bazarbackdoor | 30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
25-02-2022 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe
Size

7.8MB
MD5

20ba712dce269dffcfdc7799efd1a36f
SHA1

e8ae85628d28b5a6d28e02cdd8b20037ed498914
SHA256

30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8
SHA512

819ce30b2babf3bbd4aa3bddcf39d17e3084f107a65fb4c0f99af17791cf0c8cd3be8ac139d6f6bacd75bf5d1160e91c952a9677b58df50c53ed84133e8a493e

Score

10^/10

bazarbackdoor backdoor discovery

Malware Config

Signatures

BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Bazar/Team9 Backdoor payload 3 IoCs

Processes:

resource	yara_rule
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	BazarBackdoorVar3
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	BazarBackdoorVar3
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe	BazarBackdoorVar3

Executes dropped EXE 3 IoCs

Processes:

OfficeClickToRun.exeOfficeClickToRun.exeOfficeC2RClient.exe

pid process

3592 OfficeClickToRun.exe
544 OfficeClickToRun.exe
2552 OfficeC2RClient.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exeOfficeClickToRun.exeOfficeC2RClient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	OfficeC2RClient.exe

Loads dropped DLL 36 IoCs

Processes:

OfficeClickToRun.exeOfficeClickToRun.exeOfficeC2RClient.exe

pid	process
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
544	OfficeClickToRun.exe
544	OfficeClickToRun.exe
544	OfficeClickToRun.exe
544	OfficeClickToRun.exe
544	OfficeClickToRun.exe
544	OfficeClickToRun.exe
544	OfficeClickToRun.exe
544	OfficeClickToRun.exe
2552	OfficeC2RClient.exe
2552	OfficeC2RClient.exe
2552	OfficeC2RClient.exe
2552	OfficeC2RClient.exe
2552	OfficeC2RClient.exe
2552	OfficeC2RClient.exe
2552	OfficeC2RClient.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

Processes:

OfficeClickToRun.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-wal	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-shm	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\FeatureFlags\Settings\37\internal_config.json	OfficeClickToRun.exe

Drops file in Program Files directory 64 IoCs

Processes:

OfficeClickToRun.exeOfficeClickToRun.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\1033\PUBSPAPR\PDIR18F.GIF	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe.bak	OfficeClickToRun.exe
File created	C:\Program Files\Microsoft Office\root\office16\library\solver\PipelineWriteValidator	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\PPCORE.DLL	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\1033\PUBFTSCM\SCHEME08.CSS	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\1033\PUBFTSCM\SCHEME32.CSS	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\WINWORD.EXE	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\1033\MSACCESS_K_COL.HXK	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\1033\PUBFTSCM\SCHEME03.CSS	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\1033\PUBSPAPR\PDIR36F.GIF	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.14729.20322OfficeC2RB12F307C-88D7-4414-BACC-444679D8A6D4\C2RINTL.sk-sk.dll	OfficeClickToRun.exe
File created	C:\Program Files\Microsoft Office\packagemanifests\PipelineWriteValidator	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\1033\PUBSPAPR\ZPDIR29F.GIF	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\PROOF\MSGR8FR.LEX	OfficeClickToRun.exe
File created	C:\Program Files\Microsoft Office\root\vfs\programfilescommonx64\microsoft shared\office16\cultures\PipelineWriteValidator	OfficeClickToRun.exe
File created	C:\Program Files\Microsoft Office\root\vfs\programfilesx64\PipelineWriteValidator	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\vreg\accessmui.msi.16.en-us.vreg.dat	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\FORMS\1033\DOC.CFG	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\lynchtmlconvpxy.dll	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\api-ms-win-crt-heap-l1-1-0.dll	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\api-ms-win-crt-runtime-l1-1-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Microsoft Office\root\vfs\programfilesx86\microsoft sql server\130\PipelineWriteValidator	OfficeClickToRun.exe
File created	C:\Program Files\Microsoft Office\root\vfs\programfilescommonx86\system\ole db\PipelineWriteValidator	OfficeClickToRun.exe
File created	C:\Program Files\Microsoft Office\root\vfs\programfilescommonx64\microsoft shared\grphflt\PipelineWriteValidator	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Filters\api-ms-win-crt-private-l1-1-0.dll	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Filters\api-ms-win-crt-stdio-l1-1-0.dll	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Templates\1033\Access\DataType\Name.accft	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\FORMS\1033\POST.CFG	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\1033\LYNC_BASIC_K_COL.HXK	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\PUBWIZ\DGAD.XML	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\1033\TellMeAccess.nrr	OfficeClickToRun.exe
File created	C:\Program Files\Microsoft Office\root\vfs\programfilesx64\microsoft analysis services\as oledb\140\resources\PipelineWriteValidator	OfficeClickToRun.exe
File created	C:\Program Files\Microsoft Office\root\vfs\programfilescommonx64\PipelineWriteValidator	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\rsod\osmmui.msi.16.en-us.boot.tree.dat	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Stationery\1033\DADSHIRT.HTM	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.14729.20322OfficeC2RB12F307C-88D7-4414-BACC-444679D8A6D4\C2RINTL.ko-kr.dll	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\ADDINS\OUTEX2.ECF	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\FORMS\1033\TASKL.ICO	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\1033\ClientPreview_eula.txt	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\Interceptor.tlb	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\1033\OMICAUTINTL.DLL	OfficeClickToRun.exe
File created	C:\Program Files\Microsoft Office\root\vfs\programfilescommonx86\PipelineWriteValidator	OfficeClickToRun.exe
File created	C:\Program Files\Microsoft Office\root\vfs\programfilesx86\microsoft office\office16\dcf\1033\PipelineWriteValidator	OfficeClickToRun.exe
File created	C:\Program Files\Microsoft Office\root\vfs\windows\shellnew\PipelineWriteValidator	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\1033\OUTLOOK_F_COL.HXK	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\PTXT9.DLL	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Templates\1033\Access\DataType\Priority.accft	OfficeClickToRun.exe
File created	C:\Program Files\Microsoft Office\root\vfs\programfilescommonx64\microsoft shared\office16\office setup controller\office.en-us\PipelineWriteValidator	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\vreg\osmuxmui.msi.16.en-us.vreg.dat	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\MSYUBIN7.DLL	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\FORMS\1033\INFOMS.ICO	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\FORMS\1033\TASKACCS.ICO	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\msmdsrvi.rll	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\1033\PUBSPAPR\ZPDIR9F.GIF	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Integration\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\vreg\onenotemui.msi.16.en-us.vreg.dat	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Office16\FORMS\1033\IPML.ICO	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\api-ms-win-core-file-l2-1-0.dll	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\mfc140u.dll	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4D3CCD93-7174-4580-8C01-C73EDEB39CA3\root\Stationery\1033\PINELUMB.HTM	OfficeClickToRun.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

OfficeClickToRun.exeOfficeClickToRun.exe30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exeOfficeClickToRun.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

OfficeClickToRun.exeOfficeClickToRun.exe30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exeOfficeClickToRun.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

