8ed57a0bce1c8e5dd955f5b720615899a69aa586aeea8ae9d5813a56c7d3f8b8

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2023, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Install-x64-basic.bat
Size

86B
MD5

6f5f33fe7ab0358de6ff8ef4747533bc
SHA1

1c3bbf27ea6f7f90a2ba7c849f6bcb603d5c6c19
SHA256

4b4ea5e4728b000f16da2e8978d09546b4bec662e0d642dca63fb9b242ad8ec9
SHA512

d407910a6f912c53591d182287b373d10791cb6f9f3a9fa2c8c4fb79df1d81305e9023d8d22cdbd6b0d9b50c1d918356905ac0e02cb68f3703076cfdac3327c2

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	OfficeC2RClient.exe

Executes dropped EXE 3 IoCs

pid	Process
2188	OfficeClickToRun.exe
2648	OfficeClickToRun.exe
4872	OfficeC2RClient.exe

Loads dropped DLL 36 IoCs

pid	Process
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2648	OfficeClickToRun.exe
2648	OfficeClickToRun.exe
2648	OfficeClickToRun.exe
2648	OfficeClickToRun.exe
2648	OfficeClickToRun.exe
2648	OfficeClickToRun.exe
2648	OfficeClickToRun.exe
2648	OfficeClickToRun.exe
4872	OfficeC2RClient.exe
4872	OfficeC2RClient.exe
4872	OfficeC2RClient.exe
4872	OfficeC2RClient.exe
4872	OfficeC2RClient.exe
4872	OfficeC2RClient.exe
4872	OfficeC2RClient.exe

