Analysis
-
max time kernel
1050s -
max time network
1056s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2024, 13:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OfficeSetup.exe
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
OfficeSetup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
OfficeSetup.exe
-
Size
7.4MB
-
MD5
6734e19c42beb0510fa977292a1c787a
-
SHA1
148cf04c21c63d8c8df6cf059531f5e58c0fd736
-
SHA256
839940b0be153d81eca12a4ed058699289d7787a2fc03dcf6784371c36e5fae6
-
SHA512
078cfc6889aff05eb7ff3f9881f632e9a50a34aa79a5dab9d1ba75784a6d6da671c821a63e8b4d59fa3e9d299bd6662dd50ea446b53c02ac19bd0139e799b3ab
-
SSDEEP
196608:YHQAM/ITOdm1YS8kQJPrNfcJwsIkKJkaoJGf8v24taI6HMaJTtGbM:/T/8OdF/kQhrDkz2r
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation OfficeSetup.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation OfficeC2RClient.exe -
Executes dropped EXE 3 IoCs
pid Process 4360 OfficeClickToRun.exe 4244 OfficeClickToRun.exe 1856 OfficeC2RClient.exe -
Loads dropped DLL 35 IoCs
pid Process 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4244 OfficeClickToRun.exe 4244 OfficeClickToRun.exe 4244 OfficeClickToRun.exe 4244 OfficeClickToRun.exe 4244 OfficeClickToRun.exe 4244 OfficeClickToRun.exe 4244 OfficeClickToRun.exe 4244 OfficeClickToRun.exe 1856 OfficeC2RClient.exe 1856 OfficeC2RClient.exe 1856 OfficeC2RClient.exe 1856 OfficeC2RClient.exe 1856 OfficeC2RClient.exe 1856 OfficeC2RClient.exe 1856 OfficeC2RClient.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry 2 TTPs 8 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OfficeC2RClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OfficeC2RClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OfficeSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OfficeSetup.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120119v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120635v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120650v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700951v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702550v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120656v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700501v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701850v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703050v3.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120648v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700650v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702251v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702451v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703051v3.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703451v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704200v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120631v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120651v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700151v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700351v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701150v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703601v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120634v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120654v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120667v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120678v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701301v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704100v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120642v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702701v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702901v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703650v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120652v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230169v0.xml OfficeClickToRun.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120671v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700250v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700451v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702650v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704151v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120630v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120665v0.xml OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120601v3.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120608v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120655v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120658v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701101v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701500v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702051v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703750v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120627v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700450v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701350v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701700v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701900v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702000v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120641v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700900v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701201v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702450v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702800v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703200v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703751v0.xml OfficeClickToRun.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\api-ms-win-crt-process-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\ServiceWatcherSchedule.xml OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\api-ms-win-crt-environment-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\AppVClientIsv.man OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.kk-kz.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\ClientEventLogMessages.man OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\api-ms-win-crt-utility-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\ApiClient.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\AppVClient.man OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\AppVIntegration.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\AppVShNotify.exe OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.da-dk.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.en-gb.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.es-mx.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\OfficeOEMPlugin.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.th-th.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\ClientCapabilities.json OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\officeinventory.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\api-ms-win-crt-convert-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\api-ms-win-crt-heap-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\AppVCatalog.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.et-ee.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.fr-ca.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.sl-si.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\api-ms-win-core-timezone-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\api-ms-win-crt-conio-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\appvcleaner.exe OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\AppvIsvSubsystems64_arm64x.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.fi-fi.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\InspectorOfficeGadget.exe OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\officesvcmgr.exe OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\SharedPerformance.man OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\ucrtbase.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\api-ms-win-crt-filesystem-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\api-ms-win-crt-stdio-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.es-es.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\concrt140.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\offreg.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\AppvIsvSubsystems32.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.pt-br.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.zh-tw.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\MavInject32.exe OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\msvcr120.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\api-ms-win-core-synch-l1-2-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\api-ms-win-crt-time-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\c2r64werhandler.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.bg-bg.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.fr-fr.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.ro-ro.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\msvcp140.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\OfficeC2RCom.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\OfficeClickToRun.exe OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\IntegratedOffice.exe OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\inventory.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\AppVManifest.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.ar-sa.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.en-us.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.sv-se.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.id-id.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\manageability.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\vcruntime140_1.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17425.20176OfficeC2RD6313FD8-4929-40DA-99C9-56820BE26C21\C2RINTL.nl-nl.dll OfficeClickToRun.exe -
Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe -
Enumerates system info in registry 2 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1714053221" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSessionUpgradeCandidate\officeclicktorun OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|3" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|17" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|6" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.3 = 225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e5465616368696e675549416e63686f72222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e5573654973526561644f6e6c7950726f70222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d736f2e4c616e64696e67506167652e536861726564576974684d652e416767726567617465644d7275222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d736f2e4f757453706163652e436f70795061746853796e6346697832222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d736f2e4f757453706163652e4d616e61676553657276696365732e526563726561746553657276696365496d61676552656e646572657273222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e446f63756d656e744d72752e416767726567617465644d72752e49734c6f63616c4974656d73456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e486f6d65506167652e5265636f6d6d656e646564446f63756d656e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e486f6d65506167652e5365617263682e456e61626c65416767726567617465644d7275536561726368536f75726365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4d736f2e4f757453706163652e436f70795061746853796e63466978222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4f44656c74612e53747265616d4d6f6465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e4361636865457870697279496e4d696e222c20225622203a2022696e7436345f747c37323022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e436f6e666967496444656c696d69746572496e4c6f67222c20225622203a20227374643a3a77737472696e677c3b22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e436f6e6669674c6f67546172676574222c20225622203a20227374643a3a77737472696e677c64656661756c7422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e44697361626c65436f6e6669674c6f67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e456e61626c65536d61727445546167222c20225622203a2022696e7436345f747c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e63373265613238372d656437372d346661362d613438302d333731323430366333363765222c20225622203a20227374643a3a77737472696e677c616b612e6d732f45637343616e61727922207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e454353546573742e746573747661726961626c65222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e41766f6964467261676d656e74696e67436f6e64466d744f6e5061737465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e46413030303030303132342e4f666669636556534f5f383835353839395f666978446f75626c65436f6c756d6e496e73657274696f6e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e46413030303030303132342e4f666669636556534f5f383835373934385f726f77416e64436f6c756d6e536570617261746f72222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e4644796e616d69634172726179735570646174654368617274222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e496e7369676874732e456e61626c65436f6d706c65785069766f745461626c65496e5069766f745461626c655265636f6d6d656e646572222c20225622203a20224d736f3a3a416e79547970657c75696e7431365f747c323b626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e496e7369676874732e456e61626c655069766f745461626c655265636f6d6d656e646572222c20225622203a20224d736f3a3a416e79547970657c75696e7431365f747c323b626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e496e7369676874732e5069766f745461626c655265636f6d6d656e64657252616e6b65725632222c20225622203a20224d736f3a3a416e79547970657c75696e7431365f747c323b626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e497352756e74696d65417661696c61626c6554656c656d65747279456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e4c696e6b6564456e746974794c6f63616c697a6174696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e4f417574684d6f6465726e42726f777365724469616c6f67466561747572654e616d65222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e5061737465436865636b73222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e66613030303030303034332e47656e6572617465556e6b6e6f776e416c6961736573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4578706572696d656e746174696f6e2e44796e616d6963447069222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4578706572696d656e746174696f6e2e4665617475726551756572794c6f676765722e456e61626c655374617469634c6f6767696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4578706572696d656e746174696f6e2e57696e333244657669636543616e617279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4261636b67726f756e6455706c6f616457696e3332456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e434c502e456e61626c65476574507265417574684c6963656e7365466f726d6174222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e434c502e5265706c61636557434c6162656c4f6e504c4368616e6765222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e436163686546696c6552756e74696d654e65774c6f636b696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4368616e6765476174652e4973496e766f6b654d6f64656c4f6e436c69636b73456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e436865636b50656e64696e6755706c6f61644c6f63616c4368616e67657344657465637465644571756976616c656e6365222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e436865636b5265766973696f6e53747265616d457175616c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e446176536572766572436865636b456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e446f63732e4d736f2e4f757473706163652e496e6974436163686546726f6d464948222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e446f63756d656e7453756d6d61727954656c656d65747279456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e44796e616d6963467261676d656e7453697a65222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e456e61626c654163636573734d6f64654d616e6167657243616d222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e456e61626c65436163686546696c6552756e74696d654f7065726174696f6e42696e64696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e456e61626c65446f63756d656e744d6f64654d616e6167657243616d222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e456e61626c654d6f766543616d222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e456e61626c654d756c7469706c6554696d654f757473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e456e61626c6552656d6f74654d6f766543616d222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e456e61626c65576f726b696e67436f707943616d526573746f7265222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e457870756e67654f74686572446f63756d656e744f6e4661756c74222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e457870756e67654f74686572446f63756d656e744f6e4661756c745632222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4669784e756c6c537472696e6741737369676e6d656e74496e5365744f6e65447269766556657273696f6e496e666f222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4874747054696d696e67734f6e4572726f7273222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4874747054696d696e67734f6e4572726f727332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e496e74656772617465546f5265736f75726365496e666f222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4c4f52537570706f7274466f7256616e697479446f6d61696e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4c697374656e546f486f73744e6f74696669636174696f6e73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4d6561737572654e6f74696669636174696f6e48616e646c696e674c6174656e6379222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4d6f63736944656665727261626c65426c6f6273222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4d6f6373695761746368646f674661696c757265486973746f7279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4f6d697455706c6f6164426c6f636b6564466f7242617365446f776e6c6f61644661696c757265222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4f6e654472697665436f6e76657267656e6365456e6c69676874656e6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e50726f746f636f6c5061727365724c69626c65744368616e676547617465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e5265666163746f7265644d6f63736953796e634368616e6e656c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e5265667265736855706f6e526573746f726174696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e52756e74696d655472616e73616374696f6e52656d6f766564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e53656e6454656c656d657472794576656e74466f72416c6c4572726f7273222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e536572766572496e666f52657472794c696d6974456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e536b69704f63736949676e6f72654d6f756e74506f696e7473222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e536b6970556e636f6d70617261626c65446f776e6c6f61645265766973696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e5374616e64617264456e6372797074696f6e50726f7669646572496e557365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e54656c656d657472794f6e46696c6552656f70656e5363656e6172696f222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e54656c656d657472794f6e46696c6552656f70656e5363656e6172696f5f5632222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e54657374476174652e4f6463436c69656e74466c69676874696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e5468726f77526566726573685265636f6d6d656e6465644572726f72222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e556e6c6f636b4f6e506970656c696e65416363657373222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e556e7365745265736f757263654964496646696c655761734e6f745361766564546f536572766572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e556e74616e676c6541757468466f72416c6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e556e74616e676c654175746846726f6d5349222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e55736542617463685363686564756c65725472616e73616374696f6e4775617264222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e56616c69646174654d617050617468734c697465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e44656661756c744368616e6e656c436f6f6c646f776e2e42616e6e6572222c20225622203a2022696e7436345f747c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e456e61626c65557064617465644e7073526174696e674c6162656c73222c20225622203a2022626f6f6c7c3122207d2c207b2022 OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|15" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935} OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ApplicationUpgradeCandidate\officeclicktorun OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0 = 4d736f3a3a436865636b73756d52656769737472793a3a446174617c75696e7436345f747c2d373636323039303630313335313434313634353b456373436f6e666967526573706f6e7365446174617c7b202256657222203a2022696e7433325f747c30222c2022436f6e6649647322203a20227374643a3a77737472696e677c502d522d313039383135382d312d352c502d522d313038353730312d312d312c502d522d37363735372d312d322c502d522d35343930332d312d332c502d522d32363134362d372d31372c502d442d32393633352d312d312c502d442d32373038372d312d392c502d522d37393638382d312d332c502d522d313137333439332d342d392c502d522d313139363439302d342d342c502d522d313139333138392d342d362c502d522d313037333732342d342d342c502d522d313036353130332d342d352c502d522d313034303537342d342d342c502d522d313032313439312d342d342c502d522d313032303733302d322d362c502d522d313031393539312d342d342c502d522d313030343536312d342d342c502d582d313233363435392d312d332c502d582d313134363830352d322d352c502d582d39383531382d362d392c502d582d313134363832312d312d352c502d582d313036313437302d322d332c502d582d313032313936352d312d372c502d582d313032313936382d322d332c502d522d313032353434342d342d352c30683933333737393a3535323434392c69376534313433393a3437363437342c626c6f636b6564677261706869637361646170746572353a3437353839392c32693838353330343a3532363836352c66653635313636373a3336313635382c37326838623835393a3238343430302c38306562633336353a3236353636392c502d522d35383634302d312d332c502d582d37343731382d312d392c502d522d33353039392d322d342c6175656e613732343a3237303731382c502d522d313233363938302d382d362c502d522d33343834332d342d362c502d582d313233313432362d322d352c502d582d37313237342d312d372c502d582d313131353931322d312d352c502d582d313036373430382d322d332c502d582d313036333834332d322d332c502d582d313031393934352d312d372c502d582d313030363839392d312d352c502d582d3130393833322d312d352c502d582d313032303631372d312d332c502d582d3130373935312d312d392c502d582d3131383137312d312d332c502d582d39353330302d332d31312c502d582d38373033372d312d332c502d522d313233333439372d342d352c502d522d313233313633372d31342d31302c502d522d34353438332d31362d35332c502d522d35303731372d31382d36302c502d522d38373538372d342d342c502d522d37353036392d312d332c502d522d37353030312d312d332c502d522d36383135322d31382d32312c502d522d35323331362d4331372d33372c502d522d34393136322d31382d31332c502d522d34393136312d31382d31332c502d522d34303235332d362d31392c502d522d34303235342d362d31382c502d522d33353430312d362d372c502d522d33323130372d32322d32322c65673138303536313a3535343132332c636c70726f3130353a3436363736322c36373563383430383a3437353836332c36633932393731393