:\Test\MicrosoftTeams.exe"C:\Test\MicrosoftTeams.exe" -s2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . -s --exeName=MicrosoftTeams.exe3⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Squirrel.exe"C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe"C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --squirrel-install 1.4.00.294694⤵
- Executes dropped EXE
- Checks computer location settings
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Microsoft\Teams\Update.exeC:\Users\Admin\AppData\Local\Microsoft\Teams\Update.exe --createShortcut=Teams.exe -l=StartMenu,Desktop5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe"C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=gpu-process --field-trial-handle=1548,18255441534164161439,12282949798487855362,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1556 /prefetch:25⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe"C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1548,18255441534164161439,12282949798487855362,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1892 /prefetch:85⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.21209.2\x64\Microsoft.Teams.AddinLoader.dll"4⤵
-
C:\Windows\system32\regsvr32.exe/s /n /i:user "C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.21209.2\x64\Microsoft.Teams.AddinLoader.dll"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.21209.2\x86\Microsoft.Teams.AddinLoader.dll"4⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\integration\integrator.exeintegrator.exe /U /Extension /Msi /License PRIDName= /C2R PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates"3⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates Logon"3⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentLogOn2016"3⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentFallBack2016"3⤵
-
C:\Windows\System32\wevtutil.exewevtutil.exe um "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\wevtutil.exewevtutil.exe um "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\wevtutil.exewevtutil.exe um "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office ClickToRun Service Monitor"2⤵
-
C:\Program Files\Microsoft Office\root\integration\integrator.exeintegrator.exe /I /Msi MsiName=SPPRedist.msi,SPPRedist64.msi /C2R PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root"2⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /change /tn "Microsoft\Office\Office ClickToRun Service Monitor" /enable2⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\Office ClickToRun Service Monitor" /XML "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ServiceWatcherSchedule.xml"2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /change /tn "Microsoft\Office\Office ClickToRun Service Monitor" /enable2⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /change /tn "Microsoft\Office\Office Automatic Updates" /enable2⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Automatic Updates 2.0"2⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /change /tn "Microsoft\Office\Office Automatic Updates 2.0" /enable2⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\Office Automatic Updates 2.0" /XML "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\FrequentOfficeUpdateSchedule.xml"2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /change /tn "Microsoft\Office\Office Automatic Updates 2.0" /enable2⤵
-
C:\Program Files\Microsoft Office\root\integration\integrator.exeintegrator.exe /I /License PRIDName=O365ProPlusRetail.16,ProPlusRetail.16 /C2R PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\root\integration\integrator.exeintegrator.exe /I /Extension /Msi MsiName=C2RInt.16.msi,C2RIntLoc.en-us.16.msi,* /C2R PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates"3⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\Office Feature Updates" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates.xml"3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates Logon"3⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\Office Feature Updates Logon" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates Logon.xml"3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentLogOn2016"3⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\OfficeTelemetryAgentLogOn2016" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml"3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentFallBack2016"3⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\OfficeTelemetryAgentFallBack2016" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml"3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man" /rf:"C:\Program Files\Microsoft Office\root\Office16\wwlib.dll" /mf:"C:\Program Files\Microsoft Office\root\Office16\wwlib.dll"3⤵
