Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250313-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250313-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    13/03/2025, 20:13

General

  • Target

    O365ProPlusRetail.exe

  • Size

    7.2MB

  • MD5

    469c0d78d1261e02077af579ecde8526

  • SHA1

    9eec18714e6a0dd90056985c48bbe8afc00238f6

  • SHA256

    f0fa41fd2b9692b3213ec455336e1e78f8be22c33ee827deac8ce5ae7c3676db

  • SHA512

    b948f9c95a60d49885fb4fa1fe6a3540f060e4089d7ddd5da4f9c86a5cd6dd00157648df183838700a6c252bc17b793bc5df07c77edfc831abee6d6aa46d9ccb

  • SSDEEP

    196608:rc8mkLKQjghkRtLjR6RXshF8ibOWuPPGLNqLYpGi0caI6HMaJTtGbUD:9XrjghkRV9acP83Pq0x

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 32 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks system information in the registry 2 TTPs 8 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 9 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\O365ProPlusRetail.exe
    "C:\Users\Admin\AppData\Local\Temp\O365ProPlusRetail.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:868
    • C:\Users\Admin\AppData\Local\Temp\O365ProPlusRetail.exe
      O365ProPlusRetail.exe RELAUNCHED
      2⤵
      • Checks computer location settings
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:660
      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
        OfficeClickToRun.exe platform=x64 culture=en-us productstoadd=O365ProPlusRetail.16_en-us_x-none cdnbaseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version=16.0.18526.20168 mediatype=CDN sourcetype=CDN O365ProPlusRetail.excludedapps=teams,groove updatesenabled=False bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown uninstallcentennial=True scenario=CLIENTUPDATE
        3⤵
        • Drops file in Program Files directory
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:4716
      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
        OfficeClickToRun.exe platform=x64 culture=en-us productstoadd=O365ProPlusRetail.16_en-us_x-none cdnbaseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version.16=16.0.18526.20168 mediatype.16=CDN sourcetype.16=CDN O365ProPlusRetail.excludedapps.16=teams,groove updatesenabled.16=False bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown uninstallcentennial=True
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3120
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2424
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /progressandlaunch AppTargets="root\office16\excel.exe|root\office16\lync.exe|root\office16\msaccess.exe|root\office16\mspub.exe|root\office16\onenote.exe|root\office16\outlook.exe|root\office16\powerpnt.exe|root\office16\winword.exe" ManualUpgrade=False ScenarioToTrack="Scenario:{477E0208-58BD-4F33-978A-09BCC9AA9EB1}@INSTALL"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2312

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dll

    Filesize

    1.5MB

    MD5

    1cb61e9d862c26ce9a305472c2b6d902

    SHA1

    81118f2f2e7219999f49c0112e1615567a2572a5

    SHA256

    db8e9afd8a8c1e74215f09f4f9fa957be877258a3f359f4e3c40ff7fa76510f9

    SHA512

    d1b60dac0eb5b43cdc05da9b4fa638e9188a7da5a61ed4b33361941546eecb6dbff5ccaef7fa45658bc95c89a6037fd48686b97b9957b70cd0af06cd54147d1d

  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvApi.dll

    Filesize

    368KB

    MD5

    554aec0193ac15dbc4868c665832c328

    SHA1

    22bdcf924fcfe6d017f7f4f7fd8ae58acc7ef1b0

    SHA256

    5885091dc9441bf4ea2bf2d91c795dadd3cb3005a7bd87a1e6ed2717b18fe5b6

    SHA512

    a3bb64d865520f42eb86e2d02e1a9ffa1d8ba357398e26709bad74e0d0cc831b5c86548c442f99cff8d5821881acd5b573711e32feac1bf83eb57916285ae9aa

  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll

    Filesize

    946KB

    MD5

    4cce3606e4cdb92a5b6b0fa17e3e3ccb

    SHA1

    1fb81cc271b43f06248e48dbd2f9ad0e6dfec35f

    SHA256

    21968ae5a74d3dc18cb124218c43d795ac29fe43314a9fbf5c94fb1dbf68dc6d

    SHA512

    32435f880733cb62fa60d6cf488c282adb5eddf0a0569d602bace250212405081c9defd205bdf55483ac0188a970fb880fe49563521985b240d2f8e7e12e5298