Checks system information in the registry 2 TTPs 6 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OfficeC2RClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OfficeC2RClient.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10450v3.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120619v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule224900v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700500v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703101v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700250v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10802v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11504v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120600v4.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700351v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230104v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule70006v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120680v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702050v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702001v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11190v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11285v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120616v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701250v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702951v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702250v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702051v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702601v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222042v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120611v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120620v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120602v10.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704201v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230157v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10800v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11794v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120677v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700201v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120660v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701901v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701651v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230166v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11289v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11793v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120615v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120642v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701501v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11264v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120402v21.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120613v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120648v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700950v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704200v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704151v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10829v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule70027v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120666v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702300v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700951v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700300v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701100v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11187v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120634v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120679v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701701v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11502v0.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700401v2.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230162v1.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120673v0.xml	OfficeClickToRun.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.es-mx.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\AppVShNotify.exe	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2R64.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\AppVClient.man	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.de-de.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.el-gr.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.uk-ua.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\msvcp140.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\OfficeOEMPlugin.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\api-ms-win-core-file-l2-1-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\api-ms-win-core-localization-l1-2-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.ms-my.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\OfficeC2RClient.exe	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\RepoMan.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\AppVPolicy.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.hr-hr.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RHeartbeatConfig.xml	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.th-th.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\InspectorOfficeGadget.exe	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\msvcp140.dll.bak	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\api-ms-win-crt-filesystem-l1-1-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\api-ms-win-crt-heap-l1-1-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\officesvcmgrschedule.xml	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\StreamServer.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\vcruntime140_1.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\AppVScripting.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.cs-cz.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.zh-tw.dll	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\vcruntime140.dll.bak	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.kk-kz.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.sl-si.dll	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll.bak	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.pt-br.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.zh-cn.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.et-ee.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.he-il.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\api-ms-win-crt-conio-l1-1-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\api-ms-win-crt-runtime-l1-1-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.lv-lv.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\concrt140.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\msvcp120.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\api-ms-win-crt-private-l1-1-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\AppVIntegration.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\ApiClient.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\AppVCatalog.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2R32.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.fr-ca.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.fr-fr.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\FrequentOfficeUpdateSchedule.xml	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\api-ms-win-core-synch-l1-2-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\api-ms-win-crt-math-l1-1-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.ar-sa.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.hi-in.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\api-ms-win-crt-stdio-l1-1-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\AppvIsvSubsystems32_msix.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\MavInject32.exe	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\officeinventory.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\api-ms-win-crt-multibyte-l1-1-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\C2RINTL.fi-fi.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\api-ms-win-crt-utility-l1-1-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\appvcleaner.exe	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\AppVIsvStreamingManager.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.16827.20130OfficeC2R7C5CC296-A69F-4452-AC08-E0A5B32785E7\ClientCapabilities.json	OfficeClickToRun.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	bin.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	bin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bin.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	bin.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	bin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	bin.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\LastClean = 101daba47ef6d901	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|5"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|13"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\VersionId = "uint16_t\|0"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.16827&crev=3	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.16827&crev=3\0\Url = "https://officeclient.microsoft.com/config16/?syslcid=1033&build=16.0.16827&crev=3"	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.6 = 6e672e46696e6e697368456e74416765416e644469736162696c69747942696173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4672656e6368456e746572707269736547726f757033222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4765726d616e4164765765697365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4765726d616e436f6d6d614265666f7265436f6f7264696e6174696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4765726d616e456e744469736162696c69747942696173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4974616c69616e436f6d6d61506172656e746865746963616c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4b6f7265616e456e744469736162696c69747942696173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4e6f7277656769616e426f6b6d61616c456e746572707269736547726f757031222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e506f6c697368456e746572707269736547726f757032222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e5275737369616e456e744469736162696c69747942696173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e53776564697368456e746572707269736547726f757031222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e5475726b697368456e746572707269736547726f757033222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772617068496d706f72744865647769675558222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772617068496d706f7274496e73657274416c6c4f626a6563747356696577222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772617068496d706f72744f75746c6f6f6b496e7365727446696c65222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e47726170686963732e4368616e6765476174652e5570646174655461626c65426f756e6473466f72547970696e67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4943726974697175652e4c6f674772616d6d6172466c61674564697473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4c6173744d696c6554656c656d657472792e46656174757265466c69676874222c20225622203a2022696e7436345f747c3722207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4f6666696365496e736964657243757272656e74526567697374726174696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e50726f6f66696e672e4175746f4d616e616765722e41637469766974696573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e525443416c776179734f6e52696e6746656e636550657263656e74222c20225622203a2022696e7436345f747c31303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e54686573617572757350616e652e41637469766974696573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e576f72642e53656e6445646974466c6167546f4e6f4572726f724576656e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e4170746f734561726c794c6f6164222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e436f6c6f72466f6e74537570706f7274456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e48696464656e466f6e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e4973446f776e6c6f61644261636b67726f756e645461736b466f6e7473456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e536b697048696464656e436c6f7564466f6e7473496e457863656c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e5472616e7363726962652e436f6e666967436865636b44697361626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c655265676973746572536f757263654578656375746543616c6c6261636b416c77617973222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e417269614d617854656172646f776e55706c6f616454696d65496e536563222c20225622203a2022696e7436345f747c3222207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e456e61626c65416c6c417070496473466f72314453222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e4973436f6d706f6e656e7444617461456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e566f6c756d65547261636b696e674d61784576656e7473222c20225622203a2022696e7436345f747c3530303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4169725370616365222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22456e61626c654f6e44656d616e64507265636973696f6e546f7563685061644c6f6767696e6754656c656d657472795c22203a207b205c224576656e74466c61675c22203a203438383936207d207d2c205c225375624e616d657370616365735c22203a207b205c224261636b656e645c22203a207b205c224576656e74735c22203a207b205c224c61796572486f7374496e697469616c697a6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d706f7369746f7253657373696f6e547970655c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2257696e33325c22203a207b205c225375624e616d657370616365735c22203a207b205c224c65676163795c22203a207b205c224576656e74735c22203a207b205c22416e696d6174696f6e50657263656e74556e64657233304650535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416e696d6174696f6e4176674650535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726f737357696e54496d654f6646697273744672616d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224176657261676550726573656e74735065725365636f6e645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4368617274696e67222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22436861727445326f4c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436861727445326f536176655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224368617274696e67456e644c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e436c69636b546f52756e222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c2250726f636573734b696c6c657253687574646f776e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225472616e73706f72745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f776e6c6f61644361625c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c225363656e6172696f5c22203a207b205c224576656e74735c22203a207b205c225570646174655461736b557064617465646574656374696f6e325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b557064617465646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b557064617465636c69656e74646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265706169725461736b46756c6c7265706169725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265706169725461736b52656d6f7665696e7374616c6c6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b436f6e6669677572656c696768745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c69656e747570646174655461736b436c69656e74646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b53747265616d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b437265617465776f726b696e67636f6e66696775726174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b55706461746566696e616c697a655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225461736b4c61737452756e4865617274626561745c22203a207b205c224576656e74735c22203a207b205c225461736b4c61737452756e4865617274626561745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22556e6976657273616c426f6f7473747261707065725c22203a207b205c224576656e74735c22203a207b205c224170706c69636174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6c6c656374506172616d65746572735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6c6c656374456d6265646465645369676e61747572655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616c63756c617465506172616d65746572735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436c69656e744361624d616e616765725c22203a207b205c224576656e74735c22203a207b205c225461736b557064617465436c69656e74446f776e6c6f6164446f457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225461736b436c69656e74446f776e6c6f6164446f457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253747265616d4361625c22203a207b205c224576656e74735c22203a207b205c22446f776e6c6f616453747265616d4361625c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225472616e73706f72745c22203a207b205c225375624e616d657370616365735c22203a207b205c224578706572696d656e74616c5472616e73706f72745c22203a207b205c224576656e74735c22203a207b205c22436162735c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c224576656e74466c61675c22203a20323536207d207d207d2c205c225472616e73616374696f6e616c46696c654f7065726174696f6e735c22203a207b205c224576656e74735c22203a207b205c224170706c794368616e6765735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457865637574655472616e73616374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e446961676e6f7374696373222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436f6c6c6563746f725c22203a207b205c224576656e74735c22203a207b205c2253746172745472616365436f6c6c6563746f725c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e446f6373222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22446f63756d656e74416374697669746965735c22203a207b205c224576656e74735c22203a207b205c2241637469766974794c6f6744697363617264466f72446f63756d656e744368616e67655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67547269676765724173796e635461736b576f726b65725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575654c6f61644173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565496e697446696c65506174685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565437265617465496e73616e63655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565417070656e644173796e6342617463685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565577269746541637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756552656d6f76654173796e6342617463685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575655772697465446f63756d656e74496e666f4865616465725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756554727944656c657465456d70747946696c654173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565496e7365727441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e717565756541637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6741646441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674372656174654c6f675c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67536176654e657746696c655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674469736361726441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e71756575654c6f63616c4e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e71756575654f7574676f696e674e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575654469736361726441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224170694f70656e416374	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|9"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSessionUpgradeCandidate	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.2 = 6f66742e4f66666963652e4163636573732e55706461746550726f70536865657454657874436f6c6f724f6e5468656d654368616e6765222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e44756d6d79443244446576696365436f6e74657874466c75736843616c6c4f6e44656d616e6432222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e49676e6f7265486f7374696e674c617965724368696c6472656e4f7065726174696f6e73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e536574466c697054657874757265557064617465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e53796e6368726f6e6f757353686f7757696e646f77496e4d6f7265436173657332222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e5573654944697265637433644465766963654163636573735633222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4170706c652e5469636b6574436163686544697361626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175674c6f6f702e416e6e6f746174696f6e436865636b526573756c744265666f726545726173655632222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175674c6f6f702e456e61626c6542617463684f7074696f6e73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175674c6f6f702e576f726b666c6f7744697361626c65642e5265706c6163654f626a656374576f726b666c6f77222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4358452e426f6f7449646c655468726f74746c6572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4358452e48696464656e466f6e74734d736f466f6e745069636b657257696e3332222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4358452e4d736f2e52656163742e4f6666696365486f73742e4973436f6e6669677572655344584261736550617468456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e43686172742e50726573656e746174696f6e4c696e65456e64696e67466978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e417070564d61785265747279436f756e74222c20225622203a2022696e7436345f747c313422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e417070564d6178526574727954696d654c696d6974222c20225622203a2022696e7436345f747c363030303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e417070565265747279496e74657276616c222c20225622203a2022696e7436345f747c3230303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e43444e436f6e66696753657276696365507265666978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e4368616e6765476174652e557365456e756d57696e646f7773546f4761746865725665746f73222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e436c69656e7444656c74615061636b61676573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e446f72694f6e496e7374616c6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e446f72695761746368657243616c6c496e74657276616c222c20225622203a2022696e7436345f747c393030303030303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e446f7269576174636865725175657565496e74657276616c222c20225622203a2022696e7436345f747c36303438303030303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e446f776e6c6f6164436c69656e74576974684d534958222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5265706f4d616e506970656c696e65456c69676962696c697479222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5265706f6d616e466c69676874446f776e6c6f6164436f7272757074696f6e436865636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5265706f6d616e466c6967687453657454727573744c6576656c4f6e46696c6532222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5265706f6d616e466c6967687455736553696d706c654c6f67676572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5265706f6d616e496e7374616c6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e52756e446f726957617463686572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e53687574646f776e417070734f6e4c6f636b73637265656e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5570646174654c6f636b73637265656e41707073546f4b696c6c222c20225622203a20227374643a3a77737472696e677c75636d6170692e6578652c6c796e6368746d6c636f6e762e6578652c6c796e632e6578652c736b7970652e6578652c73656172636870726f746f636f6c686f73742e6578652c6f7366696e7374616c6c65722e6578652c6d736f73796e632e6578652c6e616d65636f6e74726f6c7365727665722e6578652c6f6e656e6f74656d2e6578652c70657266626f6f73742e6578652c67726f6f76652e6578652c6d736f69612e6578652c6f66666963656261636b67726f756e647461736b68616e646c65722e6578652c6d736f6173622e6578652c73647868656c7065722e6578652c61692e6578652c61696d67722e6578652c6f706572666d6f6e2e65786522207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5573654261636b75704465706c6f796d656e744f7074696f6e57697468496e73706563746f72546f6f6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e55736542696e674164646f6e4f6e496e7374616c6c222c20225622203a20227374643a3a77737472696e677c656e61626c656422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e55736542696e674164646f6e4f6e557064617465222c20225622203a20227374643a3a77737472696e677c656e61626c656422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e557365456e756d57696e646f7773546f4761746865725665746f73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5573655465616d734164646f6e222c20225622203a20227374643a3a77737472696e677c656e61626c656422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5573655465616d734f6e557064617465427573696e657373222c20225622203a20227374643a3a77737472696e677c656e61626c656422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5573655465616d734f6e55706461746550726f506c7573222c20225622203a20227374643a3a77737472696e677c656e61626c656422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e436f686572656e6365457870657269656e6365456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e466565646261636b2e466561747572652e46696c6555706c6f6164222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e466565646261636b446973616d626967756174696f6e53637265656e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e486f73746564466565646261636b5461736b50616e65222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e497346656174757265537065636966696344617461466f723350456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e536173466565646261636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446961676e6f73746963732e4173796e63496e6974436f6c6c6563746f7273456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446961676e6f73746963732e456e61626c6552657365744f6e4964656e74697479537769746368222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e414354522e5468726f74746c654361706163697479222c20225622203a2022696e7436345f747c313022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e414354522e5468726f74746c65496e74657276616c4d736563222c20225622203a2022696e7436345f747c3130303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e43617264546f75636861626c65222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e44484352657475726e48616e646c6564446973636172644472616674222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e44726f70536861646f7757696e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e44726f70536861646f7757696e5632222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e456e666f726365444843576964746832222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e466978694f5353656c6563744a697474657232222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e4e6577436f6d6d656e74427574746f6e44697361626c6564466f637573466978222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e50616e65546162466f637573466978657332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e506f6c697465466f637573466f7257696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e507572654361726453656c656374696f6e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e50757265436f6d706f6e656e74735265666163746f72222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e5465616368696e675549416e63686f72222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e5573654973526561644f6e6c7950726f70222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d736f2e4c616e64696e67506167652e536861726564576974684d652e416767726567617465644d7275222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d736f2e4f757453706163652e436f70795061746853796e6346697832222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d736f2e4f757453706163652e4d616e61676553657276696365732e526563726561746553657276696365496d61676552656e646572657273222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e446f63756d656e744d72752e416767726567617465644d72752e49734c6f63616c4974656d73456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e486f6d65506167652e5265636f6d6d656e646564446f63756d656e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e486f6d65506167652e5365617263682e456e61626c65416767726567617465644d7275536561726368536f75726365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4d6f6465726e436f6d6d656e74732e5265656e61626c654d656e74696f6e436f6e7461637443617264222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4d736f2e486f6d65706167652e49734f6e6c696e6553657276696365466978456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4d736f2e4f757453706163652e436f70795061746853796e63466978222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4f44656c74612e53747265616d4d6f6465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e4361636865457870697279496e4d696e222c20225622203a2022696e7436345f747c37323022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e436f6e666967496444656c696d69746572496e4c6f67222c20225622203a20227374643a3a77737472696e677c3b22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e436f6e6669674c6f67546172676574222c20225622203a20227374643a3a77737472696e677c64656661756c7422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e44697361626c65436f6e6669674c6f67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e456e61626c65536d61727445546167222c20225622203a2022696e7436345f747c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e63373265613238372d656437372d346661362d613438302d333731323430366333363765222c20225622203a20227374643a3a77737472696e677c616b612e6d732f45637343616e61727922207d2c207b20224622203a20224d6963726f736f66742e4f666669	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|14"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.9 = 