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man" /rf:"C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll" /mf:"C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll"3⤵
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man" /rf:"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\mso.dll" /mf:"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\mso.dll"3⤵
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man" /rf:"C:\Program Files\Microsoft Office\root\Office16\wwlib.dll" /mf:"C:\Program Files\Microsoft Office\root\Office16\wwlib.dll"3⤵
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man" /rf:"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\mso.dll" /mf:"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\mso.dll"3⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /progressandlaunch AppTargets="root\office16\excel.exe|root\office16\lync.exe|root\office16\msaccess.exe|root\office16\mspub.exe|root\office16\onenote.exe|root\office16\outlook.exe|root\office16\powerpnt.exe|root\office16\teams.exe|root\office16\winword.exe" ManualUpgrade=False ScenarioToTrack="Scenario:{477E0208-58BD-4F33-978A-09BCC9AA9EB1}@INSTALL"1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding 4D84C6C0BC5A20F296029A11DB376FC7 E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll"3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll"3⤵
- Drops file in Windows directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll"3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue3⤵
- Drops file in Windows directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Drops file in Windows directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding 8389E8E768240A954EE95E7D7ABB9C6F E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\Source Engine\ose.exe"C:\Program Files\Common Files\Microsoft Shared\Source Engine\ose.exe" -standalone:temp3⤵
-
C:\Windows\Temp\ose00000.exe"C:\Windows\Temp\ose00000.exe" -standalone4⤵
- Executes dropped EXE
-
\??\c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe"c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild3⤵
- Drops file in System32 directory
-
\??\c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe"c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild3⤵
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding B779F011C47645BC4B5C8F732B161ADD E Global\MSI00002⤵
- Loads dropped DLL
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 17E5C2D1DB1A1FB426DAED086D4CCCC3 E Global\MSI00002⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D112F35F3779CC12294D95C4AE3BA2AA E Global\MSI00002⤵
- Loads dropped DLL
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies3⤵
- Loads dropped DLL
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
- Loads dropped DLL
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies3⤵
- Modifies data under HKEY_USERS
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 667C116C04562EF9E0F9556E5C6A8BB7 E Global\MSI00002⤵
- Loads dropped DLL
-
C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe"C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild3⤵
-
C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe"C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild3⤵
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding F21876E7AEDB917802B988A7D752AC1F E Global\MSI00002⤵
- Loads dropped DLL
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding BDCB60F5D1ED1DC11E61C386EC08BEB1 E Global\MSI00002⤵
- Loads dropped DLL
-
\??\c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe"c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild3⤵
- Drops file in Windows directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
\??\c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe"c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8AA2C3A7E07A8A2F22106B1F84A2F7B8 E Global\MSI00002⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI544.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259917578 3826 SetupConfigCustomAction!Squirrel.SetupConfigCustomAction.SettingsCustomActions.RemoveRegKeyFromPreviousInstall3⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 35A012F0ACB66254B25684C5669DD76B2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIF96.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259919906 3832 SetupConfigCustomAction!Squirrel.SetupConfigCustomAction.SettingsCustomActions.CopyConfig3⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Microsoft Office\root\Office16\OneNote\\prnms006.inf" "9" "44b58805b" "0000000000000174" "Service-0x0-3e7$\Default" "0000000000000178" "208" "C:\Program Files\Microsoft Office\root\Office16\OneNote\"2⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wsappx -s AppXSvc1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\APPVFILESYSTEMMETADATA.dllMD5