OfficeClickToRun.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.10	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.3 = 5622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e497357656250537570706f7274456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4d616b65417274496e69744e6f65786365707432222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4d6f64656c33444f6e6c696e652e426c6f636b6564436f756e7472696573222c20225622203a20227374643a3a77737472696e677c61663b647a3b62683b636e3b63753b65673b69643b69723b69713b6a6f3b6b773b6c623b6c793b6d723b6d613b6b703b6f6d3b71613b73613b73643b73793b746e3b74723b61653b796522207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e52656d6f7665536b6574636853656564456c656d656e74222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e5356472e52656e646572536861646f7756696146696c74657273222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e55736541726344656275674c61796572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e5573654c6f6754656c656d65747279466c6167222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e5573654c6f676963616c445049466f72566563746f72496d6167655265736f75726365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e5573654d65646961456e67696e65222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4368616e6765476174652e456e61626c6553534f466f72536f7665726569676e4163636f756e74735573696e6757414d222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e456e61626c65547275737443656e746572466f726d4261736564417574685549222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4e65774d53414775657374466c6f77222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e5570646174654d6574614461746150657253657373696f6e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e5573654964656e7469747943726564656e7469616c734661696c757265496e666f222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e5573654e657750726f66696c6553657276696365466f72414144222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e5573654e657750726f66696c6553657276696365466f7241414450686f746f73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e5573654e657750726f66696c6553657276696365466f7241414450726f66696c6573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c616e677561676553657474696e67732e496e4170704332724c706b446f776e6c6f6164222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e456e61626c654e6f456e7469746c656d656e74734d6f62696c65506c616e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e486561727462656174446179734265666f726545787044617465222c20225622203a2022696e7436345f747c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e4e6f456e7469746c656d656e74735472794275794578706572696d656e7454726561746d656e74222c20225622203a2022696e7436345f747c3222207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e50726f6d707445554c41466f72534d42222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e5573654c5655584865726f4578706572696d656e74222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4e616e63794f66666963655465616d2e7a686574616e34313232303231222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4368616e6765476174652e496e766f6b6546657463684d616e696665737443616c6c6261636b4f6e446f776e6c6f61644d616e696665737432222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4368616e6765476174652e4e6f4f70576974684e657874456469746f72222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4368616e6765476174652e5365745465616d73416464696e4c61737455736564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4368616e6765476174652e53686172656452756e74696d65466f7246697273745061727479536478222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4d6f757365436c69636b546f466f6375734f6e5461736b70616e65222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4f666673637265656e52656e646572696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4f7366496e7374616c6c6572526567697374657242675461736b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f4d45582e416464496e436c61737369666965722e436c617373696669636174696f6e4973456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6666696365496e73696465722e5570646174654e6f77222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6e654e6f74652e496e6b546f5368617065222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f74656c52756c65732e54656c656d6574727952756c6573222c20225622203a20227374643a3a77737472696e677c7b205c22723232343930325f325c22203a20312c205c22723232343930315f31315c22203a20312c205c22723232343930305f305c22203a20312c205c22723132303430325f31385c22203a20312c205c22723132303130305f335c22203a20312c205c227239303430315f335c22203a20312c205c22723730313230315f315c22203a20312c205c22723730313230305f315c22203a20312c205c22723730303230315f315c22203a20312c205c22723730303230305f315c22203a20312c205c22723730323335315f315c22203a20312c205c22723730323335305f315c22203a20312c205c22723730313235315f315c22203a20312c205c22723730313235305f315c22203a20312c205c22723730303035315f315c22203a20312c205c22723730303035305f315c22203a20312c205c22723730323935315f315c22203a20312c205c22723730323935305f315c22203a20312c205c22723730313135315f315c22203a20312c205c22723730313135305f315c22203a20312c205c22723730323230315f315c22203a20312c205c22723730323230305f315c22203a20312c205c22723730303430315f325c22203a20312c205c22723730303430305f325c22203a20312c205c22723730303335315f315c22203a20312c205c22723730303335305f315c22203a20312c205c22723730333930315f305c22203a20312c205c22723730333930305f305c22203a20312c205c22723730313530315f315c22203a20312c205c22723730313530305f315c22203a20312c205c22723730323830315f315c22203a20312c205c22723730323830305f315c22203a20312c205c22723730333335315f305c22203a20312c205c22723730333335305f305c22203a20312c205c22723730333530315f305c22203a20312c205c22723730333530305f305c22203a20312c205c22723730313830315f315c22203a20312c205c22723730313830305f315c22203a20312c205c22723730313035315f315c22203a20312c205c22723730313035305f315c22203a20312c205c22723730323735315f315c22203a20312c205c22723730323735305f315c22203a20312c205c22723730323330315f315c22203a20312c205c22723730323330305f315c22203a20312c205c22723730333430315f305c22203a20312c205c22723730333430305f305c22203a20312c205c22723730323530315f315c22203a20312c205c22723730323530305f315c22203a20312c205c22723730343130315f305c22203a20312c205c22723730343130305f305c22203a20312c205c22723730303530315f315c22203a20312c205c22723730303530305f315c22203a20312c205c22723730323535315f315c22203a20312c205c22723730323535305f315c22203a20312c205c22723730313335315f315c22203a20312c205c22723730313335305f315c22203a20312c205c22723730323135315f315c22203a20312c205c22723730323135305f315c22203a20312c205c22723730333030315f315c22203a20312c205c22723730333030305f315c22203a20312c205c22723730303735315f315c22203a20312c205c22723730303735305f315c22203a20312c205c22723730303135315f315c22203a20312c205c22723730303135305f315c22203a20312c205c22723730333435315f315c22203a20312c205c22723730333435305f315c22203a20312c205c22723730303930315f315c22203a20312c205c22723730303930305f315c22203a20312c205c22723730323235315f315c22203a20312c205c22723730323235305f315c22203a20312c205c22723730323635315f315c22203a20312c205c22723730323635305f315c22203a20312c205c22723730333130315f315c22203a20312c205c22723730333130305f315c22203a20312c205c22723730323930315f315c22203a20312c205c22723730323930305f315c22203a20312c205c22723730333630315f305c22203a20312c205c22723730333630305f305c22203a20312c205c22723730333835315f305c22203a20312c205c22723730333835305f305c22203a20312c205c22723730333830315f305c22203a20312c205c22723730333830305f305c22203a20312c205c22723730333730315f305c22203a20312c205c22723730333730305f305c22203a20312c205c22723730333735315f305c22203a20312c205c22723730333735305f305c22203a20312c205c22723730313330315f315c22203a20312c205c22723730313330305f315c22203a20312c205c22723730343035315f305c22203a20312c205c22723730343035305f305c22203a20312c205c22723730313730315f315c22203a20312c205c22723730313730305f315c22203a20312c205c22723730323035315f315c22203a20312c205c22723730323035305f315c22203a20312c205c22723730303730315f315c22203a20312c205c22723730303730305f315c22203a20312c205c22723730303535315f315c22203a20312c205c22723730303535305f315c22203a20312c205c22723730333635315f305c22203a20312c205c22723730333635305f305c22203a20312c205c22723730303630315f315c22203a20312c205c22723730303630305f315c22203a20312c205c22723730333135315f315c22203a20312c205c22723730333135305f315c22203a20312c205c22723730333935315f305c22203a20312c205c22723730333935305f305c22203a20312c205c22723730323835315f315c22203a20312c205c22723730323835305f315c22203a20312c205c22723730303030315f325c22203a20312c205c22723730303030305f325c22203a20312c205c22723730313430315f315c22203a20312c205c22723730313430305f315c22203a20312c205c22723730313935315f315c22203a20312c205c22723730313935305f315c22203a20312c205c22723730303835315f315c22203a20312c205c22723730303835305f315c22203a20312c205c22723730313835315f315c22203a20312c205c22723730313835305f315c22203a20312c205c22723730333035315f335c22203a20312c205c22723730333035305f335c22203a20312c205c22723730303130315f315c22203a20312c205c22723730323130315f315c22203a20312c205c22723730323130305f315c22203a20312c205c22723730303130305f315c22203a20312c205c22723730303935315f315c22203a20312c205c22723730303935305f315c22203a20312c205c22723730333535315f305c22203a20312c205c22723730333535305f305c22203a20312c205c22723730303435315f315c22203a20312c205c22723730323730315f315c22203a20312c205c22723730323730305f315c22203a20312c205c22723730303435305f315c22203a20312c205c22723730313930315f315c22203a20312c205c22723730313930305f315c22203a20312c205c22723730343030315f305c22203a20312c205c22723730343030305f305c22203a20312c205c22723730333235315f315c22203a20312c205c22723730333235305f315c22203a20312c205c22723730323430315f315c22203a20312c205c22723730323430305f315c22203a20312c205c22723730343230315f305c22203a20312c205c22723730343230305f305c22203a20312c205c22723730313535315f315c22203a20312c205c22723730313535305f315c22203a20312c205c22723730303330315f315c22203a20312c205c22723730303330305f315c22203a20312c205c22723730323030315f315c22203a20312c205c22723730323030305f315c22203a20312c205c22723730323630315f315c22203a20312c205c22723730323630305f315c22203a20312c205c22723730333230315f315c22203a20312c205c22723730333230305f315c22203a20312c205c22723730303235315f315c22203a20312c205c22723730303235305f315c22203a20312c205c22723730343135315f305c22203a20312c205c22723730343135305f305c22203a20312c205c22723730303635315f315c22203a20312c205c22723730303635305f315c22203a20312c205c22723730333330315f305c22203a20312c205c22723730333330305f305c22203a20312c205c22723730313735315f315c22203a20312c205c22723730313735305f315c22203a20312c205c22723730313635315f315c22203a20312c205c22723730313635305f315c22203a20312c205c22723730323435315f315c22203a20312c205c22723730323435305f315c22203a20312c205c22723730313130315f315c22203a20312c205c22723730313130305f315c22203a20312c205c22723132303132385f305c22203a20312c205c22723132303630315f325c22203a20312c205c22723132303630305f335c22203a20312c205c22723132303630325f335c22203a20312c205c22723132303630335f385c22203a20312c205c22723132303630375f315c22203a20312c205c22723232363030395f305c22203a20312c205c22723233303130345f315c22203a20312c205c22723233303135315f305c22203a20312c205c22723233303135325f305c22203a20312c205c22723233303135335f305c22203a20312c205c22723233303135355f315c22203a20312c205c22723233303135375f305c22203a20312c205c22723233303135385f315c22203a20312c205c22723233303136325f305c22203a20312c205c22723233303136335f305c22203a20312c205c22723233303136345f305c22203a20312c205c22723233303136355f305c22203a20312c205c22723233303136365f305c22203a20312c205c22723132303131395f305c22203a2031207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e5063782e4c696e6b6564496e4b32466978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572666f726d616e63652e426c6f636b696e6757616974732e4f737250726f63657373222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572666f726d616e63652e496e70757444656c61794d6f6e69746f722e494f486f6f6b73526970636f7264222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572736f6e616c697a6174696f6e2e456e61626c65476574496e736967687473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572736f6e616c697a6174696f6e2e456e61626c6553656e645369676e616c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4368616e6765476174652e436865636b456e6372797074696f6e44617461466f724d6f6469667950617373776f7264222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e50726f6a6563742e50726f6a65637443656e74656e6e69616c53657276657232303133426c6f636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e50	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|2"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|4"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.14	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.11	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|9"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t\|1645839614"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.10	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|3"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1 = 4d736f3a3a436865636b73756d52656769737472793a3a446174617c75696e7436345f747c2d373531323832333830303936313931313634313b456373436f6e666967526573706f6e7365446174617c7b202256657222203a2022696e7433325f747c30222c2022436f6e6649647322203a20227374643a3a77737472696e677c502d522d35343930332d312d332c502d522d32363134362d372d31352c502d442d32393633352d312d312c502d442d32373038372d312d392c502d522d37393638382d312d332c502d522d39393336362d342d362c502d582d39383531382d332d372c502d582d38363131312d312d332c502d582d37363534392d312d332c502d522d3131333632392d382d362c626c6f636b65646772617068696373616461707465725f726576323a3138333735312c61697573653137343a3132313031382c61696d69633538323a3131393331322c502d582d38353636352d312d372c6170726f753337303a3136373038312c502d582d37393737352d312d372c61706578703134383a3131343134332c502d522d35383634302d312d332c502d522d33353039392d342d342c502d522d33343834332d342d362c502d522d313030303130362d342d352c502d522d3131383036392d362d372c502d522d3131313236322d342d352c502d522d33333832322d31362d36312c502d522d34353438332d32302d35332c502d522d38373538372d342d342c502d522d37353036392d312d332c502d522d37353030312d312d332c502d522d36383135322d32322d32312c502d522d34393136322d32302d31332c502d522d34393136312d32302d31332c502d522d34303235332d382d31392c502d522d34303235342d382d31382c502d522d33353430312d382d372c502d522d33323130372d32342d32322c502d522d32383534362d372d31302c502d522d32343938302d392d34382c502d522d32343339302d31332d31302c502d522d31393034362d352d31392c502d522d31383237392d31302d36352c502d522d3131333931352d382d372c502d522d3131313636302d382d342c502d522d35383532352d32322d34342c502d522d35323938322d33362d33342c502d522d35313134352d32302d372c502d582d37313434392d312d332c502d582d36363539302d312d352c502d522d3131333530382d382d352c502d522d3131313230342d342d362c502d522d3130393731382d382d352c502d522d39353631362d382d342c502d522d37393631362d312d332c502d522d37373632312d312d332c502d522d37373230342d312d332c502d522d37363130372d312d332c502d522d37343333342d312d332c502d522d37343433392d312d332c502d522d37333634322d312d332c502d522d36323837352d322d342c502d522d36303537392d322d322c502d522d36303333332d312d332c502d522d35383130372d322d322c502d522d35353734332d312d332c502d522d35313935382d312d352c502d522d34303438382d32302d31362c502d522d33383038352d32302d31302c646f6d6f643839383a36303731392c656e61626c65616374726f6e6f64633a35303835362c502d582d38353036342d312d352c502d582d38363336362d312d352c502d522d35353132322d31302d382c502d522d35303235352d31322d31302c502d522d34353331342d31322d31362c65786469733230343a3134353139392c65786175743134333a3138303936332c502d522d39343536302d32302d31352c502d522d39343138392d32302d31362c502d522d39333838322d32302d32392c502d522d33343031392d31302d362c502d582d38333931382d312d352c502d582d38303533372d312d31312c502d582d37383430322d312d332c502d582d35343335382d312d372c502d582d36393138392d312d372c502d582d36363533372d312d372c502d582d36373538352d312d332c502d582d35333834352d312d392c502d582d35363237342d312d392c502d582d36333133342d312d372c502d582d36323236312d312d332c502d582d35383637382d312d352c502d582d35353833322d312d362c502d582d35363134372d312d352c502d582d35363135342d312d352c502d582d35333737322d312d332c502d522d3131313838332d342d362c502d522d3131303930322d382d352c502d522d39353038322d382d342c502d522d39333937302d382d342c502d522d39303531312d342d342c502d522d37383239332d312d332c502d522d37343434312d312d332c502d522d36323436342d32302d31302c502d522d35393830382d32382d32392c502d522d35393139332d312d332c502d522d34383034372d32302d32392c502d522d34353630392d31362d362c502d522d34303938302d32302d31362c502d522d33393032392d362d31382c502d522d33383136322d36302d36362c502d522d32363936382d342d392c66697368613731393a3137383933382c6669636c703336303a3133313532362c66697368613130393a3130353939342c6669656e613934373a33353235302c6669656e613930333a36373736392c6669656e663535323a37313633322c666973796e3238353a36353439332c66697365723139303a35303931392c66696461763236353a35383738362c66696361633834313a35313034352c6669656e613334303a36303336372c6669656e613431353a34333634312c6669656e613439303a33353332372c72656d6f74656d6f76656465766963653a34353836332c6669656e613237363a34333536392c686170707930333137323032302d313a36313930382c502d522d33323130362d31372d33302c502d522d33303038352d322d392c502d522d31393831342d31372d36322c502d522d31393031322d32342d35372c502d522d33333535352d342d352c502d582d37373734322d312d352c502d582d38343332312d312d352c502d582d38333338382d312d332c502d582d37393037392d312d332c502d582d37353837362d312d352c502d582d37353231302d312d332c502d582d36353330312d312d332c502d582d35393739322d312d352c502d582d35393739332d312d352c502d582d35303232302d312d332c502d582d34393733302d312d332c502d582d34373934332d312d332c502d582d34373735342d312d332c502d522d39393334332d342d31312c502d522d36383232362d32302d31312c502d522d36353331322d32302d31332c502d522d36343834312d32342d31352c502d522d36333130302d33322d31302c502d522d36323138332d32322d32322c502d522d34303939302d33342d31352c502d522d33323734342d32302d31362c502d522d33323734312d34322d31362c502d442d33343236392d332d342c677264656c3334373a3132373632392c67727573653434343a3132353036332c67726175743133303a3137393936312c67726973773536393a3131323231382c677272656d3234353a3131313935342c6772616c743838383a3138303234362c67727376673135363a35383134382c67726973683536383a35333431332c67726973613131323a35333430392c67727573653438383a32353239332c