a3339333435382c6a6a6432663231333a3336353635352c636c3132303a3238353532342c636c7265703130363a3238343830372c636c7265703238323a3333353536382c636c63646e3338393a3234313632352c636c3937313a3239363531342c636c7265703730333a3232343731392c757073656c6c5f616e645f686172646c696e6b696e673a3137363837342c636c7573653537363a3234333839332c502d522d313233353137302d342d352c502d522d32343938302d382d34382c502d522d31383237392d322d36352c502d522d3131333931352d382d372c502d522d35323938322d31382d33342c502d522d35313134352d322d372c502d582d313031323533332d312d352c502d522d313233383832352d342d342c64696173793933323a3237333238302c502d582d313232313233342d322d352c502d582d313130343432312d322d31332c502d582d38353335392d312d31332c502d582d38393031322d312d31312c502d522d313234353037342d382d312c502d522d313234353036362d382d342c502d522d313232313238362d31302d392c502d522d313232313235322d31342d31392c502d522d313136313934392d31342d31352c502d522d313034323432302d342d332c502d522d313033363136342d342d372c502d522d37393631362d312d332c502d522d37373632312d312d332c502d522d37373230342d312d332c502d522d37363130372d312d332c502d522d37343333342d312d332c502d522d37343433392d312d332c502d522d37333634322d312d332c502d522d36323837352d322d342c502d522d36303537392d322d322c502d522d36303333332d312d332c502d522d35383130372d322d322c502d522d35353734332d312d332c502d522d35313935382d312d352c502d522d33383038352d31322d392c73756273747261746574726561743a3534303239342c737562737472617465743a3534303334362c6e617469766577696e333272646c3a3138363734342c646f6373686f6d6570616765736561726368656e61626c65616767726567617465646d7275736561726368736f757263653a3137353733392c737562737472617465743a3534303334362c73756273747261746574726561743a3534303239342c502d522d313033343136392d31302d372c502d582d313235313332362d322d332c502d582d313235303339302d312d332c502d582d313037383537362d322d332c502d582d39333738372d332d31312c502d582d313035363137372d322d332c502d582d37393936312d312d372c502d582d313032363439382d312d352c502d582d39393034342d312d332c502d582d39363134312d312d332c502d452d32383637372d43312d332c502d522d313235313333322d312d312c502d522d313235303430352d322d322c502d522d35353132322d382d382c502d522d35303235352d31302d392c502d522d34353331342d31302d31362c64697361626c656f666669636576736f5f383835373934385f726f77616e64636f6c756d6e736570617261746f723a3535303135372c64697361626c656367666978646f75626c65636f6c756d6e696e73657274696f6e3a3534383533352c37393332313738393a3335353439302c65787069766f746e6f6e64657374727563746976656175746f67726f75703a3338373137392c69393268333737303a3333363131342c657861766f3833333a3234393839332c34616265633934343a3333333233302c6d6f6465726e62726f777365726f617574686469616c6f673a3230383934332c65786973723434383a3230383933342c64697361626c656f666669636576736f5f383835373934385f726f77616e64636f6c756d6e736570617261746f723a3535303135372c64697361626c656367666978646f75626c65636f6c756d6e696e73657274696f6e3a3534383533352c502d582d313234303832332d312d332c502d452d33383233312d322d342c502d522d313234353636322d31352d342c502d522d39343536302d31342d31322c502d522d39343138392d31342d31332c502d522d39333838322d31342d32362c502d522d36313134372d31382d322c502d522d35343732382d31362d32332c502d522d35343639382d31362d31362c502d522d35343635382d31382d31392c502d522d33383330362d31382d332c502d522d33343031392d342d332c77696e333264657669636563616e6172793a3534313438332c77696e333264657669636563616e6172793a3534313438332c502d582d313133373135372d312d332c502d582d313037393733332d322d372c502d582d313036343438332d322d332c502d582d38353839362d312d31392c502d582d39313739302d312d352c502d582d3130373539352d312d352c502d582d36313130322d332d31312c502d582d35313236322d312d31312c502d582d35323539312d312d31312c502d582d39383635352d312d352c502d582d38343436342d312d352c502d582d35343335382d312d372c502d582d35333937352d332d392c502d582d36393138392d312d372c502d582d35363237342d312d392c502d582d36333133342d312d372c502d582d35383637382d312d352c502d582d35353833322d312d362c502d582d35363134372d312d352c502d582d35363135342d312d352c502d582d35343231322d312d352c502d452d34323730302d322d342c502d522d313235303933352d342d342c502d522d313234333631322d382d342c502d522d313234303834312d382d342c502d522d313233363836392d382d342c502d522d313233363438352d382d342c502d522d313232393636362d362d342c502d522d313232393631312d382d382c502d522d313136373231332d362d342c502d522d313135373737322d31332d31312c502d522d313135333933372d382d342c502d522d313134363233322d382d342c502d522d313132393434332d382d342c502d522d313132373034302d342d392c502d522d313038353239392d382d352c502d522d313038323936382d382d352c502d522d313037343033302d382d342c502d522d313036333936382d31342d32312c502d522d313035333236392d382d352c502d522d313035323137302d382d342c502d522d39333937302d382d342c502d522d36393036352d312d332c502d522d35393139332d312d332c502d522d34353630392d31342d362c502d522d34353139372d322d362c502d522d34303938302d31382d31362c502d522d33393032392d352d31382c502d522d32393830392d312d372c502d522d32363936382d332d392c36336439373330323a3531313533352c6d756c7469706c6574696d656f75747374726561746d656e743a3432313835312c646f63756d656e7473756d6d617279656e61626c65643a3430353339352c66696c69733436363a3333303234372c66696d6f633234383a3139333439312c66696261633936373a3335393434312c66697465733231373a3136313436382c66697265663334363a33343532352c66696d6f633538393a32383937392c6f6e656472697665636f6e76657267656e6365656e6c69676874656e6564726f6c6c6f75743a3135393033382c66696f6d693239333a3131383038312c6669656e613934373a33303633352c66697374613430373a36313032372c6669656e613930333a36353934342c66696461763236353a35353033352c66696361633834313a34393636342c6669656e613431353a33383738302c6669656e613439303a33343138312c72656d6f74656d6f76656465766963653a34323530302c6669656e613237363a34313030342c6669656e613338313a34393939372c502d522d313038383738382d31382d362c502d522d313037383537312d31382d382c502d522d35333534352d342d352c502d522d34393733362d362d32322c502d522d33303038352d312d392c502d522d32353030392d312d382c502d522d32343336332d312d31332c502d522d31393831342d312d36322c502d522d31393031322d312d35372c502d582d313130323633312d332d31302c502d582d313136393731382d312d332c502d582d313132363236332d312d332c502d582d313038373339322d312d352c502d582d313031313434322d312d31312c502d582d313031353535342d312d352c502d582d313031303331342d312d352c502d582d3130383336342d312d332c502d582d37373734322d312d352c502d582d38343332312d312d352c502d582d35303232302d312d332c502d582d34393733302d312d332c502d522d313233363831392d382d362c502d522d313136393938362d31322d31352c502d522d313136373631332d342d362c502d522d313134363235352d382d362c502d522d313031343435322d382d382c502d522d36343834312d32322d31352c502d522d36333130302d32382d31302c502d522d34303939302d31322d31352c502d522d33323734342d31342d31352c502d522d33323734312d33322d31362c33623638683438353a3530333538332c756e636163686563616e72756e666561747572653a3533313834362c36666769643938363a3433333838362c30336830613239333a3432303437302c67726766783930363a3432333930352c6772736b693435353a3232373433362c67723331323a3231383934392c67723337303a3531363738332c677264656c3334373a3132373632382c67727573653434343a3132343039312c67727573653438383a31393737322c677269636f3430363a31393737372c756e636163686563616e72756e666561747572653a3533313834362c502d522d35303432392d31382d382c502d582d313134383534372d312d352c502d582d313131363136302d352d392c502d582d313037313632372d312d352c502d582d313130353330362d312d352c502d582d313031393831382d312d372c502d582d37353232322d32322d37352c502d582d313034393232352d312d332c502d582d313033333336302d312d352c502d582d313031313137332d312d352c502d522d313234303535362d382d362c502d522d313137363338372d31332d31342c502d522d313135383639332d31382d31332c502d522d313135383530372d382d362c502d522d313135383135342d342d342c502d522d313131303137332d342d362c502d522d313131303435392d31382d32302c502d522d313038353730372d31382d35312c502d522d313032363534322d382d342c502d522d313032313732352d31382d34392c502d522d36373039382d3132362d3237372c502d522d35333432312d32382d31342c502d522d34303437352d32382d32382c502d522d33323030342d322d352c37656666623930393a3531363739382c39633836333136333a3530363036312c686170707930323233323032332d313a3530363033392c686170707930363236323032332d313a3534373935382c696466673139373a3338353337382c65786f6f6e6c7963663a3339383433372c39373935633332303a3335393832302c32646262623537393a3238363232352c69643539323a3238383731342c502d522d313137373930352d342d352c502d522d313136313730342d342d31302c502d582d38383033352d312d352c6c616c616e3233313a3134303738312c502d522d36313234382d31382d362c502d522d35313939352d31382d32382c502d582d313135353533392d322d352c502d582d313133323436372d322d31312c502d582d313132383532302d312d332c502d582d313132383531382d322d332c502d582d313039373038372d342d31322c502d582d313036313732332d322d352c502d582d313038383535362d322d332c502d582d313038343433312d312d332c502d582d313037363235322d312d362c502d582d313035383139372d322d332c502d582d313034343531342d322d352c502d582d313032363133312d322d352c502d582d313032373931332d312d31312c502d582d313031373734352d382d31342c502d582d38303736372d312d33372c502d582d3130383634332d322d372c502d582d313030393034382d312d392c502d522d313234363231332d362d342c502d522d313233383738352d342d332c502d522d313232343937382d342d342c502d522d313135383935392d392d362c502d522d313135383136332d392d31302c502d522d313035383637352d382d342c502d522d313033363537362d342d342c502d522d39383131302d342d352c502d522d37393936332d312d322c502d522d36303831362d31302d31392c502d522d35313736342d312d342c502d522d34323339322d322d342c502d522d33393037332d312d352c67363836353339343a3534333437362c35656131673530383a3531333133382c61376364613633333a3436313339362c65386267353334303a3436313339372c69646268303835323a3431313136392c326766396a3631383a3336323439302c66323567343231343a3337393830332c61366531353836373a3339343438342c396a6734633839333a3335373434342c63673032633239353a3434343538362c70697063687962726964743a3333363236352c6a6a3035303832373a3234353136322c61306537323236393a3332323039342c37673633363833323a3236383639382c65396268363531353a3234343439392c37366534673937353a3332343937392c6c693533303a3234393037302c502d522d313132333337362d31302d31302c502d522d313030393835352d31322d31342c502d522d39383835362d31382d34382c502d582d313131333731312d322d352c502d582d313131333731372d312d31312c62386539663137373a3531393132342c35676834333935323a3531393132352c502d582d313230303837362d312d332c502d522d313232303733392d31322d31352c502d522d33383431302d31382d32322c636865636b666f7273656c656374696f6e3a3534323135372c636865636b666f7273656c656374696f6e3a3534323135372c502d582d313135313133372d322d352c502d582d313030393233372d342d31372c502d582d313034313735362d322d352c502d582d35313735392d312d332c502d522d313234353737392d322d332c502d522d313233373138312d382d352c502d522d313233313130342d342d362c502d522d313132363239382d362d362c502d522d313038393139322d362d352c502d522d3131373934312d342d342c502d522d35393533342d312d332c502d522d35343535372d312d332c6a626937323336353a3531393135342c6f6e6c79737769746368746f77696e646f776564666f726a6177733a3332323035342c67623038643735323a3239323132322c6f656d61633335383a32303530322c502d522d37313336302d31382d31392c502d582d313131373738302d312d332c502d582d37363535352d312d332c30353364393430333a3530353436362c6f6e6d61703336363a38313734302c502d442d313134363839352d332d342c502d442d313131303935362d342d332c502d442d313037333031342d352d332c502d442d313033373534332d332d352c502d442d313033373533382d332d352c502d442d313033333339312d322d342c502d442d313033313035302d342d332c502d442d313033303932362d312d332c502d442d313033303932332d322d332c502d442d313033303932322d322d332c502d442d313033303932302d322d332c502d442d313033303931382d322d332c502d442d313033303931362d322d332c502d442d313033303931342d322d332c502d442d313033303931322d322d332c502d442d313033303931302d322d332c502d442d313033303930382d322d332c502d442d313033303930362d322d332c502d442d313033303930342d322d332c502d442d313033303930322d322d332c502d442d313033303930302d322d332c502d442d313033303839382d322d332c502d442d313033303839362d322d332c502d442d313033303839332d322d332c502d442d313033303839312d322d332c502d442d313033303838392d322d332c502d442d313033303838372d322d332c502d442d313033303838352d322d332c502d442d313033303838332d322d332c502d442d31 OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.8 = 68616e466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e66696735315c22203a207b205c224576656e744672657175656e63795c22203a205c225468726565506f696e7446697665546f4c6573735468616e466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2032207d2c205c22436f6e66696735325c22203a207b205c224576656e744672657175656e63795c22203a205c225468726565506f696e7446697665546f4c6573735468616e466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696735335c22203a207b205c224576656e744672657175656e63795c22203a205c225468726565506f696e7446697665546f4c6573735468616e466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696735345c22203a207b205c224576656e744672657175656e63795c22203a205c225468726565506f696e7446697665546f4c6573735468616e466976655c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696735355c22203a207b205c224576656e744672657175656e63795c22203a205c2246697665546f4c6573735468616e536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20323030207d2c205c22436f6e66696735365c22203a207b205c224576656e744672657175656e63795c22203a205c2246697665546f4c6573735468616e536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e66696735375c22203a207b205c224576656e744672657175656e63795c22203a205c2246697665546f4c6573735468616e536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2032207d2c205c22436f6e66696735385c22203a207b205c224576656e744672657175656e63795c22203a205c2246697665546f4c6573735468616e536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696735395c22203a207b205c224576656e744672657175656e63795c22203a205c2246697665546f4c6573735468616e536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696736305c22203a207b205c224576656e744672657175656e63795c22203a205c2246697665546f4c6573735468616e536576656e5c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696736315c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e546f4c6573735468616e4669667465656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e66696736325c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e546f4c6573735468616e4669667465656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e66696736335c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e546f4c6573735468616e4669667465656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696736345c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e546f4c6573735468616e4669667465656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696736355c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e546f4c6573735468616e4669667465656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696736365c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e546f4c6573735468616e4669667465656e5c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696736375c22203a207b205c224576656e744672657175656e63795c22203a205c224669667465656e546f4c6573735468616e536576656e7465656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e66696736385c22203a207b205c224576656e744672657175656e63795c22203a205c224669667465656e546f4c6573735468616e536576656e7465656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203230207d2c205c22436f6e66696736395c22203a207b205c224576656e744672657175656e63795c22203a205c224669667465656e546f4c6573735468616e536576656e7465656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696737305c22203a207b205c224576656e744672657175656e63795c22203a205c224669667465656e546f4c6573735468616e536576656e7465656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696737315c22203a207b205c224576656e744672657175656e63795c22203a205c224669667465656e546f4c6573735468616e536576656e7465656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696737325c22203a207b205c224576656e744672657175656e63795c22203a205c224669667465656e546f4c6573735468616e536576656e7465656e5c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696737335c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e7465656e546f4c6573735468616e5468697274795c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e66696737345c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e7465656e546f4c6573735468616e5468697274795c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130207d2c205c22436f6e66696737355c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e7465656e546f4c6573735468616e5468697274795c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696737365c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e7465656e546f4c6573735468616e5468697274795c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696737375c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e7465656e546f4c6573735468616e5468697274795c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696737385c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e7465656e546f4c6573735468616e5468697274795c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696737395c22203a207b205c224576656e744672657175656e63795c22203a205c22546869727479546f4c6573735468616e4669667479466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e66696738305c22203a207b205c224576656e744672657175656e63795c22203a205c22546869727479546f4c6573735468616e4669667479466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130207d2c205c22436f6e66696738315c22203a207b205c224576656e744672657175656e63795c22203a205c22546869727479546f4c6573735468616e4669667479466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696738325c22203a207b205c224576656e744672657175656e63795c22203a205c22546869727479546f4c6573735468616e4669667479466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696738335c22203a207b205c224576656e744672657175656e63795c22203a205c22546869727479546f4c6573735468616e4669667479466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696738345c22203a207b205c224576656e744672657175656e63795c22203a205c22546869727479546f4c6573735468616e4669667479466976655c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696738355c22203a207b205c224576656e744672657175656e63795c22203a205c22477265617465725468616e457175616c546f4669667479466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203230207d2c205c22436f6e66696738365c22203a207b205c224576656e744672657175656e63795c22203a205c22477265617465725468616e457175616c546f4669667479466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130207d2c205c22436f6e66696738375c22203a207b205c224576656e744672657175656e63795c22203a205c22477265617465725468616e457175616c546f4669667479466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696738385c22203a207b205c224576656e744672657175656e63795c22203a205c22477265617465725468616e457175616c546f4669667479466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696738395c22203a207b205c224576656e744672657175656e63795c22203a205c22477265617465725468616e457175616c546f4669667479466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696739305c22203a207b205c224576656e744672657175656e63795c22203a205c22477265617465725468616e457175616c546f4669667479466976655c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e417269614d617854656172646f776e55706c6f616454696d65496e536563222c20225622203a2022696e7436345f747c3222207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e456e61626c65416c6c417070496473466f72314453222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e457564624572726f7255726c222c20225622203a20227374643a3a77737472696e677c68747470733a2f2f65752d6f66666963652e6576656e74732e646174612e6d6963726f736f66742e636f6d2f4f6e65436f6c6c6563746f722f312e3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e4575646253687574646f776e5369676e616c222c20225622203a2022696e7436345f747c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e4973436f6d706f6e656e7444617461456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e497353616d706c696e674c6f6769635632456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e4f74656c52756c6573417070726f7665644651444e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e53616d706c696e672e416461707469766553616d706c696e67456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e53686f756c6452656d6f766544617461507265666978466f72456e61626c6564544d4c4e616d657370616365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e566f6c756d65547261636b696e674d61784576656e7473222c20225622203a2022696e7436345f747c3530303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4169725370616365222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224261636b656e645c22203a207b205c224576656e74735c22203a207b205c224c61796572486f7374496e697469616c697a6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d706f7369746f7253657373696f6e547970655c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2257696e33325c22203a207b205c225375624e616d657370616365735c22203a207b205c224c65676163795c22203a207b205c224576656e74735c22203a207b205c22416e696d6174696f6e50657263656e74556e64657233304650535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416e696d6174696f6e4176674650535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726f737357696e54496d654f6646697273744672616d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224176657261676550726573656e74735065725365636f6e645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.17425&crev=3\0\Url = "https://officeclient.microsoft.com/config16/?syslcid=1033&build=16.0.17425&crev=3" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.17425&crev=3\0\EndDate = 908a5a2aaa98da01 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile\MsaDevice = "t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAECNp9tChPOz8nzMkyYfXd3rgAALOtd0cAEIUXPBg2GU9VGXjh+oLzecnJsx5W+Kr8Cb9ev0XCLfTRR1GlgZ+20VjZGtogWyuHOP5y39WCfbyjF031EADzvlarVYlVrrhgDFVaQypBadVxcek7EAy2irfQycHE0RFC6JjI9HZrydd4aT8eXVppLqDWKLIYEeVwCbN8SWrk9g38Py91o01iHsVN/NeboSluVqkzoOESLq6RoVcRv8C+60aiG+iM4f1CeAJeqTZXhH+r3UtxZbB5SplvPW/zhe4kSd3o2NkWIBsF1YAfM/DDZykK2Q05r8hy09iHwE=&p=" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.17425&crev=3\Last = "0" OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.15 = 