47df99fe851db855c5507328f660dcf5
SHA1195a33f0b91d6fda50d48c98c8e9bbfacfbf331b
SHA25615646e0312a8ac15305efb382ce658ca37e6d4e4b73f93387589fd1d8139e3db
SHA5125de2564d67dbf37ec38d40ac3b2d11fae4318744655941a763a514ed35d38fdf55694852789ca98d9e11c9ead5f997f8091d1413e20d511aba9aef1f8c46d5ea
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\APPVMANIFEST.dllMD5
18ebc0da472b1efc4e8f6b6627cffc93
SHA120a7cf7558d8a7a5bbcc131cbaf4ba75d3f11815
SHA256624ab9c6838a88550ad5d906e86829778b5a9fce09a55a67eadcbb5806058c98
SHA512a443da09f063e6ba8711df6ac9c35aa26298356e3dcf819e7784b8641c609fa8fd5d30ec03964493790058b138534f342b65e0688b93e8fcd6d6aa772acd6f6d
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\APPVPOLICY.dllMD5
1c03d1935b5892738a188ba40cd5a223
SHA1b793c3918203f57468a7baa83e8d9e6e7b775545
SHA256d656c21853e185feb04c0decc52df277ed9d214e9ffa31b86ed34c682e1b5730
SHA512f9fa9def40ec3053f3a75ab2bc8e7c68c8b806be5bb80cda726ac8c08e3152c32db84a43a9e5775851bde0067d9ce9c8657a19850887171b0b206685318dbf40
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dllMD5
e85b603cc6968ffb4303fee315cf1af7
SHA1e18d26df594425ff299cae10521ab21bb37baa31
SHA256dbddda4caf6b63671b74666584ce1ac2affa59270e987725f2059fb1249c4ec8
SHA512a1ab6bd6f908a2edb5b4afd2d5da24c187e14bd2572f27237f1fb4d24da8a8fa7d227c140e99da9739ca8be63cfcd96e2259c9c29f64f1059033ab049f6dfa9b
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVCatalog.dllMD5
cf282ddd8d2cd281b2afb341bbbc7f8a
SHA18104ad996680c838c44743b1cc3149353c8bdb2b
SHA25691cc31c10bac6b042855d8a48c854ba57b8e2085ca427786416f418f3597860b
SHA512fed8069b200919471a21ac0b1d258f89f206bb6ed172b9b5a17e7d13b78fd825d25a33172adedec55cb89f225756f36daa9eec587eff52bf91df3752c2bd9de3
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dllMD5
c01cc0200f3d889c68b503c68049ff62
SHA1338589ddb1ffb4422f06e75f62f0db1151741f5d
SHA256326bcb85652c67780d0193d78d5bab30e3668e6bcbcffcff304751b2f4518f54
SHA5128d072207da418ff170e843f2d97b0e52875b42d2d4b46882d5de08a4e98bf1b7788052c5c591aa70f72813fe2b692541c55920d6dbe22ef15b7ef8a9252da58a
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvApi.dllMD5
fc0e1d121cdded19e7b98cd995bde281
SHA1102ebe6eb24cf598d559b305423b38896a8208cc
SHA2567ccc472997dc3d5080cac6918bbd7ba172a4e674f59b5721e7487cd9b101d64d
SHA5127077503a5265554f85364744385c4db557cc87f3540688f661c3f139e94cf107ceb2fdac51235a92030ce9dc19a411326ac720ff0925d9d28894afa4b3a0989c
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvStreamingManager.dllMD5
4d3d26e3dee4398c1127903171ceb1c3
SHA195e316fe28d10ab358eaf71cc1bc66e3912d55a0
SHA2563f54dc6589030ea96e0022e2a36624d9f8aba31a0940db4f2da3773739f5fd3c
SHA5127241f433e9c970d16658fc3498235804de128564c7be25afce9c3d75d14000e738a9cc8de343c339f47144f243250eb8918f4ddaef783fae1b0dae0a1d5bcb45
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dllMD5
5f98a9c985171cd6f7b709b4727f802e
SHA11a822aca0699d67e2726ba716e7bb28316493328
SHA256238a45614b67a38facf98730b2b5e316b424f79b4ad591eddb6ec52460c3265c
SHA5122e6342e689a090854a24db2d837975eccdcaf8f78a3dff568e9dde6f76b2c0b929f307498b278a1feae5eec17e60cdbc81b8f10d0379dd1c77b6a0b8da5b5370
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dllMD5
b5da8c6339ac4fe30dab6be4ca4fb8f5
SHA1fa628818d38d49527a4cdaa46b47bfd1ea18477d
SHA2566677f595565cc80ad6cc46dda9760ffb1c5d02cdd3a36cb525f5a96d8edc601c
SHA5121619ce0bcb62ddcb22fe0d5caf456a2ad84d08ffb4b42951aef18efb5e3e73458441b84fab815521c936fd94c78d474e47997ef4c9cc18aab90c77b029d0a5d7
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dllMD5
0884821e75b789d14faa4757a7f31880
SHA1b837e32188a5673683d02bc62e21a23647308d7f
SHA2561ebb321cbfeceb8eb13045118f09d43b94bc0172cdd185fbb3dffe58d7da10ab
SHA51242fe74d5d28c20695d2230d66e0c368059e0726f494a2ecec3e2c8aef4e4a1c570f072564c59362c347e653c46b4f15af4db11fbc9ad0d2babbf8883df032ebb
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RUI.dllMD5
9d499d107cec3a860cfcc2dcf69460de
SHA14ee5fe5661df25f844f7b9fe7976704a592a3d71
SHA2569fb86a0ecd3273971a8f276cbfac500bd5a1cdcab50c2f2601fd52faf19a122d
SHA5120e3d2673ee7eb408728a680cbc775f1d997276e04e3e8aa762aa7777b20329ec2b84c2d6421e0e285f41ebb9f65028cbca6b048c504fb97c3ddf6e86842fa9a4
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\CONCRT140.dllMD5
c4fe3f03efd3188252caa101f954ffeb
SHA198b613aee45c71aed9d2be0d61d7ace323929e9c
SHA25695bb425be3d515a6a58f7399d44dd9e032baea11667dfdba29517c460171880a
SHA51280018e0bddf079367d3568433a5f89f0144aa0a75286b0105fe32aeeb5d80876c9b2e1ecaafb70fb041271e27a234a2cb88a2d3d160a4aa3768ccfcfc574704a
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\IntegratedOffice.exeMD5
2ca4cf3c39635030a0d6f7e774f9dc95
SHA1d73c8e3e6642ed32c4f2105b27fbb82019f2be45
SHA256864a6f41bd1a57ffd5fc403798271614c8151e25861fd83b50f9e12e1ee6ac4e