677269636f3430363a32353239342c502d522d3131313735322d342d362c502d522d35333432312d33302d31352c502d522d35303736342d32302d31342c502d522d34303437352d33302d32382c502d522d33323030342d31322d352c502d582d38383033352d312d352c6c616c616e3233313a3135313237332c502d522d36363839352d32302d32312c502d522d35313939352d33322d32382c502d582d3131343831312d312d352c502d522d37393936332d312d322c502d522d36353138362d322d342c502d522d36303831362d31322d31392c502d522d35313736342d322d342c6c693231353a3139313637322c502d582d38313537392d312d332c502d582d37373738332d312d352c502d522d39363732352d362d342c502d522d36353239362d312d332c502d522d35393533342d312d332c502d522d35343535372d312d332c502d522d35313735312d32302d32322c502d522d33363634392d31302d382c6f656e65773738393a3138343738322c6f656d6f753439343a3138303339302c502d522d37313336302d32322d31392c502d582d38353633382d312d372c6f6d6164643137353a3137313731352c502d582d38373730352d312d31322c6f6e696e6b3831303a3137303938322c502d442d3130343236372d352d332c502d442d3130343236362d342d332c502d442d3130343236352d342d332c502d442d3130343232312d332d332c502d442d3130343136322d312d332c502d442d3130333639352d312d332c502d442d3130333639322d322d332c502d442d3130333639302d322d332c502d442d3130333638382d322d332c502d442d3130333638362d322d332c502d442d3130333638342d322d332c502d442d3130333638312d322d332c502d442d3130333637382d322d332c502d442d3130333637362d322d332c502d442d3130333637342d322d332c502d442d3130333637322d322d332c502d442d3130333637302d322d332c502d442d3130333636382d322d332c502d442d3130333636352d322d332c502d442d3130333636332d322d332c502d442d3130333636312d322d332c502d442d3130333635382d322d332c502d442d3130333635352d322d332c502d442d3130333635322d322d332c502d442d3130333635302d322d332c502d442d3130333634372d322d332c502d442d3130333634352d322d332c502d442d3130333634332d322d332c502d442d3130333634312d322d332c502d442d3130333633392d322d332c502d442d3130333633382d322d332c502d442d3130333633372d322d332c502d442d3130333633342d332d332c502d442d3130333633332d322d332c502d442d3130333633322d322d332c502d442d3130333633302d322d332c502d442d3130333632392d322d332c502d442d3130333632382d322d332c502d442d3130333632372d322d332c502d442d3130333632362d322d332c502d442d3130333632352d322d332c502d442d3130333632342d322d332c502d442d3130333632312d322d332c502d442d3130333631382d322d332c502d442d3130333631352d322d332c502d442d3130333631322d322d332c502d442d3130333631302d322d332c502d442d3130333630372d322d332c502d442d3130333630362d322d332c502d442d3130333630342d322d332c502d442d3130333630312d322d332c502d442d3130333539382d322d332c502d442d3130333539362d322d332c502d442d3130333539352d322d332c502d442d3130333539322d322d332c502d442d3130333538392d322d332c502d442d3130333538382d322d332c502d442d3130333538372d322d332c502d442d3130333538342d322d332c502d442d3130333538322d322d332c502d442d3130333538302d322d332c502d442d3130333537382d322d332c502d442d3130333537362d322d332c502d442d3130333537342d322d332c502d442d3130333537322d322d332c502d442d3130333537302d322d332c502d442d3130333536362d322d332c502d442d3130333536342d322d332c502d442d3130333536322d322d332c502d442d3130333536302d322d332c502d442d3130333535392d322d332c502d442d3130333535382d322d332c502d442d3130333535362d322d332c502d442d3130333535342d322d332c502d442d3130333535322d322d332c502d442d3130333535302d322d332c502d442d3130333534392d322d332c502d442d3130333534382d322d332c502d442d3130333534372d322d332c502d442d3130333534362d322d332c502d442d3130333534342d322d332c502d442d3130333534332d322d332c502d442d3130333534322d322d332c502d442d3130333534312d322d332c502d442d3130333533392d322d332c502d442d3130333533382d322d332c502d442d3130333533362d322d332c502d442d3130333533342d322d332c502d442d3130333533332d322d332c502d442d3130333533312d322d332c502d442d3130333532392d322d332c502d442d3130333532362d322d332c502d442d3130333532342d322d332c502d442d3130333532322d322d332c502d442d3130333531372d322d332c502d442d3130333531352d322d332c502d442d3130333531332d322d332c502d442d3130333531312d322d332c502d442d3130333530392d322d332c502d442d3130333530362d322d332c502d442d3130333530332d322d332c502d442d3130333530312d322d332c502d442d3130333530302d322d332c502d442d3130333439392d322d332c502d442d3130333439382d322d332c502d442d3130333439372d322d332c502d442d3130333439362d322d332c502d442d3130333439352d322d332c502d442d3130333439332d322d332c502d442d3130333439312d322d332c502d442d3130333438392d322d332c502d442d3130333438372d322d332c502d442d3130333438352d322d332c502d442d3130333438332d322d332c502d442d3130333438302d332d332c502d442d3130333437382d322d332c502d442d3130333437372d322d332c502d442d3130333437362d322d332c502d442d3130333437342d322d332c502d442d3130333437322d322d332c502d442d3130333437302d322d332c502d442d3130333436382d322d332c502d442d3130333436332d322d332c502d442d3130333436312d322d332c502d442d3130333435392d31342d342c502d442d3130333435372d31342d342c502d442d3130333434362d31342d342c502d442d3130333334382d322d332c502d442d3130333334362d322d332c502d442d3130333334352d322d332c502d442d3130333334342d322d332c502d442d3130333334322d322d332c502d442d3130333334312d322d332c502d442d3130333334302d322d332c502d442d3130333333392d322d332c502d442d3130333333382d322d332c502d442d3130333333372d322d332c502d442d3130333333362d322d332c502d442d3130333333352d322d332c502d442d3130333333342d322d332c502d442d3130333333332d322d332c502d442d3130333333322d322d332c502d442d3130333333302d322d332c502d442d3130333332382d322d332c502d442d3130333332372d322d332c502d442d3130333332362d322d332c502d442d3130333332342d322d332c502d442d3130333332322d322d332c502d442d3130333332312d322d332c502d442d3130333332302d322d332c502d442d3130333331382d322d332c502d442d3130333331362d322d332c502d442d3130333331342d322d332c502d442d3130333331322d322d332c502d442d3130333331302d322d332c502d442d3130333330392d322d332c502d442d3130333330372d322d332c502d442d3130333330352d322d332c502d442d3130333330332d322d332c502d442d3130333330302d322d332c502d442d3130333239382d322d332c502d442d3130333239362d322d332c502d442d3130333239352d322d332c502d442d3130333239342d322d332c502d442d3130333239332d322d332c502d442d3130333239322d322d332c502d442d3130333239302d322d332c502d442d3130333238382d322d332c502d442d3130333238312d312d332c502d442d3130333237392d312d332c502d442d3130333237362d312d332c502d442d3130333237322d312d332c502d442d3130333236392d312d332c502d442d3130333032382d322d332c502d442d3130323938362d312d332c502d442d3130313930362d312d332c502d522d33383531302d342d31302c502d522d38323437332d312d342c502d522d35363631382d312d332c502d522d33333839322d362d382c502d522d33333639362d362d352c502d522d36383433332d312d332c502d522d35303338302d32302d31382c502d582d39343330362d312d332c502d582d39323933342d312d332c502d582d38343036312d312d352c502d582d38313133322d312d352c502d582d37383434342d312d332c502d582d37333331352d312d392c502d522d313030313039392d382d352c502d522d37333532312d312d332c502d522d36333333382d32302d31322c7365636c703636333a3137303130352c7365646c703630343a3136333531372c73656669733833303a3134353434352c7365636c703934383a3130373837362c7365636c703732333a39343434342c7365636c703837393a38373236342c502d582d37333731382d312d332c502d522d36373830372d332d362c502d522d36373830382d332d362c502d522d36373830362d332d362c502d522d36373830342d332d362c502d522d36373830332d332d362c502d522d35383735302d332d382c502d522d35383734382d332d382c502d522d35383734392d362d362c502d522d35323032372d332d372c502d522d35323032362d332d372c502d522d35323032312d332d392c502d522d35303339312d332d372c502d522d35303338342d332d362c502d522d34393532362d332d362c502d522d34373533322d332d362c502d522d34373234322d32302d31312c502d522d34343039362d342d31302c502d522d34323431372d352d362c502d522d34313534392d32302d31352c502d522d34303136392d31302d31312c502d522d33393730312d332d382c502d522d33393539302d332d372c502d522d33393538362d332d372c502d522d33393538342d332d382c502d522d33393533302d342d392c502d522d33393436382d332d392c502d522d33393436332d332d392c502d522d33333139372d352d31312c502d522d33333133372d332d372c502d522d32383937382d332d31312c502d522d32383937392d332d31312c502d522d32383938302d332d31302c502d522d32393233322d342d31362c502d522d32383939392d352d31332c502d522d32383939322d392d31342c502d522d32333433342d342d372c502d522d31383531332d312d33302c73686963723331373a3131353938302c502d522d36353031312d312d332c502d522d35303534312d32302d372c502d522d36393233322d32382d31342c502d582d38333330342d312d332c502d522d35313931362d3130322d33312c74657561653331303a3134353938342c502d522d32353236392d31312d31362c502d522d313030303036312d322d342c502d522d3131313638322d312d332c502d522d3130353733312d33332d33352c502d522d3130343433352d31302d31322c502d522d3130303239342d312d332c502d522d39393633332d312d332c502d522d39383932392d312d332c502d522d39383932362d312d332c502d522d39383235302d312d332c502d522d39343830392d312d332c502d522d39343239392d312d332c502d522d39333037372d312d332c502d522d39303535332d332d352c502d522d38383330392d322d342c502d522d38363131382d312d332c502d522d38303531372d332d352c502d522d37393233382d382d31302c502d522d37383835322d332d352c502d522d37383131322d312d332c502d522d37323434392d332d362c502d522d32333734362d32362d33322c502d522d36373534342d322d352c502d522d35303539362d342d382c502d522d33383234382d31342d31382c502d522d33303137382d37302d37322c502d522d32353832322d31312d31342c502d522d32333733362d31332d31362c502d442d33323438352d322d342c502d442d33323438342d322d342c502d522d34373630312d32302d3136	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\CountryCode = "std::wstring\|IE"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|5"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigIds = "std::wstring\|P-R-54903-1-3,P-R-26146-7-15,P-D-29635-1-1,P-D-27087-1-9,P-R-79688-1-3,P-R-99366-4-6,P-X-98518-3-7,P-X-86111-1-3,P-X-76549-1-3,P-R-113629-8-6,blockedgraphicsadapter_rev2:183751,aiuse174:121018,aimic582:119312,P-X-85665-1-7,aprou370:167081,P-X-79775-1-7,apexp148:114143,P-R-58640-1-3,P-R-35099-4-4,P-R-34843-4-6,P-R-1000106-4-5,P-R-118069-6-7,P-R-111262-4-5,P-R-33822-16-61,P-R-45483-20-53,P-R-87587-4-4,P-R-75069-1-3,P-R-75001-1-3,P-R-68152-22-21,P-R-49162-20-13,P-R-49161-20-13,P-R-40253-8-19,P-R-40254-8-18,P-R-35401-8-7,P-R-32107-24-22,P-R-28546-7-10,P-R-24980-9-48,P-R-24390-13-10,P-R-19046-5-19,P-R-18279-10-65,P-R-113915-8-7,P-R-111660-8-4,P-R-58525-22-44,P-R-52982-36-34,P-R-51145-20-7,P-X-71449-1-3,P-X-66590-1-5,P-R-113508-8-5,P-R-111204-4-6,P-R-109718-8-5,P-R-95616-8-4,P-R-79616-1-3,P-R-77621-1-3,P-R-77204-1-3,P-R-76107-1-3,P-R-74334-1-3,P-R-74439-1-3,P-R-73642-1-3,P-R-62875-2-4,P-R-60579-2-2,P-R-60333-1-3,P-R-58107-2-2,P-R-55743-1-3,P-R-51958-1-5,P-R-40488-20-16,P-R-38085-20-10,domod898:60719,enableactronodc:50856,P-X-85064-1-5,P-X-86366-1-5,P-R-55122-10-8,P-R-50255-12-10,P-R-45314-12-16,exdis204:145199,exaut143:180963,P-R-94560-20-15,P-R-94189-20-16,P-R-93882-20-29,P-R-34019-10-6,P-X-83918-1-5,P-X-80537-1-11,P-X-78402-1-3,P-X-54358-1-7,P-X-69189-1-7,P-X-66537-1-7,P-X-67585-1-3,P-X-53845-1-9,P-X-56274-1-9,P-X-63134-1-7,P-X-62261-1-3,P-X-58678-1-5,P-X-55832-1-6,P-X-56147-1-5,P-X-56154-1-5,P-X-53772-1-3,P-R-111883-4-6,P-R-110902-8-5,P-R-95082-8-4,P-R-93970-8-4,P-R-90511-4-4,P-R-78293-1-3,P-R-74441-1-3,P-R-62464-20-10,P-R-59808-28-29,P-R-59193-1-3,P-R-48047-20-29,P-R-45609-16-6,P-R-40980-20-16,P-R-39029-6-18,P-R-38162-60-66,P-R-26968-4-9,fisha719:178938,ficlp360:131526,fisha109:105994,fiena947:35250,fiena903:67769,fienf552:71632,fisyn285:65493,fiser190:50919,fidav265:58786,ficac841:51045,fiena340:60367,fiena415:43641,fiena490:35327,remotemovedevice:45863,fiena276:43569,happy03172020-1:61908,P-R-32106-17-30,P-R-30085-2-9,P-R-19814-17-62,P-R-19012-24-57,P-R-33555-4-5,P-X-77742-1-5,P-X-84321-1-5,P-X-83388-1-3,P-X-79079-1-3,P-X-75876-1-5,P-X-75210-1-3,P-X-65301-1-3,P-X-59792-1-5,P-X-59793-1-5,P-X-50220-1-3,P-X-49730-1-3,P-X-47943-1-3,P-X-47754-1-3,P-R-99343-4-11,P-R-68226-20-11,P-R-65312-20-13,P-R-64841-24-15,P-R-63100-32-10,P-R-62183-22-22,P-R-40990-34-15,P-R-32744-20-16,P-R-32741-42-16,P-D-34269-3-4,grdel347:127629,gruse444:125063,graut130:179961,grisw569:112218,grrem245:111954,gralt888:180246,grsvg156:58148,grish568:53413,grisa112:53409,gruse488:25293,grico406:25294,P-R-111752-4-6,P-R-53421-30-15,P-R-50764-20-14,P-R-40475-30-28,P-R-32004-12-5,P-X-88035-1-5,lalan231:151273,P-R-66895-20-21,P-R-51995-32-28,P-X-114811-1-5,P-R-79963-1-2,P-R-65186-2-4,P-R-60816-12-19,P-R-51764-2-4,li215:191672,P-X-81579-1-3,P-X-77783-1-5,P-R-96725-6-4,P-R-65296-1-3,P-R-59534-1-3,P-R-54557-1-3,P-R-51751-20-22,P-R-36649-10-8,oenew789:184782,oemou494:180390,P-R-71360-22-19,P-X-85638-1-7,omadd175:171715,P-X-87705-1-12,onink810:170982,P-D-104267-5-3,P-D-104266-4-3,P-D-104265-4-3,P-D-104221-3-3,P-D-104162-1-3,P-D-103695-1-3,P-D-103692-2-3,P-D-103690-2-3,P-D-103688-2-3,P-D-103686-2-3,P-D-103684-2-3,P-D-103681-2-3,P-D-103678-2-3,P-D-103676-2-3,P-D-103674-2-3,P-D-103672-2-3,P-D-103670-2-3,P-D-103668-2-3,P-D-103665-2-3,P-D-103663-2-3,P-D-103661-2-3,P-D-103658-2-3,P-D-103655-2-3,P-D-103652-2-3,P-D-103650-2-3,P-D-103647-2-3,P-D-103645-2-3,P-D-103643-2-3,P-D-103641-2-3,P-D-103639-2-3,P-D-103638-2-3,P-D-103637-2-3,P-D-103634-3-3,P-D-103633-2-3,P-D-103632-2-3,P-D-103630-2-3,P-D-103629-2-3,P-D-103628-2-3,P-D-103627-2-3,P-D-103626-2-3,P-D-103625-2-3,P-D-103624-2-3,P-D-103621-2-3,P-D-103618-2-3,P-D-103615-2-3,P-D-103612-2-3,P-D-103610-2-3,P-D-103607-2-3,P-D-103606-2-3,P-D-103604-2-3,P-D-103601-2-3,P-D-103598-2-3,P-D-103596-2-3,P-D-103595-2-3,P-D-103592-2-3,P-D-103589-2-3,P-D-103588-2-3,P-D-103587-2-3,P-D-103584-2-3,P-D-103582-2-3,P-D-103580-2-3,P-D-103578-2-3,P-D-103576-2-3,P-D-103574-2-3,P-D-103572-2-3,P-D-103570-2-3,P-D-103566-2-3,P-D-103564-2-3,P-D-103562-2-3,P-D-103560-2-3,P-D-103559-2-3,P-D-103558-2-3,P-D-103556-2-3,P-D-103554-2-3,P-D-103552-2-3,P-D-103550-2-3,P-D-103549-2-3,P-D-103548-2-3,P-D-103547-2-3,P-D-103546-2-3,P-D-103544-2-3,P-D-103543-2-3,P-D-103542-2-3,P-D-103541-2-3,P-D-103539-2-3,P-D-103538-2-3,P-D-103536-2-3,P-D-103534-2-3,P-D-103533-2-3,P-D-103531-2-3,P-D-103529-2-3,P-D-103526-2-3,P-D-103524-2-3,P-D-103522-2-3,P-D-103517-2-3,P-D-103515-2-3,P-D-103513-2-3,P-D-103511-2-3,P-D-103509-2-3,P-D-103506-2-3,P-D-103503-2-3,P-D-103501-2-3,P-D-103500-2-3,P-D-103499-2-3,P-D-103498-2-3,P-D-103497-2-3,P-D-103496-2-3,P-D-103495-2-3,P-D-103493-2-3,P-D-103491-2-3,P-D-103489-2-3,P-D-103487-2-3,P-D-103485-2-3,P-D-103483-2-3,P-D-103480-3-3,P-D-103478-2-3,P-D-103477-2-3,P-D-103476-2-3,P-D-103474-2-3,P-D-103472-2-3,P-D-103470-2-3,P-D-103468-2-3,P-D-103463-2-3,P-D-103461-2-3,P-D-103459-14-4,P-D-103457-14-4,P-D-103446-14-4,P-D-103348-2-3,P-D-103346-2-3,P-D-103345-2-3,P-D-103344-2-3,P-D-103342-2-3,P-D-103341-2-3,P-D-103340-2-3,P-D-103339-2-3,P-D-103338-2-3,P-D-103337-2-3,P-D-103336-2-3,P-D-103335-2-3,P-D-103334-2-3,P-D-103333-2-3,P-D-103332-2-3,P-D-103330-2-3,P-D-103328-2-3,P-D-103327-2-3,P-D-103326-2-3,P-D-103324-2-3,P-D-103322-2-3,P-D-103321-2-3,P-D-103320-2-3,P-D-103318-2-3,P-D-103316-2-3,P-D-103314-2-3,P-D-103312-2-3,P-D-103310-2-3,P-D-103309-2-3,P-D-103307-2-3,P-D-103305-2-3,P-D-103303-2-3,P-D-103300-2-3,P-D-103298-2-3,P-D-103296-2-3,P-D-103295-2-3,P-D-103294-2-3,P-D-103293-2-3,P-D-103292-2-3,P-D-103290-2-3,P-D-103288-2-3,P-D-103281-1-3,P-D-103279-1-3,P-D-103276-1-3,P-D-103272-1-3,P-D-103269-1-3,P-D-103028-2-3,P-D-102986-1-3,P-D-101906-1-3,P-R-38510-4-10,P-R-82473-1-4,P-R-56618-1-3,P-R-33892-6-8,P-R-33696-6-5,P-R-68433-1-3,P-R-50380-20-18,P-X-94306-1-3,P-X-92934-1-3,P-X-84061-1-5,P-X-81132-1-5,P-X-78444-1-3,P-X-73315-1-9,P-R-1001099-8-5,P-R-73521-1-3,P-R-63338-20-12,seclp663:170105,sedlp604:163517,sefis830:145445,seclp948:107876,seclp723:94444,seclp879:87264,P-X-73718-1-3,P-R-67807-3-6,P-R-67808-3-6,P-R-67806-3-6,P-R-67804-3-6,P-R-67803-3-6,P-R-58750-3-8,P-R-58748-3-8,P-R-58749-6-6,P-R-52027-3-7,P-R-52026-3-7,P-R-52021-3-9,P-R-50391-3-7,P-R-50384-3-6,P-R-49526-3-6,P-R-47532-3-6,P-R-47242-20-11,P-R-44096-4-10,P-R-42417-5-6,P-R-41549-20-15,P-R-40169-10-11,P-R-39701-3-8,P-R-39590-3-7,P-R-39586-3-7,P-R-39584-3-8,P-R-39530-4-9,P-R-39468-3-9,P-R-39463-3-9,P-R-33197-5-11,P-R-33137-3-7,P-R-28978-3-11,P-R-28979-3-11,P-R-28980-3-10,P-R-29232-4-16,P-R-28999-5-13,P-R-28992-9-14,P-R-23434-4-7,P-R-18513-1-30,shicr317:115980,P-R-65011-1-3,P-R-50541-20-7,P-R-69232-28-14,P-X-83304-1-3,P-R-51916-102-31,teuae310:145984,P-R-25269-11-16,P-R-1000061-2-4,P-R-111682-1-3,P-R-105731-33-35,P-R-104435-10-12,P-R-100294-1-3,P-R-99633-1-3,P-R-98929-1-3,P-R-98926-1-3,P-R-98250-1-3,P-R-94809-1-3,P-R-94299-1-3,P-R-93077-1-3,P-R-90553-3-5,P-R-88309-2-4,P-R-86118-1-3,P-R-80517-3-5,P-R-79238-8-10,P-R-78852-3-5,P-R-78112-1-3,P-R-72449-3-6,P-R-23746-26-32,P-R-67544-2-5,P-R-50596-4-8,P-R-38248-14-18,P-R-30178-70-72,P-R-25822-11-14,P-R-23736-13-16,P-D-32485-2-4,P-D-32484-2-4,P-R-47601-20-16,P-R-33916-4-5,P-R-33580-10-9,P-X-79922-1-5,P-X-82382-1-3,P-X-77252-1-5,P-X-71712-1-5,P-R-112863-4-5,P-R-99175-4-5,P-R-95350-4-7,P-R-77634-1-4,P-R-59426-1-3,reactfilterpointerevents:106904,ux488646:97083,uxpro637:147636,checkoutdeviceonpaint:142122,P-R-19262-1-12,P-R-81720-1-2,P-R-58406-1-5,P-D-50697-2-4,P-D-29719-1-1,P-D-29718-1-1,P-D-29593-1-4"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.8 = 