36207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4c6963656e73696e67222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22436f6d70617265427573426172735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6963656e73696e67427573626172416374696f6e5c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c22487244697370617463685375625461736b53746172745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22517569636b56616c69646174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253617665416c6c536b75696473546f52656769737472795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2257616974546f52657472794865617274626561745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536561726368466f7253657373696f6e546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224e554c56616c69646174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2256616c696461746553657373696f6e546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2243616e52756e4665617475726543616368655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22506572666f726d4c6963656e73696e674e6f74696669636174696f6e735c22203a207b205c224576656e74466c61675c22203a20323536207d207d2c205c225375624e616d657370616365735c22203a207b205c224c5655585c22203a207b205c224576656e74735c22203a207b205c224e6f456e7469746c656d656e74735c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c224e6f456e7469746c656d656e74734578706572696d656e74547269676765725c22203a207b205c224576656e74466c61675c22203a203439343038207d207d207d2c205c224f6666696365436c69656e744c6963656e73696e675c22203a207b205c224576656e74735c22203a207b205c224c6963656e7365436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6567616379416374697669747953756363657373436f756e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c656761637941637469766974794661696c757265436f756e745c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c22436c69656e745c22203a207b205c224576656e74735c22203a207b205c224653686f756c6441637469766174655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c224865617274626561745c22203a207b205c224576656e74735c22203a207b205c22577269746543616368655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265616443616368655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22517569636b56616c69646174696f6e5c22203a207b205c224576656e74735c22203a207b205c224c6f61644c6963656e73655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2246756c6c56616c69646174696f6e5c22203a207b205c224576656e74735c22203a207b205c224c6f61644c6963656e73655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2250726f706572746965735c22203a207b205c224576656e74735c22203a207b205c224765744c6963656e736543617465676f72795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546f6b656e697a654c6963656e736543617465676f726965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174654c6963656e736543617465676f726965735c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c224272616e64696e675c22203a207b205c224576656e74735c22203a207b205c2247657441707056616c75655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657450726f6475637456616c75655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253686f756c645573654d6963726f736f66743336354272616e64696e675c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2254656e616e745c22203a207b205c224576656e74735c22203a207b205c22496e697454656e616e7449645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224e756c5c22203a207b205c225375624e616d657370616365735c22203a207b205c22466574636865725c22203a207b205c224576656e74735c22203a207b205c224765744e756c4f626a656374466f724964656e746974795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2246657463684d6f64656c46726f6d4f6c735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224765744c6963656e73654665617475726573466f724964656e746974795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2243726561746552657175657374426f64795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d6f64656c5c22203a207b205c224576656e74735c22203a207b205c224765744c6963656e736543617465676f72795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22476574416c6c4c6963656e736543617465676f726965735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446573657269616c697a655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225061727365526177526573706f6e73655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2243616e52756e46656174757265526573756c74735c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c224d6f64655c22203a207b205c224576656e74735c22203a207b205c224765744d6f64655c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c224170695c22203a207b205c224576656e74735c22203a207b205c22437265617465526571756573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253656e64526571756573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2252656365697665526573706f6e73655c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2253746f726167655c22203a207b205c224576656e74735c22203a207b205c2247657453746f72616765506174685c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c6f61644d6f64656c735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22476574556e766572696669656453746f72616765506174685c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c6f61644d6f64656c5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2252656e616d6546696c65546f55736555706461746564486173685c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2256616c69646174696f6e5c22203a207b205c224576656e74735c22203a207b205c22517569636b56616c69646174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2256616c696461746f725c22203a207b205c224576656e74735c22203a207b205c224d61746368696e67486172776172656449645c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d2c205c22466c6f77735c22203a207b205c224576656e74735c22203a207b205c22536561726368466f72534341546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4d4c222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224d6f64656c446f776e6c6f61645c22203a207b205c224576656e74735c22203a207b205c22446f776e6c6f61645265736f757263657346726f6d436174616c6f674173796e635c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4d6f786965222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74466c61675c22203a203438383936207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4f6666696365222c20225622203a20227374643a3a77737472696e677c7b205c224c6f636b65645c22203a2066616c73652c205c225375624e616d657370616365735c22203a207b205c224e61747572616c4c616e67756167655c22203a207b205c224c6f636b65645c22203a2066616c73652c205c225375624e616d657370616365735c22203a207b205c224372697469717565735c22203a207b205c224c6f636b65645c22203a2066616c73652c205c224576656e74735c22203a207b205c2250726f636573734175676c6f6f704372697469717565735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250726f636573734175676c6f6f7041646443726974697175655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4f75746c6f6f6b222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224465736b746f705c22203a207b205c225375624e616d657370616365735c22203a207b205c2253796e635c22203a207b205c224576656e74735c22203a207b205c2253796e6350757267654f66666c696e654974656d735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2256696577735c22203a207b205c224576656e74735c22203a207b205c224872566965774c6f6164436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22566965774d6f64655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e506572666f726d616e6365222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22496e70757444656c61794d6f6e69746f725c22203a207b205c224576656e74735c22203a207b205c22526573706f6e736976656e6573735665746f5c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e506572736f6e616c697a6174696f6e222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c2246696c65496e736967687443616368654d616e616765725c22203a207b205c224576656e74735c22203a207b205c2250757267654578706972656443616368655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225369676e616c50726f636573736f725c22203a207b205c224576656e74735c22203a207b205c2253656e645369676e616c5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e50726f6772616d6d6162696c697479222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22416464696e735c22203a207b205c224576656e74735c22203a207b205c224f6e53746172747570436f6d706c657465456e74657270726973654343434f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6e53746172747570436f6d706c6574654343434f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22417070416464496e4c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22417070416464496e55736167655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464696e446f634c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7465726e616c536574436f6e6e6563745c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2254656c656d657472795c22203a207b205c224576656e74735c22203a207b205c22446e61416464496e4c6f6164586c6c46696c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446e61416464496e4c6f616445787465726e616c446c6c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446e61416464496e4c6f6164446e6146696c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464696e43726173685c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e50726f6772616d6d61626c655375726661636573222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22737562736372697074696f6e63656e7465725c22203a207b205c224576656e74735c22203a207b205c22697363617074696f6e636f6e74726f6c656e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e5365637572697479222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22436c70547279557067726164654c6162656c4661696c7572655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d2c205c225375624e616d657370616365735c22203a207b205c22436c705c22203a207b205c224576656e74735c22203a207b205c224c6162656c55736167655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f7574636f6d6555736167655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f66666963654a534765744c6162656c44657461696c735c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22436c70506f6c696379466574636843616c6c4261636b537563636573735c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224d616e6461746f72794c6162656c6c696e674469616c6f675c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f626a6563744d6f64656c4765744c6162656c5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f626a6563744d6f64656c5365744c6162656c5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f626a6563744d6f64656c506f6c696379436f6d706c657465496e697469616c697a655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2253656c6563744a757374696669636174696f6e4f7074696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2253656e7369746976697479466c796f7574416e63686f72547261636b416e645265766f6b65427574746f6e436c69636b5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225265676973746572446f63756d656e745c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2246657463684c6162656c7346726f6d5365727665725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657444656661756c744c6162656c49445c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744c6162656c735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744f7574636f6d6573466f724c6162656c4368616e67655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250726f6365737341756469744f6e506f6c6963794d617463685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250726f6365737341756469744f6e5265706c79466f72776172645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250726f6365737341756469744f70656e48656c7065725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744175646974496e666f506f6c6963794d617463685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744175646974496e666f4c6162656c416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744175646974496e666f46696c65416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6162656c696e67457870657269656e63655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224164644c6162656c4f627365727665725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656d6f76654c6162656c4f627365727665725c22203a207b205c224576656e74466c61675c22203a2032207d207d OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\FlightCacheProviderId OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceId = "0018400E1B949601" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.17425&crev=3\0\FilePath = "officeclient.microsoft.com\\4B7995A3-D466-409A-8F4A-0D798F193099" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|5" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.6 = 