486973746f727950616765436f707956657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616765436f707956657273696f6e496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f7279506167654372656174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616765526573746f726556657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f72795061676553656c65637456657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616e654e6f6e436c69636b61626c654974656d53656c65637465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f63616c41637469766974696573426567696e526566726573685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6666696365436f6c6c61624163746976697479436f6d6d616e644d534f446f63756d656e7450726f76696465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225368617265506f696e74436865636b4f757446696c65546f4c6f63616c466f6c6465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546f67676c65486964655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546f67676c6553686f775c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225759574143616c6c6f757453686f7743616c6c6f75745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7365656e416374697669747943616c6c6f757450726573656e7443616c6c6f75745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7365656e41637469766974794765744c6173745669657754696d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7365656e416374697669747946696e6443757272656e74557365724c6f67696e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7365656e416374697669747943616c6c6f7574436c69636b65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253686f77536d616c6c53637265656e435759574143616c6c6f75745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d7275416461707465725c22203a207b205c224576656e74735c22203a207b205c224872416464446f63756d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872416464506c6163655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872416464446f63756d656e74576974684f7074696f6e7357697468436f6e746578745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872416464506c616365576974684f7074696f6e7357697468436f6e746578745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872416464446f63756d656e745061746857697468436f6e746578745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872416464506c6163655061746857697468436f6e746578745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872416464446f63756d656e74496e6465785c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872416464506c616365496e6465785c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22487252656d6f7665506174685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872416464576974684f7074696f6e7357697468436f6e746578745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22417070446f63735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745c22203a207b205c225375624e616d657370616365735c22203a207b205c2241637469766174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6173744f70656e6564446f63756d656e744d657461646174615c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d6f6465726e446f6354656d706c617465536572766963655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225361766550726f6d707448656c7065725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e74436861745c22203a207b205c224576656e74735c22203a207b205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e6572436f6e6e65637465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e6572436f6e6e656374696e674576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e6572446973636f6e6e65637465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e6572446973636f6e6e656374696e674576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e65725265667265736850657273697374656e7453746174654173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e65725265667265736850657273697374656e7453746174654173796e63496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e65725265667265736850657273697374656e7453746174654173796e6352657472795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e657253746172745265616c74696d65436f6e6e656374696f6e4c697374656e696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e657253746f705265616c74696d65436f6e6e656374696f6e4c697374656e696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572436f6e6e65637465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572436f6e6e656374696e674576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572446973636f6e6e65637465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572446973636f6e6e656374696e674576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e7453746174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e745374617465496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e74537461746552657472795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e7453746174655265747279496e6e65724c6f6f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f61646361737465725265667265736850657273697374656e7453746174654173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f616463617374657253746172745265616c74696d65436f6e6e656374696f6e4c697374656e696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f616463617374657253746f705265616c74696d65436f6e6e656374696f6e4c697374656e696e675c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253686172696e6755495c22203a207b205c225375624e616d657370616365735c22203a207b205c22436f6c6c616250616e65557365725c22203a207b205c224576656e74735c22203a207b205c22536861726550616e65436f6d706c657465446973706c61795c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2253686172654469616c6f675c22203a207b205c224576656e74735c22203a207b205c224e61766967617465546f5765624469616c6f675c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253656e6441734174746163686d656e745c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d2c205c224544505c22203a207b205c224576656e74735c22203a207b205c22506f6c6963794d657461646174615c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c225369746573536572766963654170695c22203a207b205c224576656e74735c22203a207b205c22526571756573744173796e635c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225265616446726f6d43616368655c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e44796e616d696343616e766173222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c224f7574537061636543616e7661735c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2250726f677265737355695c22203a207b205c224576656e74735c22203a207b205c22556e6578706f727461626c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224578706f727461626c655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2243616e7661735c22203a207b205c225375624e616d657370616365735c22203a207b205c225765624469616c6f675c22203a207b205c225375624e616d657370616365735c22203a207b205c2242726f777365724576656e7448616e646c65725c22203a207b205c224576656e74735c22203a207b205c224f6e4c6f616465645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c224e617669676174696f6e48616e646c65725c22203a207b205c224576656e74735c22203a207b205c224f6e4e61766967617465645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e457863656c222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436f617574685c22203a207b205c224576656e74735c22203a207b205c22457865637574654d65726765496e7374616e63655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224b69636b4f6666517569636b536176655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22586c53796e6353746174654368616e67654c697374656e65724f6e53796e6353746174654368616e67655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f63734765744f70496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c6f7365576f726b626f6f6b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224261636b67726f756e6451756575655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f637350756c6c4f704f6e4765745265766973696f6e436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f637350756c6c4f704f6e4765745265766973696f6e526573706f6e736552656365697665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f637350756c6c4f70464275696c644765745265766973696f6e526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f637350756c6c4f704f6e436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b5061636b61676546696c6553746172745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b5061636b61676546696c6553746f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b456e637279707465644d6574726f46696c6553746172745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b456e637279707465644d6574726f46696c6553746f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536b697070656443686743656c6c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243717532674872446f456e74657243656c6c466d6c61584c5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436f6d6d616e645c22203a207b205c224576656e74735c22203a207b205c2252656672657368416c6c5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22526566457874446174615c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c2246696c65536176655c22203a207b205c224576656e74735c22203a207b205c225361766541735361766546696c655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c2243616c635c22203a207b205c224576656e74735c22203a207b205c224669784d616e75616c43616c634f6e4c6f61645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4578706572696d656e746174696f6e222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c224564676546657463685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f6164696e67466972737453657373696f6e43616368655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744665617475726573466f72534458556e65787065637465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224142436f6e66696754726561746d656e7454797065556e65787065637465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e457874656e736962696c697479222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436174616c6f675c22203a207b205c224576656e74735c22203a207b205c2245786368616e67654765744c617374557064617465325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22547279446973636f76657245777355726c735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2245786368616e67654765744c6173745570646174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22547279446973636f76657245777355726c73325c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2254727948616e646c6541757468656e7469636174696f6e526573756c745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2245786368616e6765476574456e7469746c656d656e74735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2245786368616e67654765744d616e6966657374735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2245786368616e676552656672657368457874656e73696f6e4c6973745c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2241757468656e7469636174696f6e526963684170695c22203a207b205c224576656e74735c22203a207b205c22476574416363657373546f6b656e56324261636b67726f756e645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574416363657373546f6b656e56324d61696e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574416363657373546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2247657441757468546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22496e7374616c6c65725c22203a207b205c225375624e616d657370616365735c22203a207b205c225461736b456e67696e655c22203a207b205c224576656e74735c22203a207b205c224765744368616e676564536f6c7574696f6e735461736b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22476574	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\RemoteClearDate = 0040a7e3a36bc901	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.16827&crev=3\Last = "0"	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.10 = 4368616e676564536f6c7574696f6e735461736b5265676973746572536f6c7574696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744368616e676564536f6c7574696f6e735461736b52656769737465724e65757472616c5061636b6167655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b5363686564756c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b526567697374726174696f6e4572726f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b537563636573735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b496e46696e616c697a655374617465457863657074696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b536574496e7374616c6c5374617475734572726f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225061636b61676541707078457874726163746f725461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225061636b6167655265717565737465725461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225061636b6167655265717565737465725461736b53657276696365526571756573745374617475735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457870466972737453657373696f6e5461736b446573747275637465644265666f7265436f6d706c6574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457870466972737453657373696f6e5461736b436f6d706c6574656446657463685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457870466972737453657373696f6e5461736b496e7374616c6c6564417070735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457870466972737453657373696f6e5461736b4170704665746368446f6e655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225061636b61676553617665725461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224578705061636b616765526567697374726174696f6e496e666f5461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225061636b616765536f6c7574696f6e49445570646174655461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224578747261637446696c6573546573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2245787472616374466f6f747072696e7446696c6573546573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b52756e4e657874457863657074696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f73664d616e696665737456616c696461746f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224765744368616e676564536f6c7574696f6e735461736b52656769737465724c6f63616c655061636b6167655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243496e7374616c6c65724d61696e5368656c6c476574436f6e66696755726c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253636176656e6765725461736b436c656172526567697374726174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b416e64557064617465416c6c536478536f6c7574696f6e735461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b416e64557064617465416c6c536478536f6c7574696f6e735461736b5265676973746572536f6c7574696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b416e64557064617465416c6c536478536f6c7574696f6e735461736b52656769737465724e65757472616c5061636b6167655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b416e64557064617465416c6c536478536f6c7574696f6e735461736b52656769737465724c6f63616c655061636b6167655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744368616e676564536f6c7574696f6e735461736b4c6f63616c65556e617661696c61626c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744368616e676564536f6c7574696f6e735461736b5061636b616765556e617661696c61626c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253636176656e6765725461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253636176656e6765725461736b436c656172526567697374726174696f6e4661696c65645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d61696e5c22203a207b205c224576656e74735c22203a207b205c225344584261636b67726f756e645461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f7366496e7374616c6c65725374617274436f6d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f7366496e7374616c6c657253746172744e6f74434f4d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243496e7374616c6c65724d61696e5368656c6c496e69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f7366496e7374616c6c657253746172744d61696e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243496e7374616c6c65724d61696e5368656c6c5363686564756c655461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243496e7374616c6c65724d61696e5368656c6c53687574646f776e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744e6574776f726b436f737454696d656f75745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744e6574776f726b436f737453657276696365556e617661696c61626c655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d2c205c224576656e74735c22203a207b205c225061636b61676541707078457874726163746f725461736b5061636b616765496e666f726d6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224f66666963654a735c22203a207b205c224576656e74735c22203a207b205c22417070496e697469616c697a6174696f6e585c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225363726970744c6f6164585c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224f7366416374696f6e5c22203a207b205c224576656e74735c22203a207b205c22416374696f6e457865637574696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225061636b61676543616368655c22203a207b205c224576656e74735c22203a207b205c225365727669636544656c6976657279465343616368655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22536574757044656c6976657279465343616368655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224765744361636865645265736f757263655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2246534361636865496e76616c69645c22203a207b205c224576656e74466c61675c22203a20353132207d207d207d2c205c2253616e64626f785c22203a207b205c224576656e74735c22203a207b205c22506f73744f7366436f6e74726f6c4d6573736167655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f445041637469766174696f6e48616e67696e675c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2253616e64626f784372656174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c6574654f7366436f6e74726f6c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225365744f4d546f6b656e4f6e54726964656e74486f73745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253657454726964656e74486f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224372656174654f7366436f6e74726f6c56325c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f445053686f775461736b70616e65436f6e74726f6c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726561746552656d6f7465725c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446f776e6c6f61644d616e69666573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2252656c6f6164416c6c4f7366436f6e74726f6c735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225265737461727452656d6f7465725c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225265737461727453616e64626f7865735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253746172744f7366436f6e74726f6c5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2255585c22203a207b205c224576656e74735c22203a207b205c224c61756e63684f6d657853534f436f6e73656e744469616c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416761766555784d696e6f72426c6f636b65645c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2241707044656c6574656446726f6d446f63756d656e745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224469616c6f67436c6f7365645c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224469616c6f674f70656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253686f77496e666f626172436f6e73656e74566965775c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253686f774c6f6164696e6753746174655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253686f775265616374566965775c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22417070436f6d6d616e64735c22203a207b205c224576656e74735c22203a207b205c22417070436d6450726f6a656374696f6e5374617475735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224361636865446573657269616c697a6546726f6d53747265616d5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22436163686553657269616c697a65546f53747265616d5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224361636865536f6c7574696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22457773526566726573685c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2245786563757465416374696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2246616c6c6261636b546f46697273744c6976654964496e4f454d5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2246616c6c6261636b546f46697273744c6976654964496e526962626f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2246657463684361636865536f6c7574696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22496e7374616c6c4d616e696665737452656164795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c6f61644d696e43616368655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224d69734d61746368696e67526962626f6e4964656e74697479496e666f5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225072657061726553686f775461736b70616e6556325c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2252656d6f766546726f6d526962626f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253686f775465616368696e6743616c6c6f75745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225461736b70616e65417070436d64496e7374616c6c6174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c224f4d54656c656d657472795c22203a207b205c224576656e74735c22203a207b205c22576f72645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22416464696e50726566657463685c22203a207b205c224576656e74735c22203a207b205c22507265666574636849636f6e735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22507265666574636855726c5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225072656c6f61644d616e69666573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253616e64626f78507265666574636855726c5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2241637469766174696f6e5c22203a207b205c224576656e74735c22203a207b205c224352656d6f74657250726f78795c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2253696e676c655369676e4f6e5c22203a207b205c224576656e74735c22203a207b205c22446973706c617953534f436f6e73656e7450616765466f7241706943616c6c5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224578656375746547657453534f546f6b656e496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2247657441757468546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d2c205c224576656e74735c22203a207b205c224f445041637469766174696f6e466f7254616761353572735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2256626154656c656d65747279436f6d4f626a656374496e7374616e7469617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2256626154656c656d6574727950726f6a6563744c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434f4d416464696e4f7065726174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f4450417070436f6d6d616e647343616368655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f4450417070436f6d6d616e6473496e7374616c6c54696d655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f4450417070436f6d6d616e6473526962626f6e436c69636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224557534c69626c657443616c6c735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2256626154656c656d65747279436f6d70696c655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2256626154656c656d657472794465636c6172655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2256626154656c656d65747279486f73744d6163726f52756e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2256626154656c656d657472794d6163726f4372656174655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2256626154656c656d657472794d6163726f5265636f72645c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2256626154656c656d657472795265666572656e6365644c6962726172795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2256626154656c656d6574727953686f774964655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22434f4d416464696e436f756e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434f4d416464696e446c67436c69636b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434f4d416464696e556e68616e646c6564457863657074696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f4d43616c6c54656c656d65747279486173684d61705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446565704c696e6b696e67436865636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446565704c696e6b696e67446f63756d656e744f70656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446565704c696e6b696e67446f63756d656e7453686f77547275737455495c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446565704c696e6b696e675472757374526573756c745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224577734c6173745570646174655374617475734974656d436c69636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224577734c6173745570646174655374617475734974656d53686f776e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2247656e314163746976697479416767726567617465644261736553756272756c65	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|10"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSessionUpgradeCandidate\officeclicktorun	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|0"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|2"	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb010000001a9f0322ddb9014ba44d143b4c50365c00000000020000000000106600000001000020000000b6a68b729815c62e1472f3ac6c83f3b8e6cc0b3141bd3fc80b515acdf2da4e69000000000e8000000002000020000000ca34ef1042b4d418622344431232499051fc0bb954d6c11a13a656c5c69c68e3f0030000f43cd58ae0b6eb15d98c38800e0b6892af97b25278bc046641a00680933ea79fcb34bdfc5ce4d6669e5d509ad855ea71a450f3b55887de19c1f2771b5c09b2ebdec8790721af679172fd69a2f5ab89d59e9ef80c0a473680c010ab115a64091050764cb5c1c25bb9e8477bac1225a1a86157de591146ede0563271b7a8438ab771e6be0be5ef8166c81b78903a0af4e85570610ec5d13d02e6188b51b368a99a4fc93f6fd2229eb5982e9859f257f0a8bf62a9f1c622c16e964b46d7bde28a4cc4ca8998018e14f9561e4638aa0b146f2f09802d7c1adc73a8fb18e8d098cf94159c81464819c58be4c44764082ef6ac78085c9076966282205f17746c68cc9cc8c858f2f07b007394abecffc29e6b77536e4b318909203e06d338c1598c056fe85d185e8ff086926393a9c4dbdf306c1e8fab139a829f1bac4675e8535cf105f69eeca91bedcb7c7f481c838e440e84e67c690b2773ba55e076b2167e7f6d883d045dd6b14d21d5e20928b231a30a412736ed1070d62f46853d46fb2dcab88a27dd87969292e3f4dadcd34363cb2b8ad67a2eb5e016d69b4679234bc4dc9a07a15859b5745eda8ead12c1d615098535079ff9952a30d6f3409e59fb6ba2fa859861ec0085b3412991357cd45984df4c479434df8c0ecbf119488a063b51346e019724ffce78bfd30125cdbfcf7a8975b42db6da51d7ab202bfea446647d2cc48db333abf2b591c567452717b3abf3d9e1aa49438143da0bb064ebf86bab13808f57b945d7c3191b0f1c2c84aa5bf6eac516edcc8bcab7ea792b6cc65ae447f20df6b7daab36629c9bb14c479543cbbb15c1daf288abd8415416af02a7b200e46ca899522c287dc1a207b2dd2e5f294bbea8304a30e0d6e9ffdd181f6e15af8b8226a4439e35fbd84c57fcd00c3240a29d5bd9f20fb930b23f6ffe0bd4eee4b06c752dc8ce9f490dca82c865d48031a9a3283ccfb4fc8a0f678505855a5bb620051ed4823ece2aaee4a433ffa7a10dab52a2c8558b1e81fc4a7fc2f3a0145db8dae6a80e76949b894f4540d179dc81340fa93a33dfd7542b27fc50e8c94ae923dfad22fe52498d56eb6174a6698eed0b23caba27be785b22390e391fda1b4c235169de20c8fa446bb16e5a261498554b8211b1cc15883d7a5eec192ac86fb03a960f40ecc029c4d72918e86b0b71cd248ae1ab77ea34717ef31f417780c1df3d4645401309737544f13dab98e1c57d9bce5e0941fccfe5694ab5fd9dfe136504aef0c10ecaa035597239cf117928395d19dba51e2444b9ebfefe373a8ea135530605ecb2ed2bdd2d1cb0a2f6f48c691e88366ff49d9fa9b51e6da4ad534b7f91dab9fb012c5f365e24ede728a38d9d1d4184cd26de370c9ee05b45e0c50b46e9c2d4c04dade5bee248d11ac5c856888f40000000a4052b92d6d5971fefd3318d9f3bbede2b30e2ef7416d66f0f820bd5ee87f826acc01a920af966a0eaee04dff243a6edbd7ca4501ea5fc90934fdf0d88a244ff	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.16827&crev=3\0\FilePath = "officeclient.microsoft.com\\99791328-4723-4F45-94CC-E629A1D3CFF2"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t\|1696438378"	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.7 = 69766974794c6f675769746853747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6741646441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674361636865446f63756d656e74496e666f5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e74727946696e616c697a655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6746696c7465724f757443757272656e7455736572416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674c6f616446726f6d53747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6753617665546f53747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565436865636b5265766f6b65644544505c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565526570616972436f7272757074656446696c654173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674d6f64696679436c6f6e655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c654f70656e4572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c65526561644572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c655265706c6163654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c6557726974654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565536574456e74657270726973654461746150726f74656374696f6e4173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575655472756e6361746551756575655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e7472794372656174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e74727953657453746174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22536572766963654163746976697479526573756c745c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f674f6e436f6e74656e74416374696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e717565756541637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f674469736361726441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225472616e736d69745175657565496e7365727441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225472616e736d697451756575654469736361726441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e71756575654f7574676f696e675c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67436c6f73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d6974517565756548656c706572456e737572654469726563746f72795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d697451756575654d616e61676572437265617465496e73616e63655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2241706943726561746541637469766974794c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224170694372656174654c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d69745175657565536574456e74657270726973654461746150726f74656374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2241637469766974794c6f674173796e635461736b5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22436f6c6c6162436f726e65725c22203a207b205c224576656e74735c22203a207b205c22436f617574686f725570646174654c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f617574686f72476f546f43757272656e744c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795573657252655265676973746572436f6e6e65637469766974794368616e67654e6f7469667949664e65636573736172795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e6443686174427574746f6e497356697369626c654e6f7744617461706f696e745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572436c6f736553696e676c65466c796f75745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e64497343686174417661696c61626c655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572794f6e436f617574686f72735265747269657665644173796e63506f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795265747269657665436f617574686f72735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572794f6e436f617574686f72735265747269657665645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795265747269657665436f617574686f72734265666f72654173796e63506f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279496e6974464d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279436f617574686f72577261707065725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e64436f61757468696e6757697468416c6c4775657374734f724d697373696e67456d61696c456469746f72735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22476f546f4c6f636174696f6e416374696f6e487562416374696f6e4a756d70546f417574686f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572557064617465417574686f724c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572557064617465456d61696c416e64436861745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6e7461637443617264416374696f6e487562416374696f6e53686f77436f6e74616374436172645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279557365724a756d70546f417574686f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279557365724f70656e53696e676c65466c796f75745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22456d61696c416374696f6e487562416374696f6e53656e64456d61696c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e6453657456616c75655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224d736f494d5365727669636573536642506861736531496d70726f76656d656e7473456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224368617443616c6c6f757455736572496e697455495c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f494d5365727669636573497357616343686174456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f494d536572766963657353664257616343686174456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f494d536572766963657353664357616343686174456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617455494d6f64656c4f6e55494576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224368617443616c6c6f7574557365724f6e5061727469636970616e744c6973744368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6175746847616c6c65727955736572437265617465416374696f6e4875624c69737446726f6d536e617073686f745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22436f6175746847616c6c65727955736572437265617465466c65784c69737446726f6d536e617073686f745c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22436f6c6c61625c22203a207b205c225375624e616d657370616365735c22203a207b205c22436f617574686f725c22203a207b205c225375624e616d657370616365735c22203a207b205c22436f617574686f72446f63756d656e7448656c7065725c22203a207b205c224576656e74735c22203a207b205c22547269676765725265747269657665446f63756d656e74436f617574686f72735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225265747269657665456469746f72735461626c654d616e616765725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225265747269657665527463557365725c22203a207b205c224576656e74466c61675c22203a20353132207d207d207d207d207d207d207d2c205c2241744d656e74696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22446f63756d656e744163746976697479496e746567726174696f6e5c22203a207b205c224576656e74735c22203a207b205c224164645265636f7665726564416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2250726f6365737341744d656e74696f6e4e6f74696669636174696f6e734c6973745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6d6d656e74734e6f74696669636174696f6e436f6c6c6563746f7252656d6f766564436f6d6d656e74735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2250726f63657373436f6d6d656e74734e6f74696669636174696f6e734c6973745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22536176654c6f67466f725265636f766572795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22437265617465446f63756d656e7441637469766974794c6f674d616e616765725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c657465436f6d6d656e7441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22446973636172644c6f63616c416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c6574655265706c7941637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2243726561746541744d656e74696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c65746541744d656e74696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c6574654d6f6465726e436f6d6d656e7441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224372656174654d6f6465726e41744d656e74696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f70656e4c6f6746726f6d5265636f766572795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c6574654d6f6465726e5265706c7941637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225064616c6d446f63756d656e7441637469766974794c6f674d616e616765725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22456e73757265446f63756d656e744163746976697479436170747572655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456e737572654c6f67507265526571735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d6574726f4f70656e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726561746555736572496e666f466f72417574686f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22437265617465556e69717565417574686f72566563746f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726561746555736572496e666f46726f6d417574686f72566563746f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224973436c6f7564446f63756d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225365745361766564507265526571735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224372656174655265766973696f6e53657441637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574436f6d6d656e74436f6e74656e744964656e7469666965725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f67436f6d6d656e744174747269627574696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472794372656174654c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536176654c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253657453617665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224162616e646f6e4c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224372656174655461736b41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225461736b4372656174696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526561737369676e5461736b41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656f70656e5461736b41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d706c6574655461736b41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224465736b746f704261636b73746167655c22203a207b205c224576656e74735c22203a207b205c22536176654173526563656e74436c69636b65645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2253617665417344656661756c745365727669636553656c656374696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f70656e526563656e74446f63756d656e747356696577436c69636b65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f70656e526563656e74446f63756d656e7473566965775769746846656174757265456e61626c6564436c69636b65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22424743616c634d616e6167657250726f6365737353657456616c75657350726f635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22424743616c6349646c655461736b46457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22506c6163657347726f757065724163636f756e74496e666f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657474696e67537461727465644d5255536c61624765744d72754461746554696d6547726f7570547970655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f70656e526563656e744c6f636174696f6e7356696577436c69636b65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e617669676174696f6e5265616453697465526f6f74427956726f6f6d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e617669676174696f6e52656164446f634c6962466f6c646572427956726f6f6d5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224f666669636553706163655c22203a207b205c225375624e616d657370616365735c22203a207b205c224465736b746f704261636b73746167654e617669676174696f6e5c22203a207b205c224576656e74735c22203a207b205c224c617a794c6f616446696c6543616368655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224c6f616446726f6d46696c6543616368655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2253617665496e746f46696c6543616368655c22203a207b205c224576656e74466c	