  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll

    Filesize

    760KB

    MD5

    aedfd7487e954f59da47bedc8f507e56

    SHA1

    55ff65d0a32d4dc32fdcd59386d8c7dd97bd6698

    SHA256

    ac1ab3fe28dc70e2ec4f4b9426851dafbb9a6b196eebc60292c95de4cdb8cc46

    SHA512

    0c56fdc5467b2ac1b8f960a824bf44c15ccaa0951273e057db9491de001457c2de3ba54df6a68ff918e7221301377c629467d51199319686f40dee5cb5b14799

  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\IntegratedOffice.exe

    Filesize

    5.1MB

    MD5

    6b8a98fa53f57424bb3868ec63d7e927

    SHA1

    6111e946bb98353e24ce937c82ef09c4210644f8

    SHA256

    321f15d72ea8f092597f7396d16d338ad11993bd0ee8955751d7489a7ef71c98

    SHA512

    fbf36ddf27f66d12e1af4c78cc80090caf6724cd853c094f2a1928e1b7ede79ed57ad83c7f768ea3d78db55d9e7038ec9e61c7f063e42be79387ebfd730333d9

  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\MSVCP140.dll

    Filesize

    561KB

    MD5

    959fbd9eca0be7d289435b7dffeac0a1

    SHA1

    acc14175d2a59624528087a8c174d205082ec6d7

    SHA256

    f7ba518cb961853ec35c7bb159054983fc006fdfbb6b1c360720eb52fefb3d38

    SHA512

    628df65b1a69d8793248cf217566e179e7f9a8bf409470793031d440783a3827ad8424e755cbd31f91e3f0e4e171a9807735f2308e0e219e334033ca3307a90f

  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\appvisvsubsystems32.dll

    Filesize

    1014KB

    MD5

    9bebfaab38c829ba01de56ee17dd2158

    SHA1

    04f4d5b79724284a7d1b6949e27ccde05c0da7f1

    SHA256

    24360057ec647b2f6e09be701e81cf45675cbab9576805399852f02a07ef7008

    SHA512

    eee5421927f1caad0d3f0111e284f263994c74a389f95954135ded7689a0d0c306dec4eb15fee3398aa6a63713e11f68dcb11a93369b76f51df69e9f7fbbccd0

  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\repoman.dll

    Filesize

    1.7MB

    MD5

    a2cfce6d2a69cc21567990c119f83675

    SHA1

    abf022b25a4e58d96572c1dbb91eddd81e66f580

    SHA256

    0118428cc0abb5aeb0aabd9e2f1c440fdde4767340531e381d8217619225b756

    SHA512

    199e94a80a79444bbfddf280d5f68e7a8604bd3aafb1d80721a7868c278df5f5a468c000d102785eb65dab5f32d6dc196508f6b818fe4a211c9cc0ee787a4321

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll

    Filesize

    529KB

    MD5

    9b185978b78584a2b7ab675191c66788

    SHA1

    f7db7510f5ab627b09395d8b5c07a7f6ef6998f1

    SHA256

    987623398c621b5559d6340e6fa51d9c3eae3411970a25951054f351f51f0a22

    SHA512

    06c3d2f6a2dacb86f8d0b741d5e59cff3d279e6c022f530142017e7ef8f65a9b4063902715b93e0edd696b3508e9203365f02633f373f528792efffd239ff578

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll

    Filesize

    531KB

    MD5

    c0c460b1cf5ace53bd7a32b0057a8d8d

    SHA1

    d483e9c3082e31038024dcf6deebe379e251fb49

    SHA256

    d132f29fbee8270afb5637d4d067d67e9878fce543f9fecbbea1072f6a9d536d

    SHA512

    d6d543d2730891da73909aa147e00ff47ebf5410c06d23439023d5c209bb8dafd92d100fd603bbd72f376409bc3f831934c8744c57e5942edca5a748e02335be