207b205c224576656e74735c22203a207b205c22547279446973636f76657245777355726c735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2245786368616e67654765744c6173745570646174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2245786368616e67654765744c617374557064617465325c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22547279446973636f76657245777355726c73325c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2254727948616e646c6541757468656e7469636174696f6e526573756c745c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2253686f7274637574735c22203a207b205c224576656e74735c22203a207b205c22436f6e666c696374496e666f5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22496e7374616c6c6174696f6e496e666f5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2252756e74696d65496e666f5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22416464696e53686f727463757444697370617463685c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c22457874656e6465644d616e69666573745c22203a207b205c224576656e74735c22203a207b205c225061727365457874656e6465644d616e69666573745c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c22416464696e50726566657463685c22203a207b205c224576656e74735c22203a207b205c22507265666574636849636f6e735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22507265666574636855726c5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225072656c6f61644d616e69666573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253616e64626f78507265666574636855726c5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2241637469766174696f6e5c22203a207b205c224576656e74735c22203a207b205c224352656d6f74657250726f78795c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2241757468656e7469636174696f6e526963684170695c22203a207b205c224576656e74735c22203a207b205c22476574416363657373546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2247657441757468546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2253696e676c655369676e4f6e5c22203a207b205c224576656e74735c22203a207b205c22446973706c617953534f436f6e73656e7450616765466f7241706943616c6c5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224578656375746547657453534f546f6b656e496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2247657441757468546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2255585c22203a207b205c224576656e74735c22203a207b205c22416761766555784d696e6f72426c6f636b65645c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2241707044656c6574656446726f6d446f63756d656e745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224469616c6f67436c6f7365645c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224469616c6f674f70656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c61756e63684f6d657853534f436f6e73656e744469616c6f675c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253686f77496e666f626172436f6e73656e74566965775c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253686f774c6f6164696e6753746174655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253686f775265616374566965775c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e46696c65494f222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436f6c6c61624d4c5c22203a207b205c224576656e74735c22203a207b205c224c6f636174696f6e53756767657374696f6e73536176654173546f436c6f75645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c224d534f5c22203a207b205c224576656e74735c22203a207b205c2246696c6552657061697250726f746563746564446f63756d656e745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e466c6f6f6467617465222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436c69656e74436f72655c22203a207b205c225375624e616d657370616365735c22203a207b205c22426f6e6469446573657269616c697a6174696f6e5c22203a207b205c224576656e74735c22203a207b205c2246726f6d5375727665795061796c6f616442696e6172795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4772617068696373222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22415243457863657074696f6e53636f70655c22203a207b205c224576656e74466c61675c22203a20353132207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4c6963656e73696e67222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c2253686f774e6f74696669636174696f6e4469616c6f675c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c22496e41707050726545787069726174696f6e547269676765725c22203a207b205c224576656e74466c61675c22203a203439343038207d207d2c205c225375624e616d657370616365735c22203a207b205c224e6f74696669636174696f6e4469616c6f675c22203a207b205c224576656e74735c22203a207b205c2252656e65774f72427579436c69636b5c22203a207b205c224576656e74466c61675c22203a203439343038207d207d207d2c205c224c5655585c22203a207b205c224576656e74735c22203a207b205c224e6f456e7469746c656d656e747352656e6577436c69636b65645c22203a207b205c224576656e74466c61675c22203a203439343038207d207d207d2c205c224275734261725c22203a207b205c224576656e74735c22203a207b205c22496e41707052656e6577616c46616c6c6261636b546f5765625c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c224c61756e6368496e41707052656e6577616c5c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c225265736574496e417070457870657269656e63655c22203a207b205c224576656e74466c61675c22203a203439343038207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4d616e6167656162696c697479222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436c69656e745c22203a207b205c224576656e74735c22203a207b205c224665746368416e6453657454656e616e744173736f63696174696f6e4b65795c22203a207b205c224576656e74466c61675c22203a203439343038207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4f75746c6f6f6b222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224465736b746f705c22203a207b205c225375624e616d657370616365735c22203a207b205c2253796e635c22203a207b205c224576656e74735c22203a207b205c2253796e6350757267654f66666c696e654974656d735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2256696577735c22203a207b205c224576656e74735c22203a207b205c224872566965774c6f6164436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22566965774d6f64655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e5365637572697479222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c2246696c65426c6f636b5c22203a207b205c224576656e74735c22203a207b205c2246696c65426c6f636b496e666f726d6174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c224f66666963655c22203a207b205c225375624e616d657370616365735c22203a207b205c2253656375726974795c22203a207b205c225375624e616d657370616365735c22203a207b205c224f43585c22203a207b205c224576656e74735c22203a207b205c2254727573746564456e636f756e7465725c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224e6f6e54727573746564456e636f756e7465725c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22416363657373456e636f756e7465725c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c224d6163726f5c22203a207b205c224576656e74735c22203a207b205c22456e636f756e74657265645c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22456e61626c65645c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d2c205c22457874656e736962696c6974795c22203a207b205c224576656e74735c22203a207b205c224d6163726f44696753696756657269667956657273696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d2c205c22436c705c22203a207b205c224576656e74735c22203a207b205c224164644c6162656c4f627365727665725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656d6f76654c6162656c4f627365727665725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e54656c656d65747279222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22436c69656e7453616d706c696e674f76657272696464656e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2253797374656d4865616c74684d657461646174614e6574776f726b436f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224576656e7451756172616e74696e65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f6164586d6c52756c65735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2250726f6365737349646c6551756575654a6f625c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22466c7573684576656e744275666665725c22203a207b205c224576656e74466c61675c22203a20353132207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e5558222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c225344585c22203a207b205c225375624e616d657370616365735c22203a207b205c224d65436f6e74726f6c5c22203a207b205c224576656e74735c22203a207b205c22547261636b65645363656e6172696f5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e576f7264222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224c696e6b6564496e5c22203a207b205c224576656e74735c22203a207b205c224372656174654c696e6b6564496e526573756d65417373697374616e745461736b50616e655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c2246696c65536176655c22203a207b205c224576656e74735c22203a207b205c225361766541735361766546696c655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22416374436d64476f7375625361766541735c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f435349464f4353536176655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c2246696c654f70656e5c22203a207b205c224576656e74735c22203a207b205c22446f634e6f7469667943616c6c6261636b5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22446f4e6f746966794d657267654469616c6f675c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c22436f417574686f72696e675c22203a207b205c224576656e74735c22203a207b205c2253686f77526573747269637465644d6163726f45646974696e674275734261725c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2246586c7255736572507265666572656e63655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f63735472616e736974696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22436f617574684d657267655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225365745464725265616479466f725472616e736974696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c22466f726d735c22203a207b205c224576656e74735c22203a207b205c224c6561726e696e67546f6f6c73576b4f6e446f63756d656e744f70656e5c22203a207b205c224576656e74466c61675c22203a203439343038207d207d207d2c205c22446961676e6f737469635c22203a207b205c224576656e74735c22203a207b205c22566563416c6c6f634661696c7572655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c224f4353425c22203a207b205c224576656e74735c22203a207b205c2256636c6f6b4f6e446f63446973706c61795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2256636c6f6b4f6e53617665436f6d706c6574655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2256636c6f6b4f6e55706c6f6164436f6d706c6574655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c22536176655c22203a207b205c224576656e74735c22203a207b205c22436f61757468436f6e74656e744c6174656e6379496e536176655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e456e61626c654c6f63616c697a6174696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e526573656172636865722e4e6f64654a5357656250616765457874726163746f72222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e48656c7050726f7669646572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e506172616d657465725465726d50726564696374696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e53686f756c6453686f7748656c70416374696f6e73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e34383831323634222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e43616e63656c416e696d6174696f6e734f6e526573657474696e67546248776e64222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e436865636b6f75744465766963654f6e5061696e74496e76616c696447616467657473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e46697833383934383832222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e466c75656e7453564d656e7552656672657368222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb0100000089bb160257f9b1489c8258cb0eb6a61b000000000200000000001066000000010000200000009b97c7952759c310a832f4ccd656f6cc7bb9c57107ac1024c7aea129ce6ddcb2000000000e8000000002000020000000f068660a9910c168fb4aac95b58c9e998c75cc15f182e819120b602e2e145c51f00300007b1aa056bef2566ff768c634b634c4e50b91ba195c45ad90318ff7630242346cdb9986a381f7afeefaa322ae5601ec992847d0b568612e143b16c2a0b5daebd9016a4e699ed4b65be881d9e971fbf12068bbbe26e39b0ce5c1f7fc650b1a793421fb82f5a006960ca890fa7d398e42071f67f48acf48bd282986695a6ab5a501f12d92144349a4c8518184c9447bfd49b74b4e6cccc4108525267779638f37756319e8164c278c36402174fa3e2ea4c2c7e35b90984e06632694d04fec8275ff0be641002b01eae5202601eaf8680052494338d6863056eef1f7e35afcdc923c8096ca881ef6173f60a6c196ae8ec427f52a6419752ae00bb613fe5348cfec123bb1fb65ca79ae05e614733db595109561261d82d2fd8a80eae1f3169d16569ef4ae83b7239247777945047026beabe935fbb5f6e7efdb61a710585a7f88865b02afd91e1eaadd676c621a3ebb215ea76da3b981310df87f29897e1c968eff6bf24c2be0ae561bd6633f800d9eb136a5d5a907fe71aa0fcab2765d58699f5e551e67bed261963f6dc0f511a5b94a7a6e93014f1ba5d42f260a21dd1d676005526375199be41d8b76d70fe27b3f7e91239b908edca7b15e84a471f80ffab8691639cb6cd7fa080a3ebfb90479202fbea0ab9b366816b0ab605b6e663a9333dd5b9807922b90a3b36bc9cda14614c46da0f59183a9ef1d981ef2f7e777e45323a9531cbb1edb0b2ed7c1f9cb6e79e2f2764c3e19aef25bfa790cd0bad23dae86cec6728db907066c477fc91be82c090968fc8d5f4e273d7128af66eb57fbf1ad5f4423d573632f48b482963067d5e2ae9975c2c51f8ed6c00e7e61accf5beca1c228c916e115f9d6464019c518269de7e535ece092c3a3c4cc890e52a352694edbe144101296dd5a47f3472313281f6905f11c9fe984b070ecf6335b71dcff50b44ffb6689ba7e7ecdbbf84b936935ab5aaec27b9c5d7d196877d5bd1985dbdcb5ea9cd7140fcdd3921ee70155fcdfe146f87a8d79bef4f85e1367bd4637cfedbb634b257e47ef597c21ab97d8a7a8ffadbe2f4c192fd54c03ec0b0ca702e51acb0aa99338d6ffcc7311d4f03567a0973b9eda872614dfb603a963356c4c9d37c72ba1533a98278c42282f86613d329ead2acd35fa5fafe6f428cd1ad1420a2e81d7f021444c1e777e3e87733247b94c70fa0dfb67bacb6441a1f40b314aa8978be4954b3c08023746a57f4a701065ba53416e2bea8a08e94121c469330a6f1a8876d008e261a39bb89b68aa1794780eb9967e32de457229b0c43a859af287b4be1c65ea9cb5c4f23fb3fe1c5e2a465b8ebd825c40a52fbc3fbf712aa03405f079c26166832ec2cdcd4be70bf3bf51de25ed479216d43acfe17b73313e0a8389b0de8e358509eeeaffc269c6e379efe62f4000000098afaf47a6a3a2a93735464dac3a8f49767c935bfa55540eaf4517a141f5986d2040ad66e10920fed0e441630a767a237cebdf6dbd4a030c3aa037cae1cb3d9f	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSessionUpgradeCandidate\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.14	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.12	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t\|0"	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.5 = 72616e736d697451756575655772697465446f63756d656e74496e666f4865616465725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756554727944656c657465456d70747946696c654173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565496e7365727441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e717565756541637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6741646441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674372656174654c6f675c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67536176654e657746696c655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674469736361726441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e71756575654c6f63616c4e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e71756575654f7574676f696e674e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575654469736361726441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224170694f70656e41637469766974794c6f675769746853747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6741646441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674361636865446f63756d656e74496e666f5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e74727946696e616c697a655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6746696c7465724f757443757272656e7455736572416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674c6f616446726f6d53747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6753617665546f53747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565436865636b5265766f6b65644544505c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565526570616972436f7272757074656446696c654173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674d6f64696679436c6f6e655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c654f70656e4572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c65526561644572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c655265706c6163654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c6557726974654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565536574456e74657270726973654461746150726f74656374696f6e4173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575655472756e6361746551756575655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e7472794372656174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e74727953657453746174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22536572766963654163746976697479526573756c745c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f674f6e436f6e74656e74416374696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e717565756541637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f674469736361726441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225472616e736d69745175657565496e7365727441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225472616e736d697451756575654469736361726441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e71756575654f7574676f696e675c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67436c6f73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d6974517565756548656c706572456e737572654469726563746f72795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d697451756575654d616e61676572437265617465496e73616e63655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2241706943726561746541637469766974794c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224170694372656174654c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d69745175657565536574456e74657270726973654461746150726f74656374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436f6c6c6162436f726e65725c22203a207b205c224576656e74735c22203a207b205c22436f617574686f725570646174654c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f617574686f72476f546f43757272656e744c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795573657252655265676973746572436f6e6e65637469766974794368616e67654e6f7469667949664e65636573736172795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e6443686174427574746f6e497356697369626c654e6f7744617461706f696e745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572436c6f736553696e676c65466c796f75745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e64497343686174417661696c61626c655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572794f6e436f617574686f72735265747269657665644173796e63506f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795265747269657665436f617574686f72735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572794f6e436f617574686f72735265747269657665645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795265747269657665436f617574686f72734265666f72654173796e63506f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279496e6974464d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279436f617574686f72577261707065725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e64436f61757468696e6757697468416c6c4775657374734f724d697373696e67456d61696c456469746f72735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22476f546f4c6f636174696f6e416374696f6e487562416374696f6e4a756d70546f417574686f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572557064617465417574686f724c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572557064617465456d61696c416e64436861745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6e7461637443617264416374696f6e487562416374696f6e53686f77436f6e74616374436172645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279557365724a756d70546