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\SessionId = 9eb47e26abf3704f8332020e98ba13e0	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t\|0"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|3"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\ApplicationFlags = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1696395237"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.16827&crev=3\0\StartDate = 2080a1a47ef6d901	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0 = 4d736f3a3a436865636b73756d52656769737472793a3a446174617c75696e7436345f747c373837363633343139373833363132323831383b456373436f6e666967526573706f6e7365446174617c7b202256657222203a2022696e7433325f747c30222c2022436f6e6649647322203a20227374643a3a77737472696e677c502d522d313039383135382d312d352c502d522d313038353730312d312d312c502d522d37363735372d312d322c502d522d35343930332d312d332c502d522d32363134362d372d31372c502d442d32393633352d312d312c502d442d32373038372d312d392c502d522d37393638382d312d332c502d522d313133383531302d342d342c502d522d313039383836372d342d352c502d522d313037333732342d342d342c502d522d313036353130332d342d352c502d522d313034303537342d342d342c502d522d313032313439312d342d342c502d522d313032303733302d322d362c502d522d313031393539312d342d342c502d522d313030343536312d342d342c502d582d313131393239352d312d332c502d582d313036313437302d322d332c502d582d313032313936352d312d372c502d582d313032313936382d322d332c502d522d313032353434342d342d352c33326169303434303a3434373531372c66653635313636373a3336313635382c37326838623835393a3238343430302c38306562633336353a3236353636392c502d522d35383634302d312d332c502d582d37343731382d312d392c502d522d313130373537382d31322d392c502d522d33353039392d322d342c6175656e613732343a3237303731382c502d522d33343834332d342d362c502d582d313036373430382d322d332c502d582d313036333834332d322d332c502d582d313031393934352d312d372c502d582d313030363839392d312d352c502d582d3130393833322d312d352c502d582d313032303631372d312d332c502d582d3130373935312d312d392c502d582d3131383137312d312d332c502d582d39353330302d332d31312c502d582d38373033372d312d332c502d522d33333832322d31342d36342c502d522d34353438332d31362d35332c502d522d35303731372d31382d36302c502d522d38373538372d342d342c502d522d37353036392d312d332c502d522d37353030312d312d332c502d522d36383135322d31382d32312c502d522d35323331362d4331372d33372c502d522d34393136322d31382d31332c502d522d34393136312d31382d31332c502d522d34303235332d362d31392c502d522d34303235342d362d31382c502d522d33353430312d362d372c502d522d33323130372d32322d32322c36633932393731393a3339333435382c6a6a6432663231333a3336353635352c636c3132303a3238353532342c636c7265703130363a3238343830372c636c7265703238323a3333353536382c636c63646e3338393a3234313632352c636c3937313a3239363531342c636c7265703730333a3232343731392c757073656c6c5f616e645f686172646c696e6b696e673a3137363837342c636c7573653537363a3234333839332c502d582d313036343039332d312d332c502d582d313030333535362d312d352c502d522d32343938302d382d34382c502d522d31383237392d322d36352c30653638363433323a3336373930362c63756973663436343a3434363635342c502d522d3131333931352d382d372c502d522d35323938322d31382d33342c502d522d35313134352d322d372c502d582d313031323533332d312d352c502d522d313037323130392d31362d31352c64696173793933323a3237333238302c502d582d38353335392d312d31332c502d582d38393031322d312d31312c502d582d37313434392d312d332c502d522d313034323432302d342d332c502d522d313033363136342d342d372c502d522d3131333530382d382d352c502d522d39353631362d382d342c502d522d37393631362d312d332c502d522d37373632312d312d332c502d522d37373230342d312d332c502d522d37363130372d312d332c502d522d37343333342d312d332c502d522d37343433392d312d332c502d522d37333634322d312d332c502d522d36383933382d312d352c502d522d36323837352d322d342c502d522d36303537392d322d322c502d522d36303333332d312d332c502d522d35383130372d322d322c502d522d35353734332d312d332c502d522d35313935382d312d352c502d522d33383038352d31322d392c6e617469766577696e333272646c3a3138363734342c646f6373686f6d6570616765736561726368656e61626c65616767726567617465646d7275736561726368736f757263653a3137353733392c646f6d6f643839383a36303731392c502d522d313033343136392d31302d372c502d582d313031373934332d382d32322c502d582d313037383537362d322d332c502d582d39333738372d332d31312c502d582d313035363137372d322d332c502d582d313030353435342d372d32332c502d582d37393936312d312d372c502d582d313032363439382d312d352c502d582d39393034342d312d332c502d582d39363134312d312d332c502d452d32383637372d322d332c502d522d313133363938332d33352d342c502d522d35353132322d382d382c502d522d35303235352d31302d392c502d522d34353331342d31302d31362c786c6d686663663a3434363739332c37393332313738393a3335353439302c65787069766f746e6f6e64657374727563746976656175746f67726f75703a3338373137392c69393268333737303a3333363131342c65786e6577726563616c637061746873373a3431313839372c657861766f3833333a3234393839332c34616265633934343a3333333233302c6d6f6465726e62726f777365726f617574686469616c6f673a3230383934332c65786973723434383a3230383933342c786c6d686663663a3434363739332c502d582d313038313636302d322d352c502d452d33383233312d322d342c502d522d313133333431392d382d372c502d522d39343536302d31342d31322c502d522d39343138392d31342d31332c502d522d39333838322d31342d32362c502d522d36313134372d31382d322c502d522d35343732382d31362d32332c502d522d35343639382d31362d31362c502d522d35343635382d31382d31392c502d522d33383330362d31382d332c502d522d33343031392d342d332c6a313069633736343a3434343030312c502d582d313037393733332d322d372c502d582d313036363230382d312d392c502d582d313036343438332d322d332c502d582d313030373237342d332d31372c502d582d313030373237352d31332d34352c502d582d38353839362d312d31392c502d582d39313739302d312d352c502d582d3131363131352d312d372c502d582d3130373539352d312d352c502d582d36313130322d332d31312c502d582d35313236322d312d31312c502d582d35323539312d312d31312c502d582d39383635352d312d352c502d582d38343436342d312d352c502d582d35343335382d312d372c502d582d35333937352d332d392c502d582d36393138392d312d372c502d582d35363237342d312d392c502d582d36333133342d312d372c502d582d35383637382d312d352c502d582d35353833322d312d362c502d582d35363134372d312d352c502d582d35363135342d312d352c502d582d35343231322d312d352c502d452d34323730302d322d342c502d522d313132393434332d382d342c502d522d313132373034302d342d392c502d522d313131383634302d382d362c502d522d313131313539322d342d352c502d522d313038353239392d382d342c502d522d313038323936382d382d342c502d522d313038303038332d31332d32332c502d522d313037343033302d382d342c502d522d313036333936382d31342d32312c502d522d313035333236392d382d352c502d522d313035323137302d382d342c502d522d39353038322d382d342c502d522d39333937302d382d342c502d522d36393036352d312d332c502d522d35393139332d312d332c502d522d34353630392d31342d362c502d522d34353139372d322d362c502d522d34303938302d31382d31362c502d522d33393032392d352d31382c502d522d32393830392d312d362c502d522d32363936382d332d392c502d442d313130393930372d342d31312c6d756c7469706c6574696d656f75747374726561746d656e743a3432313835312c33383368383432363a3339333534342c646f63756d656e7473756d6d617279656e61626c65643a3430353339352c686e656469746f72733a3338313133302c356d696e31306d696e5f31306d696e6772616365706572696f643a3432363330382c66696c69733436363a3333303234372c66696d6f633234383a3139333439312c6669616c6c3139383a3431343834332c66696261633936373a3335393434312c66697465733231373a3136313436382c66697265663334363a33343532352c66696d6f633538393a32383937392c6f6e656472697665636f6e76657267656e6365656e6c69676874656e6564726f6c6c6f75743a3135393033382c66696f6d693239333a3131383038312c6669656e613934373a33303633352c66697374613430373a36313032372c6669656e613930333a36353934342c66696461763236353a35353033352c66696361633834313a34393636342c6669656e613431353a33383738302c6669656e613439303a33343138312c72656d6f74656d6f76656465766963653a34323530302c6669656e613237363a34313030342c6669656e613338313a34393939372c502d522d313038383738382d31382d362c502d522d313037383537312d31382d382c502d522d313032363335342d31382d31392c502d522d35333534352d342d352c502d522d34393733362d362d32322c502d522d33303038352d312d392c502d522d32353030392d312d382c502d522d32343336332d312d31322c502d522d31393831342d312d36322c502d522d31393031322d312d35372c502d582d313035363435362d322d31312c502d582d313132363236332d312d332c502d582d313038373339322d312d352c502d582d313038373433322d312d332c502d582d313031313434322d312d31312c502d582d313031353535342d312d352c502d582d313031303331342d312d352c502d582d37373734322d312d352c502d582d38363339352d312d352c502d582d38343332312d312d352c502d582d35303232302d312d332c502d582d34393733302d312d332c502d522d313034333838352d362d342c502d522d313031343435322d382d382c502d522d36343834312d32322d31352c502d522d36333130302d32382d31302c502d522d34303939302d31322d31352c502d522d33323734342d31342d31352c502d522d33323734312d33322d31362c69693435373531323a3434393137382c36666769643938363a3433333838362c30336830613239333a3432303437302c62306a68323830363a3432303436382c67726766783930363a3432333930352c6772736b693435353a3232373433362c67723331323a3231383934392c677264656c3334373a3132373632382c67727376673936303a3235333739342c67727573653434343a3132343039312c67727573653438383a31393737322c677269636f3430363a31393737372c502d522d35303432392d31382d382c502d582d313031393831382d312d372c502d582d313036353536392d322d332c502d582d37353232322d32312d37352c502d582d313034393232352d312d332c502d582d313033333336302d312d352c502d582d313031313137332d312d352c502d522d313131303137332d342d362c502d522d313032363534322d382d342c502d522d313032313732352d31382d34302c502d522d36373039382d3132362d3235392c502d522d35333432312d32382d31342c502d522d34303437352d32382d32382c502d522d33353938352d31342d32322c502d522d33323030342d322d352c696466673139373a3338353337382c6f617574686964656e7469747972656672657368776974686f757470726f66696c65726571756573745f74726561746d656e743a3433363035372c65786f6f6e6c793a3339383433362c39373935633332303a3335393832302c32646262623537393a3238363232352c69643539323a3238383731342c502d582d38383033352d312d352c6c616c616e3233313a3134303738312c502d522d36313234382d31382d362c502d522d35313939352d31382d32382c502d582d313039373038372d342d31322c502d582d313036313732332d322d352c502d582d313037383332302d332d382c502d582d313038383535362d322d332c502d582d313038343433312d312d332c502d582d313037363235322d312d362c502d582d313035383139372d322d332c502d582d313034393634392d322d352c502d582d313034343531342d322d352c502d582d313032363133312d322d352c502d582d313032373931332d312d31312c502d582d313031373734352d382d31342c502d582d38303736372d312d33372c502d582d3130383634332d322d372c502d582d313030393034382d312d392c502d582d39353630352d322d332c502d522d313035383637352d382d342c502d522d313033363537362d342d342c502d522d39383131302d342d352c502d522d37393936332d312d322c502d522d36303831362d31302d31392c502d522d35313736342d312d342c502d522d34323339322d322d342c502d522d33393037332d312d352c69646268303835323a3431313136392c326766396a3631383a3336323439302c65766572797468696e676f66663a3339353134332c66323567343231343a3337393830332c61366531353836373a3339343438342c396a6734633839333a3335373434342c63673032633239353a3434343538362c34676839653230353a3332353539322c70697063687962726964743a3333363236352c6a6a3035303832373a3234353136322c61306537323236393a3332323039342c37673633363833323a3236383639382c65396268363531353a3234343439392c37366534673937353a3332343937392c6c693533303a3234393037302c67306864303232313a3435303335352c502d522d313132333337362d31302d382c502d522d313030393835352d31322d31342c502d522d39383835362d31382d34382c502d522d33383431302d31382d32322c502d582d313036363534362d312d31332c502d582d313035303636352d332d372c502d582d313030393233372d342d31372c502d582d313034313735362d322d352c502d582d35313735392d312d332c502d522d313132363239382d362d362c502d522d313132343733382d362d342c502d522d313131383536352d382d342c502d522d313038393139322d362d352c502d522d313037373034352d362d352c502d522d3131373934312d342d342c502d522d35393533342d312d332c502d522d35343535372d312d332c62656c6f776f70656e646976696465723a3434323533322c6f65656e61626c656f73666964656e746974796d616e616765723a3434393931392c6f6e6c79737769746368746f77696e646f776564666f726a6177733a3332323035342c67623038643735323a3239323132322c6f656d61633335383a32303530322c502d522d37313336302d31382d31392c502d582d37363535352d312d332c6f6e6d61703336363a38313734302c502d442d313131303935362d342d332c502d442d313037333031342d352d332c502d442d313033373534332d332d352c502d442d313033373533382d332d352c502d442d313033333339312d322d342c502d442d313033313035302d342d332c502d442d313033303932362d312d332c502d442d313033303932332d322d332c502d442d313033303932322d322d332c502d442d313033303932302d322d332c502d442d313033303931382d322d332c502d442d313033303931362d322d332c502d442d313033303931342d322d332c502d442d313033303931322d322d332c502d442d313033303931302d322d332c502d442d313033303930382d322d332c502d442d313033303930362d322d332c502d442d313033303930342d322d332c502d442d313033303930322d322d332c502d442d313033303930302d322d332c502d442d313033303839382d322d332c502d442d313033303839362d322d332c502d442d313033303839332d322d332c502d442d313033303839312d322d332c502d442d313033303838392d322d332c502d442d313033303838372d322d332c502d442d313033303838352d322d332c502d442d313033303838332d322d332c502d442d313033303838312d322d332c502d442d313033303837392d322d332c502d442d313033303837372d322d332c502d442d313033303837362d322d332c502d442d313033303837352d322d332c502d442d313033303837332d332d332c502d442d313033303837322d322d332c502d442d313033303837312d322d332c502d442d313033303837302d322d332c502d442d313033303836392d322d332c502d442d313033303836382d322d332c502d442d313033303836372d322d332c502d442d313033303836362d322d332c502d442d313033303836352d322d332c502d442d313033303836342d322d332c502d442d313033303836322d322d332c502d442d313033303836302d322d332c502d442d313033303835382d322d332c502d442d313033303835362d322d332c502d442d313033303835342d322d332c502d442d313033303835322d322d332c502d442d313033303835302d322d332c502d442d313033303834382d322d332c502d442d313033303834372d322d332c502d442d313033303834362d322d332c502d442d313033303834342d322d332c502d442d313033303834322d322d332c502d442d313033303834312d322d332c502d442d313033303834302d322d332c502d442d313033303833382d322d332c502d442d313033303833362d322d332c502d442d313033303833342d322d332c502d442d313033303833322d322d332c502d442d313033303833302d322d332c502d442d313033303832382d322d332c502d442d313033303832362d322d332c502d442d313033303832342d322d332c502d442d313033303832322d322d332c502d442d313033303831392d322d332c502d442d313033303831362d322d332c502d442d313033303831322d322d332c502d442d313033303831312d322d332c502d442d313033303831302d322d332c502d442d313033303830382d322d332c502d442d313033303830362d322d332c502d442d313033303830332d322d332c502d442d313033303830312d322d332c502d442d313033303830302d322d332c502d442d313033303739392d322d332c502d442d313033303739382d322d332c502d442d313033303739372d322d332c502d442d313033303739362d322d332c502d442d313033303739352d322d332c502d442d313033303739342d322d332c502d442d313033303739332d322d332c502d442d313033303739322d322d332c502d442d313033303739312d322d332c502d442d313033303738392d322d332c502d442d313033303738372d322d332c502d442d313033303738362d322d332c502d442d313033303738352d322d332c502d442d313033303738332d322d332c502d442d313033303738312d322d332c	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.1 = 502d442d313033303737392d322d332c502d442d313033303737372d322d332c502d442d313033303737352d322d332c502d442d313033303737332d322d332c502d442d313033303737312d322d332c502d442d313033303736392d322d332c502d442d313033303736372d322d332c502d442d313033303736352d322d332c502d442d313033303736332d322d332c502d442d313033303736312d322d332c502d442d313033303736302d322d332c502d442d313033303735392d322d332c502d442d313033303735382d322d332c502d442d313033303735372d322d332c502d442d313033303735362d322d332c502d442d313033303735352d322d332c502d442d313033303735332d322d332c502d442d313033303735312d322d332c502d442d313033303734392d322d332c502d442d313033303734372d322d332c502d442d313033303734352d322d332c502d442d313033303734332d322d332c502d442d313033303734302d332d332c502d442d313033303733382d322d332c502d442d313033303733372d322d332c502d442d313033303733362d322d332c502d442d313033303733342d322d332c502d442d313033303733322d322d332c502d442d313033303733302d322d332c502d442d313033303732382d322d332c502d442d313033303732362d322d332c502d442d313033303732342d322d332c502d442d313033303732322d322d332c502d442d313033303731392d322d332c502d442d313033303731372d322d332c502d442d313033303731352d322d332c502d442d313033303731332d322d332c502d442d313033303731322d322d332c502d442d313033303731312d322d332c502d442d313033303730392d322d332c502d442d313033303730382d322d332c502d442d313033303730372d322d332c502d442d313033303730362d322d332c502d442d313033303730352d322d332c502d442d313033303730342d322d332c502d442d313033303730332d322d332c502d442d313033303730322d322d332c502d442d313033303730312d322d332c502d442d313033303639392d322d332c502d442d313033303639372d322d332c502d442d313033303639362d322d332c502d442d313033303639352d322d332c502d442d313033303639332d322d332c502d442d313033303639312d322d332c502d442d313033303639302d322d332c502d442d313033303638392d322d332c502d442d313033303638372d322d332c502d442d313033303638352d322d332c502d442d313033303638332d322d332c502d442d313033303638312d322d332c502d442d313033303637392d322d332c502d442d313033303637372d322d332c502d442d313033303637352d322d332c502d442d313033303637332d322d332c502d442d313033303637312d322d332c502d442d313033303636392d322d332c502d442d313033303636382d322d332c502d442d313033303636352d322d332c502d442d313033303636342d322d332c502d442d313033303636332d322d332c502d442d313033303636312d322d332c502d442d313033303635392d322d332c502d442d313033303635362d312d332c502d442d313033303634322d372d362c502d442d313033303630302d33392d372c502d442d313033303531322d312d332c502d442d313032393238392d342d332c502d442d313032393234332d312d332c502d442d313032393039372d322d332c502d442d313032393039362d322d332c502d442d313032393039332d322d332c502d442d313032393039322d322d332c502d442d313032393039312d322d332c502d442d313032393039302d322d332c502d442d313031383637382d32312d342c502d582d313130383739302d322d332c502d582d313032303532392d312d332c502d522d313031363533392d382d352c502d522d38323437332d312d342c502d522d35363631382d312d332c69363261643334353a3434393335332c7065696e703639343a3234363834392c502d522d36313731382d31382d332c502d522d33333639362d312d352c502d522d33393931322d312d322c502d522d35303338302d31382d31382c502d582d3131353136362d312d332c70753436393a3433343439332c502d582d313039343437352d312d372c502d582d313037383931382d322d31312c502d582d313034353236392d312d352c502d582d313031383131372d312d352c502d582d313032313138372d312d332c502d522d313131393633332d362d342c502d522d313131343538392d382d342c502d522d313034303537392d32362d31342c502d522d36333333382d31382d31312c502d522d35383235312d31382d31312c502d522d33333733372d312d342c32363838333239333a3432323534382c39663765673735383a3435303633352c38623061313234353a3332323031332c6a757374696669636174696f6e6f746865727769746873656375726974797761726e696e673a3237323535322c33363832333632363a3238393336352c502d582d313039313538392d312d332c502d582d3131363238362d312d332c502d582d3131363038352d312d332c502d582d3131363037382d312d352c502d582d3131363036352d312d332c502d582d37383534352d312d332c502d582d37343233342d312d31312c502d582d37333731382d312d332c502d452d32393636322d43312d332c502d522d313132383531342d382d372c502d522d36313335382d4331372d32312c502d522d313039323535362d322d362c502d522d313038393331382d322d362c502d522d313038353339382d322d372c502d522d313035353439352d322d382c502d522d313034393532362d322d372c502d522d313034393533352d322d372c502d522d313034393335322d322d372c502d522d32393330332d322d31392c502d522d33333932322d362d31392c502d522d32393330372d322d31352c502d522d35323138392d322d31352c502d522d32393033312d322d31392c502d522d33363331362d362d32302c502d522d32393139372d322d31372c502d522d33303239302d362d32322c502d522d32383938322d332d31382c502d522d36333934372d31382d322c502d522d36313336312d31382d32362c502d522d35333235362d322d31312c502d522d34383633342d322d31342c502d522d34373234322d31382d31312c502d522d34353535302d31382d34362c502d522d34323531322d312d322c502d522d34313534392d31382d32302c502d522d34303532312d322d31332c502d522d33353430372d342d332c502d522d33333133342d322d31372c502d522d33303239322d342d372c502d522d32383634342d312d342c502d522d32343033372d312d362c502d522d32333434352d332d362c502d522d32333433342d332d372c502d522d32333430332d332d382c502d522d31383531332d312d33302c736d617274616e646c6f6f706c696e6b63616c6c6f7574656e61626c65643a3431383435302c73686772613439383a3232373730372c73686772613630313a3138343038302c73686772613335353a3230383034392c73686772613530323a3138393932342c73686175743539363a39323130372c73686772613734373a38363637372c73686963723331373a39343532312c502d582d313130373037302d322d332c502d582d313039363332302d322d332c502d582d313038363633332d312d372c502d582d313038333432372d322d352c502d522d36353031312d312d332c502d522d35303534312d322d372c66366562623730383a3433343833322c6a336237333236373a3431363736312c31306337373639343a3434353737352c6a683861623434373a3338303633332c502d582d37313536382d312d352c502d522d36393233322d33382d31322c502d522d32333638312d322d372c502d442d33323530322d322d332c502d442d33323530312d322d332c502d442d33323431352d322d332c7461656e613537363a39303236352c502d582d313131363638392d312d332c502d582d313131323735352d312d382c502d582d313032373136332d322d31312c502d582d313035393231322d322d332c502d582d3130393636322d312d31372c502d522d36343531332d31382d31302c502d522d35313931362d38342d33312c33306637623534383a3434393331302c31343831363436383a3431363336392c6f74656c657564623a3332363832362c35343637393634363a3336333131312c74656172693335323a3233333737342c502d522d313133323832312d322d342c502d522d313132393233342d312d332c502d522d313131393031332d312d332c502d522d313130393638372d312d332c502d522d313039373437332d342d382c502d522d313039383739362d312d332c502d522d313039343538392d322d342c502d522d313039343434352d312d332c502d522d313035383634332d352d392c502d522d313037313736312d312d332c502d522d313036393736392d322d342c502d522d313036383131352d312d332c502d522d313032343037362d342d382c502d522d313032343037342d342d382c502d522d313034353131382d322d342c502d522d32353236392d31342d32312c502d522d313034343430382d312d332c502d522d313034323833332d312d332c502d522d313033373838372d312d332c502d522d313033373837392d312d332c502d522d313033363239332d312d332c502d522d313033363239322d312d332c502d522d313033363238392d322d342c502d522d313033363238382d312d332c502d522d313033363036382d322d342c502d522d313033353933332d322d342c502d522d313033353134392d322d342c502d522d313033333831372d312d332c502d522d313033333632342d322d342c502d522d313032383535302d322d342c502d522d313032383136382d312d332c502d522d313032373533352d332d352c502d522d313032343037312d322d342c502d522d313030363839362d312d332c502d522d313030363839342d312d332c502d522d313030363536322d322d342c502d522d313030303036312d322d342c502d522d3131313638322d312d332c502d522d3130353733312d33362d33382c502d522d3130343433352d31332d31352c502d522d3130303239342d312d332c502d522d39393633332d312d332c502d522d39383932392d322d342c502d522d39383932362d312d332c502d522d39383235302d312d332c502d522d39343535362d322d342c502d522d39343239392d312d332c502d522d39333037372d312d332c502d522d38383330392d322d342c502d522d38363131382d312d332c502d522d38303531372d362d382c502d522d37383835322d332d352c502d522d37383131322d342d362c502d522d37363931382d322d342c502d522d37363732312d312d332c502d522d37363235332d312d332c502d522d37353434302d322d342c502d522d37353433362d312d332c502d522d37353433342d312d332c502d522d37353433332d312d332c502d522d37323434392d372d31302c502d522d36383036392d322d342c502d522d36363937352d312d332c502d522d36353536372d312d332c502d522d36303630322d332d352c502d522d35333330392d312d332c502d522d35323633332d312d332c502d522d35323137312d322d342c502d522d35313932312d382d31302c502d522d35313235382d382d31302c502d522d35303735322d322d342c502d522d35303638312d322d342c502d522d35303539392d342d362c502d522d35303539362d342d382c502d522d35303535332d312d332c502d522d34393539372d332d352c502d522d34393435382d322d342c502d522d34383533302d352d372c502d522d34373934382d312d342c502d522d34363538302d332d352c502d522d34363438342d31302d31322c502d522d34363132322d312d332c502d522d34353835382d322d342c502d522d34333936362d322d342c502d522d34333530322d31392d32312c502d522d33383234382d31382d32322c502d522d34313433302d312d332c502d522d34303735312d382d31302c502d522d34303237332d342d362c502d522d33393233382d352d372c502d522d33383638322d332d352c502d522d33373538382d322d342c502d522d33343335352d382d31302c502d522d32363236362d342d392c502d522d32363833342d332d382c502d522d32343636322d31362d32322c502d522d32373437392d362d31312c502d522d32363035362d372d31352c502d522d32373030362d372d31322c502d522d33303333382d332d372c502d522d33303137382d37382d38302c502d522d33303035332d382d31302c502d522d32373435382d312d352c502d522d32353832322d31362d31392c502d522d32353038332d362d392c502d522d32343639302d33382d34322c502d522d32343638392d322d352c502d522d32343636362d322d352c502d522d32343636332d362d31312c502d522d32343635392d372d31302c502d522d32333734342d372d392c502d522d32333733392d372d392c502d522d32333733362d31342d31372c502d522d32333733342d372d392c502d522d32333733302d32312d32342c502d522d32333732332d31302d31322c502d442d33323538382d312d332c502d442d33323533342d312d332c502d442d33323532342d312d332c502d442d33323531382d312d332c502d442d33323531322d312d332c502d442d33323530392d312d332c502d442d33323438362d312d332c502d442d33323438352d312d342c502d442d33323438342d312d342c502d442d33323430352d312d332c502d582d37313939392d332d31312c502d522d313037353139392d362d342c502d522d313031333933302d342d352c502d522d34373630312d31382d31332c502d522d33333931362d312d352c502d522d33333538302d382d392c75637368613636303a37363535382c502d582d313131323633342d322d332c502d582d313037343036392d312d352c502d582d313037343035332d322d352c502d582d313036343937332d312d352c502d582d313034393230312d332d31312c502d582d313035373536362d322d332c502d582d313035313736332d322d372c502d582d313030303436352d312d332c502d582d3131373430302d312d332c502d582d3130353639372d312d392c502d582d39343937322d312d332c502d582d37313731322d312d352c502d522d313133333639352d342d342c502d522d313131353936352d342d342c502d522d313033353932312d342d342c502d522d36313432362d31382d372c502d522d35393432362d312d332c502d522d34363931332d31382d382c6d63696e7365727473796d626f6c7374726561746d656e74313a3433393139372c39623136663631383a3430383338372c62376768643630353a3430383338362c39356167673335373a3334323230302c656e64706f696e74706c7573746f6b656e733a3338383631302c36366a66383838343a3335383430342c6d65636f6e74726f6c5f7765616b7074725f696e746567726174696f6e5f656e61626c65643a3334303935362c7578666c753233343a3330343731342c75786d656469756d69636f6e6c756d696e616e63653a3335333435352c666c75656e746261636b7374616765726566726573683a3234363431322c7578656e613130313a3238383831382c636865636b6f75746465766963656f6e7061696e743a3132323131302c502d522d31393236322d312d31322c502d582d313133363731352d312d332c502d582d313131343730342d312d332c502d582d313130393138372d322d332c502d582d313130333334382d322d332c502d582d313038333937312d312d352c502d582d313034323237352d322d332c502d582d313033373139362d312d332c502d582d3130373631392d312d352c502d582d313030363435302d312d352c502d582d37373138342d312d332c502d522d313133363731372d382d352c502d522d313132353737342d382d362c502d522d313130393338332d392d382c34336131653939393a3434363331352c37626966633731333a3434363330302c67613639673735383a3431363637302c68336764343532393a3430363436332c6c6f6f707374796c6573636f6e746578746d656e75656e61626c65643a3431383434372c67316836623639323a3333343638322c34663366623834333a3239313233392c776f6675733934373a3333333632342c776f77696e3839353a3335373435332c776f636f6c3933363a38303033312c502d522d313132383633302d312d372c502d522d313039383431322d312d352c502d522d313039313236372d312d32382c502d522d38313732302d312d322c502d522d35383430362d312d352c502d442d35303639372d322d342c502d442d32393731392d312d312c502d442d32393731382d312d312c502d442d32393539332d312d36222c2022434322203a20227374643a3a77737472696e677c5553222c2022446566436f6e667322203a20227374643a3a77737472696e677c6f6673683663326231746c61316133312c6f666372756934797664756c626633312c6f6668706578336a7a6e65706f6f3331222c202245787054696d6522203a2022696e7436345f747c31363936343338333738222c20224554616722203a20227374643a3a77737472696e677c5c224962744e696c6c532b506c6c3174366e682b4e48573958584c4c6d4f4e53544b4c30516d6e5a3377586a383d5c22222c202246434d617022203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e4368616e6765476174655f446f6e74547275737456424156617269616e74446f75626c6556616c7565222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e4368616e6765476174655f446f6e74547275737456424156617269616e74446f75626c6556616c75654e6577222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e4368616e6765476174655f4e6577556e69636f6465496e556e697175654964656e746966696572436f6c756d6e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e4368616e6765476174655f556e69636f6465496e556e697175654964656e746966696572436f6c756d6e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e4368616e6765476174655f5573654265747465724964656e697469747952657472656976616c4d6574686f64222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e43757272656e6379446563696d616c506c61636573466978222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e446f6e745265696e697469616c697a654d736f34222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e5265736574436f6c6f72734265666f726553656e64696e674d657373616765222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f73	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "577889346,5804129,7202269,17110992,9179409,24262478,41484365,17110988,7153487,508368333,17962391,17962392,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,7202265,41816131,20502174,6308191,18407617,39125643,539756558,17102418,595174594,593359442,24262477,25036127,24262473,9179410,6104718,9179411,51475283,41185282,39389248,539756557,528570079"	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3136	powershell.exe
3136	powershell.exe
1588	powershell.exe
1588	powershell.exe
1588	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeBackupPrivilege	2188	OfficeClickToRun.exe
Token: SeRestorePrivilege	2188	OfficeClickToRun.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2648	OfficeClickToRun.exe
2648	OfficeClickToRun.exe
2648	OfficeClickToRun.exe
4872	OfficeC2RClient.exe
2648	OfficeClickToRun.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2648	OfficeClickToRun.exe
2648	OfficeClickToRun.exe
2648	OfficeClickToRun.exe
2648	OfficeClickToRun.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2696	bin.exe
3456	OfficeClickToRun.exe
2188	OfficeClickToRun.exe
2648	OfficeClickToRun.exe
4872	OfficeC2RClient.exe
4872	OfficeC2RClient.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 2696	3120	cmd.exe	86
PID 3120 wrote to memory of 2696	3120	cmd.exe	86
PID 3120 wrote to memory of 2696	3120	cmd.exe	86
PID 2696 wrote to memory of 3136	2696	bin.exe	88
PID 2696 wrote to memory of 3136	2696	bin.exe	88
PID 2696 wrote to memory of 3136	2696	bin.exe	88
PID 2696 wrote to memory of 1588	2696	bin.exe	97
PID 2696 wrote to memory of 1588	2696	bin.exe	97
PID 2696 wrote to memory of 1588	2696	bin.exe	97
PID 2696 wrote to memory of 3456	2696	bin.exe	103
PID 2696 wrote to memory of 3456	2696	bin.exe	103
PID 2696 wrote to memory of 2648	2696	bin.exe	106
PID 2696 wrote to memory of 2648	2696	bin.exe	106