SHA51240287b61cc89c5695917da4ab31f951335bb83cacdb087af70508eb1f5c7563b4a1fdeaccfe222ef93bbae8633a56b1c02d64cd15646cfca2dc7c16095077a7e
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\MSIX.dllMD5
680de13431ec58094f287adcb1865d06
SHA1feb2eab60f1ab0f7add64282be9ede34219530b0
SHA25682d366c444bf6147227fae26ad3468094a230fbce84e15eb9f5cba3c7bb63ffb
SHA512884de914ddfd66f8e22918b243da512629b9fa6552bbbd0cc94ca920c4fd40859451aafeda29152cedb11a99fef845f9e106019d517bc57df6460f4fc51c6cb1
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\MSVCP140.dllMD5
cd0c37f1875b704f8eb08e397381ac16
SHA1249d33c43e105a1c36ec6a24e5ef8dbc5f56b31b
SHA256d86ac158123a245b927592c80cc020fea29c8c4addc144466c4625a00ca9c77a
SHA512d60c56716399b417e1d9d7d739af13674c8572974f220a44e5e4e9ab0b0a23b8937bd0929eee9f03f20b7f74db008f70f9559a7eb66948b3afab5b96bdd1a6d5
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeMD5
e83faef7ae94f73949d5db33b015f256
SHA14603162e8eea9fe3e75a94eb80c2d57f577368b0
SHA256dfd8e89144ff14b58be63c56ba4dd83eadd279b0c00fb3ba3e04dba59e29a385
SHA51268d59eed52857cce8134248771f954907c27c2ab57e43424ca9d21862fa3d87145fb241c4559317a5669bfe5ed7e457e6d36a845f6a9dc3a51b80f4c5cea4a9c
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\StreamServer.dllMD5
0af84993d66a9d68d6d1c65707c2ef4a
SHA1848f692dd049d957d01a3386f83b7da836bf99e7
SHA2565951e8c2e0d1a7ba0b3ddb568e67809eac72d4285be1d0a982882e58f54814e4
SHA512247f3cf55926a6a10a6da1b04de41e8bb4ffd54bd908ee7057b204819f82197ef6d8c0cff55e78d662d9fbaa76f1167befe211dfc976312c78db013a500ab548
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\VCRUNTIME140.dllMD5
11d9ac94e8cb17bd23dea89f8e757f18
SHA1d4fb80a512486821ad320c4fd67abcae63005158
SHA256e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
SHA512aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\VCRUNTIME140_1.dllMD5
7667b0883de4667ec87c3b75bed84d84
SHA1e6f6df83e813ed8252614a46a5892c4856df1f58
SHA25604e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
SHA512968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\appvisvsubsystems32.dllMD5
eceaf9a27eaadbf0b9efed8f4d1fce85
SHA104f479306df3202d8765fa94925a00d2782666b8
SHA256d18eed0f63f80a35cdb0a572470659843054723ad986de127a5dd1e7527f01bc
SHA51251197498d1be232a2feb029771991db277512221ca2139c9a30fc6103d6c70b97b56bbbf90891c82da6a79bc2b383a8d9295634e077464af96052c3c2fd7d58e
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\c2rintl.en-us.dllMD5
dcb65de3ae26aa5847c13b45cd9411a3
SHA1b74417bcbe423499f36a2542f6b5c0395f347c5a
SHA2567cdedae25bcdce1f8458e7062d9dd768d5780765fcdc8aa7747f28711de65f85
SHA51267dd2ba2bef1586e97a9fe3045c7fc96701ee8c90d52beeca2c5c06a6837a28f1da83448472fb186925aff9084bdb59dab926ce81a16b2c56c732da225f4f6e3
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\i640.hashMD5
08640975c413392f3613bfbcffdd203c
SHA1eed97c73eba0289fd569a0025074a02c4da3384c
SHA256605466624ec867b3d6038c18ea06030f96eda22ab19579c926c664ca1fe49a59
SHA5128ef0a00caa7fdb6255ed4a112a4e4c7df19bebaefe98abcc915086d37ed0211e626f9fff1904df1f6b40084a80f3896d8886a0e3160a24d3c16b02d42f3ed2bc
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\repoman.dllMD5
4896c2fdbad50c502b0418f8547d8a49
SHA1c7b95ce8e8fa1e55b2e7410613f9eb1a95a291d9
SHA256a35781e2da58a5faba9504b1faa1c9074ff5cf7f1488220983942faf2ccec7d6
SHA5124439397f4f357f88713374c426a89632cdb61029161785fb2c8b87a9527b1f86041781c19321f055ca9210fbe41767e6787adad1fbb8372439d59b405828680e
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exeMD5
d6f51c2dd13f3b13e2ffa521072094d2
SHA189fcf050ec06dfdb75e3e4f7ec7420ad56a97464
SHA2560fbc4613b66a98de6112cc113d936eca0305865666516662a8cc0fae0cde7c11
SHA5120910213380cb659d199be9768ef30a31272c997edc6f2f511cbf7bc6c1e7a95e90e698b4d29d410e32aeddcfce29c8fdea7379814b99687c7f1e300690d3704c
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exeMD5
e83faef7ae94f73949d5db33b015f256
SHA14603162e8eea9fe3e75a94eb80c2d57f577368b0
SHA256dfd8e89144ff14b58be63c56ba4dd83eadd279b0c00fb3ba3e04dba59e29a385
SHA51268d59eed52857cce8134248771f954907c27c2ab57e43424ca9d21862fa3d87145fb241c4559317a5669bfe5ed7e457e6d36a845f6a9dc3a51b80f4c5cea4a9c
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exeMD5
e83faef7ae94f73949d5db33b015f256
SHA14603162e8eea9fe3e75a94eb80c2d57f577368b0
SHA256dfd8e89144ff14b58be63c56ba4dd83eadd279b0c00fb3ba3e04dba59e29a385
SHA51268d59eed52857cce8134248771f954907c27c2ab57e43424ca9d21862fa3d87145fb241c4559317a5669bfe5ed7e457e6d36a845f6a9dc3a51b80f4c5cea4a9c
-
C:\Test\Office365.exeMD5
f8fbe5f1b0214436b8d531a88a3a15f9
SHA1676e4285348089cd09a8bb8ccbe7eb43258e9d38
SHA256e252fa969d83e249335d527f209be0d0fe58fa031df656b724e59d195f7b2e7c
SHA5127def594467a4e5b5b05764d214b9f965bb46671057a4e725a8444a336bf265a421d57ff81106def56974bb3abb0761a153795856b5d1775fc0e1a5fc6eab260c