f417574686f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279557365724f70656e53696e676c65466c796f75745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22456d61696c416374696f6e487562416374696f6e53656e64456d61696c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e6453657456616c75655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224d736f494d5365727669636573536642506861736531496d70726f76656d656e7473456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224368617443616c6c6f757455736572496e697455495c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f494d5365727669636573497357616343686174456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f494d536572766963657353664257616343686174456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f494d536572766963657353664357616343686174456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617455494d6f64656c4f6e55494576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224368617443616c6c6f7574557365724f6e5061727469636970616e744c6973744368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6175746847616c6c65727955736572437265617465416374696f6e4875624c69737446726f6d536e617073686f745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22436f6175746847616c6c65727955736572437265617465466c65784c69737446726f6d536e617073686f745c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22436f6c6c61625c22203a207b205c225375624e616d657370616365735c22203a207b205c22436f617574686f725c22203a207b205c225375624e616d657370616365735c22203a207b205c22436f617574686f72446f63756d656e7448656c7065725c22203a207b205c224576656e74735c22203a207b205c22547269676765725265747269657665446f63756d656e74436f617574686f72735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225265747269657665456469746f72735461626c654d616e616765725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225265747269657665527463557365725c22203a207b205c224576656e74466c61675c22203a20353132207d207d207d207d207d207d207d2c205c2241744d656e74696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22446f63756d656e744163746976697479496e746567726174696f6e5c22203a207b205c224576656e74735c22203a207b205c224164645265636f7665726564416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2250726f6365737341744d656e74696f6e4e6f74696669636174696f6e734c6973745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6d6d656e74734e6f74696669636174696f6e436f6c6c6563746f7252656d6f766564436f6d6d656e74735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2250726f63657373436f6d6d656e74734e6f74696669636174696f6e734c6973745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22536176654c6f67466f725265636f766572795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22437265617465446f63756d656e7441637469766974794c6f674d616e616765725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c657465436f6d6d656e7441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22446973636172644c6f63616c416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c6574655265706c7941637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2243726561746541744d656e74696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c65746541744d656e74696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c6574654d6f6465726e436f6d6d656e7441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224372656174654d6f6465726e41744d656e74696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f70656e4c6f6746726f6d5265636f766572795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c6574654d6f6465726e5265706c7941637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225064616c6d446f63756d656e7441637469766974794c6f674d616e616765725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22456e73757265446f63756d656e744163746976697479436170747572655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456e737572654c6f67507265526571735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d6574726f4f70656e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726561746555736572496e666f466f72417574686f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22437265617465556e69717565417574686f72566563746f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726561746555736572496e666f46726f6d417574686f72566563746f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224973436c6f7564446f63756d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225365745361766564507265526571735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224372656174655265766973696f6e53657441637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574436f6d6d656e74436f6e74656e744964656e7469666965725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f67436f6d6d656e744174747269627574696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472794372656174654c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536176654c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253657453617665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224162616e646f6e4c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224372656174655461736b41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225461736b4372656174696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526561737369676e5461736b41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656f70656e5461736b41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d706c6574655461736b41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224465736b746f704261636b73746167655c22203a207b205c224576656e74735c22203a207b205c22536176654173526563656e74436c69636b65645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2253617665417344656661756c745365727669636553656c656374696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f70656e526563656e74446f63756d656e747356696577436c69636b65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f70656e526563656e74446f63756d656e7473566965775769746846656174757265456e61626c6564436c69636b65645c22203a	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.6 = 207b205c224576656e74466c61675c22203a2032207d2c205c22424743616c634d616e6167657250726f6365737353657456616c75657350726f635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22424743616c6349646c655461736b46457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22506c6163657347726f757065724163636f756e74496e666f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657474696e67537461727465644d5255536c61624765744d72754461746554696d6547726f7570547970655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f70656e526563656e744c6f636174696f6e7356696577436c69636b65645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224f666669636553706163655c22203a207b205c225375624e616d657370616365735c22203a207b205c224465736b746f704261636b73746167654e617669676174696f6e5c22203a207b205c224576656e74735c22203a207b205c224c617a794c6f616446696c6543616368655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224c6f616446726f6d46696c6543616368655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2253617665496e746f46696c6543616368655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2252656164546869735043526f6f745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22526561644c6f63616c466f6c6465725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225265616453697465526f6f74427956726f6f6d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224765744974656d57656244617655726c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2247657452656d6f74654974656d496e666f726d6174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2252656164446f634c6962466f6c646572427956726f6f6d5c22203a207b205c224576656e74466c61675c22203a20353132207d207d207d207d207d2c205c22504358506572736f6e6150686f746f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f757453706163655c22203a207b205c224576656e74735c22203a207b205c22557064617465506c616365735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224372656174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486964655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225365744d72754c697374466f72486f6d65506167655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c65616e75705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536861726564576974684d65506f70756c6174654c6973745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174654d52554974656d735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f70656e4469736d6973735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e65774469736d6973735c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c224465736b746f704261636b73746167655c22203a207b205c224576656e74735c22203a207b205c224261636b73746167654469736d69737365645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224175746f5265636f76657279436f6d7061726557697468556e736176656456657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224175746f5265636f7665727944656c657465556e736176656456657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224175746f5265636f766572794f70656e556e736176656456657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224175746f5265636f76657279506f70756c617465556e736176656456657273696f6e4c6973745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e69744e65774e6176466f6c6465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e6577536572766963654c6973745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c225368617265506f696e7453697465735c22203a207b205c224576656e74735c22203a207b205c2247726f75707353697465735265717565737449636f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225368617265506f696e745369746573496e697469616c697a655369746573436f6c6c656374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225368617265506f696e74536974657350726f63657373526573756c74466f724964656e746974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225368617265506f696e7453697465734964656e74697479436163686552657175657374526573756c745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225368617265506f696e7453697465735265717565737453697465734361636865645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225368617265506f696e7453697465735265717565737453697465734173796e6350726f63657373526573756c745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225368617265506f696e7453697465735265717565737453697465734173796e635c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224372656174654c6f636174696f6e735c22203a207b205c224576656e74735c22203a207b205c2244656661756c744964656e74697479456d7074795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253686172696e674c6567616379436c69656e745c22203a207b205c224576656e74735c22203a207b205c22476574446174615c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22536861726564436f6d6d656e74735c22203a207b205c224576656e74735c22203a207b205c22436f6d6d656e74436f6e746578744368616e676564416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f6164436f6d6d656e74416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368436c6f7365566965774576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368436f6e74657874437265617465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244697370617463684f70656e566965774576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368566965774368616e6765644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368426567696e44726166744576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244697370617463684361706162696c69746965734368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368436f6d6d656e74734368616e6765644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368436f6d6d656e7453656c65637465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368437265617465436f6d6d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368446f634368616e6765644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368456e64436f6d6d656e7453657373696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368456e6444726166744576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244697370617463684576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368466f63757350616e655472696767657265644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368496e6974436f6d6d656e7453657373696f6e4173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368496e697469616c52656e646572436f6d706c657465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368496e76616c69644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244697370617463684c6f6164546872656164735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636850616e654368616e6765644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636850616e65466f63757353746174654368616e6765644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636850616e65546f52656e6465724576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636853656c656374436f6d6d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636853657448616c6650616e65446973706c61794d6f64655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244697370617463685468656d654368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636844656c657465436f6d6d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c656172436f6d6d656e7453656c656374696f6e416374696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22486f6d65506167655c22203a207b205c224576656e74735c22203a207b205c22506c6163654368616e6765536c6162436f6e646974696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6e53686f77486f6d65506167655c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c225365617263685c22203a207b205c224576656e74735c22203a207b205c225365656e4279557365725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c224f666669636553746172745c22203a207b205c224576656e74735c22203a207b205c22536574757054656d706c61746550726f706572746965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243757272656e745549416374697665506c6163654368616e67655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22547269676765725468756d626e61696c416374696f6e52756e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22446f63756d656e744e6f74696669636174696f6e735c22203a207b205c224576656e74735c22203a207b205c2252656769737465724f6e49646c65466561747572654761746544697361626c65645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d7275536572766963654170695c22203a207b205c225375624e616d657370616365735c22203a207b205c22446f63756d656e74735c22203a207b205c224576656e74735c22203a207b205c2252656164526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225772697465526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6e526571756573745375636365656465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22506c616365735c22203a207b205c224576656e74735c22203a207b205c2252656164526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225772697465526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6e526571756573745375636365656465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c224d736f53686172696e675c22203a207b205c224576656e74735c22203a207b205c22434d736f53686172696e675365727669636548656c706572456e64476574486f73744361706162696c69746965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572476574486f73744361706162696c69746965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572456e6447657455736572417474726962757465735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c70657247657455736572417474726962757465735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572456e644765744c696e6b735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c7065724765744c696e6b735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572456e645365744c696e6b735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c7065725365744c696e6b735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572456e644765745065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c7065724765745065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572456e645365745065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c7065725365745065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572436865636b5065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c70657247657453686172696e67496e666f726d6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572426567696e5365745065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c70657247657453686172696e6756657273696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d6f6465726e4261636b73746167655c22203a207b205c224576656e74735c22203a207b205c224261636b737461676550616765436f6e74726f6c55736572437265617465436f6e74726f6c557365725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224465736b746f704261636b73746167654e617669676174696f6e5c22203a207b205c224576656e74735c22203a207b205c224e617669676174696f6e5461736b496e766f6b655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225461736b496e766f6b654f6e52656164466f6c6465725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224465736b746f7053686172696e675c22203a207b205c224576656e74735c22203a207b205c22436f6c6c616250616e6555736572536574436f6c6c616250616e654d6f64655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6c6c616250616e6555736572436c69636b53686172696e674c696e6b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6c6c616250616e6555736572497343757272656e74446f63456e746572707269736550726f7465637465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22446f63756d656e7473536861726564576974684d655c22203a207b205c224576656e74735c22203a207b205c22446f63756d656e7473536861726564576974684d6552657175657374446f63756d656e7473536861726564576974684d654173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7473536861726564576974684d6552657175657374436163686564446f63756d656e7473536861726564576974684d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7473536861726564576974684d654964656e74697479436163686552657175657374526573756c745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7473536861726564576974684d6552657175657374436163686564446f63756d656e7473466f724661696c757265735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22486973746f727955585c22203a207b205c224576656e74735c22203a207b205c224163746976697479506167654d616e6167657252656769737465725669736962696c697479436f6e74726f6c6c65725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224275734261724f70656e4c6f63616c56657273696f6e5c22203a207b205c2245	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceId = "0018000881B59083"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.12	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.15	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