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Install-x64-basic.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Users\Admin\AppData\Local\Temp\bin.exe
  bin.exe /configure "configuration/configuration-x64-basic.xml"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3136
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    OfficeClickToRun.exe platform=x64 culture=en-us productstoadd=ProPlus2021Retail.16_en-us_x-none cdnbaseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version=16.0.16827.20130 mediatype=CDN sourcetype=CDN ProPlus2021Retail.excludedapps=lync,teams,access,onedrive,onenote,outlook,publisher updatesenabled=True forceappshutdown=True acceptalleulas=True displaylevel=True bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown besteffortcultureinstall=True scenario=CLIENTUPDATE
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of SetWindowsHookEx
    PID:3456
- - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    OfficeClickToRun.exe platform=x64 culture=en-us productstoadd=ProPlus2021Retail.16_en-us_x-none cdnbaseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version.16=16.0.16827.20130 mediatype.16=CDN sourcetype.16=CDN ProPlus2021Retail.excludedapps.16=lync,teams,access,onedrive,onenote,outlook,publisher updatesenabled.16=True forceappshutdown=True acceptalleulas.16=True displaylevel=True bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown besteffortcultureinstall=True
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2648

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2188

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /progressandlaunch AppTargets="root\office16\excel.exe|root\office16\powerpnt.exe|root\office16\winword.exe" ManualUpgrade=False ScenarioToTrack="Scenario:{477E0208-58BD-4F33-978A-09BCC9AA9EB1}@INSTALL"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\APPVFILESYSTEMMETADATA.dll

Filesize
297KB

MD5
94d6fb63e0fcc7db6ce26674e61a06f6

SHA1
34d019f759db4649d89f584437804597b5d02395

SHA256
53090adc6e512a6cc52fdd7640736b9352537e757520db7b808857f179bfb3a3

SHA512
83a4a927a10fa5210f54908c43c6d68a09ef1aae0aaac40538b4f9252bc01f7b2e3f3e56fe2ee89f0f739918f2559e6af63f58af914f68ba97927245324d7843

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\APPVMANIFEST.dll

Filesize
985KB

MD5
b992640abf4ea6cdac53d8b38076f845

SHA1
ed480fe74fb663e0192098c99a822022b380481c

SHA256
f945dddd970b1bd95c6f713f3a1797a2f0772bbaaee0803f43e39fd748d4502a

SHA512
a3b1beef8df9a0f14eda0cd6d01895bd17c346fd930284806cea6657b3c73df8899c699484742a45753dc0cd85b4b92e7e5b6d31b4f94ccc9865959f28fbc0d9

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\APPVPOLICY.dll

Filesize
1.0MB

MD5
20ae1459b18c035d187ebd44d6fe23c2

SHA1
9fd7012e099ab2c8a39341e7260f050e6c997a6d

SHA256
f694caa849ce8b91e5ff374af38c8fc13af15b477b6f3401a13056da11d6f818

SHA512
978ab47b667ca96cb16c02a19692433d1dd46f1209a4fc17e6ebab026b3a665b98298ef1df877faf77d3fd460f052da80c2e6d1ed40cbcb2da97bb648700e585

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll

Filesize
531KB

MD5
c66926bfecc9c8a1df9e2f1e17070661

SHA1
a6335dd5a0e62621b32c4a2d26c7b8a592d51ca6

SHA256
25d70018e8cda903759499599fd4cd015058966205f254e1a6660c72bc3e9cd0

SHA512
19a215b12f7eb2a5ffdcc43bdf58310be665a1e3f42d316f649047bb6ec8b6700a04288211b793e965514fa5f6785eb10a8cdd7cde9466d6362db0ef55206b4e

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVCatalog.dll

Filesize
597KB

MD5
647a0967315ed80dd590fe111f38bed7

SHA1
f311845d591fcab6c9b086f519e6f83b52ba960d

SHA256
95a069ff97824a004d4fada58a23c78b775db72de5570a05977355149df67cb6

SHA512
0178a3f488e6972ca87a56fcb4bad16679df88149ae265e29c8a2aac3bea75de1cce5e82575de0eef4303bfdbab2593d96e5074f10a7561c83cde22972590d7e

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dll

Filesize
1.6MB

MD5
df8403e03a06679d9077a4161849671e

SHA1
6635f842092ba46af0520ce0fdb978c6b12a7be7

SHA256
49738cd60073b83e07957faaf57ac2fee48fb44eb9a69d9a96591b9fb045d06c

SHA512
433a869ba671361f7a72601cf9f47dd560aff5abdb69557ae8cf9d7572646a762e711e7f3dba32f5c04b2e8865c8bc29227cd5197a7cb0762131e8baf4ec8b18

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvApi.dll

Filesize
405KB

MD5
69d9cc8fcfb951ec44c7d9f26bcb3499

SHA1
243b233b74a96d2676a0a2c3dec02904944c97cb

SHA256
0167466a80c29b10f0cfda34c745930d96a1117d6a9b7838efd6ae77156df495

SHA512
18c588224cd6e5a3b82d27c98f6f92bcf6efb111b11f0c6695ecd9ea1b0dfebf1e5575a4d0fa1e193890a3d7409a041fa5f1322262da095a9f16e5b284a48eab

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvStreamingManager.dll

Filesize
189KB

MD5
5cb3f3f7d8d9afe46bf220b1076f7272

SHA1
f6ba4dd48e9deddf6094c9f5fb1bcf761e9e31d7

SHA256
97119e4ac0b990aabdcb218dce06c2752bf4e37ad7139390cbfd466b1b67889c

SHA512
42f8813eb73e1757e200d18e5ae7ee381000466cb9eee11d11993b81ff9b2364995dc293e3109f7e1cb35a2081b0ccc46942afcd03ba24cccbdac61313187f1f

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll

Filesize
1.0MB

MD5
c9f1a48e9594a1e00a754d0bf50fa6cd

SHA1
c07ac2f5d10c007e33a76261dd4b9f5a7ca9a67e

SHA256
b9ce70c3b1a73efe80753a05d93d1f84d43456095e1f72358a7cc5c48444d0b3

SHA512
3a1edfdce7884558a9ad728e897ef0b3268c18f68b79441fe6eaa4505cbb9ba757b9907ece46781d09e57e32c949e64c973e4ac848bfe9b88c53777e0c05bbff

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll

Filesize
569KB

MD5
15f5792844af082587747a09f1123a0d

SHA1
558999ff58818971f96dfff4f433afa596794ba7

SHA256
e5188cf139c4af572588fe794b7392479a0bf59aef86666a0a22db121e41da9d

SHA512
7de7f740bab5dcafb9f502853963547c7e50993404535dbcd39b88a586a2bf31b50f1eebe4682ee5fa458a00948af44dc104daa0b595c2c02d6901a81beab24f