-
C:\Test\Office365.exeMD5
f8fbe5f1b0214436b8d531a88a3a15f9
SHA1676e4285348089cd09a8bb8ccbe7eb43258e9d38
SHA256e252fa969d83e249335d527f209be0d0fe58fa031df656b724e59d195f7b2e7c
SHA5127def594467a4e5b5b05764d214b9f965bb46671057a4e725a8444a336bf265a421d57ff81106def56974bb3abb0761a153795856b5d1775fc0e1a5fc6eab260c
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
3c77e960becbd7a3941082e5bfdc79a5
SHA1270dac097f92b9c8d77eb5cc9ddb5a79175ee374
SHA256c2427c938fd1a390a30ba47d1130e14f3ee8894d0dff080d05eacd45f1a981c6
SHA51207c44f3e4a2fccc7b8bc2065d7b67ae21b1d1d87375d92c55240bcf2b72248b5e5059470241980b85635c7d915669e809de2b1d2a977438f7e7988455bd5e36f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
2103394621268673c023dd8021f3b16c
SHA151631638e123d73298b14b27998ad8cb3121c92c
SHA2563b31cef253c0045b1035ff688bee318a81f79c7a33e10af011bb840064fede1c
SHA512cf7422c65da826c0b6dfaf3d73617969045312244eb1c84110122922f6e3ae20da6831d6c67fecaf1a5e0413f725001aa376419e7d2c91abe57d8bb0974e3d14
-
C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratchMD5
bd3457e50947d4280734e74b51b5b68d
SHA1424635c6b5622a6c01a59d290a1c9ab8e593effc
SHA25623d647979bc5dc186de5ba3e00a222a912ab8e4782eb6407efa70e29e95979f5
SHA512e83e3615a5e94af288eb1c9b92f55e271765cc43531ec94574371debf63c0c4a58327b6fd8a4775bfba8a3234220cb0396b6d33164309a09a1d826c0689143fb
-
C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratchMD5
bd3457e50947d4280734e74b51b5b68d
SHA1424635c6b5622a6c01a59d290a1c9ab8e593effc
SHA25623d647979bc5dc186de5ba3e00a222a912ab8e4782eb6407efa70e29e95979f5
SHA512e83e3615a5e94af288eb1c9b92f55e271765cc43531ec94574371debf63c0c4a58327b6fd8a4775bfba8a3234220cb0396b6d33164309a09a1d826c0689143fb
-
C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratchMD5
21438ef4b9ad4fc266b6129a2f60de29
SHA15eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA25613bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
SHA51237436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
-
C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratchMD5
21438ef4b9ad4fc266b6129a2f60de29
SHA15eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA25613bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
SHA51237436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
-
\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dllMD5
e85b603cc6968ffb4303fee315cf1af7
SHA1e18d26df594425ff299cae10521ab21bb37baa31
SHA256dbddda4caf6b63671b74666584ce1ac2affa59270e987725f2059fb1249c4ec8
SHA512a1ab6bd6f908a2edb5b4afd2d5da24c187e14bd2572f27237f1fb4d24da8a8fa7d227c140e99da9739ca8be63cfcd96e2259c9c29f64f1059033ab049f6dfa9b
-
\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dllMD5
e85b603cc6968ffb4303fee315cf1af7
SHA1e18d26df594425ff299cae10521ab21bb37baa31
SHA256dbddda4caf6b63671b74666584ce1ac2affa59270e987725f2059fb1249c4ec8
SHA512a1ab6bd6f908a2edb5b4afd2d5da24c187e14bd2572f27237f1fb4d24da8a8fa7d227c140e99da9739ca8be63cfcd96e2259c9c29f64f1059033ab049f6dfa9b
-
\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dllMD5
e85b603cc6968ffb4303fee315cf1af7
SHA1e18d26df594425ff299cae10521ab21bb37baa31
SHA256dbddda4caf6b63671b74666584ce1ac2affa59270e987725f2059fb1249c4ec8
SHA512a1ab6bd6f908a2edb5b4afd2d5da24c187e14bd2572f27237f1fb4d24da8a8fa7d227c140e99da9739ca8be63cfcd96e2259c9c29f64f1059033ab049f6dfa9b
-
\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dllMD5
cf282ddd8d2cd281b2afb341bbbc7f8a
SHA18104ad996680c838c44743b1cc3149353c8bdb2b
SHA25691cc31c10bac6b042855d8a48c854ba57b8e2085ca427786416f418f3597860b
SHA512fed8069b200919471a21ac0b1d258f89f206bb6ed172b9b5a17e7d13b78fd825d25a33172adedec55cb89f225756f36daa9eec587eff52bf91df3752c2bd9de3
-
\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dllMD5
47df99fe851db855c5507328f660dcf5
SHA1195a33f0b91d6fda50d48c98c8e9bbfacfbf331b
SHA25615646e0312a8ac15305efb382ce658ca37e6d4e4b73f93387589fd1d8139e3db
SHA5125de2564d67dbf37ec38d40ac3b2d11fae4318744655941a763a514ed35d38fdf55694852789ca98d9e11c9ead5f997f8091d1413e20d511aba9aef1f8c46d5ea
-
\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dllMD5
c01cc0200f3d889c68b503c68049ff62
SHA1338589ddb1ffb4422f06e75f62f0db1151741f5d
SHA256326bcb85652c67780d0193d78d5bab30e3668e6bcbcffcff304751b2f4518f54
SHA5128d072207da418ff170e843f2d97b0e52875b42d2d4b46882d5de08a4e98bf1b7788052c5c591aa70f72813fe2b692541c55920d6dbe22ef15b7ef8a9252da58a
-
\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dllMD5
fc0e1d121cdded19e7b98cd995bde281
SHA1102ebe6eb24cf598d559b305423b38896a8208cc
SHA2567ccc472997dc3d5080cac6918bbd7ba172a4e674f59b5721e7487cd9b101d64d
SHA5127077503a5265554f85364744385c4db557cc87f3540688f661c3f139e94cf107ceb2fdac51235a92030ce9dc19a411326ac720ff0925d9d28894afa4b3a0989c
-
\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dllMD5