3976 powershell.exe
3976 powershell.exe
364 powershell.exe
364 powershell.exe

pid	process
3976	powershell.exe
3976	powershell.exe
364	powershell.exe
364	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

powershell.exepowershell.exeOfficeClickToRun.exe

description	pid	process
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	364	powershell.exe
Token: SeBackupPrivilege	3592	OfficeClickToRun.exe
Token: SeRestorePrivilege	3592	OfficeClickToRun.exe
Token: 35	3592	OfficeClickToRun.exe
Token: 35	3592	OfficeClickToRun.exe
Token: 35	3592	OfficeClickToRun.exe
Token: 35	3592	OfficeClickToRun.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

OfficeClickToRun.exeOfficeC2RClient.exe

pid process

544 OfficeClickToRun.exe
544 OfficeClickToRun.exe
544 OfficeClickToRun.exe
2552 OfficeC2RClient.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

OfficeClickToRun.exe

pid process

544 OfficeClickToRun.exe
544 OfficeClickToRun.exe
544 OfficeClickToRun.exe

pid	process
544	OfficeClickToRun.exe
544	OfficeClickToRun.exe
544	OfficeClickToRun.exe
2552	OfficeC2RClient.exe

pid	process
544	OfficeClickToRun.exe
544	OfficeClickToRun.exe
544	OfficeClickToRun.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exeOfficeClickToRun.exeOfficeClickToRun.exeOfficeClickToRun.exeOfficeC2RClient.exe

pid	process
220	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe
3048	OfficeClickToRun.exe
3592	OfficeClickToRun.exe
544	OfficeClickToRun.exe
2552	OfficeC2RClient.exe
2552	OfficeC2RClient.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe

description	pid	process	target process
PID 220 wrote to memory of 3976	220	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe	powershell.exe
PID 220 wrote to memory of 3976	220	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe	powershell.exe
PID 220 wrote to memory of 3976	220	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe	powershell.exe
PID 220 wrote to memory of 364	220	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe	powershell.exe
PID 220 wrote to memory of 364	220	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe	powershell.exe
PID 220 wrote to memory of 364	220	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe	powershell.exe
PID 220 wrote to memory of 3048	220	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe	OfficeClickToRun.exe
PID 220 wrote to memory of 3048	220	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe	OfficeClickToRun.exe
PID 220 wrote to memory of 544	220	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe	OfficeClickToRun.exe
PID 220 wrote to memory of 544	220	30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe	OfficeClickToRun.exe

C:\Users\Admin\AppData\Local\Temp\30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe
"C:\Users\Admin\AppData\Local\Temp\30fb56d8d4977c094901fea9e4d8d57692b3dd09e8b547ce38fdacee3385ffe8.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:220

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} "
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} "
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:364

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
OfficeClickToRun.exe platform=x64 culture=en-us productstoadd=O365ProPlusRetail.16_en-us_x-none cdnbaseurl=http://officecdn.microsoft.com/pr/55336b82-a18d-4dd6-b5f6-9e5095c314a6 baseurl=http://officecdn.microsoft.com/db/55336b82-a18d-4dd6-b5f6-9e5095c314a6 version=16.0.14729.20322 mediatype=CDN sourcetype=CDN O365ProPlusRetail.excludedapps=groove updatesenabled=False bitnessmigration=False deliverymechanism=55336b82-a18d-4dd6-b5f6-9e5095c314a6 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown scenario=CLIENTUPDATE
2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:3048

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
OfficeClickToRun.exe platform=x64 culture=en-us productstoadd=O365ProPlusRetail.16_en-us_x-none cdnbaseurl.16=http://officecdn.microsoft.com/pr/55336b82-a18d-4dd6-b5f6-9e5095c314a6 baseurl.16=http://officecdn.microsoft.com/db/55336b82-a18d-4dd6-b5f6-9e5095c314a6 version.16=16.0.14729.20322 mediatype.16=CDN sourcetype.16=CDN O365ProPlusRetail.excludedapps.16=groove updatesenabled.16=False bitnessmigration=False deliverymechanism=55336b82-a18d-4dd6-b5f6-9e5095c314a6 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:544

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3592

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /progressandlaunch AppTargets="root\office16\excel.exe|root\office16\lync.exe|root\office16\msaccess.exe|root\office16\mspub.exe|root\office16\onenote.exe|root\office16\outlook.exe|root\office16\powerpnt.exe|root\office16\teams.exe|root\office16\winword.exe" ManualUpgrade=False ScenarioToTrack="Scenario:{477E0208-58BD-4F33-978A-09BCC9AA9EB1}@INSTALL"
1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\APPVFILESYSTEMMETADATA.dll
MD5
47df99fe851db855c5507328f660dcf5

SHA1
195a33f0b91d6fda50d48c98c8e9bbfacfbf331b

SHA256
15646e0312a8ac15305efb382ce658ca37e6d4e4b73f93387589fd1d8139e3db

SHA512
5de2564d67dbf37ec38d40ac3b2d11fae4318744655941a763a514ed35d38fdf55694852789ca98d9e11c9ead5f997f8091d1413e20d511aba9aef1f8c46d5ea

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\APPVMANIFEST.dll
MD5
18ebc0da472b1efc4e8f6b6627cffc93

SHA1
20a7cf7558d8a7a5bbcc131cbaf4ba75d3f11815

SHA256
624ab9c6838a88550ad5d906e86829778b5a9fce09a55a67eadcbb5806058c98

SHA512
a443da09f063e6ba8711df6ac9c35aa26298356e3dcf819e7784b8641c609fa8fd5d30ec03964493790058b138534f342b65e0688b93e8fcd6d6aa772acd6f6d

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\APPVPOLICY.dll
MD5
1c03d1935b5892738a188ba40cd5a223

SHA1
b793c3918203f57468a7baa83e8d9e6e7b775545

SHA256
d656c21853e185feb04c0decc52df277ed9d214e9ffa31b86ed34c682e1b5730

SHA512
f9fa9def40ec3053f3a75ab2bc8e7c68c8b806be5bb80cda726ac8c08e3152c32db84a43a9e5775851bde0067d9ce9c8657a19850887171b0b206685318dbf40

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll
MD5
e85b603cc6968ffb4303fee315cf1af7

SHA1
e18d26df594425ff299cae10521ab21bb37baa31

SHA256
dbddda4caf6b63671b74666584ce1ac2affa59270e987725f2059fb1249c4ec8

SHA512
a1ab6bd6f908a2edb5b4afd2d5da24c187e14bd2572f27237f1fb4d24da8a8fa7d227c140e99da9739ca8be63cfcd96e2259c9c29f64f1059033ab049f6dfa9b

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVCatalog.dll
MD5
cf282ddd8d2cd281b2afb341bbbc7f8a

SHA1
8104ad996680c838c44743b1cc3149353c8bdb2b

SHA256
91cc31c10bac6b042855d8a48c854ba57b8e2085ca427786416f418f3597860b

SHA512
fed8069b200919471a21ac0b1d258f89f206bb6ed172b9b5a17e7d13b78fd825d25a33172adedec55cb89f225756f36daa9eec587eff52bf91df3752c2bd9de3

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dll
MD5
c01cc0200f3d889c68b503c68049ff62

SHA1
338589ddb1ffb4422f06e75f62f0db1151741f5d

SHA256
326bcb85652c67780d0193d78d5bab30e3668e6bcbcffcff304751b2f4518f54

SHA512
8d072207da418ff170e843f2d97b0e52875b42d2d4b46882d5de08a4e98bf1b7788052c5c591aa70f72813fe2b692541c55920d6dbe22ef15b7ef8a9252da58a

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvApi.dll
MD5
fc0e1d121cdded19e7b98cd995bde281