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll

Filesize
829KB

MD5
ddc59d3df358f9372708531b977848c3

SHA1
e1a0f9b58dc5579bbd5845bb6d3a7da3b5d8b7da

SHA256
fedc8cf10ab72e7a0ec3a493356157028fe16d2ae97f73dead28fffde1b7c935

SHA512
4b75fe159eeadd71fea2e3b569796ce547808bff5c183d271e3d2aed7ef11311121f7ec768bcbc1c0354b771f971aa2b46836a8a6c2b0c1d2f8b21922943dbd3

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RUI.dll

Filesize
2.8MB

MD5
6ab304bc4104b9cce5258a294d560bd9

SHA1
5a7e9a026e088ffe3c2d0f895e4b07e0973eee26

SHA256
462add3d556b15e93b067693d03046556ed7dee7318650b996dd4d3caf091c6d

SHA512
66baf57d467ac524495d436ecd254dc2d6dc3c82033c1f902aa6b18cc7576f24f921745988038e6b0b598a32af66c010b43766ae9738f332288a0bdb1519b824

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\CONCRT140.dll

Filesize
309KB

MD5
22a0056ffd1c0b3081ca56f441cec3c9

SHA1
81eaaed525b7c714261f840f7cdb5164e45d734e

SHA256
782910b23f8a65ec477f886f7bcbdc67103354af263bd30c0dccabbfbc506ba1

SHA512
72cc4c4625555fd2fb2276a0a062d39ff2ac7b55a212ce6f58fbd7f58ca5a4a0d69e43a7b72bdafa803c84bc400afb5c274e455e5846c83d35d3f9bce88be41b

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\IntegratedOffice.exe

Filesize
5.0MB

MD5
8d2a500de1b893f21aca679040496aa3

SHA1
50f4d7211e04763b568917779bb037a2099e616d

SHA256
ce3246664f6581ff2940877bc9c193c69dd3173298d4935487f9afd94969aaf3

SHA512
bf46ca174b6fca41c449aa70fdc175f279de87dd10551760d5a0d6e5d3e0c0ab6e46f21c3f973a73b75a8b1e7931e9febee96f9cbac59135b7c8c05bf428505a

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\MSIX.dll

Filesize
2.0MB

MD5
b1fd09c0de1771839af0ae6de39000d3

SHA1
fff7157c1119b97f2d594e339baa83dcd5a57ac9

SHA256
eb0eb7d606f60953f988ad7c3c975efc34fa6ecb4597c576e391e29f5b3a6a42

SHA512
2ebf56647eb318ff4c8d7abf3d771cbd425d35ac9a833652d1f6be517671dff3c9acd80e530718c01bc128283304d09b45e2c37d237857ecfc3172a66d1ed7bc

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\MSVCP140.dll

Filesize
557KB

MD5
7db24201efea565d930b7ec3306f4308

SHA1
880c8034b1655597d0eebe056719a6f79b60e03c

SHA256
72fe4598f0b75d31ce2dc621e8ef161338c6450bb017cd06895745690603729e

SHA512
bac5729a3eb53e9bc7b680671d028cabef5ea102dfaa48a7c453b67f8ecb358db9f8fb16b3b1d9ea5a2dff34f459f6ac87f3a563c736d81d31048766198ff11e

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe

Filesize
25.7MB

MD5
4f025e7f9add3623a8b384bc0c7b18cb

SHA1
e39e0b82463ace5cdcd0ac796ce6d0bbe12a2f11

SHA256
ee5c531e60da2108f9a922746fa1fb177195048d5aafe2244b0dd894956f5b8e

SHA512
1dec7a3d7ef0b2304efb3074b7baaf6f6243c7035d32e1f30a52a8d45d2fdb73c42fda55dc73785ba65ad0e722ddb237d9f20147052832434ef963dc40d76924

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

Filesize
12.3MB

MD5
75f42872c0302d36a1e3bb5c7928fc02

SHA1
1e79281a76f249b085cccc28a479e40e16a099ba

SHA256
a84d211c63f9d8e0258696d61eded7dc7fe914303e2a4a8ff015fcc5696d4c39

SHA512
ec783032f87d8bda3b9702905e7c5749c031c163f86165e8b2a6b26e67f35c8c3d6ad96af80dba8baf87c2e7d945b038cfc8e798d9a555267bff45ebab266b66

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\VCRUNTIME140_1.dll

Filesize
37KB

MD5
75e78e4bf561031d39f86143753400ff

SHA1
324c2a99e39f8992459495182677e91656a05206

SHA256
1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

SHA512
ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\appvisvsubsystems32.dll

Filesize
1.3MB

MD5
75e832bb1529d87a88ef49034e381930

SHA1
9b8a52c3c9b3a88c3bdd3b5f5aeb0aecc3df67e8

SHA256
4a7ac11ff22d5d842c47be8df6ca98f99c7d48e7ab2f638ccd01eae253e424b0

SHA512
6e285a0484d57f6de0ca78a24fb46d9626741d764356d12e2ea6fab32e00a3f285ea0722b89b5a63c11179a5d1ed2a065f97b9399f63f67981fad01967ae654e

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\c2rintl.en-us.dll

Filesize
50KB

MD5
331f05e490914da44395950a1a57755e

SHA1
c1961dc9fa4b58393187d32afd4bb6a44828de03

SHA256
2072908383ee3b1bc47041600a40ccf92a64ec3046808cd62c61cb408da98e07

SHA512
2edd9e0fac061934dcde4b15b39a016bd0b70346b2e830bb06067383252fe349e54f3101cfa26e3498cd0714c541deff9047ca7e7f77f6b575af9a0359334330

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\i640.hash

Filesize
106B

MD5
a4347f1ff6f6f41a3507683638109005

SHA1
88a6dc2c2b2bb7036ccd928dae0551deea77e97f

SHA256
fc54d089527750bd624a8577c87679894f4624fce607a6da4b60764f0e69a483

SHA512
19199c3f468be7c844056f1e7566706f0daa051730912d30a6dd9c4e1eb41f135645b307b826a579fe71ed0347265f12ffbd4c1879ecc6dc898ebcd068e6f24a

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\repoman.dll

Filesize
5.6MB

MD5
1559ca2093f1c2ffcf3ab9a9fb2776c9

SHA1
ca87af3e61631d38d4079617a8ad84aca14324cb

SHA256
7898ae219d0876fc57bcf22569b50164c41391bb9a32c3cc1cd03737e86b0475

SHA512
1c118e97eb9bba992891b2be378f59ac2d6866e6a556129311f1f8e7697c1a41d2974ff81c1a85de084e7dc2e8735a43583f9c34957b5cfa1aa0df2e93d51987

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll

Filesize
531KB

MD5
c66926bfecc9c8a1df9e2f1e17070661

SHA1
a6335dd5a0e62621b32c4a2d26c7b8a592d51ca6

SHA256
25d70018e8cda903759499599fd4cd015058966205f254e1a6660c72bc3e9cd0

SHA512
19a215b12f7eb2a5ffdcc43bdf58310be665a1e3f42d316f649047bb6ec8b6700a04288211b793e965514fa5f6785eb10a8cdd7cde9466d6362db0ef55206b4e

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll

Filesize
531KB

MD5
c66926bfecc9c8a1df9e2f1e17070661

SHA1
a6335dd5a0e62621b32c4a2d26c7b8a592d51ca6

SHA256
25d70018e8cda903759499599fd4cd015058966205f254e1a6660c72bc3e9cd0

SHA512
19a215b12f7eb2a5ffdcc43bdf58310be665a1e3f42d316f649047bb6ec8b6700a04288211b793e965514fa5f6785eb10a8cdd7cde9466d6362db0ef55206b4e

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll

Filesize
531KB

MD5
c66926bfecc9c8a1df9e2f1e17070661

SHA1
a6335dd5a0e62621b32c4a2d26c7b8a592d51ca6

SHA256
25d70018e8cda903759499599fd4cd015058966205f254e1a6660c72bc3e9cd0

SHA512
19a215b12f7eb2a5ffdcc43bdf58310be665a1e3f42d316f649047bb6ec8b6700a04288211b793e965514fa5f6785eb10a8cdd7cde9466d6362db0ef55206b4e

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll

Filesize
597KB

MD5
647a0967315ed80dd590fe111f38bed7

SHA1
f311845d591fcab6c9b086f519e6f83b52ba960d

SHA256
95a069ff97824a004d4fada58a23c78b775db72de5570a05977355149df67cb6

SHA512
0178a3f488e6972ca87a56fcb4bad16679df88149ae265e29c8a2aac3bea75de1cce5e82575de0eef4303bfdbab2593d96e5074f10a7561c83cde22972590d7e

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll

Filesize
297KB

MD5
94d6fb63e0fcc7db6ce26674e61a06f6

SHA1
34d019f759db4649d89f584437804597b5d02395

SHA256
53090adc6e512a6cc52fdd7640736b9352537e757520db7b808857f179bfb3a3

SHA512
83a4a927a10fa5210f54908c43c6d68a09ef1aae0aaac40538b4f9252bc01f7b2e3f3e56fe2ee89f0f739918f2559e6af63f58af914f68ba97927245324d7843

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll

Filesize
1.6MB

MD5
df8403e03a06679d9077a4161849671e

SHA1
6635f842092ba46af0520ce0fdb978c6b12a7be7

SHA256
49738cd60073b83e07957faaf57ac2fee48fb44eb9a69d9a96591b9fb045d06c

SHA512
433a869ba671361f7a72601cf9f47dd560aff5abdb69557ae8cf9d7572646a762e711e7f3dba32f5c04b2e8865c8bc29227cd5197a7cb0762131e8baf4ec8b18

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll

Filesize
405KB

MD5
69d9cc8fcfb951ec44c7d9f26bcb3499

SHA1
243b233b74a96d2676a0a2c3dec02904944c97cb

SHA256
0167466a80c29b10f0cfda34c745930d96a1117d6a9b7838efd6ae77156df495

SHA512
18c588224cd6e5a3b82d27c98f6f92bcf6efb111b11f0c6695ecd9ea1b0dfebf1e5575a4d0fa1e193890a3d7409a041fa5f1322262da095a9f16e5b284a48eab

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll

Filesize
189KB

MD5
5cb3f3f7d8d9afe46bf220b1076f7272

SHA1
f6ba4dd48e9deddf6094c9f5fb1bcf761e9e31d7

SHA256
97119e4ac0b990aabdcb218dce06c2752bf4e37ad7139390cbfd466b1b67889c

SHA512
42f8813eb73e1757e200d18e5ae7ee381000466cb9eee11d11993b81ff9b2364995dc293e3109f7e1cb35a2081b0ccc46942afcd03ba24cccbdac61313187f1f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll

Filesize
1.0MB

MD5
c9f1a48e9594a1e00a754d0bf50fa6cd

SHA1
c07ac2f5d10c007e33a76261dd4b9f5a7ca9a67e

SHA256
b9ce70c3b1a73efe80753a05d93d1f84d43456095e1f72358a7cc5c48444d0b3

SHA512
3a1edfdce7884558a9ad728e897ef0b3268c18f68b79441fe6eaa4505cbb9ba757b9907ece46781d09e57e32c949e64c973e4ac848bfe9b88c53777e0c05bbff

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll

Filesize
569KB

MD5
15f5792844af082587747a09f1123a0d

SHA1
558999ff58818971f96dfff4f433afa596794ba7

SHA256
e5188cf139c4af572588fe794b7392479a0bf59aef86666a0a22db121e41da9d

SHA512
7de7f740bab5dcafb9f502853963547c7e50993404535dbcd39b88a586a2bf31b50f1eebe4682ee5fa458a00948af44dc104daa0b595c2c02d6901a81beab24f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll

Filesize
985KB

MD5
b992640abf4ea6cdac53d8b38076f845

SHA1
ed480fe74fb663e0192098c99a822022b380481c

SHA256
f945dddd970b1bd95c6f713f3a1797a2f0772bbaaee0803f43e39fd748d4502a

SHA512
a3b1beef8df9a0f14eda0cd6d01895bd17c346fd930284806cea6657b3c73df8899c699484742a45753dc0cd85b4b92e7e5b6d31b4f94ccc9865959f28fbc0d9

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll

Filesize
829KB

MD5
ddc59d3df358f9372708531b977848c3

SHA1
e1a0f9b58dc5579bbd5845bb6d3a7da3b5d8b7da

SHA256
fedc8cf10ab72e7a0ec3a493356157028fe16d2ae97f73dead28fffde1b7c935

SHA512
4b75fe159eeadd71fea2e3b569796ce547808bff5c183d271e3d2aed7ef11311121f7ec768bcbc1c0354b771f971aa2b46836a8a6c2b0c1d2f8b21922943dbd3

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll

Filesize
1.0MB

MD5
20ae1459b18c035d187ebd44d6fe23c2

SHA1
9fd7012e099ab2c8a39341e7260f050e6c997a6d

SHA256
f694caa849ce8b91e5ff374af38c8fc13af15b477b6f3401a13056da11d6f818

SHA512
978ab47b667ca96cb16c02a19692433d1dd46f1209a4fc17e6ebab026b3a665b98298ef1df877faf77d3fd460f052da80c2e6d1ed40cbcb2da97bb648700e585

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll

Filesize
50KB

MD5
331f05e490914da44395950a1a57755e

SHA1
c1961dc9fa4b58393187d32afd4bb6a44828de03

SHA256
2072908383ee3b1bc47041600a40ccf92a64ec3046808cd62c61cb408da98e07

SHA512
2edd9e0fac061934dcde4b15b39a016bd0b70346b2e830bb06067383252fe349e54f3101cfa26e3498cd0714c541deff9047ca7e7f77f6b575af9a0359334330

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll

Filesize
50KB

MD5
331f05e490914da44395950a1a57755e

SHA1
c1961dc9fa4b58393187d32afd4bb6a44828de03

SHA256
2072908383ee3b1bc47041600a40ccf92a64ec3046808cd62c61cb408da98e07

SHA512
2edd9e0fac061934dcde4b15b39a016bd0b70346b2e830bb06067383252fe349e54f3101cfa26e3498cd0714c541deff9047ca7e7f77f6b575af9a0359334330

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll

Filesize
2.8MB

MD5
6ab304bc4104b9cce5258a294d560bd9

SHA1
5a7e9a026e088ffe3c2d0f895e4b07e0973eee26

SHA256
462add3d556b15e93b067693d03046556ed7dee7318650b996dd4d3caf091c6d

SHA512
66baf57d467ac524495d436ecd254dc2d6dc3c82033c1f902aa6b18cc7576f24f921745988038e6b0b598a32af66c010b43766ae9738f332288a0bdb1519b824

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
25.7MB

MD5
4f025e7f9add3623a8b384bc0c7b18cb

SHA1
e39e0b82463ace5cdcd0ac796ce6d0bbe12a2f11

SHA256
ee5c531e60da2108f9a922746fa1fb177195048d5aafe2244b0dd894956f5b8e

SHA512
1dec7a3d7ef0b2304efb3074b7baaf6f6243c7035d32e1f30a52a8d45d2fdb73c42fda55dc73785ba65ad0e722ddb237d9f20147052832434ef963dc40d76924

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe

Filesize
12.3MB

MD5
75f42872c0302d36a1e3bb5c7928fc02

SHA1
1e79281a76f249b085cccc28a479e40e16a099ba

SHA256
a84d211c63f9d8e0258696d61eded7dc7fe914303e2a4a8ff015fcc5696d4c39

SHA512
ec783032f87d8bda3b9702905e7c5749c031c163f86165e8b2a6b26e67f35c8c3d6ad96af80dba8baf87c2e7d945b038cfc8e798d9a555267bff45ebab266b66

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe

Filesize
12.3MB

MD5
75f42872c0302d36a1e3bb5c7928fc02

SHA1
1e79281a76f249b085cccc28a479e40e16a099ba

SHA256
a84d211c63f9d8e0258696d61eded7dc7fe914303e2a4a8ff015fcc5696d4c39

SHA512
ec783032f87d8bda3b9702905e7c5749c031c163f86165e8b2a6b26e67f35c8c3d6ad96af80dba8baf87c2e7d945b038cfc8e798d9a555267bff45ebab266b66