4d3d26e3dee4398c1127903171ceb1c3
SHA195e316fe28d10ab358eaf71cc1bc66e3912d55a0
SHA2563f54dc6589030ea96e0022e2a36624d9f8aba31a0940db4f2da3773739f5fd3c
SHA5127241f433e9c970d16658fc3498235804de128564c7be25afce9c3d75d14000e738a9cc8de343c339f47144f243250eb8918f4ddaef783fae1b0dae0a1d5bcb45
-
\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dllMD5
5f98a9c985171cd6f7b709b4727f802e
SHA11a822aca0699d67e2726ba716e7bb28316493328
SHA256238a45614b67a38facf98730b2b5e316b424f79b4ad591eddb6ec52460c3265c
SHA5122e6342e689a090854a24db2d837975eccdcaf8f78a3dff568e9dde6f76b2c0b929f307498b278a1feae5eec17e60cdbc81b8f10d0379dd1c77b6a0b8da5b5370
-
\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dllMD5
b5da8c6339ac4fe30dab6be4ca4fb8f5
SHA1fa628818d38d49527a4cdaa46b47bfd1ea18477d
SHA2566677f595565cc80ad6cc46dda9760ffb1c5d02cdd3a36cb525f5a96d8edc601c
SHA5121619ce0bcb62ddcb22fe0d5caf456a2ad84d08ffb4b42951aef18efb5e3e73458441b84fab815521c936fd94c78d474e47997ef4c9cc18aab90c77b029d0a5d7
-
\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dllMD5
18ebc0da472b1efc4e8f6b6627cffc93
SHA120a7cf7558d8a7a5bbcc131cbaf4ba75d3f11815
SHA256624ab9c6838a88550ad5d906e86829778b5a9fce09a55a67eadcbb5806058c98
SHA512a443da09f063e6ba8711df6ac9c35aa26298356e3dcf819e7784b8641c609fa8fd5d30ec03964493790058b138534f342b65e0688b93e8fcd6d6aa772acd6f6d
-
\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dllMD5
0884821e75b789d14faa4757a7f31880
SHA1b837e32188a5673683d02bc62e21a23647308d7f
SHA2561ebb321cbfeceb8eb13045118f09d43b94bc0172cdd185fbb3dffe58d7da10ab
SHA51242fe74d5d28c20695d2230d66e0c368059e0726f494a2ecec3e2c8aef4e4a1c570f072564c59362c347e653c46b4f15af4db11fbc9ad0d2babbf8883df032ebb
-
\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dllMD5
1c03d1935b5892738a188ba40cd5a223
SHA1b793c3918203f57468a7baa83e8d9e6e7b775545
SHA256d656c21853e185feb04c0decc52df277ed9d214e9ffa31b86ed34c682e1b5730
SHA512f9fa9def40ec3053f3a75ab2bc8e7c68c8b806be5bb80cda726ac8c08e3152c32db84a43a9e5775851bde0067d9ce9c8657a19850887171b0b206685318dbf40
-
\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dllMD5
dcb65de3ae26aa5847c13b45cd9411a3
SHA1b74417bcbe423499f36a2542f6b5c0395f347c5a
SHA2567cdedae25bcdce1f8458e7062d9dd768d5780765fcdc8aa7747f28711de65f85
SHA51267dd2ba2bef1586e97a9fe3045c7fc96701ee8c90d52beeca2c5c06a6837a28f1da83448472fb186925aff9084bdb59dab926ce81a16b2c56c732da225f4f6e3
-
\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dllMD5
dcb65de3ae26aa5847c13b45cd9411a3
SHA1b74417bcbe423499f36a2542f6b5c0395f347c5a
SHA2567cdedae25bcdce1f8458e7062d9dd768d5780765fcdc8aa7747f28711de65f85
SHA51267dd2ba2bef1586e97a9fe3045c7fc96701ee8c90d52beeca2c5c06a6837a28f1da83448472fb186925aff9084bdb59dab926ce81a16b2c56c732da225f4f6e3
-
\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dllMD5
9d499d107cec3a860cfcc2dcf69460de
SHA14ee5fe5661df25f844f7b9fe7976704a592a3d71
SHA2569fb86a0ecd3273971a8f276cbfac500bd5a1cdcab50c2f2601fd52faf19a122d
SHA5120e3d2673ee7eb408728a680cbc775f1d997276e04e3e8aa762aa7777b20329ec2b84c2d6421e0e285f41ebb9f65028cbca6b048c504fb97c3ddf6e86842fa9a4
-
\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dllMD5
4896c2fdbad50c502b0418f8547d8a49
SHA1c7b95ce8e8fa1e55b2e7410613f9eb1a95a291d9
SHA256a35781e2da58a5faba9504b1faa1c9074ff5cf7f1488220983942faf2ccec7d6
SHA5124439397f4f357f88713374c426a89632cdb61029161785fb2c8b87a9527b1f86041781c19321f055ca9210fbe41767e6787adad1fbb8372439d59b405828680e
-
\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dllMD5
0af84993d66a9d68d6d1c65707c2ef4a
SHA1848f692dd049d957d01a3386f83b7da836bf99e7
SHA2565951e8c2e0d1a7ba0b3ddb568e67809eac72d4285be1d0a982882e58f54814e4
SHA512247f3cf55926a6a10a6da1b04de41e8bb4ffd54bd908ee7057b204819f82197ef6d8c0cff55e78d662d9fbaa76f1167befe211dfc976312c78db013a500ab548
-
\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dllMD5
c4fe3f03efd3188252caa101f954ffeb
SHA198b613aee45c71aed9d2be0d61d7ace323929e9c
SHA25695bb425be3d515a6a58f7399d44dd9e032baea11667dfdba29517c460171880a
SHA51280018e0bddf079367d3568433a5f89f0144aa0a75286b0105fe32aeeb5d80876c9b2e1ecaafb70fb041271e27a234a2cb88a2d3d160a4aa3768ccfcfc574704a
-
\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dllMD5
c4fe3f03efd3188252caa101f954ffeb
SHA198b613aee45c71aed9d2be0d61d7ace323929e9c
SHA25695bb425be3d515a6a58f7399d44dd9e032baea11667dfdba29517c460171880a
SHA51280018e0bddf079367d3568433a5f89f0144aa0a75286b0105fe32aeeb5d80876c9b2e1ecaafb70fb041271e27a234a2cb88a2d3d160a4aa3768ccfcfc574704a
-
\Program Files\Common Files\microsoft shared\ClickToRun\msix.dllMD5
680de13431ec58094f287adcb1865d06
SHA1feb2eab60f1ab0f7add64282be9ede34219530b0
SHA25682d366c444bf6147227fae26ad3468094a230fbce84e15eb9f5cba3c7bb63ffb
SHA512884de914ddfd66f8e22918b243da512629b9fa6552bbbd0cc94ca920c4fd40859451aafeda29152cedb11a99fef845f9e106019d517bc57df6460f4fc51c6cb1