SHA1
102ebe6eb24cf598d559b305423b38896a8208cc

SHA256
7ccc472997dc3d5080cac6918bbd7ba172a4e674f59b5721e7487cd9b101d64d

SHA512
7077503a5265554f85364744385c4db557cc87f3540688f661c3f139e94cf107ceb2fdac51235a92030ce9dc19a411326ac720ff0925d9d28894afa4b3a0989c

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvStreamingManager.dll
MD5
4d3d26e3dee4398c1127903171ceb1c3

SHA1
95e316fe28d10ab358eaf71cc1bc66e3912d55a0

SHA256
3f54dc6589030ea96e0022e2a36624d9f8aba31a0940db4f2da3773739f5fd3c

SHA512
7241f433e9c970d16658fc3498235804de128564c7be25afce9c3d75d14000e738a9cc8de343c339f47144f243250eb8918f4ddaef783fae1b0dae0a1d5bcb45

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll
MD5
5f98a9c985171cd6f7b709b4727f802e

SHA1
1a822aca0699d67e2726ba716e7bb28316493328

SHA256
238a45614b67a38facf98730b2b5e316b424f79b4ad591eddb6ec52460c3265c

SHA512
2e6342e689a090854a24db2d837975eccdcaf8f78a3dff568e9dde6f76b2c0b929f307498b278a1feae5eec17e60cdbc81b8f10d0379dd1c77b6a0b8da5b5370

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll
MD5
b5da8c6339ac4fe30dab6be4ca4fb8f5

SHA1
fa628818d38d49527a4cdaa46b47bfd1ea18477d

SHA256
6677f595565cc80ad6cc46dda9760ffb1c5d02cdd3a36cb525f5a96d8edc601c

SHA512
1619ce0bcb62ddcb22fe0d5caf456a2ad84d08ffb4b42951aef18efb5e3e73458441b84fab815521c936fd94c78d474e47997ef4c9cc18aab90c77b029d0a5d7

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll
MD5
0884821e75b789d14faa4757a7f31880

SHA1
b837e32188a5673683d02bc62e21a23647308d7f

SHA256
1ebb321cbfeceb8eb13045118f09d43b94bc0172cdd185fbb3dffe58d7da10ab

SHA512
42fe74d5d28c20695d2230d66e0c368059e0726f494a2ecec3e2c8aef4e4a1c570f072564c59362c347e653c46b4f15af4db11fbc9ad0d2babbf8883df032ebb

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RUI.dll
MD5
1f98a71ac22012bf5024a5a5189d68a2

SHA1
adb5949c1c6801581054e8570bf2e3521311c998

SHA256
40c3740d17a3e26aeb8908f2ae130a54a5630326b317011cc9e6470773b3a00a

SHA512
56843cf7caa346b8607b8f53ae6816e754a9d97cd14b2a062ed20922ad97cdf81bc8917f8be576a5130e03833212b133729361f9081fd9dbcba2887debf6d8f1

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\CONCRT140.dll
MD5
c4fe3f03efd3188252caa101f954ffeb

SHA1
98b613aee45c71aed9d2be0d61d7ace323929e9c

SHA256
95bb425be3d515a6a58f7399d44dd9e032baea11667dfdba29517c460171880a

SHA512
80018e0bddf079367d3568433a5f89f0144aa0a75286b0105fe32aeeb5d80876c9b2e1ecaafb70fb041271e27a234a2cb88a2d3d160a4aa3768ccfcfc574704a

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\IntegratedOffice.exe
MD5
c1ae7b695355a7e2109729d42f816cd5

SHA1
c27b1dd02a3e8aa21f03146855b7e15a4861723a

SHA256
908420920efda03afcd7954592da35c255ebc7e55cb288d9240682afdf920223

SHA512
6b06a85bf27c312050de4f8333943e67eb5df59bc27466be233054cd31d25c36c866d8fbdc1358e107faa6e91911f2964d19710d97fc0495fed8034b0dbac418

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\MSIX.dll
MD5
e2893c72dd3bc0a0aafce73ee590a67e

SHA1
dea575e53d54aef9308ae7a55687a4412f57bc2b

SHA256
2f7fbed41fe526b950971240423c28d3117fec3a11eb27aa1bad0dcfb060cf08

SHA512
3f8c78e46182535f3217e41077fbe727f73405e3381a9252e1cd0d9d1cc9db0250795032a0844f03941f8199f7d1eb1602e37f875992228a1c7a6db111e024d9

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\MSVCP140.dll
MD5
cd0c37f1875b704f8eb08e397381ac16

SHA1
249d33c43e105a1c36ec6a24e5ef8dbc5f56b31b

SHA256
d86ac158123a245b927592c80cc020fea29c8c4addc144466c4625a00ca9c77a

SHA512
d60c56716399b417e1d9d7d739af13674c8572974f220a44e5e4e9ab0b0a23b8937bd0929eee9f03f20b7f74db008f70f9559a7eb66948b3afab5b96bdd1a6d5

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
MD5
d993f89d9117e6bbd996a7a950be9f3b

SHA1
c942b04871af9d23224ab9ae8ec71b2de1ed8145

SHA256
747d66a808c25a37c59408f9e53b86b2368d49a62e34139ef7d22f97691d2882

SHA512
6bf248ab87031fc85b7b5edf474ce503d6de7dc16370a1cca1cc6e7d4e4fd4f472d5baafcb285a83c38dc1c1d912b9dc00a7b85dd03bd0b1784296d9a833e9cc

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\StreamServer.dll
MD5
5074ba3f6753cdcee1f8a87a75ee494c

SHA1
f30ed812053c4c980635732fcf239d4ce57888e2

SHA256
0cdd5bf55454607312a8acf5bce99a9670060a22a7fc93fffab3ea83f277643b

SHA512
8d145cf8171bff0ee75770bfb381486bdd98122510676fa510744fb047731ebb15373157d508820d261ae54b59d3ef67d3cf3c86a73a7036a1ea016eaf6eb17f

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\VCRUNTIME140.dll
MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\VCRUNTIME140_1.dll
MD5
7667b0883de4667ec87c3b75bed84d84

SHA1
e6f6df83e813ed8252614a46a5892c4856df1f58

SHA256
04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d

SHA512
968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\appvisvsubsystems32.dll
MD5
eceaf9a27eaadbf0b9efed8f4d1fce85

SHA1
04f479306df3202d8765fa94925a00d2782666b8

SHA256
d18eed0f63f80a35cdb0a572470659843054723ad986de127a5dd1e7527f01bc

SHA512
51197498d1be232a2feb029771991db277512221ca2139c9a30fc6103d6c70b97b56bbbf90891c82da6a79bc2b383a8d9295634e077464af96052c3c2fd7d58e

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\c2rintl.en-us.dll
MD5
2b59a7d400d00748a85d38de4ea3bb91

SHA1
2d7c8aab0f16c89069da8607c572d4fe06ab9c44

SHA256
820a07642bf0e6856ddd5ce724b083111aa1b9d8b5a3e713cd0b48d1dd1259ce

SHA512
ca37f389e60d8c9e8e2fd2f0635ade454a0b68732e9b92a41d1646376a5d8d3b0b116aed9f3e02df89ba461fa6ce5178271181feed6ba16c48f0694b1e4d2d7b

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\i640.hash
MD5
96429ad9316be3dd165e3891655e21c5

SHA1
9bcb1216adbc3eaddeaac8aa278987c0db8715a6

SHA256
163222238c210ba8a89b30860eda6b3ef572e5364aa9ca3d5c87c1e4f13eba3e

SHA512
922a2f77e8b25a7ff3f8b02af4e701f484b169ea46fc4968277486f8ba3a8b7c86fdeeb09a6b52cf036a56d89abf0f82014d74e952065a46fcec3c1cbd8ecfe2

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\repoman.dll
MD5
89ddaa19eb5f5e083d8d2562ec30d181

SHA1
72b919b863c954b446d2fa05257a89e287ba419d

SHA256
882eb2aa8e008016d07942b3ff5990e3e04f99df08fa3cdb1ff4e94b08168f22

SHA512
8fc864318b00ca82fb184ad51797b00db5a74ce3bbd791dd6d933b21ea8badbc48ba50b016c1c67f2c26a5af05e839cfb4150c4b9aa9ae77f16089fd445a8f6c

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll
MD5
e85b603cc6968ffb4303fee315cf1af7

SHA1
e18d26df594425ff299cae10521ab21bb37baa31

SHA256
dbddda4caf6b63671b74666584ce1ac2affa59270e987725f2059fb1249c4ec8

SHA512
a1ab6bd6f908a2edb5b4afd2d5da24c187e14bd2572f27237f1fb4d24da8a8fa7d227c140e99da9739ca8be63cfcd96e2259c9c29f64f1059033ab049f6dfa9b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll
MD5
e85b603cc6968ffb4303fee315cf1af7

SHA1
e18d26df594425ff299cae10521ab21bb37baa31

SHA256
dbddda4caf6b63671b74666584ce1ac2affa59270e987725f2059fb1249c4ec8

SHA512
a1ab6bd6f908a2edb5b4afd2d5da24c187e14bd2572f27237f1fb4d24da8a8fa7d227c140e99da9739ca8be63cfcd96e2259c9c29f64f1059033ab049f6dfa9b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll
MD5
e85b603cc6968ffb4303fee315cf1af7

SHA1
e18d26df594425ff299cae10521ab21bb37baa31

SHA256
dbddda4caf6b63671b74666584ce1ac2affa59270e987725f2059fb1249c4ec8

SHA512
a1ab6bd6f908a2edb5b4afd2d5da24c187e14bd2572f27237f1fb4d24da8a8fa7d227c140e99da9739ca8be63cfcd96e2259c9c29f64f1059033ab049f6dfa9b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll
MD5
cf282ddd8d2cd281b2afb341bbbc7f8a

SHA1
8104ad996680c838c44743b1cc3149353c8bdb2b

SHA256
91cc31c10bac6b042855d8a48c854ba57b8e2085ca427786416f418f3597860b

SHA512
fed8069b200919471a21ac0b1d258f89f206bb6ed172b9b5a17e7d13b78fd825d25a33172adedec55cb89f225756f36daa9eec587eff52bf91df3752c2bd9de3

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll
MD5
47df99fe851db855c5507328f660dcf5

SHA1
195a33f0b91d6fda50d48c98c8e9bbfacfbf331b

SHA256
15646e0312a8ac15305efb382ce658ca37e6d4e4b73f93387589fd1d8139e3db

SHA512
5de2564d67dbf37ec38d40ac3b2d11fae4318744655941a763a514ed35d38fdf55694852789ca98d9e11c9ead5f997f8091d1413e20d511aba9aef1f8c46d5ea

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll
MD5
c01cc0200f3d889c68b503c68049ff62

SHA1
338589ddb1ffb4422f06e75f62f0db1151741f5d

SHA256
326bcb85652c67780d0193d78d5bab30e3668e6bcbcffcff304751b2f4518f54

SHA512
8d072207da418ff170e843f2d97b0e52875b42d2d4b46882d5de08a4e98bf1b7788052c5c591aa70f72813fe2b692541c55920d6dbe22ef15b7ef8a9252da58a

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll
MD5
fc0e1d121cdded19e7b98cd995bde281

SHA1
102ebe6eb24cf598d559b305423b38896a8208cc

SHA256
7ccc472997dc3d5080cac6918bbd7ba172a4e674f59b5721e7487cd9b101d64d

SHA512
7077503a5265554f85364744385c4db557cc87f3540688f661c3f139e94cf107ceb2fdac51235a92030ce9dc19a411326ac720ff0925d9d28894afa4b3a0989c

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll
MD5
4d3d26e3dee4398c1127903171ceb1c3

SHA1
95e316fe28d10ab358eaf71cc1bc66e3912d55a0

SHA256
3f54dc6589030ea96e0022e2a36624d9f8aba31a0940db4f2da3773739f5fd3c

SHA512
7241f433e9c970d16658fc3498235804de128564c7be25afce9c3d75d14000e738a9cc8de343c339f47144f243250eb8918f4ddaef783fae1b0dae0a1d5bcb45

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll
MD5
5f98a9c985171cd6f7b709b4727f802e

SHA1
1a822aca0699d67e2726ba716e7bb28316493328

SHA256
238a45614b67a38facf98730b2b5e316b424f79b4ad591eddb6ec52460c3265c

SHA512
2e6342e689a090854a24db2d837975eccdcaf8f78a3dff568e9dde6f76b2c0b929f307498b278a1feae5eec17e60cdbc81b8f10d0379dd1c77b6a0b8da5b5370

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll
MD5
b5da8c6339ac4fe30dab6be4ca4fb8f5

SHA1
fa628818d38d49527a4cdaa46b47bfd1ea18477d

SHA256
6677f595565cc80ad6cc46dda9760ffb1c5d02cdd3a36cb525f5a96d8edc601c

SHA512
1619ce0bcb62ddcb22fe0d5caf456a2ad84d08ffb4b42951aef18efb5e3e73458441b84fab815521c936fd94c78d474e47997ef4c9cc18aab90c77b029d0a5d7

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll
MD5
18ebc0da472b1efc4e8f6b6627cffc93