22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e436c6f73652e456e61626c654452474279746553747265616d446574616368222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e436f6d6d616e64732e44656c657465556e646f456e7472794166746572526f6c6c6261636b5472616e73616374696f6e436f6d6d6974222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4465736b746f702e416c657274732e55736544657461696c65644572726f72564543222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4c6567616379446f63546f6b656e2e43616c6c445247436c6f7365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e5061727469616c446f632e5361766541735265616453747265616d5472616e73666572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e5361766541732e456e61626c654452474279746553747265616d4465746163684f6e536176654173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e50726f6a6563742e50726f6a65637443656e74656e6e69616c53657276657232303133426c6f636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e50726f6a6563742e50726f6a65637443656e74656e6e69616c53657276657232303133436f6e6e656374696f6e426c6f636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5075626c69736865722e33383032343932222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e4174746163686d656e744948616e646c657241637469766174696f6e486f7374222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e43472e536166654c696e6b732e52657475726e52657075746174696f6e526573756c74222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e434c502e46472e416464436f6e76657274427574746f6e546f4e6f74696669636174696f6e54726179222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e434c502e46472e49726d526564697265637473546f436c70222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e434c502e46472e53686f756c645570677261646556657273696f6e466f72506f6c69637946696c65222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e53686f756c6452756e436c6f75645365637572697479506f6c696379436865636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e436c6f7564222c20225622203a20227374643a3a77737472696e677c5075626c696322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e46617374465445222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e4d53495442697a63686174416c6c6f776c697374222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e4d6f636861222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e4f584f416c6c222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e50657270657475616c4c6963656e7365222c20225622203a20227374643a3a77737472696e677c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e5365676d656e74222c20225622203a20227374643a3a77737472696e677c4e4f4e4652444322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e56657273696f6e506172746974696f6e222c20225622203a20227374643a3a77737472696e677c57696e3332416e64726f6964486f7422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e576f7264436f70696c6f74446f67666f6f64222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4175676c6f6f702e44796e616d69635175657374696f6e47656e657261746f722e656e61626c654f666669636550726f6d70745369676e616c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e41757468656e7469636174656450726f76696465727353656172636852657175657374456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4175746f436f727265637455492e41637469766974696573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4368616e6765476174652e44656c617943757272656e745549416374697665506c616365557064617465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4372634261736564556964222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e43726974697175652e4c6f67496e7465726e616c4e616d65416e645072696f72697479222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e446f634578706f72742e4e6f53756254616773466f7247726f757057697468416c745465787432222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e446f635265636f7665727955495f556e696e697433222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e466c7569644f75746c6f6f6b2e536d617274416e644c6f6f704c696e6b43616c6c6f7574456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e417261626963456e746572707269736547726f757032222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4272617a696c69616e436f6e74726163746564507265706f736974696f6e73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4272617a696c69616e456e744469736162696c69747942696173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4475746368456e746572707269736547726f757032222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e456e676c697368456e7444697342696173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e456e676c697368456e744d656e74616c4865616c746842696173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e456e676c697368456e7452616369616c426961734361706974616c697a6174696f6e6f6641626f726967696e616c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e456e676c697368456e7452616369616c426961734361706974616c697a6174696f6e6f66426c61636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e456e676c697368456e7452616369616c426961734361706974616c697a6174696f6e6f66496e646967656e6f7573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e456e676c697368456e74536f63696f65636f6e6f6d6963426961734e6577222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e46696e6e697368456e74416765416e644469736162696c69747942696173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4672656e6368456e746572707269736547726f757033222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4765726d616e4164765765697365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4765726d616e436f6d6d614265666f7265436f6f7264696e6174696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4765726d616e456e744469736162696c69747942696173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4974616c69616e4361706974616c697a6174696f6e4f66436f6d6d6f6e4e6f756e73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4974616c69616e436f6d6d61506172656e746865746963616c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4b6f7265616e456e744469736162696c69747942696173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e4e6f7277656769616e426f6b6d61616c456e746572707269736547726f757031222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e506f6c697368456e746572707269736547726f757032222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e5275737369616e456e744469736162696c69747942696173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e53776564697368456e746572707269736547726f757031222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e5475726b697368456e746572707269736547726f757033222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772617068496d706f72744865647769675558222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772617068496d706f7274496e73657274416c6c4f626a6563747356696577222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772617068496d706f72744f75746c6f6f6b496e7365727446696c65222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e47726170686963732e4368616e6765476174652e5570646174655461626c65426f756e6473466f72547970696e67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4943726974697175652e4c6f674772616d6d6172466c61674564697473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4c6173744d696c654661636164652e46656174757265466c69676874222c20225622203a2022696e7436345f747c3722207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4c6173744d696c6554656c656d657472792e46656174757265466c69676874222c20225622203a2022696e7436345f747c3722207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4c6173744d696c6554656c656d657472792e46656174757265466c69676874456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e50726f6f66696e672e4175746f4d616e616765722e41637469766974696573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e54686573617572757350616e652e41637469766974696573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5472616365526f757465466163616465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e576f72642e53656e6445646974466c6167546f4e6f4572726f724576656e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e4170746f734561726c794c6f6164222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e436f6c6f72466f6e74537570706f7274456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e466978457874656e64546f46756c6c576f7264222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e48696464656e466f6e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e53686f756c64436f6e766572744c6567616379456e636f64656453796d626f6c43686172616374657273222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e53686f756c64436f6e766572744c6567616379456e636f64656453796d626f6c4368617261637465727332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e536b697048696464656e436c6f7564466f6e7473496e457863656c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e5472616e7363726962652e436f6e666967436865636b44697361626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e55736553747269637453796d626f6c466f6e74446574656374696f6e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c655265676973746572536f757263654578656375746543616c6c6261636b416c77617973222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e416461707469766553616d706c696e67222c20225622203a20227374643a3a77737472696e677c7b205c22436f6e666967315c22203a207b205c224576656e744672657175656e63795c22203a205c224c6573735468616e506f696e745a65726f466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c65526174655065725465 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|8" OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.17425&crev=3\0\Properties = "1" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|2" OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.9 = 66666963652e54656c656d6574727944796e616d6963436f6e6669672e4368617274696e67222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22436861727445326f536176655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224368617274696e67456e644c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e436c69636b546f52756e222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c225363656e6172696f5c22203a207b205c224576656e74735c22203a207b205c22446f72695461736b5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225570646174655461736b557064617465646574656374696f6e325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b557064617465646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b557064617465636c69656e74646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265706169725461736b46756c6c7265706169725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265706169725461736b52656d6f7665696e7374616c6c6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b436f6e6669677572656c696768745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c69656e747570646174655461736b436c69656e74646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b53747265616d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b437265617465776f726b696e67636f6e66696775726174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b55706461746566696e616c697a655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225461736b4c61737452756e4865617274626561745c22203a207b205c224576656e74735c22203a207b205c225461736b4c61737452756e4865617274626561745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22556e6976657273616c426f6f7473747261707065725c22203a207b205c224576656e74735c22203a207b205c224170706c69636174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6c6c656374506172616d65746572735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6c6c656374456d6265646465645369676e61747572655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616c63756c617465506172616d65746572735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436c69656e744361624d616e616765725c22203a207b205c224576656e74735c22203a207b205c225461736b557064617465436c69656e74446f776e6c6f6164446f457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225461736b436c69656e74446f776e6c6f6164446f457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253747265616d4361625c22203a207b205c224576656e74735c22203a207b205c22446f776e6c6f616453747265616d4361625c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225472616e73706f72745c22203a207b205c225375624e616d657370616365735c22203a207b205c224578706572696d656e74616c5472616e73706f72745c22203a207b205c224576656e74735c22203a207b205c22436162735c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c224576656