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll

Filesize
5.6MB

MD5
1559ca2093f1c2ffcf3ab9a9fb2776c9

SHA1
ca87af3e61631d38d4079617a8ad84aca14324cb

SHA256
7898ae219d0876fc57bcf22569b50164c41391bb9a32c3cc1cd03737e86b0475

SHA512
1c118e97eb9bba992891b2be378f59ac2d6866e6a556129311f1f8e7697c1a41d2974ff81c1a85de084e7dc2e8735a43583f9c34957b5cfa1aa0df2e93d51987

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\Updates\16.0.16827.20130\i640.hash

Filesize
106B

MD5
a4347f1ff6f6f41a3507683638109005

SHA1
88a6dc2c2b2bb7036ccd928dae0551deea77e97f

SHA256
fc54d089527750bd624a8577c87679894f4624fce607a6da4b60764f0e69a483

SHA512
19199c3f468be7c844056f1e7566706f0daa051730912d30a6dd9c4e1eb41f135645b307b826a579fe71ed0347265f12ffbd4c1879ecc6dc898ebcd068e6f24a

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll

Filesize
309KB

MD5
22a0056ffd1c0b3081ca56f441cec3c9

SHA1
81eaaed525b7c714261f840f7cdb5164e45d734e

SHA256
782910b23f8a65ec477f886f7bcbdc67103354af263bd30c0dccabbfbc506ba1

SHA512
72cc4c4625555fd2fb2276a0a062d39ff2ac7b55a212ce6f58fbd7f58ca5a4a0d69e43a7b72bdafa803c84bc400afb5c274e455e5846c83d35d3f9bce88be41b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll

Filesize
309KB

MD5
22a0056ffd1c0b3081ca56f441cec3c9

SHA1
81eaaed525b7c714261f840f7cdb5164e45d734e

SHA256
782910b23f8a65ec477f886f7bcbdc67103354af263bd30c0dccabbfbc506ba1

SHA512
72cc4c4625555fd2fb2276a0a062d39ff2ac7b55a212ce6f58fbd7f58ca5a4a0d69e43a7b72bdafa803c84bc400afb5c274e455e5846c83d35d3f9bce88be41b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat

Filesize
31KB

MD5
1f7b8b1aa4f7de7a457973919e1c38e7

SHA1
311c29a414c2699b8f1747021138a492cb7022ef

SHA256
5110c0417135be31a782ee11202892bb6a2c8c3c8fda1c6809750ca4fa90218f

SHA512
1795aff677d7512aff6015a9212560728cb20ec2687f11d66284d59d194b64dbc409d2bcef2c234bfe9e1803d265ec24f131f51863dcd9f475ad87384aa9394b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll

Filesize
2.0MB

MD5
b1fd09c0de1771839af0ae6de39000d3

SHA1
fff7157c1119b97f2d594e339baa83dcd5a57ac9

SHA256
eb0eb7d606f60953f988ad7c3c975efc34fa6ecb4597c576e391e29f5b3a6a42

SHA512
2ebf56647eb318ff4c8d7abf3d771cbd425d35ac9a833652d1f6be517671dff3c9acd80e530718c01bc128283304d09b45e2c37d237857ecfc3172a66d1ed7bc

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll

Filesize
557KB

MD5
7db24201efea565d930b7ec3306f4308

SHA1
880c8034b1655597d0eebe056719a6f79b60e03c

SHA256
72fe4598f0b75d31ce2dc621e8ef161338c6450bb017cd06895745690603729e

SHA512
bac5729a3eb53e9bc7b680671d028cabef5ea102dfaa48a7c453b67f8ecb358db9f8fb16b3b1d9ea5a2dff34f459f6ac87f3a563c736d81d31048766198ff11e

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll

Filesize
557KB

MD5
7db24201efea565d930b7ec3306f4308

SHA1
880c8034b1655597d0eebe056719a6f79b60e03c

SHA256
72fe4598f0b75d31ce2dc621e8ef161338c6450bb017cd06895745690603729e

SHA512
bac5729a3eb53e9bc7b680671d028cabef5ea102dfaa48a7c453b67f8ecb358db9f8fb16b3b1d9ea5a2dff34f459f6ac87f3a563c736d81d31048766198ff11e

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll

Filesize
557KB

MD5
7db24201efea565d930b7ec3306f4308

SHA1
880c8034b1655597d0eebe056719a6f79b60e03c

SHA256
72fe4598f0b75d31ce2dc621e8ef161338c6450bb017cd06895745690603729e

SHA512
bac5729a3eb53e9bc7b680671d028cabef5ea102dfaa48a7c453b67f8ecb358db9f8fb16b3b1d9ea5a2dff34f459f6ac87f3a563c736d81d31048766198ff11e

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140_1.dll

Filesize
37KB

MD5
75e78e4bf561031d39f86143753400ff

SHA1
324c2a99e39f8992459495182677e91656a05206

SHA256
1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

SHA512
ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140_1.dll

Filesize
37KB

MD5
75e78e4bf561031d39f86143753400ff

SHA1
324c2a99e39f8992459495182677e91656a05206

SHA256
1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

SHA512
ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140_1.dll

Filesize
37KB

MD5
75e78e4bf561031d39f86143753400ff

SHA1
324c2a99e39f8992459495182677e91656a05206

SHA256
1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

SHA512
ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

Download Submit
C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe

Filesize
5.0MB

MD5
8d2a500de1b893f21aca679040496aa3

SHA1
50f4d7211e04763b568917779bb037a2099e616d

SHA256
ce3246664f6581ff2940877bc9c193c69dd3173298d4935487f9afd94969aaf3

SHA512
bf46ca174b6fca41c449aa70fdc175f279de87dd10551760d5a0d6e5d3e0c0ab6e46f21c3f973a73b75a8b1e7931e9febee96f9cbac59135b7c8c05bf428505a

Download Submit
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E249050-F0E4-4573-969E-482A85CC383A\en-us.16\MasterDescriptor.en-us.xml

Filesize
35KB

MD5
ae945c6ef33c884b27fb7b2d2374dc6e

SHA1
6b85301f7ec20402f57ee887ae929f3a6f6d4d8e

SHA256
434e84b8b49f46772c6f1a150a281879528413bc9f84595e21f455fc096a2ebb

SHA512
53fb0088c7c6f681ba3b773c8b56393ea9395b88ab545441b1a3695ed084d9acfc497f47dfdc607e1fde627c80ff89089b42d430a6f8f119200f81f8de9c35ce

Download Submit
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E249050-F0E4-4573-969E-482A85CC383A\en-us.16\stream.x64.en-us.dat.cat

Filesize
79KB

MD5
705b8669ffbaeaf41a774fb4917039fb

SHA1
ab6f911e119061fe5d24a0d6892370dff9233f2c

SHA256
5dea2975b7460908f832a525d2ffc7e59b2975fdc1bfd7fabc69fc75d7abcc50

SHA512
df3cb3ccf6384098487c60649289904470564ea7ddfaf5c73b0868aa7a268bf8678c3248e2e20bdc3c11cbd0c543cbee0f1fa34797e5bf655f48aa620b830266

Download Submit
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E249050-F0E4-4573-969E-482A85CC383A\sd640.delta02.cab_extractOfficeC2R744069C4-6C95-403A-814B-F9B238685285\MasterDescriptor.x-none.xml

Filesize
30KB

MD5
1a1324a6eeaaefc5cb915a8752d36c5d

SHA1
3de63decde31a2e0198ef4080410999ec9f3ca9f

SHA256
4aef7b17f4ea4b1a779380fbb42d0339ee71ed1166bad21ba0b92624f6d99e62

SHA512
ebd0e46ffc5833850ec657ca109bc5dd28c85a9423951ac0fadf8da068c69c4cefa1f4a1d7638b8f794c29ad1725e59c6f6bbce55efd788bf04a998bda1c3292

Download Submit
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E249050-F0E4-4573-969E-482A85CC383A\sd640.delta03.cab_extractOfficeC2R8087FC55-EE2C-44C2-9959-A112B0F59387\stream.x64.x-none.delta03.hash

Filesize
128B

MD5
76e5a96edd868b89f7ad29b2c02d3422

SHA1
fdfe4a43c110992584062fbde78c39e1e00a5c84

SHA256
9e4b2ec7c273f35c0aec9cc43b10da527ef8a4e8bed091e1df53fcb692fffc86

SHA512
9e6adf58e41c3fa3761d3a47957e18a06777798fed7877b0f378687714e0bd331d3efa50965ed08b5a18b21ac3cc4dfe47330a5c23ce8476f44d0a47680527f9

Download Submit
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E249050-F0E4-4573-969E-482A85CC383A\sd640.delta03.cab_extractOfficeC2R8087FC55-EE2C-44C2-9959-A112B0F59387\stream.x64.x-none.delta03.man.dat

Filesize
22KB

MD5
ced64644c15e850e59643f121f41cfaa

SHA1
76a66772565450965f444dbab76c237088530227

SHA256
c4ba6d43851dfa413b6cd56189374e6ee27ff2b6a6a6cf78ac53bb7551effa66

SHA512
5bf3d8d72e6c43dda52d8fded0a112b0c30fca53ae878bed0f2e49824e5f0959efcdcd01bb84eae0f3c89065eaa01eba686549a3080f6c4834c63c5457cbb3dc

Download Submit
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E249050-F0E4-4573-969E-482A85CC383A\sd641033.delta03.cab_extractOfficeC2RB56B4A79-C7BD-4310-A810-BAF1FC23F3EC\stream.x64.en-us.delta03.hash

Filesize
128B

MD5
5af1afa7b4144318bc908cadc37bf98e

SHA1
cd472798d49e1874eec1858a7abea156090172df

SHA256
37627d4112b3576295bc8f2767dcf45994e1762d43bc3502d44735f172a17a19

SHA512
aa9a3d01172e9c043c5881c487e585018b32847ce5aa562630d2c41578b712b34891bbe26f2c2a72b584c6bf5f10c79df019818754001fe3b1774a3039ddd2fb

Download Submit
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E249050-F0E4-4573-969E-482A85CC383A\sd641033.delta03.cab_extractOfficeC2RB56B4A79-C7BD-4310-A810-BAF1FC23F3EC\stream.x64.en-us.delta03.man.dat

Filesize
15KB

MD5
4682def60903c30ca470c4fc1c20bc1d

SHA1
78b769c7a7637863461a88c1939aacba92a3ff16

SHA256
6d5699d5ce9cb8d991f73cb0fd8ae0435e006dd32dbcd5334edcb6067e110936

SHA512
f52f73eacd2dedbcb854d9809d328252b1eb1caf9e82850772846e70a0d001fa87cdfd9cd10964c74c796d38b5e99a89c4ead144fee53b8d681ce47bea53d6e0

Download Submit
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E249050-F0E4-4573-969E-482A85CC383A\x-none.16\MasterDescriptor.x-none.xml

Filesize
34KB

MD5
27fc66cbbc931de27a370792d0656a3b

SHA1
c6fc9bcccd42acdc2e7e320ed19c99f2aa5f76ab

SHA256
291a54ea36b9d7b655a6b526c215353fe3866733eb4b92ef44345a2e15c5c8a7

SHA512
6a28d029d0462a40729891363b338ea9793dc08e655e33c8c8911c9c6a4f41290507ec2076c9416007b3007fea0b01963f6745cebf06665beaa8a3fb09559361

Download Submit
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E249050-F0E4-4573-969E-482A85CC383A\x-none.16\stream.x64.x-none.dat.cat

Filesize
642KB

MD5
73d7306c0ffbb6788d07ab7322273ab8

SHA1
6ce7c60ae47ad2ec945595dc4fff16d7191bc319

SHA256
1f3aa019516965cd406b0b15910ea031bdabc7ed0aa01a44f1bc4d0686637acd

SHA512
71978772b9dd968d06ec3d3125613317083c83cefc0ed5d1debcf8e2897145dc5f0e63cdf718052c22f35bcc3fee948e1f48addf8107418a1e2fe79641efea8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
95201d9e44c732d9b261b4b334505d6b

SHA1
d5f3f499ef27920d8a614152191a7e0c2f9c0264

SHA256
baa9a89717f4013b2799bd06490c738246759ecdf7a3200406fad5a443e83669

SHA512
15ddf637b642144dca99e2794cb4ca4d1dfa9d682e7eb42075d9b269dd5a479b5ea86017db142b599a3f022ebb695baf3691305ab17009060b4f64ddd7254282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Filesize
352KB

MD5
815172747c64e2f781505da8d849c0f6

SHA1
3d0ab653a45e7869a8f82bd711501616c3f7f367

SHA256
6898e40a8ef1d64e6314c438882814785719886b99d2560e6a59168c1b65ed8b

SHA512
c53eb93d383516e166f337b8d502ec375272dee978c4ca4bca86a1ac6f0635fcb939c5670a65debc9def8fc8823b4894d12213a7b481626a9ca8d4d9ca267dc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120100v3.xml

Filesize
999B

MD5
0847565b252c325b0f3f4b65ddbf8cc2

SHA1
bbae496c74dd0952de4cfc8a2f86fd0a8a9bb3b8

SHA256
0534c65211d5503b490beed86790ee243c5da900eada1b419d593c90ee082a9e

SHA512
d53981bfddf765ca9e4544744a234b7fef266dfa85700e51523e52d784b4ee955a670da22a549ee53bccdc4d2ce5a9007ec793a732202ab143db6f27317c98fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120600v4.xml

Filesize
2KB

MD5
8bbd2775aa81f41a3625c1185693f355

SHA1
8b2bd5ea1c41d9fa47f541847effb2b088667ec9

SHA256
60c556b6975f181604286131cefe803b627861bc3bc0c0bd43af6b3728ef4fd6

SHA512
db11d25e0b235f3af00c0c57e1bac7c5095625822a3c66aef9b582d6e16643303b5ef2f69dffc0af1ec64484b21b196905c1569e383995a2527c452a205a36fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120608v0.xml

Filesize
2KB

MD5
8c5777ac756cc40b68cbe34588696355

SHA1
bb6c949c54144bf5489af3d12031692a38c31745

SHA256
093a6a5626cf6ef14c8986b7ff0de639e4bbb9f152e092a1f7c896af804e3408

SHA512
955fd469318dff19fe4438308e288b9543c62c9ab577c963525b81b86cba449df1853ad1bf3ddf070bfeb5329c1f896aa01cddbad72b0f82c5f98830b3f7d12f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120609v0.xml

Filesize
408B

MD5
a5e9e240da5021a44de2baf579e8b347

SHA1
f0e818444f67af281a33c7decff515761dfbaa6f

SHA256
ffe83d5f40f6a716b3215eb98bc35709f2dd6afc64433cba47d52dac5618987d

SHA512
4ba5e8977e984119dd5fdb9cb69418734cfe668b5e5eb9b08db8e4da542515c278f3fe64c763ce1a54f2555ca48033073acbb3a6f0efffb1e087c4c211007d15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120610v0.xml

Filesize
474B

MD5
b749b5a57be6f4bca525707db60c079d

SHA1
d3e1a5802fba58dfdfe8d49e6045ad5e1bda3d91

SHA256
8771387ac554c3bacba845583d16017cd31889c9c50a922d468c76fded4c262b

SHA512
b139d03311f95d54cf5d4db20499a4c4e6f179fa7cec10ac9b234169cc1d280f4f9dc53901776b90e2a6d7ac3f35d68e4e7724ed136a02c3dfda4976cf145756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120611v0.xml

Filesize
415B

MD5
96718bbac0dfce5a21fb806ea2cc862b

SHA1
c5eda22f3fae25f5213d4b1f1d1eebeb9f29aaef

SHA256
cb5297d29bfe20d41f76dabf48dfa447a1675b61255778a41fd951fbbe37bf4d

SHA512
4156b7307ca6f5a3b8293ed85f96451ca8a9562a48c96f5b547ea6243894232ef81fe839f184e0ce2b49901ad89e7af29788d3e4426133e6b3d4da5cf34bcb83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120612v0.xml