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll

    Filesize

    248KB

    MD5

    d7eb2ad396e9f30b3676943da0b4f1aa

    SHA1

    d9b56515af67e96e3cc0906289d374858660c8a7

    SHA256

    2dea77ad5e83dfe32ea88557b12b747e800d0a0ec2b859ecb595e32c064cbd0c

    SHA512

    c4cbf6b37824fb3d2e73ccc1fa4abd7f5cec698038a20c849e08f3c567c913f2f17d094e5ac1d07b361352d3c98b97c50b6858c39b5f4ce8cec489a7eff3ff71

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll

    Filesize

    182KB

    MD5

    4b2d11880084862ed30cb8f03fad2947

    SHA1

    6cddd224f5fff98dd22a99e88d9e3d9b70ac2a33

    SHA256

    7b0d1857129ab6c89d3fd4362e223f06dd942109a19c7a21ec4dd6b5a02e755b

    SHA512

    9fbda00740a0099d265f84643f81771dc27190d00d65a4b9097e7f6ee9432677588c5b313c27b67c4e9db4fd8b613590bad4e24f6cc6e6e9dd7b6ad18d6212d4

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll

    Filesize

    472KB

    MD5

    955afc2363f3a7d092884b02261099a8

    SHA1

    55c00216f26d2b6e03dc023e36ca1051a4d65e5d

    SHA256

    82560057bbe4737379fc5087853b81e46d0b44b89465bcc7d9116a8126fec74a

    SHA512

    5c559bc0bc9c295dd356684d70ce592a6accbe075740d3127a8bd960d67eb97d54795ed0a7730504c79093404cbb762867ab2193625223da82aedad586ac54da

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll

    Filesize

    926KB

    MD5

    df80a024434f7aaaf21c8aeaf5f175eb

    SHA1

    4733b343b79b2647eb5034eab4fab9cdd1a1a5c4

    SHA256

    0ad5b175d58e61afa10e4ddab2aa22e8654193555f1439beeab32228820ded0b

    SHA512

    a038109c84499bd3cbced60a93d3f5ac6456c340af442dc181a87f41e77e5a8b4733ab229ba746fe7dd3d75365ce6923c377fe749a19d21b00d82190b24309df

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll

    Filesize

    1010KB

    MD5

    e8ef418a1f13a84fdb300440e36811e1

    SHA1

    f54215e4c37e0624f8b4ff542bf9c8dbc5707162

    SHA256

    28b092968cace5092e71d071d169a28d999632e40dde39eccd6a6cb08cb9c38d

    SHA512

    ae1c6767e7be43f2bd34e3f967195e58cfdf372e561a4d09b460e23e3417b206766b20f37b2526c738bcad7dc56f7960103e198659cc5f60e8fa0aeee82d5938

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll

    Filesize

    50KB

    MD5

    c79c132250f38f7109c8422d087e2650

    SHA1

    76ae4102da87e05e4f1ed9fc56390985c543eb6e

    SHA256

    8c9d5925b93f88997e4e4c217aaf7194a558f695ddb3e439f99d3a460ffebffd

    SHA512

    a15dd4fdccbfaeff7628678a06a83dec8a092251c6bf111d2dc923933b0f24791f8113c3315106b8e76ca8475695dee5777dfc50d001f5961237547927601bf4

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll

    Filesize

    2.9MB

    MD5

    716a0560f529981e5925a3c1782dc502

    SHA1

    84cac9869014485ba787b21e1af536e7428541f7

    SHA256

    a7b36accf2ac7f077397bb971bfcf2a8ac119c7ffa493263377d98266939fd6d

    SHA512

    2c0c1f4320b23a50ec9b9843f3b6f0b3419f449e19b0ed71578ec0676c44a9beed17aa699545f0043d4f36940f3c727cf996a5a20bb907a482159c43bce8a805