SHA1
20a7cf7558d8a7a5bbcc131cbaf4ba75d3f11815

SHA256
624ab9c6838a88550ad5d906e86829778b5a9fce09a55a67eadcbb5806058c98

SHA512
a443da09f063e6ba8711df6ac9c35aa26298356e3dcf819e7784b8641c609fa8fd5d30ec03964493790058b138534f342b65e0688b93e8fcd6d6aa772acd6f6d

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll
MD5
0884821e75b789d14faa4757a7f31880

SHA1
b837e32188a5673683d02bc62e21a23647308d7f

SHA256
1ebb321cbfeceb8eb13045118f09d43b94bc0172cdd185fbb3dffe58d7da10ab

SHA512
42fe74d5d28c20695d2230d66e0c368059e0726f494a2ecec3e2c8aef4e4a1c570f072564c59362c347e653c46b4f15af4db11fbc9ad0d2babbf8883df032ebb

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll
MD5
1c03d1935b5892738a188ba40cd5a223

SHA1
b793c3918203f57468a7baa83e8d9e6e7b775545

SHA256
d656c21853e185feb04c0decc52df277ed9d214e9ffa31b86ed34c682e1b5730

SHA512
f9fa9def40ec3053f3a75ab2bc8e7c68c8b806be5bb80cda726ac8c08e3152c32db84a43a9e5775851bde0067d9ce9c8657a19850887171b0b206685318dbf40

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll
MD5
2b59a7d400d00748a85d38de4ea3bb91

SHA1
2d7c8aab0f16c89069da8607c572d4fe06ab9c44

SHA256
820a07642bf0e6856ddd5ce724b083111aa1b9d8b5a3e713cd0b48d1dd1259ce

SHA512
ca37f389e60d8c9e8e2fd2f0635ade454a0b68732e9b92a41d1646376a5d8d3b0b116aed9f3e02df89ba461fa6ce5178271181feed6ba16c48f0694b1e4d2d7b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll
MD5
2b59a7d400d00748a85d38de4ea3bb91

SHA1
2d7c8aab0f16c89069da8607c572d4fe06ab9c44

SHA256
820a07642bf0e6856ddd5ce724b083111aa1b9d8b5a3e713cd0b48d1dd1259ce

SHA512
ca37f389e60d8c9e8e2fd2f0635ade454a0b68732e9b92a41d1646376a5d8d3b0b116aed9f3e02df89ba461fa6ce5178271181feed6ba16c48f0694b1e4d2d7b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll
MD5
1f98a71ac22012bf5024a5a5189d68a2

SHA1
adb5949c1c6801581054e8570bf2e3521311c998

SHA256
40c3740d17a3e26aeb8908f2ae130a54a5630326b317011cc9e6470773b3a00a

SHA512
56843cf7caa346b8607b8f53ae6816e754a9d97cd14b2a062ed20922ad97cdf81bc8917f8be576a5130e03833212b133729361f9081fd9dbcba2887debf6d8f1

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
MD5
d8f715ce5d1140663d9b239115129911

SHA1
314f9e92f19fab3764e10103a551fb658ea3a3c7

SHA256
8a800a35468743ae5aab3546108d572b41447bd32877734cd2cf00528d2fc586

SHA512
5685597553841a3e30e2cd2fc82f90803022618316204ba78945da16c9eb886be3ad9fd6abd08eab874bf7fe1e9ff9a5301e426bc5513dce0d7a32eeb9ab2040

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
MD5
d993f89d9117e6bbd996a7a950be9f3b

SHA1
c942b04871af9d23224ab9ae8ec71b2de1ed8145

SHA256
747d66a808c25a37c59408f9e53b86b2368d49a62e34139ef7d22f97691d2882

SHA512
6bf248ab87031fc85b7b5edf474ce503d6de7dc16370a1cca1cc6e7d4e4fd4f472d5baafcb285a83c38dc1c1d912b9dc00a7b85dd03bd0b1784296d9a833e9cc

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
MD5
d993f89d9117e6bbd996a7a950be9f3b

SHA1
c942b04871af9d23224ab9ae8ec71b2de1ed8145

SHA256
747d66a808c25a37c59408f9e53b86b2368d49a62e34139ef7d22f97691d2882

SHA512
6bf248ab87031fc85b7b5edf474ce503d6de7dc16370a1cca1cc6e7d4e4fd4f472d5baafcb285a83c38dc1c1d912b9dc00a7b85dd03bd0b1784296d9a833e9cc

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll
MD5
89ddaa19eb5f5e083d8d2562ec30d181

SHA1
72b919b863c954b446d2fa05257a89e287ba419d

SHA256
882eb2aa8e008016d07942b3ff5990e3e04f99df08fa3cdb1ff4e94b08168f22

SHA512
8fc864318b00ca82fb184ad51797b00db5a74ce3bbd791dd6d933b21ea8badbc48ba50b016c1c67f2c26a5af05e839cfb4150c4b9aa9ae77f16089fd445a8f6c

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll
MD5
5074ba3f6753cdcee1f8a87a75ee494c

SHA1
f30ed812053c4c980635732fcf239d4ce57888e2

SHA256
0cdd5bf55454607312a8acf5bce99a9670060a22a7fc93fffab3ea83f277643b

SHA512
8d145cf8171bff0ee75770bfb381486bdd98122510676fa510744fb047731ebb15373157d508820d261ae54b59d3ef67d3cf3c86a73a7036a1ea016eaf6eb17f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll
MD5
c4fe3f03efd3188252caa101f954ffeb

SHA1
98b613aee45c71aed9d2be0d61d7ace323929e9c

SHA256
95bb425be3d515a6a58f7399d44dd9e032baea11667dfdba29517c460171880a

SHA512
80018e0bddf079367d3568433a5f89f0144aa0a75286b0105fe32aeeb5d80876c9b2e1ecaafb70fb041271e27a234a2cb88a2d3d160a4aa3768ccfcfc574704a

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll
MD5
c4fe3f03efd3188252caa101f954ffeb

SHA1
98b613aee45c71aed9d2be0d61d7ace323929e9c

SHA256
95bb425be3d515a6a58f7399d44dd9e032baea11667dfdba29517c460171880a

SHA512
80018e0bddf079367d3568433a5f89f0144aa0a75286b0105fe32aeeb5d80876c9b2e1ecaafb70fb041271e27a234a2cb88a2d3d160a4aa3768ccfcfc574704a

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll
MD5
e2893c72dd3bc0a0aafce73ee590a67e

SHA1
dea575e53d54aef9308ae7a55687a4412f57bc2b

SHA256
2f7fbed41fe526b950971240423c28d3117fec3a11eb27aa1bad0dcfb060cf08

SHA512
3f8c78e46182535f3217e41077fbe727f73405e3381a9252e1cd0d9d1cc9db0250795032a0844f03941f8199f7d1eb1602e37f875992228a1c7a6db111e024d9

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll
MD5
cd0c37f1875b704f8eb08e397381ac16

SHA1
249d33c43e105a1c36ec6a24e5ef8dbc5f56b31b

SHA256
d86ac158123a245b927592c80cc020fea29c8c4addc144466c4625a00ca9c77a

SHA512
d60c56716399b417e1d9d7d739af13674c8572974f220a44e5e4e9ab0b0a23b8937bd0929eee9f03f20b7f74db008f70f9559a7eb66948b3afab5b96bdd1a6d5

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll
MD5
cd0c37f1875b704f8eb08e397381ac16

SHA1
249d33c43e105a1c36ec6a24e5ef8dbc5f56b31b

SHA256
d86ac158123a245b927592c80cc020fea29c8c4addc144466c4625a00ca9c77a

SHA512
d60c56716399b417e1d9d7d739af13674c8572974f220a44e5e4e9ab0b0a23b8937bd0929eee9f03f20b7f74db008f70f9559a7eb66948b3afab5b96bdd1a6d5

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll
MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll
MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll
MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140_1.dll
MD5
7667b0883de4667ec87c3b75bed84d84

SHA1
e6f6df83e813ed8252614a46a5892c4856df1f58

SHA256
04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d

SHA512
968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140_1.dll
MD5
7667b0883de4667ec87c3b75bed84d84

SHA1
e6f6df83e813ed8252614a46a5892c4856df1f58

SHA256
04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d

SHA512
968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140_1.dll
MD5
7667b0883de4667ec87c3b75bed84d84

SHA1
e6f6df83e813ed8252614a46a5892c4856df1f58

SHA256
04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d

SHA512
968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140_1.dll
MD5
7667b0883de4667ec87c3b75bed84d84

SHA1
e6f6df83e813ed8252614a46a5892c4856df1f58

SHA256
04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d

SHA512
968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
95201d9e44c732d9b261b4b334505d6b

SHA1
d5f3f499ef27920d8a614152191a7e0c2f9c0264

SHA256
baa9a89717f4013b2799bd06490c738246759ecdf7a3200406fad5a443e83669

SHA512
15ddf637b642144dca99e2794cb4ca4d1dfa9d682e7eb42075d9b269dd5a479b5ea86017db142b599a3f022ebb695baf3691305ab17009060b4f64ddd7254282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db
MD5
8665de22b67e46648a5a147c1ed296ca

SHA1
b289a96fee9fa77dd8e045ae8fd161debd376f48

SHA256
b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f

SHA512
bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
c553ea8a8743a6a50789a7575e1db5d8

SHA1
2dbd5043d48805ae6a7d76f2ebf2f70a78004753

SHA256
a343a3281bb6b6ef8f99604dd52d233abba6dea5d17637b69d75188f4007c5a1

SHA512
1442223c2efa5ddd90e2f93201085787ae56de041a2bccbb94c1cd6b68341159671414ee3820df352ae00cd1d879b170ff9f07e5eee1f7d148d5fc10f0678fd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch
MD5
bd3457e50947d4280734e74b51b5b68d

SHA1
424635c6b5622a6c01a59d290a1c9ab8e593effc

SHA256
23d647979bc5dc186de5ba3e00a222a912ab8e4782eb6407efa70e29e95979f5

SHA512
e83e3615a5e94af288eb1c9b92f55e271765cc43531ec94574371debf63c0c4a58327b6fd8a4775bfba8a3234220cb0396b6d33164309a09a1d826c0689143fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch
MD5
bd3457e50947d4280734e74b51b5b68d

SHA1
424635c6b5622a6c01a59d290a1c9ab8e593effc

SHA256
23d647979bc5dc186de5ba3e00a222a912ab8e4782eb6407efa70e29e95979f5

SHA512
e83e3615a5e94af288eb1c9b92f55e271765cc43531ec94574371debf63c0c4a58327b6fd8a4775bfba8a3234220cb0396b6d33164309a09a1d826c0689143fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch
MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch
MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
memory/364-158-0x0000000006760000-0x0000000006761000-memory.dmp

Filesize
4KB

Download
memory/364-157-0x0000000071E4E000-0x0000000071E4F000-memory.dmp

Filesize
4KB

Download
memory/364-162-0x000000006E790000-0x000000006E7DC000-memory.dmp

Filesize
304KB

Download
memory/364-161-0x0000000006765000-0x0000000006767000-memory.dmp

Filesize
8KB

Download
memory/364-159-0x0000000006762000-0x0000000006763000-memory.dmp

Filesize
4KB

Download
memory/3976-140-0x0000000007110000-0x000000000712E000-memory.dmp

Filesize
120KB

Download
memory/3976-150-0x0000000009950000-0x0000000009976000-memory.dmp

Filesize
152KB

Download
memory/3976-145-0x0000000008970000-0x000000000898E000-memory.dmp

Filesize
120KB

Download
memory/3976-139-0x0000000007D70000-0x0000000007DD6000-memory.dmp

Filesize
408KB

Download
memory/3976-146-0x0000000009D90000-0x000000000A40A000-memory.dmp

Filesize
6.5MB

Download
memory/3976-147-0x0000000009710000-0x000000000972A000-memory.dmp

Filesize
104KB

Download
memory/3976-148-0x00000000098C0000-0x00000000098D6000-memory.dmp

Filesize
88KB

Download
memory/3976-149-0x0000000008980000-0x000000000898A000-memory.dmp

Filesize
40KB

Download
memory/3976-138-0x0000000007D00000-0x0000000007D66000-memory.dmp

Filesize
408KB

Download
memory/3976-143-0x000000007F3F0000-0x000000007F3F1000-memory.dmp

Filesize
4KB

Download
memory/3976-137-0x00000000074E0000-0x0000000007502000-memory.dmp

Filesize
136KB

Download
memory/3976-144-0x000000006E790000-0x000000006E7DC000-memory.dmp

Filesize
304KB

Download
memory/3976-141-0x0000000003105000-0x0000000003107000-memory.dmp

Filesize
8KB

Download
memory/3976-136-0x0000000003102000-0x0000000003103000-memory.dmp

Filesize
4KB

Download
memory/3976-135-0x0000000007530000-0x0000000007B58000-memory.dmp

Filesize
6.2MB

Download
memory/3976-134-0x0000000003100000-0x0000000003101000-memory.dmp

Filesize
4KB

Download
memory/3976-132-0x0000000004A90000-0x0000000004AC6000-memory.dmp

Filesize
216KB

Download
memory/3976-142-0x00000000093A0000-0x00000000093D2000-memory.dmp

Filesize
200KB

Download
memory/3976-133-0x0000000071E4E000-0x0000000071E4F000-memory.dmp

Filesize
4KB

Download