-
\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dllMD5
cd0c37f1875b704f8eb08e397381ac16
SHA1249d33c43e105a1c36ec6a24e5ef8dbc5f56b31b
SHA256d86ac158123a245b927592c80cc020fea29c8c4addc144466c4625a00ca9c77a
SHA512d60c56716399b417e1d9d7d739af13674c8572974f220a44e5e4e9ab0b0a23b8937bd0929eee9f03f20b7f74db008f70f9559a7eb66948b3afab5b96bdd1a6d5
-
\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dllMD5
cd0c37f1875b704f8eb08e397381ac16
SHA1249d33c43e105a1c36ec6a24e5ef8dbc5f56b31b
SHA256d86ac158123a245b927592c80cc020fea29c8c4addc144466c4625a00ca9c77a
SHA512d60c56716399b417e1d9d7d739af13674c8572974f220a44e5e4e9ab0b0a23b8937bd0929eee9f03f20b7f74db008f70f9559a7eb66948b3afab5b96bdd1a6d5
-
\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dllMD5
11d9ac94e8cb17bd23dea89f8e757f18
SHA1d4fb80a512486821ad320c4fd67abcae63005158
SHA256e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
SHA512aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
-
\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dllMD5
11d9ac94e8cb17bd23dea89f8e757f18
SHA1d4fb80a512486821ad320c4fd67abcae63005158
SHA256e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
SHA512aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
-
\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dllMD5
11d9ac94e8cb17bd23dea89f8e757f18
SHA1d4fb80a512486821ad320c4fd67abcae63005158
SHA256e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
SHA512aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
-
\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140_1.dllMD5
7667b0883de4667ec87c3b75bed84d84
SHA1e6f6df83e813ed8252614a46a5892c4856df1f58
SHA25604e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
SHA512968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74
-
\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140_1.dllMD5
7667b0883de4667ec87c3b75bed84d84
SHA1e6f6df83e813ed8252614a46a5892c4856df1f58
SHA25604e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
SHA512968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74
-
\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140_1.dllMD5
7667b0883de4667ec87c3b75bed84d84
SHA1e6f6df83e813ed8252614a46a5892c4856df1f58
SHA25604e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
SHA512968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74
-
memory/64-439-0x0000000000000000-mapping.dmp
-
memory/208-430-0x0000000000000000-mapping.dmp
-
memory/352-664-0x0000000003620000-0x0000000003621000-memory.dmpFilesize
4KB
-
memory/396-420-0x0000000000000000-mapping.dmp
-
memory/404-402-0x0000000000000000-mapping.dmp
-
memory/648-438-0x0000000000000000-mapping.dmp
-
memory/656-443-0x0000000000000000-mapping.dmp
-
memory/696-670-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/712-193-0x0000000000CE3000-0x0000000000CE4000-memory.dmpFilesize
4KB
-
memory/712-143-0x00000000082B0000-0x00000000082B1000-memory.dmpFilesize
4KB
-
memory/712-136-0x0000000000CE2000-0x0000000000CE3000-memory.dmpFilesize
4KB
-
memory/712-135-0x0000000000CE0000-0x0000000000CE1000-memory.dmpFilesize
4KB
-
memory/712-134-0x0000000007170000-0x0000000007171000-memory.dmpFilesize
4KB
-
memory/712-133-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/712-132-0x0000000000CD0000-0x0000000000CD1000-memory.dmpFilesize
4KB
-
memory/712-131-0x0000000000CD0000-0x0000000000CD1000-memory.dmpFilesize
4KB
-
memory/712-130-0x0000000000000000-mapping.dmp
-
memory/712-139-0x0000000007900000-0x0000000007901000-memory.dmpFilesize
4KB
-
memory/712-141-0x00000000079A0000-0x00000000079A1000-memory.dmpFilesize
4KB
-
memory/712-411-0x0000000000000000-mapping.dmp
-
memory/712-142-0x0000000008540000-0x0000000008541000-memory.dmpFilesize
4KB
-
memory/712-138-0x0000000007890000-0x0000000007891000-memory.dmpFilesize
4KB
-
memory/712-144-0x0000000000CD0000-0x0000000000CD1000-memory.dmpFilesize
4KB
-
memory/712-151-0x0000000009090000-0x00000000090C3000-memory.dmpFilesize
204KB
-
memory/712-158-0x0000000009070000-0x0000000009071000-memory.dmpFilesize
4KB
-
memory/712-163-0x00000000091D0000-0x00000000091D1000-memory.dmpFilesize
4KB
-
memory/712-192-0x000000007E830000-0x000000007E831000-memory.dmpFilesize
4KB
-
memory/812-436-0x0000000000000000-mapping.dmp
-
memory/916-231-0x0000000000000000-mapping.dmp
-
memory/916-244-0x0000000004420000-0x0000000004421000-memory.dmpFilesize
4KB
-
memory/916-246-0x0000000004422000-0x0000000004423000-memory.dmpFilesize
4KB
-
memory/916-278-0x000000007EED0000-0x000000007EED1000-memory.dmpFilesize
4KB
-
memory/916-333-0x0000000004423000-0x0000000004424000-memory.dmpFilesize
4KB
-
memory/1040-394-0x0000000000000000-mapping.dmp
-
memory/1092-445-0x0000000000000000-mapping.dmp
-
memory/1120-412-0x0000000000000000-mapping.dmp
-