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

    Filesize

    27.6MB

    MD5

    91f66e674c6b9db51cd0541e4c1385fb

    SHA1

    d2789dccdfbebdeb105fafa18330923f4c0dc5b5

    SHA256

    b242bb87b303d329beb472c6305600d62873f88ad96fc8336af4e3efcddbf9ea

    SHA512

    cc6572416883ac97b0ac95e6be731feafec4ee5cc4e638423c8dbfb42896dc62173f94e0456226c2feef28cf3fac7398899e26d4e1b356c634f7082847f39a1a

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe

    Filesize

    13.1MB

    MD5

    33f980b29bc3d0b5b536646573d8a63f

    SHA1

    d4aa370b88077847e967f121d3a68b2e2502ef59

    SHA256

    2017cb623fcef42290b76f40649c8044ce2036dc6a2218fe974f075cb92b11ae

    SHA512

    e63842767899b0bce521fc22ecd42fb98e46b46e5976ae44082f385903488d4f97b76c8f442b008b27a62c727491a357d3c6dda44889a4607b780dc6a102466c

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\Updates\16.0.18526.20168\i640.hash

    Filesize

    106B

    MD5

    822d6ac2eb55e92edf3e0f7956972f8c

    SHA1

    5424e55c7896e3efd95bafe75ec4587d4a4e5006

    SHA256

    a0537261c3a4377aa79d2a43e9de2fd488056dfc7270e7ffab6125425bbcf484

    SHA512

    8791e0b9dbcfa952b6505134a267e4d03242e8d333d40c7310f792ad32ea83a2b6fdbcf851af856a9710b993a5a56a19c6b1d2ea6d9d185f31d4633a7e6337e7

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat

    Filesize

    30KB

    MD5

    ae7887aee02292340d71b6bbff65a772

    SHA1

    11755126ebea83dd6785b32b6912b1cf75509982

    SHA256

    bb26741cb6aeac2f31fbe545c2cbf18275d5cbfcd3c91e0ff9c96cb5278514ae

    SHA512

    9f53ff69eeda0576c72a90de71f4106d594df97b1974471a1be59d36c76d016d6b3ab3e394ee77fb35ac97b0ead7bd5d8f90d490437444c001ffe2aa4a17405b

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll

    Filesize

    820KB

    MD5

    6b8fb54bf68d5702cf53e6e2a30f56d8

    SHA1

    3168a9cb5a96346e434f8bc58dd9bcc90aa1cf49

    SHA256

    5a6f72e159c7a0ace2c9d9fdf5c803b74d5141c30d297d8de26b715b3850dfdb

    SHA512

    26ba43939156703fca4ee0fa958fa27a1055dc4411d41b5207370604bc980e6fbb1efbdbd864f7d8286af17732ed85747deb850b9ace6d2ef19b4ca6b9b8b1f9

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll

    Filesize

    117KB

    MD5

    7fa7a9e378e4f60ff7b5bd2e07a78eba

    SHA1

    de7efc05b646df01ce9c8dca4055d4a5388e465e

    SHA256

    0a2073428bee5f1881b068a7a9e3321cbd1f98142233eb8e1d4fe2e2c9813a6f

    SHA512

    946a28ded16d43ec9439333553abb3ea9327cb20eb66472a14e0f960568a69f194a8eb1bb14dfb3f225bcd21dee8ebb09949167e0a9273ac971853969d5ae5e1

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140_1.dll

    Filesize

    48KB

    MD5

    4f4a6d0eecb0989b162a8c4439eb8fa9

    SHA1

    25150fffda206e6e08d83cfdcbd1c913bf288fe8

    SHA256

    d591b0db20a152057f48f44a7256bc6f92e3e870b76b9790c3e8039235ff1565

    SHA512

    ef629f31d836197a78eae5bfd88c7c9c706773ecf9afd4773f451329c78e95b90f863882ff4d0ec42b81eb6985bf1adf5d8a70e1cacaa893eeafe16927047203

  • C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7AD950C8-92E9-430A-B6F4-17053A98F876\en-us.16\MasterDescriptor.en-us.xml

    Filesize

    40KB

    MD5

    17694f7c92fc6c82db3d645d2703a602

    SHA1

    7fb741709a22cf97196e73c9381a3f840cf3c455

    SHA256

    63eba73a791fa80e35ed9b3a8b98612b49c672e6a1088b0c5bb69381addc8165

    SHA512

    8848a9a288133e7a04dc36f22cd60449e88a6e4797f6455f489c34d0fe132a580957570418588667d24419bc36c924bf873551635d072711228cf1fcbb5aac2a