e74466c61675c22203a20323536207d207d207d2c205c225472616e73616374696f6e616c46696c654f7065726174696f6e735c22203a207b205c224576656e74735c22203a207b205c224170706c794368616e6765735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457865637574655472616e73616374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d2c205c224576656e74735c22203a207b205c225472616e73706f72745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f776e6c6f61644361625c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e446961676e6f7374696373222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436f6c6c6563746f725c22203a207b205c224576656e74735c22203a207b205c2253746172745472616365436f6c6c6563746f725c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e446f6373222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22446f63756d656e74416374697669746965735c22203a207b205c224576656e74735c22203a207b205c2241637469766974794c6f6744697363617264466f72446f63756d656e744368616e67655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67547269676765724173796e635461736b576f726b65725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575654c6f61644173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565496e697446696c65506174685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565437265617465496e73616e63655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565417070656e644173796e6342617463685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565577269746541637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756552656d6f76654173796e6342617463685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575655772697465446f63756d656e74496e666f4865616465725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756554727944656c657465456d70747946696c654173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565496e7365727441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e717565756541637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6741646441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674372656174654c6f675c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67536176654e657746696c655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674469736361726441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e71756575654c6f63616c4e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e71756575654f7574676f696e674e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575654469736361726441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224170694f70656e41637469766974794c6f675769746853747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6741646441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674361636865446f63756d656e74496e666f5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e74727946696e616c697a655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6746696c7465724f757443757272656e7455736572416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674c6f616446726f6d53747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6753617665546f53747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565436865636b5265766f6b65644544505c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565526570616972436f7272757074656446696c654173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674d6f64696679436c6f6e655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c654f70656e4572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c65526561644572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c655265706c6163654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c6557726974654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565536574456e74657270726973654461746150726f74656374696f6e4173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575655472756e6361746551756575655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e7472794372656174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e74727953657453746174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22536572766963654163746976697479526573756c745c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f674f6e436f6e74656e74416374696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e717565756541637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f674469736361726441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225472616e736d69745175657565496e7365727441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225472616e736d697451756575654469736361726441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e71756575654f7574676f696e675c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67436c6f73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d6974517565756548656c706572456e737572654469726563746f72795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d697451756575654d616e61676572437265617465496e73616e63655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2241706943726561746541637469766974794c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224170694372656174654c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d69745175657565536574456e74657270726973654461746150726f74656374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2241637469766974794c6f674173796e635461736b5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22436f6c6c6162436f726e65725c22203a207b205c224576656e74735c22203a207b205c22436f617574686f725570646174654c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f617574686f72476f546f43757272656e744c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795573657252655265676973746572436f6e6e65637469766974794368616e67654e6f7469667949664e65636573736172795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e6443686174427574746f6e497356697369626c654e6f7744617461706f696e745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572436c6f736553696e676c65466c796f75745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e64497343686174417661696c61626c655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572794f6e436f617574686f72735265747269657665644173796e63506f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795265747269657665436f617574686f72735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572794f6e436f617574686f72735265747269657665645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795265747269657665436f617574686f72734265666f72654173796e63506f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279496e6974464d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279436f617574686f72577261707065725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e64436f61757468696e6757697468416c6c4775657374734f724d697373696e67456d61696c456469746f72735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22476f546f4c6f636174696f6e416374696f6e487562416374696f6e4a756d70546f417574686f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572557064617465417574686f724c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572557064617465456d61696c416e64436861745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6e7461637443617264416374696f6e487562416374696f6e53686f77436f6e74616374436172645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279557365724a756d70546f417574686f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279557365724f70656e53696e676c65466c796f75745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22456d61696c416374696f6e487562416374696f6e53656e64456d61696c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e6453657456616c75655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224d736f494d5365727669636573536642506861736531496d70726f76656d656e7473456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224368617443616c6c6f757455736572496e697455495c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f494d5365727669636573497357616343686174456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f494d536572766963657353664257616343686174456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f494d536572766963657353664357616343686174456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617455494d6f64656c4f6e55494576656e745c22203a20 OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|9" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\SessionId = 0d8880a698b59e47b7f39afba1355361 OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ETag = "std::wstring|\"aAQHkg5NLdUC3K1jATXESZ0UWatDAA4qMJlulKdj80M=\"" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|1" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|12" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|16" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs OfficeClickToRun.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeBackupPrivilege 4360 OfficeClickToRun.exe Token: SeRestorePrivilege 4360 OfficeClickToRun.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4244 OfficeClickToRun.exe 4244 OfficeClickToRun.exe 4244 OfficeClickToRun.exe 4244 OfficeClickToRun.exe 1856 OfficeC2RClient.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 4244 OfficeClickToRun.exe 4244 OfficeClickToRun.exe 4244 OfficeClickToRun.exe 4244 OfficeClickToRun.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 5088 OfficeSetup.exe 2832 OfficeClickToRun.exe 4360 OfficeClickToRun.exe 4244 OfficeClickToRun.exe 1856 OfficeC2RClient.exe 1856 OfficeC2RClient.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5088 wrote to memory of 2832 5088 OfficeSetup.exe 95 PID 5088 wrote to memory of 2832 5088 OfficeSetup.exe 95 PID 5088 wrote to memory of 4244 5088 OfficeSetup.exe 105 PID 5088 wrote to memory of 4244 5088 OfficeSetup.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\OfficeSetup.exe"C:\Users\Admin\AppData\Local\Temp\OfficeSetup.exe"1⤵
- Checks computer location settings
- Checks system information in the registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeOfficeClickToRun.exe platform=x64 culture=en-us productstoadd=O365ProPlusRetail.16_en-us_x-none cdnbaseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version=16.0.17425.20176 mediatype=CDN sourcetype=CDN O365ProPlusRetail.excludedapps=teams,groove updatesenabled=False bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown uninstallcentennial=True scenario=CLIENTUPDATE2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:2832
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeOfficeClickToRun.exe platform=x64 culture=en-us productstoadd=O365ProPlusRetail.16_en-us_x-none cdnbaseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version.16=16.0.17425.20176 mediatype.16=CDN sourcetype.16=CDN O365ProPlusRetail.excludedapps.16=teams,groove updatesenabled.16=False bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown uninstallcentennial=True2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4244
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4360
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /progressandlaunch AppTargets="root\office16\excel.exe|root\office16\lync.exe|root\office16\msaccess.exe|root\office16\mspub.exe|root\office16\onenote.exe|root\office16\outlook.exe|root\office16\powerpnt.exe|root\office16\winword.exe" ManualUpgrade=False ScenarioToTrack="Scenario:{477E0208-58BD-4F33-978A-09BCC9AA9EB1}@INSTALL"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵PID:3604
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵PID:5484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD520ae1459b18c035d187ebd44d6fe23c2
SHA19fd7012e099ab2c8a39341e7260f050e6c997a6d
SHA256f694caa849ce8b91e5ff374af38c8fc13af15b477b6f3401a13056da11d6f818
SHA512978ab47b667ca96cb16c02a19692433d1dd46f1209a4fc17e6ebab026b3a665b98298ef1df877faf77d3fd460f052da80c2e6d1ed40cbcb2da97bb648700e585
-
Filesize
405KB
MD569d9cc8fcfb951ec44c7d9f26bcb3499