memory/1156-399-0x0000000000000000-mapping.dmp
-
memory/1244-393-0x0000000000000000-mapping.dmp
-
memory/1280-408-0x0000000000000000-mapping.dmp
-
memory/1292-441-0x0000000000000000-mapping.dmp
-
memory/1348-423-0x0000000000000000-mapping.dmp
-
memory/1372-444-0x0000000000000000-mapping.dmp
-
memory/1480-405-0x0000000000000000-mapping.dmp
-
memory/1492-435-0x0000000000000000-mapping.dmp
-
memory/1548-425-0x0000000000000000-mapping.dmp
-
memory/1592-453-0x0000000000000000-mapping.dmp
-
memory/1772-127-0x0000000000000000-mapping.dmp
-
memory/1840-418-0x0000000000000000-mapping.dmp
-
memory/1892-398-0x0000000000000000-mapping.dmp
-
memory/1892-455-0x0000000000000000-mapping.dmp
-
memory/1944-633-0x0000000007084000-0x0000000007086000-memory.dmpFilesize
8KB
-
memory/1944-632-0x0000000007083000-0x0000000007084000-memory.dmpFilesize
4KB
-
memory/1944-631-0x0000000007081000-0x0000000007082000-memory.dmpFilesize
4KB
-
memory/1944-630-0x0000000007080000-0x0000000007081000-memory.dmpFilesize
4KB
-
memory/1944-634-0x0000000007086000-0x0000000007087000-memory.dmpFilesize
4KB
-
memory/1968-449-0x0000000000000000-mapping.dmp
-
memory/2020-415-0x0000000000000000-mapping.dmp
-
memory/2028-454-0x0000000000000000-mapping.dmp
-
memory/2028-417-0x0000000000000000-mapping.dmp
-
memory/2088-440-0x0000000000000000-mapping.dmp
-
memory/2100-334-0x0000000000000000-mapping.dmp
-
memory/2172-396-0x0000000000000000-mapping.dmp
-
memory/2176-442-0x0000000000000000-mapping.dmp
-
memory/2176-429-0x0000000000000000-mapping.dmp
-
memory/2180-426-0x0000000000000000-mapping.dmp
-
memory/2204-456-0x0000000000000000-mapping.dmp
-
memory/2220-448-0x0000000000000000-mapping.dmp
-
memory/2224-615-0x0000000002A20000-0x0000000002A22000-memory.dmpFilesize
8KB
-
memory/2240-432-0x0000000000000000-mapping.dmp
-
memory/2252-612-0x00000000028B0000-0x00000000028B2000-memory.dmpFilesize
8KB
-
memory/2312-428-0x0000000000000000-mapping.dmp
-
memory/2316-431-0x0000000000000000-mapping.dmp
-
memory/2452-422-0x0000000000000000-mapping.dmp
-
memory/2620-124-0x00000000098B0000-0x000000000995C000-memory.dmpFilesize
688KB
-
memory/2620-121-0x00000000051D0000-0x00000000051D1000-memory.dmpFilesize
4KB
-
memory/2620-115-0x0000000000860000-0x0000000000861000-memory.dmpFilesize
4KB
-
memory/2620-122-0x0000000005450000-0x0000000005451000-memory.dmpFilesize
4KB
-
memory/2620-117-0x0000000005120000-0x0000000005121000-memory.dmpFilesize
4KB
-
memory/2620-125-0x0000000009AE0000-0x0000000009AE1000-memory.dmpFilesize
4KB
-
memory/2620-118-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/2620-123-0x0000000005250000-0x000000000574E000-memory.dmpFilesize
5.0MB
-
memory/2620-119-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/2620-120-0x0000000005250000-0x000000000574E000-memory.dmpFilesize
5.0MB
-
memory/2620-126-0x000000000A3E0000-0x000000000A3E1000-memory.dmpFilesize
4KB
-
memory/2672-392-0x0000000000000000-mapping.dmp
-
memory/2676-616-0x0000000002660000-0x0000000002662000-memory.dmpFilesize
8KB
-
memory/2688-416-0x0000000000000000-mapping.dmp
-
memory/2984-452-0x0000000000000000-mapping.dmp
-
memory/2988-451-0x0000000000000000-mapping.dmp
-
memory/3012-424-0x0000000000000000-mapping.dmp
-
memory/3040-450-0x0000000000000000-mapping.dmp
-
memory/3076-409-0x0000000000000000-mapping.dmp
-
memory/3112-434-0x0000000000000000-mapping.dmp
-
memory/3136-427-0x0000000000000000-mapping.dmp
-
memory/3160-421-0x0000000000000000-mapping.dmp
-
memory/3296-410-0x0000000000000000-mapping.dmp
-
memory/3320-413-0x0000000000000000-mapping.dmp
-
memory/3360-419-0x0000000000000000-mapping.dmp
-
memory/3480-447-0x0000000000000000-mapping.dmp
-
memory/3492-608-0x0000000000C90000-0x0000000000C92000-memory.dmpFilesize
8KB
-
memory/3492-609-0x00007FF5FEFD0000-0x00007FF5FEFD1000-memory.dmpFilesize
4KB
-
memory/3560-414-0x0000000000000000-mapping.dmp
-
memory/3700-397-0x0000000000000000-mapping.dmp
-
memory/3712-395-0x0000000000000000-mapping.dmp
-
memory/3716-458-0x0000000000900000-0x0000000000902000-memory.dmpFilesize
8KB
-
memory/3740-437-0x0000000000000000-mapping.dmp
-
memory/3748-374-0x0000000000000000-mapping.dmp
-
memory/3864-446-0x0000000000000000-mapping.dmp
-
memory/3864-433-0x0000000000000000-mapping.dmp
-
memory/3868-650-0x0000000007216000-0x0000000007217000-memory.dmpFilesize
4KB
-
memory/3868-649-0x0000000007214000-0x0000000007216000-memory.dmpFilesize
8KB
-
memory/3868-648-0x0000000007213000-0x0000000007214000-memory.dmpFilesize
4KB
-
memory/3868-646-0x0000000007210000-0x0000000007211000-memory.dmpFilesize
4KB
-
memory/3868-647-0x0000000007211000-0x0000000007212000-memory.dmpFilesize
4KB
-
memory/3888-687-0x0000000005910000-0x0000000005911000-memory.dmpFilesize
4KB
-
memory/3936-457-0x0000000002380000-0x0000000002382000-memory.dmpFilesize
8KB