  • C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7AD950C8-92E9-430A-B6F4-17053A98F876\en-us.16\stream.x64.en-us.dat.cat

    Filesize

    76KB

    MD5

    2450bd17a0f0b465ce5e42bbb4bdb055

    SHA1

    5835dd11dff2a989277ec71e781922ec3e88817e

    SHA256

    3be4132c919497015103a6ec8a2b023789cfad560425a88dd7bb636831b427b5

    SHA512

    a2147518afb737b99a69e63f188627ae0bf767d245c255f3aec81e5d145dcf6a5265edd6d13328a612c561446ecd015830e657cd3cd18e83ee25aab592ebbaa2

  • C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7AD950C8-92E9-430A-B6F4-17053A98F876\sd640.delta02.cab_extractOfficeC2RDAD03C17-E637-4438-BE38-72AB1B2B8C7C\MasterDescriptor.x-none.xml

    Filesize

    35KB

    MD5

    b57000c7f9c7dac44c69751349e4b958

    SHA1

    6215e08d193c8d77d697a96e89ad0d64b12f77f3

    SHA256

    a726e1e49060c23530081f97654111e138c708714a6a22a30123ffbd465b515e

    SHA512

    3bdd21aa11cbb76ec8796001f95754920ab86a0cd007696d2ee2ecfed02697171b5d4d2c36029fa21272d2a4ad8dc8749873047e8875a1e9efcd063877870ad5

  • C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7AD950C8-92E9-430A-B6F4-17053A98F876\sd640.delta03.cab_extractOfficeC2R4B608461-E5C2-4C82-AEFB-A76A0E9BE213\stream.x64.x-none.delta03.hash

    Filesize

    128B

    MD5

    e19966d09863d08e0229f2aa91a68996

    SHA1

    3f740cccee1c645a372c50abafe46fcea17e81d0

    SHA256

    85dfaacef394ed3f63480dc4c80c774278f8503e09d34bcbc014dd3ffe785b95

    SHA512

    dd16d82dc260cef2aaf82dcea927b68ce4b8aad67e3f0ed2b829d832dbb33ba1bedbb31b4b4cc0d1674c82e7f51d1679d5fa54546ec8da338cc8707ffeacd382

  • C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7AD950C8-92E9-430A-B6F4-17053A98F876\sd640.delta03.cab_extractOfficeC2R4B608461-E5C2-4C82-AEFB-A76A0E9BE213\stream.x64.x-none.delta03.man.dat

    Filesize

    23KB

    MD5

    81569d174161d0535aa832611dde4c05

    SHA1

    ffcb9c10395f3e729c00163bf95e11de33411efd

    SHA256

    3147a0eff98acfe57c639591ce51a4d49e7ec1253af514a59205e5d5f0c6e7fc

    SHA512

    57a6fbd59937089a4b5534cbcf2a8c5dcb47b59a2d833e85542d06231b9719c2b75014e7b1e4af3da159603cfdde82820ee937271a61797fa66269dea8dd6f6f

  • C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7AD950C8-92E9-430A-B6F4-17053A98F876\sd641033.delta03.cab_extractOfficeC2RC41F3570-97B1-4202-9F10-81D81E69C626\stream.x64.en-us.delta03.hash

    Filesize

    128B

    MD5

    ad0e7c503c4df228a2a895d2ec1fb842

    SHA1

    e8251c41686c6820633b3d60b570797a1f6fe9a8

    SHA256

    0565f569bcb4a27a076c1f21725f85849d677c0079d16e8b08851b33481d822f

    SHA512

    2f4f7a9251b83a388764d953ae1a098658fb1364838b659b1022770653fff2630d6e11dc41faa1a6f89a6d28a336d288b85f41a1a37289450b15e4159c42e31d