Filesize
471B

MD5
1afd53ec257e7a723f1a178236a9067d

SHA1
7b06375a5b91c6d31ed0bc332d40c3a1e093e929

SHA256
994bfccaec776aeba7bbd1a919ce807dd659454cd5783e57d2d825129848d81c

SHA512
83ba0ee3849a4d1bf1feb632009587b0af58a3f7be0dac7e8eb79bc0492e93aca9dcee3abc67630f02d0deeccb56a444d4b0fac50f2a7478cc14fa320326c891

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120613v0.xml

Filesize
632B

MD5
2df5adf9e713cb5364ef87433ecdfd5b

SHA1
b7056e141c73dc2617261e1b0332df9769fb07fc

SHA256
2188bc1fea17080edc6b217a2e62ba75db989ac7147038fa489d5dbef5f42111

SHA512
7cec28bcdb6e6fc9a5e861423c6f10757d7e3e5fe8dcb63cf5c9b4114ebd8a689d5e36f61332d61ddfc7e7d74eac830cf1f9e7e8bf78d97f5c65cc4e2cf538cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120614v0.xml

Filesize
467B

MD5
d5c74868b0ce63977312885f24b52b19

SHA1
867d9ac41c3ed3e696e60af34617c9396df88c94

SHA256
48adb758e05cea4b8530d29b93b36905fef8023fcedb6fa82509e3729c0e0dba

SHA512
aa6cd53ba6279d7ba68081f85ff4f0136558b391f178a4cdef240f1b2a2f6c7bdc6176182cc68da77c1eab072bd59a084a9ab979432ad88577c1d6d4bd3afe68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120615v0.xml

Filesize
407B

MD5
11ef9ac85f51c17ee92a874871c4225c

SHA1
f7a67119cd3a3eb47ad54e933b5a402a66355641

SHA256
8797b1ee2e130f062e458a3a4ee6fa9f927aea4464b4c857e685aab3a333f320

SHA512
4c76191e38b2c299b616c5adebc1abb6b1a2827299b5e564281ef9957a8533e60f5e106be3a161daa93528a9253cd918f654105b63c5768aaad94c28fd7e7321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule90401v3.xml

Filesize
1KB

MD5
01bdec61af8a91f0974fa2877635c522

SHA1
65bcd305418e0f394bf8a480cb312c2dd2006b2e

SHA256
cb9affbb94de8a990e1c1fe1f108947d0be197c7d95483c774a758dbc594c677

SHA512
98fcaa668198a45b741c849137d0af8c8da2eb0409d9a47b86520cf7f14b7ceb78d9ba88b7f26f0d873cc036925fb52720a91582fd04889d5790cbd0d5e9b635

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
197114036581811316bff888b3f46a01

SHA1
55b0dbd51a3ad7c0582067c412cf63bf4696194f

SHA256
e745ec332da4496f180504c4ce982236146adadcd16eb2fdd2801e61ac26db24

SHA512
99f30ea0a71fb3a31ff11232a6e43ffb0bd4f2d7a6bfdecc168c8d7112874d28c5ff1ae626121a98d4f8a88a4ab56f5992e409c3d4c74058903ed0925660bfaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\OFFICE~1\i640.cab

Filesize
31.2MB

MD5
672c3ab277bac5c668e51878a5c88fb4

SHA1
aee83d1df83d2071c8b98b1d5e5a68582d01d91b

SHA256
d31bc3476c5377a008e6e7dfebff8b422d94dc7e50aaebc1170c9a806aec3079

SHA512
7e771888f7571c595cfd16107fbf9512a7ca6e0eb7f14fb55f1ab7649c54bd13466e0d159060977667e87fe3cb5cc31ad7e41b8ca07867994b914c59d5c89232

Download Submit
C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch

Filesize
26B

MD5
bd3457e50947d4280734e74b51b5b68d

SHA1
424635c6b5622a6c01a59d290a1c9ab8e593effc

SHA256
23d647979bc5dc186de5ba3e00a222a912ab8e4782eb6407efa70e29e95979f5

SHA512
e83e3615a5e94af288eb1c9b92f55e271765cc43531ec94574371debf63c0c4a58327b6fd8a4775bfba8a3234220cb0396b6d33164309a09a1d826c0689143fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch

Filesize
26B

MD5
bd3457e50947d4280734e74b51b5b68d

SHA1
424635c6b5622a6c01a59d290a1c9ab8e593effc

SHA256
23d647979bc5dc186de5ba3e00a222a912ab8e4782eb6407efa70e29e95979f5

SHA512
e83e3615a5e94af288eb1c9b92f55e271765cc43531ec94574371debf63c0c4a58327b6fd8a4775bfba8a3234220cb0396b6d33164309a09a1d826c0689143fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\Users\Admin\AppData\Local\Temp\OfficeC2RA30AC90D-0E0A-4EBF-B3E8-70D8F759F035\VersionDescriptor.xml

Filesize
20KB

MD5
cff0b7b3316d537895e39317dff4fcdf

SHA1
c4203908d88e89a8d50256634d2adc770ceace18

SHA256
9cc92b831cfa36c26334f345d7b860efcc7b824e8df2cc93ea50282ddde7a5dd

SHA512
fc073fcab3a5bcbd92b4ed46016f5c7d4bef0d9c8a6d30beeeec925c43c92cccfedb6fc0be0a84ee03d09c7c6ab0a4caca315ea93d9390fa24b56ca3b19b923a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wsegjjqo.rys.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Temp\OFFICE~1\d640.cab

Filesize
9KB

MD5
b5b89d13e070177b46163f04cbfa7a9b

SHA1
73e02607c1aac8049bec13babc2cdbcc521e1209

SHA256
7a509fd9fa1e904acc2cb4e11b7b2452fa58394a054524f45ffce4c2901b4828

SHA512
812e39871b513573074053205ede18092a2b76007add9a700ad5124a204eedcc1db45f5c7a4bc6815ec76a7a81b1d9f22ddecb145ca4cdde7d56371648952b87

Download Submit
C:\Windows\Temp\OFFICE~1\d641033.cab

Filesize
9KB

MD5
df3df03e7d593056491c289a8fc23a00

SHA1
39a6a6e76747fead3205aedbbce8420776e8fa18

SHA256
eeeb8bc39002a1b8999386a62a273f543b47b2f4e25dd061d832c6129e2b7d47

SHA512
21adfe15c7bb6717190d69c81aa402d64f59879d4e3d1af2f15e81ed6bd9c8a04f7096e2de13e0e03908e0716cc440ddea2e4e13b09a7d01ffa19a34bf3374d8

Download Submit
C:\Windows\Temp\OFFICE~1\s640.cab

Filesize
2.4MB

MD5
002e24d9fb61bbc3b5f0d06a286880cb

SHA1
a13ceb70423e9dadd6d44d54828e33814d0eb1e3

SHA256
7cd16275242b15421b09b5d54fa30fe224301c4a409ae365693b7cc32c514868

SHA512
99975fd17885a2215d883dbb6f6eec7d62318dfb9239def7c2da9aab281624fd2c1ab6ec1dfdee8191f590658141413f76b2730f993f8ce8b9408cf3385d82c9

Download Submit
C:\Windows\Temp\OFFICE~1\s641033.cab

Filesize
629KB

MD5
b4c290d08f37d3b7ab0fb7f763807465

SHA1
eebfb1627383db2ee7c3647b063b1e6b3d940433

SHA256
06c812830c806e416c305d56c2009a1d8163063364586d2bbf60382644cc1209

SHA512
bbc2716e23d31571e765f5dd247c9d0b4ab00e95c66e7edfdf5cba54afce0cfca9cfd1ba0dc3e05e8d2bcaffa31b3d8983aa7c620cb9d0b0450f1d02f2cc7b8f

Download Submit
C:\Windows\Temp\OFFICE~1\sd640.delta00.cab

Filesize
1.6MB

MD5
f8c75c03bb8c89a9ef5cc4859d130d05

SHA1
82d1409cb5a7d9de6befe507e71390ad49c2aaf9

SHA256
a4cb36c68d6cd42b8f005d4586e7ee6517363b5d196b5b76e9bdaeec5589c029

SHA512
36e41ef444495b614a4d2ffdeeeb8b1d533c5024f2078624ffdbe6db349150ebfe151cd51e88773eb3e95637c35d8a3564ac6585da53a6bdd1f575352e379750

Download Submit
C:\Windows\Temp\OFFICE~1\sd640.delta01.cab

Filesize
33KB

MD5
1488d69baea917ba535a69ffbccfec0e

SHA1
4f543d08b8678873b8c7d53447bcdd6fa32a32b1

SHA256
b2eff32f5041f6cea09e21d1de449e5589b34e79be4e5fdafdc21c3e66093060

SHA512
3f7bea3194690f28a8d4776751aba4f7248d5e12fbdee4bdc487c871cb65c8e75aafa553de57c75ebca957339a529199edff6a48d4484e0d12c371fedf030b4e

Download Submit
C:\Windows\Temp\OFFICE~1\sd640.delta02.cab

Filesize
33KB

MD5
e1aaf731a32f64dfd1cc07b2e4f4fa36

SHA1
16367b78d9d7a6f4a1d5aeb10ddbe3ec3236dd68

SHA256
862fef3da6c5054b1484654af7441f2142f7b6f47ae04c85a77f6474ce1eeb3e

SHA512
c4054d17c41e3c811a61ec4e698a2f6949770ea869c1fc7d722e867ba304b5db7ca4ef92bc747e3e1a764596bd644b0feb5c399355e2760210e4aac1d62d4ce0

Download Submit
C:\Windows\Temp\OFFICE~1\sd640.delta03.cab

Filesize
33KB

MD5
852aef3c187090c917a170020eea17c8

SHA1
90ff37cca1839764abc334cea70f014384ad0875

SHA256
f64f323f138ba41b02da41a2e0da698f4b1bf920a28e65f3ae22a0b9fd9e69a8

SHA512
c39d917fc735956ea039917a4fdefd1667d3e7b271e3bacaec53887eec9ea0d1512b2a1d8272e421587743358c19ef2728b8563685d9f3eefc862756a7948984

Download Submit
C:\Windows\Temp\OFFICE~1\sd641033.delta00.cab

Filesize
339KB

MD5
ab0d55b3563f03d62c242bc8921f554f

SHA1
ca8b902dde7a601765bbd9efff6c6a09e6382314

SHA256
2fc2bd10866194953f41d5d3f9092e3a98f33f3a1ba5e9abc80bed504be54d8d

SHA512
1540a851bdcb95f584acebaca7bd71b75417d0ac7db6ab2586fe48ce641aafb7a245fd04eb1c410caeadcd96fd2cc7f564029bcebab33bf78218c08d30a25245

Download Submit
C:\Windows\Temp\OFFICE~1\sd641033.delta01.cab

Filesize
29KB

MD5
db03eb5194028aebb326e69d47412576

SHA1
69df3a9b381bdcd304cccd0310bd4dcff29d2966

SHA256
8ee21820b7c298ad2be987adffe8d57d0598d3e7e770dab46c67f477065ab916

SHA512
5a3082e66f9073d5e11d54933a948835021f06853b54414b49ecaca53f16ea9148cda0104f1db1408cb65117cd5e7978de6186b2b486ccae5b87e2ea5a2bc892

Download Submit
C:\Windows\Temp\OFFICE~1\sd641033.delta02.cab

Filesize
29KB

MD5
25e9156743510f4218636e0b847027d0

SHA1
f50cb40981097fb3a20e5bacc684fe11eeb19c91

SHA256
e46dfed3bc65156045b2e01e219f18a51102ca6efcd410a667c86e58a0d58203

SHA512
702dcb343e63b5638ed3a7d78dccf69eca74a63e2b5d09d6c3f1ec522a6903e853e78b61d07d2f096c2750ad1b89700d1029bd5971b2fbc3b249afb891e5d1b2

Download Submit
C:\Windows\Temp\OFFICE~1\sd641033.delta03.cab

Filesize
29KB

MD5
b90aeff228ada059af3f180e45700ff5

SHA1
8176342817f52f9404de33f5218b5380a72d1a14

SHA256
68988249ebbc7cfb7263ccf37b78989e289c0b6e09d98182994311eb38c45ab3

SHA512
b63b73a95213f7db21b3c92fb938fc7b4926ac75ed741316fd5f95dda2f51dc5831a54290f0d037d9d76ceafdb681fd140668c697330af53c4d3e041ddc092c2

Download Submit
memory/1588-63-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/1588-49-0x0000000071BB0000-0x0000000072360000-memory.dmp

Filesize
7.7MB

Download
memory/1588-51-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/1588-61-0x00000000062E0000-0x0000000006634000-memory.dmp

Filesize
3.3MB

Download
memory/1588-77-0x0000000071BB0000-0x0000000072360000-memory.dmp

Filesize
7.7MB

Download
memory/1588-50-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/1588-64-0x000000006E4B0000-0x000000006E4FC000-memory.dmp

Filesize
304KB

Download
memory/3136-6-0x0000000004B50000-0x0000000004B72000-memory.dmp

Filesize
136KB

Download
memory/3136-36-0x00000000075C0000-0x0000000007C3A000-memory.dmp

Filesize
6.5MB

Download
memory/3136-8-0x0000000005600000-0x0000000005666000-memory.dmp

Filesize
408KB

Download
memory/3136-19-0x0000000005C20000-0x0000000005C3E000-memory.dmp

Filesize
120KB

Download
memory/3136-20-0x0000000005C60000-0x0000000005CAC000-memory.dmp

Filesize
304KB

Download
memory/3136-2-0x0000000071BB0000-0x0000000072360000-memory.dmp

Filesize
7.7MB

Download
memory/3136-21-0x00000000046C0000-0x00000000046D0000-memory.dmp

Filesize
64KB

Download
memory/3136-7-0x0000000005520000-0x0000000005586000-memory.dmp

Filesize
408KB

Download
memory/3136-22-0x000000007FC50000-0x000000007FC60000-memory.dmp

Filesize
64KB

Download
memory/3136-45-0x0000000071BB0000-0x0000000072360000-memory.dmp

Filesize
7.7MB

Download
memory/3136-5-0x0000000004D00000-0x0000000005328000-memory.dmp

Filesize
6.2MB

Download
memory/3136-23-0x0000000006210000-0x0000000006242000-memory.dmp

Filesize
200KB

Download
memory/3136-24-0x000000006E4B0000-0x000000006E4FC000-memory.dmp

Filesize
304KB

Download
memory/3136-34-0x00000000061F0000-0x000000000620E000-memory.dmp

Filesize
120KB

Download
memory/3136-35-0x0000000006C10000-0x0000000006CB3000-memory.dmp

Filesize
652KB

Download
memory/3136-18-0x0000000005770000-0x0000000005AC4000-memory.dmp

Filesize
3.3MB

Download
memory/3136-3-0x0000000004630000-0x0000000004666000-memory.dmp

Filesize
216KB

Download
memory/3136-4-0x00000000046C0000-0x00000000046D0000-memory.dmp

Filesize
64KB

Download
memory/3136-37-0x0000000006F80000-0x0000000006F9A000-memory.dmp

Filesize
104KB

Download
memory/3136-38-0x0000000007140000-0x0000000007156000-memory.dmp

Filesize
88KB

Download
memory/3136-39-0x0000000006200000-0x000000000620A000-memory.dmp

Filesize
40KB

Download
memory/3136-40-0x00000000071D0000-0x00000000071F6000-memory.dmp

Filesize
152KB

Download
memory/3456-543-0x00007FFF60880000-0x00007FFF608BA000-memory.dmp

Filesize
232KB

Download
memory/3456-571-0x00007FFF60880000-0x00007FFF608BA000-memory.dmp

Filesize
232KB

Download
memory/3456-570-0x00007FFF609D0000-0x00007FFF60A6B000-memory.dmp

Filesize
620KB

Download
memory/3456-569-0x00007FFF625D0000-0x00007FFF625E5000-memory.dmp

Filesize
84KB

Download
memory/3456-568-0x00007FF702F10000-0x00007FF7039A9000-memory.dmp

Filesize
10.6MB

Download
memory/3456-539-0x00007FFF609D0000-0x00007FFF60A6B000-memory.dmp

Filesize
620KB

Download
memory/3456-530-0x00007FF702F10000-0x00007FF7039A9000-memory.dmp

Filesize
10.6MB

Download
memory/3456-532-0x00007FFF625D0000-0x00007FFF625E5000-memory.dmp

Filesize
84KB

Download