  • C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7AD950C8-92E9-430A-B6F4-17053A98F876\sd641033.delta03.cab_extractOfficeC2RC41F3570-97B1-4202-9F10-81D81E69C626\stream.x64.en-us.delta03.man.dat

    Filesize

    15KB

    MD5

    846512c048f0fd1f375552b0975dc694

    SHA1

    821c2c5d79779d358e3edd69622a02dc294d4a78

    SHA256

    66a4f0c2442153455a87a494113d3cd5ffd271a901dd82989bb9da1adca8d57c

    SHA512

    8987b7ae500fa6275b51e0f4519d97a624e22ffe8eb3a615dc5e818341fcb2a07fc005989e28f69f5f877ecc9b613d70b64ba23b7561bad4c8c2d8d55d5c31bf

  • C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7AD950C8-92E9-430A-B6F4-17053A98F876\x-none.16\MasterDescriptor.x-none.xml

    Filesize

    40KB

    MD5

    68b4e6d3c2b8518994904019f463e53a

    SHA1

    23913bb96f4a29a3678b903ad852ced3d157533e

    SHA256

    c8d04d1ef68d4563dd99c7f329d12dc34dbc73fe5d44765fdfdb918b0bbe70a5

    SHA512

    d3c4242a1fd1b58c2b10dfc3febe1525ea0ab91ebe1e4659608b80748755665c747fd16c9779593368b2d0e2e06849236f93b4db9ca483b630d86f85307c76a4

  • C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7AD950C8-92E9-430A-B6F4-17053A98F876\x-none.16\stream.x64.x-none.dat.cat

    Filesize

    734KB

    MD5

    de3d0af957ac5910d919fc8dd89d75e9

    SHA1

    688e84e43fde3f74f6bc0f158f0857e96b02d066

    SHA256

    f0e4baa5200a007d8e7aa1914e16da24952449b68180a6d03cb712afccf3fc74

    SHA512

    f21b9a5996c757582fc0f0f577b732f0104ff44b4ca39c7a4c5293ffb2a6b269acdc7e34dacef14dec7da923907b32cb4c2debceb35d1e6262e132241f887a1c

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\67E3FF5C-B5C6-438B-ADD4-1FBD6B71CD9D

    Filesize

    178KB

    MD5

    b874c07cfc4680e9d3092a7df21e7299

    SHA1

    6192ac8307ab0d7677a40f4bf7c91134334b9c0c

    SHA256

    a4dd7a8ad3e7781f42e353ad2cdbc397e94f0b3d91a061d31636eb7d3f28c489

    SHA512

    e828a71543ac1f25a10d7c37c6eca1a69d5a4e65224730d033ca0e69fbef29991c126b4d363b177d23e4c02452d257d0aadf123f3c4be8ec7763038c619ae72b

  • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db

    Filesize

    24KB

    MD5

    8665de22b67e46648a5a147c1ed296ca

    SHA1

    b289a96fee9fa77dd8e045ae8fd161debd376f48

    SHA256

    b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f

    SHA512

    bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da

  • C:\Users\Admin\AppData\Local\Temp\OFFICE~1\i640.cab

    Filesize

    30.0MB

    MD5

    1423ba5b1e271242a0f80e4f2289ea72

    SHA1

    43474dc3a2246f3cb0c728a8048b0c77ebf9cd62

    SHA256

    320cfc22b036a5ee5a3d23ff7ee9ea60dbbac25fcc222e023ecf8cdcd4315d2f

    SHA512

    07fa337e659cc7500d82e78aebab9b131f1012289f7c68890a8d01bcd461470dfde0190f04ce15e7da1ecd58551586f6abedc1a017571ba9c448456b886cf628

  • C:\Users\Admin\AppData\Local\Temp\OfficeC2R420356CC-152A-48FB-9495-4C4034C4E715\VersionDescriptor.xml

    Filesize

    25KB

    MD5

    6f6ec0a1b6b282751031b7cd1712350f

    SHA1

    386bfcf792ffc76694eec94c572e566d09373692

    SHA256

    dd02c986a04e50b7ccf7e07119a89d9d00b05a6dbe09d5f4cbcf7636815e678c

    SHA512

    a1eae300cf95bbfc85a89199fc62986a07051a16da381b08c75f9e1dcd21c4d7e04bfae53619a3e17c71658c10cd0f0257d2be417cdb171efe7a3e1e16ce8750

  • C:\Windows\Temp\OFFICE~1\d640.cab

    Filesize

    9KB

    MD5

    cb3662618eb76323be2dc183f3139bd8

    SHA1

    8001e47c1156b984c036b3e6995c312855fcbf90

    SHA256

    df451eaa100913c9c2d48ffd8d17dfca3c2c480b833efe09b4bb4c27033b19b3

    SHA512

    e5699816b735a0512615092b74d9aad7001eacd82e1c00d2f3da27e3be2ef3a7fa219766873f8e21cdf536d6ab461ae41c1211814d973dac158df3b7e95fef24

  • C:\Windows\Temp\OFFICE~1\d641033.cab

    Filesize

    9KB

    MD5

    b641bd2dcd22bf21779abdfc017d5e82

    SHA1

    637501ed2baff7bb4583432618e26b0210ca16cc

    SHA256

    7169873e48fcf0f24136a135882a797fde567dbe167c370b8408ee67934bf320

    SHA512

    ebc5acd787dc51cb47b25f71964a073cb6ab626a608c3e77fe681490e6abb4bf342b46bfab4ad2241ccd77b11f5b7f9ea85b80e7311cc38d7ac15b7fb2a909fd

  • C:\Windows\Temp\OFFICE~1\s640.cab

    Filesize

    3.0MB

    MD5

    5d43d7029ff9cc52a58b5beccc71888f

    SHA1

    eac728678d95200d1cad71436c14c38447cf44e4

    SHA256

    bc0d829d97b6d6a3199f222448aaa7a6dce8f9fa0c07fe6e4bec2b16ab3485a6

    SHA512

    1c3edc91dbbb3262d25119618ee4f40bfc35a741adecb39d3b3d87e03b3044b3ed49ba6b507fe28872a9b3769efad120ca22d881e492ad991a254f6fed620edc

  • C:\Windows\Temp\OFFICE~1\s641033.cab

    Filesize

    562KB

    MD5

    8c24b8f8ae3204d0e45f7d9015c4e5aa

    SHA1

    07bfb95eb66f5feaf175193ffa9a176c44dadead

    SHA256

    65b722d5a71e93c583fa2cb7d5ad1e5335dee5e65150785122ac562609991c1f

    SHA512

    68e16aaa30e3547fc7f094afd4b9768479b194d8ed0987557c54f1fd5966aaa0ba4d60b2b2f989316478170b58e5b7d6e341d881f0ebd04de086c71759a64675

  • C:\Windows\Temp\OFFICE~1\sd640.delta00.cab

    Filesize

    2.1MB

    MD5

    a4da1ba200614315d666b7777988c703

    SHA1

    120f59660b6549cf34c636a3d33199354e37a0aa

    SHA256

    96b5b8cd9d9a5d50ed0d419adeed47a24402c0cea8c97b0a41a035d0bf2abce0

    SHA512

    577a5d8ea25dfbc2f5642fa4cb77b2f56917cef06e61bc3e85d0f51525f0e64bca037ce3fa7e917b05d24bbd30cd610abcdb600d0cc1a5c32a392df9a29ab526

  • C:\Windows\Temp\OFFICE~1\sd640.delta01.cab

    Filesize

    34KB

    MD5

    cc1075465f01cebd65560a8a8a02df1c

    SHA1

    5a830d897e85d1e2a32f0f01e7df176dc472b33a

    SHA256

    c6152ab43404a19d7ed7857472b80fec5daa5c59f20860a39244d41ea555ce88

    SHA512

    be77a83a89c612c5c52e1dcda68ed14f9177cfde8477d9997e70b5ce3a475d59a2eec8077b05d654b004ae06a91b2cb3029a67cdfd88e1af47418f2b40235bd7

  • C:\Windows\Temp\OFFICE~1\sd640.delta02.cab

    Filesize

    34KB

    MD5

    4613821cf051abe2ce524f0ab4f4d5f2

    SHA1

    7998d975868b83f9ac129311d1c7f5081ccc9e02

    SHA256

    e8ed5f5d9faf03a805a360150fb10ee4590c2d12831055f3fa5ba6d33e5d5316

    SHA512

    22f42e0477a4be600e191e0a6d84d9812e83c23e421a91c3700ad5f6dde9f9b7b0f9d2b0ab8b045ad370d93698b4737b721e87a3205cc5ee125c10eb5232187f

  • C:\Windows\Temp\OFFICE~1\sd640.delta03.cab

    Filesize

    34KB

    MD5

    4efe610e9f5fc42fbdcca20d673fc5c3

    SHA1

    f6b320522385e944bdf7366cdb9a2ce97de06f52

    SHA256

    06b044ff93f4c8b3062752f5f11e46732cecf8fb2037440b660f4882699c055e

    SHA512

    18e875fa54af11b4ee14320aa19a5a4ab6fc882fd638a47b31343eed656129b91dddf2c6839eb46a72b4837778d729b3d942893e055502b29f7df1a407f76e04

  • C:\Windows\Temp\OFFICE~1\sd641033.delta00.cab

    Filesize

    253KB

    MD5

    9ea86c15592c56b3964af67e44c25049

    SHA1

    4db4630346f3125ae3d08daf43b741bc43a3ba8b

    SHA256

    105b3d9d7fcd9fa9255538288644ed34501ec077d8af90e73bef2547d21239e5

    SHA512

    db8c5b4c53a68595e356d635f3e7c1c9a76598fdce61166b4382448204155f2a9280ce0936d0d476c51ab25878f5cc16ce765f74d2728a78c40748dbe03abef9

  • C:\Windows\Temp\OFFICE~1\sd641033.delta01.cab

    Filesize

    30KB

    MD5

    ea33897fde104114ab6e68e0c7942daa

    SHA1

    da39952ae0ea63b729eaa751ce7efd655e708467

    SHA256

    fd7d9669b8ec2f2b6ea88d1e84f98d3263c95db0babe6a6f23031256dc4cd47f

    SHA512

    1f6e6ca7fd32a109da8f842d71446624ff1e0281ba8d84ecec53d0aa0789555aaf2b33bf6e38aaa895dde1c0dc698f70845b83a7e8248b9454e0544460e47370

  • C:\Windows\Temp\OFFICE~1\sd641033.delta02.cab

    Filesize

    30KB

    MD5

    a03d4bc01af09be4b0a4f6539726bf9a

    SHA1

    1ef15ba61f4ab617747185c988c424b05c0f2074

    SHA256

    cd95eeeae39b5a73003bfe87153673b043149695a08870293337bff47498aea0

    SHA512

    79a96c8162968815d8529a4adeda174eded9ec6266368ea638e256324c4c57d6a7864c993f8f3040648315c19855c6ab97be8c3b6d5b6e17d0b230bc532e2c62

  • C:\Windows\Temp\OFFICE~1\sd641033.delta03.cab

    Filesize

    30KB

    MD5

    2b8260d9feed37270d84fa3aa6ade765

    SHA1

    b97282c8ac56ce600a93f6513cb0b086838d98e9

    SHA256

    fff78494a6844b1f25dbeed51d46d8bb5159b2f198acb97618aee185096d885c

    SHA512

    e6390962349d95f99d35081e7132e77bfc92f5ab63314607d9a7756b8687b9a307d405294c5a9bac1037307952841c35b45f1629ca8e793260809d25ddb7be12

  • memory/4716-463-0x00007FFB5EF70000-0x00007FFB5EF85000-memory.dmp

    Filesize

    84KB

  • memory/4716-464-0x00007FFB5C4D0000-0x00007FFB5C56B000-memory.dmp

    Filesize

    620KB

  • memory/4716-462-0x00007FF7EC170000-0x00007FF7ECC09000-memory.dmp

    Filesize

    10.6MB

  • memory/4716-465-0x00007FFB5C360000-0x00007FFB5C39A000-memory.dmp

    Filesize

    232KB