SHA1243b233b74a96d2676a0a2c3dec02904944c97cb
SHA2560167466a80c29b10f0cfda34c745930d96a1117d6a9b7838efd6ae77156df495
SHA51218c588224cd6e5a3b82d27c98f6f92bcf6efb111b11f0c6695ecd9ea1b0dfebf1e5575a4d0fa1e193890a3d7409a041fa5f1322262da095a9f16e5b284a48eab
-
Filesize
1.0MB
MD5c9f1a48e9594a1e00a754d0bf50fa6cd
SHA1c07ac2f5d10c007e33a76261dd4b9f5a7ca9a67e
SHA256b9ce70c3b1a73efe80753a05d93d1f84d43456095e1f72358a7cc5c48444d0b3
SHA5123a1edfdce7884558a9ad728e897ef0b3268c18f68b79441fe6eaa4505cbb9ba757b9907ece46781d09e57e32c949e64c973e4ac848bfe9b88c53777e0c05bbff
-
Filesize
829KB
MD5ddc59d3df358f9372708531b977848c3
SHA1e1a0f9b58dc5579bbd5845bb6d3a7da3b5d8b7da
SHA256fedc8cf10ab72e7a0ec3a493356157028fe16d2ae97f73dead28fffde1b7c935
SHA5124b75fe159eeadd71fea2e3b569796ce547808bff5c183d271e3d2aed7ef11311121f7ec768bcbc1c0354b771f971aa2b46836a8a6c2b0c1d2f8b21922943dbd3
-
Filesize
5.1MB
MD575e46c342e51ddcfd2b0ad7b18a47e61
SHA1bfc1042128cdd9ba73e7954cf5327ddc2cbb3459
SHA25696b47d7d0d8d3b12075b7a0d13f90a7c2df032a265511790c00b7ab4f004990b
SHA5121a26ca09ea8a3130fa1b9509349ac7d94469d8fc96d6b816b2638f449910955efc3238af5004bc10e1bf7149b15b9f4dd2f372d483f7cd99b41acf2cc247a036
-
Filesize
2.0MB
MD547a05aec297a3193754eab4e6b46afd1
SHA16f65a187c73e2e55feec7300230e8a59326b09f5
SHA25606bf1de1fda59eea875ff942ed1c2e8399b31efc2e3ca6fed1348c56b5defba3
SHA512ddcac38d8af0b5d50ace0c09ecc7a1a62aa5ae20b6e2480237dc6029d74664229690208c5cbe401ba8b3168016cb52ec6c650f51301d680d448437404e0ac84c
-
Filesize
559KB
MD5c3d497b0afef4bd7e09c7559e1c75b05
SHA1295998a6455cc230da9517408f59569ea4ed7b02
SHA2561e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98
SHA512d5c62fdac7c5ee6b2f84b9bc446d5b10ad1a019e29c653cfdea4d13d01072fdf8da6005ad4817044a86bc664d1644b98a86f31c151a3418be53eb47c1cfae386
-
Filesize
48KB
MD5eb49c1d33b41eb49dfed58aafa9b9a8f
SHA161786eb9f3f996d85a5f5eea4c555093dd0daab6
SHA2566d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
SHA512d15905a3d7203b00181609f47ce6e4b9591a629f2bf26ff33bf964f320371e06d535912fda13987610b76a85c65c659adac62f6b3176dbca91a01374178cd5c6
-
Filesize
1.3MB
MD575e832bb1529d87a88ef49034e381930
SHA19b8a52c3c9b3a88c3bdd3b5f5aeb0aecc3df67e8
SHA2564a7ac11ff22d5d842c47be8df6ca98f99c7d48e7ab2f638ccd01eae253e424b0
SHA5126e285a0484d57f6de0ca78a24fb46d9626741d764356d12e2ea6fab32e00a3f285ea0722b89b5a63c11179a5d1ed2a065f97b9399f63f67981fad01967ae654e
-
Filesize
5.7MB
MD5ec3f98182da4d10c0f4a3f7a01ee50cf
SHA1380b71faa9cccd1a2e7d5e8cf2d1100f60c3b29d
SHA2562dc9ab16e59688e50f04928fe098fc40d693c6454d1d9e0404df912254f1e132
SHA512a13285b00f7b8a13704944312a736b020b3d1e3f9753b582cc26fed0db0ec5a2f6f19a07341b21f693451b33c933694605274beaca81ce25827c9fe2e34b8d8e
-
Filesize
532KB
MD5c020ac63dd9de96a169fc1b3bcc014a5
SHA166c037d5e4e9bfb1aebbfdf9d4b15eee0f852929
SHA25676c20553c8072c3ad729904b27e9c10692fa0e91db06f359bd49e868ef323010
SHA5127698adb46c7c5da979bc667cd7b74c8fadcba154d946264f5f5337ca618a67fc675ce708669884f774fc87811cd3e1671fa5e2d15a7fc12a539389322892a65f
-
Filesize
597KB
MD5647a0967315ed80dd590fe111f38bed7
SHA1f311845d591fcab6c9b086f519e6f83b52ba960d
SHA25695a069ff97824a004d4fada58a23c78b775db72de5570a05977355149df67cb6
SHA5120178a3f488e6972ca87a56fcb4bad16679df88149ae265e29c8a2aac3bea75de1cce5e82575de0eef4303bfdbab2593d96e5074f10a7561c83cde22972590d7e
-
Filesize
297KB
MD594d6fb63e0fcc7db6ce26674e61a06f6
SHA134d019f759db4649d89f584437804597b5d02395
SHA25653090adc6e512a6cc52fdd7640736b9352537e757520db7b808857f179bfb3a3
SHA51283a4a927a10fa5210f54908c43c6d68a09ef1aae0aaac40538b4f9252bc01f7b2e3f3e56fe2ee89f0f739918f2559e6af63f58af914f68ba97927245324d7843
-
Filesize
1.6MB
MD5df8403e03a06679d9077a4161849671e
SHA16635f842092ba46af0520ce0fdb978c6b12a7be7
SHA25649738cd60073b83e07957faaf57ac2fee48fb44eb9a69d9a96591b9fb045d06c
SHA512433a869ba671361f7a72601cf9f47dd560aff5abdb69557ae8cf9d7572646a762e711e7f3dba32f5c04b2e8865c8bc29227cd5197a7cb0762131e8baf4ec8b18
-
Filesize
189KB
MD55cb3f3f7d8d9afe46bf220b1076f7272
SHA1f6ba4dd48e9deddf6094c9f5fb1bcf761e9e31d7
SHA25697119e4ac0b990aabdcb218dce06c2752bf4e37ad7139390cbfd466b1b67889c
SHA51242f8813eb73e1757e200d18e5ae7ee381000466cb9eee11d11993b81ff9b2364995dc293e3109f7e1cb35a2081b0ccc46942afcd03ba24cccbdac61313187f1f
-
Filesize
569KB
MD515f5792844af082587747a09f1123a0d
SHA1558999ff58818971f96dfff4f433afa596794ba7
SHA256e5188cf139c4af572588fe794b7392479a0bf59aef86666a0a22db121e41da9d
SHA5127de7f740bab5dcafb9f502853963547c7e50993404535dbcd39b88a586a2bf31b50f1eebe4682ee5fa458a00948af44dc104daa0b595c2c02d6901a81beab24f
-
Filesize
985KB
MD5b992640abf4ea6cdac53d8b38076f845
SHA1ed480fe74fb663e0192098c99a822022b380481c
SHA256f945dddd970b1bd95c6f713f3a1797a2f0772bbaaee0803f43e39fd748d4502a
SHA512a3b1beef8df9a0f14eda0cd6d01895bd17c346fd930284806cea6657b3c73df8899c699484742a45753dc0cd85b4b92e7e5b6d31b4f94ccc9865959f28fbc0d9
-
Filesize
50KB
MD5331f05e490914da44395950a1a57755e
SHA1c1961dc9fa4b58393187d32afd4bb6a44828de03
SHA2562072908383ee3b1bc47041600a40ccf92a64ec3046808cd62c61cb408da98e07
SHA5122edd9e0fac061934dcde4b15b39a016bd0b70346b2e830bb06067383252fe349e54f3101cfa26e3498cd0714c541deff9047ca7e7f77f6b575af9a0359334330
-
Filesize
2.8MB
MD5530ee57634fcfcbbf83a1280d7734abc
SHA16121081dd0e415d8925a4147e7fa6fd434efab85
SHA256702758ed69a603bffbcf007699ca8049297da1e3685cd36c67fed7f429a473c4
SHA512d33c3a4299814aad12f88b51a0e451bcebd327c56e5a71555b4cdfc84b78dc097947994f1470331f805a5ac534e605364a0215a4486b0cf595850988439d41ca
-
Filesize
27.1MB
MD5d80c0e89cf4ed13bedeedc1d023cf1cb
SHA17775de9c1b7044c211f6634507ce5b54e6d50a59
SHA2560632794ea40f575ee8ee692f0e48520e403d25ccd95de224095f3e1717aa2aaf
SHA512d6868381dda84b299bdf7b1bafef9ed08617626391bdcb1110e58e650ff402b409b02834e244472fb125726a27f3e9bdc372ea213b70de3042acd874f5b9c573
-
Filesize
13.6MB
MD52ee3851baaa3c7c9f685902605e6259d
SHA18a0cb1905d005bbdf4f676b4e21afbe1bc88575d
SHA2568e60d450460a0a2ffe9f501342c7a3ad357dbb5daa121eabab05810c3381d00b
SHA5128428f8149fc034accc3d37459b55a8eedb5c85ba0c06d16dae6da67f08f9c88aa94f5e9c4635162c1dcd336b7d536983f60d0381f63b90c4117049995b79cb9d
-
Filesize
106B
MD5c42769fc58a705ab16044804cd33de08
SHA1ea1e6c0774ad18ae80b69105684df800e59002a3
SHA25687f6b9a4eb6fe138ce34632445034b1426724ac65893b5f0c2d3df1b09844d02
SHA51274434e1345628d439a40ede16dc59c91b4c582f5867ea0ef42e8c36dc4284a7327ee722a644fc0af47ca595c716ae2b2381f30574e10b323f5e6c6c7ea076ad9
-
Filesize
315KB
MD59485d003573e0eaf7952ab23cc82ef7b
SHA175b1dcafc21ddc7c3877caeac06bb04ebf09ea40
SHA2565e0e8eac57b86e2de7ca7d6e8d34dddea602ce3660208fb53947a027635d59a1
SHA51250bfdcc4f889cd40fe1b79bd3b32515c18836bc533d5590c95ecf4af5041df61c87df6ad87ef9323e19771de00d7d483fecd07fb7674df380be8839f6ff3256a
-
Filesize
31KB
MD536957c7c690a6238b9d06f7ac2bbb09e
SHA10e13ccb55b2453ac0b6ddfeb4b61a2db656b2407
SHA25678a1951162274ea528a5e5aa7858093cd51ad3da66c5b8aac6155b49992a396c
SHA5122ac34da18adc5cfa433b259e2563695418186d393cfe174b88c24d2d64c678ac82cbebd3bbde82703c9307c586c1edab3f305bb862299feb544b94b890118c46
-
Filesize
116KB
MD5e9b690fbe5c4b96871214379659dd928
SHA1c199a4beac341abc218257080b741ada0fadecaf
SHA256a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8
SHA51200cf9b22af6ebbc20d1b9c22fc4261394b7d98ccad4823abc5ca6fdac537b43a00db5b3829c304a85738be5107927c0761c8276d6cb7f80e90f0a2c991dbcd8c
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F1EF857C-9E36-4EEE-92CE-77344C0A2D59\en-us.16\MasterDescriptor.en-us.xml
Filesize36KB
MD572fb563248d442e416eae516094458dd
SHA1d206ad65cfe79d52bf3d0845cbe35585cf7e365b
SHA2567680d0929bafd13ef271a853659afbbf313dd2fb69381f7eb00fe08d38615fe4
SHA5120161a2faef57ed1d704dcb1f89e4d794a563c8900acc0494c8a56e9645637fbd30930c916c261353b399282b256c40e687acf9ef875483bec4cdc0666c4a2639
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F1EF857C-9E36-4EEE-92CE-77344C0A2D59\en-us.16\stream.x64.en-us.dat.cat
Filesize78KB
MD58551c9ac4f3ec1d6bf80d23396fed971
SHA1c01110845fd2e9b631b0751981c92d90e89d2714
SHA2569115dcf7978a71ecdfc4cae690f4e7c43ffab7a3711177139601bb252d1e119f
SHA512b20daf2312e82e8b6ef2e21d47606d1a617577565108666ffdd757e370daf688351915d2c43ece57ee00e910be53f723875ad9d4562622fa297f700216c69a7a
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F1EF857C-9E36-4EEE-92CE-77344C0A2D59\sd640.delta02.cab_extractOfficeC2RF3961C26-93B9-462B-B0BC-BEE70ECA715D\MasterDescriptor.x-none.xml
Filesize31KB
MD5e640a6b8af4361a79ba887d1af5993fa
SHA1029cef189a38ff85b6ae456cbfea59b70cc3b725
SHA25609582ad3d949825978c4289654598a20a7ad8128606a1bb4cc33b3c8e931d290
SHA51285f37aebc49e594aa6a4564c8a83234be207f86ad5b7fe00e612f7a58e980da84c31fdbaabd63932e6218479fc85b89b0315b52ac53d375959c5e07dece17c44
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F1EF857C-9E36-4EEE-92CE-77344C0A2D59\sd640.delta03.cab_extractOfficeC2RB574C7D7-AD7A-4AC2-8999-F1890A753448\stream.x64.x-none.delta03.hash
Filesize128B
MD5c96676c4e935552d7b23caf0844acbb2
SHA1e51181e2d5aecc64b2156e0b7f5c2ae721062e27
SHA256d9dd0a2e99b95e0916575fd4f0014fd44981beb2d99b3af82b14bf29d227c21f
SHA5129f4b50a63c0ab504060f0ab911561afecfe75f5b9582ff1039558a6088f42d89e4dcbd1e2b45f61ce881513ceb33ab42d57f568cd77445669439e52383511a08
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F1EF857C-9E36-4EEE-92CE-77344C0A2D59\sd640.delta03.cab_extractOfficeC2RB574C7D7-AD7A-4AC2-8999-F1890A753448\stream.x64.x-none.delta03.man.dat
Filesize22KB
MD5e48beb9e1c747f4c5119e72d2382040e
SHA121a7956474881402e26731995807cc84931d19bd
SHA256c764726c73ed0bbdb2ed814d7f0d88fd37a7ecdb87024a8bbbb1bb3be5fcc122
SHA512c3dc143ac4e6a50faf7eb5fe4018803dbc7669cbe4c75a4a98bb194004007d0847fb37ac235bc54fef12a85332bda01063f51e7c6dfbe49893a8a361e6c381ad
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F1EF857C-9E36-4EEE-92CE-77344C0A2D59\sd641033.delta03.cab_extractOfficeC2RCE295DDC-829A-4A69-A647-7BC72E2D2AFD\stream.x64.en-us.delta03.hash
Filesize128B
MD5840946710eb8ccfaf98f31f776eaace0
SHA1fa917c58d32105c1d4ba3ea47c34f81a2030484d
SHA256811bddaaa9839c2f19d165bf7e89f8693736c7a3d16a8da26d1a9e28fdc611a0
SHA5122f9d1d2d5c6847aaaad6cf9f534bbae5d7d434eeec5a636c3d44bb715e0dc504658145e9944978d72cd0e315d9adfe79fa15976d9b248bc892eea40d8945cae6
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F1EF857C-9E36-4EEE-92CE-77344C0A2D59\sd641033.delta03.cab_extractOfficeC2RCE295DDC-829A-4A69-A647-7BC72E2D2AFD\stream.x64.en-us.delta03.man.dat
Filesize15KB
MD59172c7830ebc7049d4a1830624a0bf46
SHA1694c6df4b1233838e50304a3a9c23d89752cb602
SHA2560ac5fd10987aa4eac096535d9004d9194c95d40dc69a0d8c0ec08ba4f2f67264
SHA5124db0343eb82837b8eb5b5d23100ea90c6233307b24941c856fcd4e163becd36b545c62df1bfbed4222cc16d08f8e7dd30c7ba6a29748c8fd75020ddd235e7d3c
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F1EF857C-9E36-4EEE-92CE-77344C0A2D59\x-none.16\MasterDescriptor.x-none.xml
Filesize36KB
MD56e08be42bc44430589bfd4ef6efcb7a9
SHA1310fe6029cc423da9317b5735d06455d7c68b5fb
SHA256cdfe176584414d4f76730d283ac657d807d4f6fb5f382520bee8e296d2dcc68e
SHA51250d24c53b14b9cb8f8d6b102971be1588a57d0cc2fdee110ca6c70eff59c3461f5ae8ca14a8c5facdc7f8669c0bc58a03360b3fa10777041c91a9f879dd364a3
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F1EF857C-9E36-4EEE-92CE-77344C0A2D59\x-none.16\stream.x64.x-none.dat.cat
Filesize641KB
MD5335082845f2f7f4534dc809ce8023d7f
SHA1d83c0da25fb437981d6085cc0fc41c950cea4307
SHA256e6ebff4a02303dc9eb9355c6b61013a032f89064b15d4c994bd122b3369da685
SHA5126670affec93d5bd477036f3e8c670f993d8a0eeb3d0695a80a13f77d3a7d4da03753f74dd5a651f889a9397b5cbe5e5ac44091d30a1d9cb9c50d7b8803054445
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\3950571B-C4ED-4FAD-82D4-D0C054ADBEF8
Filesize162KB
MD5edab31e5f853fc9f42444cc0c695e8ca
SHA154b60e8ae5754b188729ab848d9e536d9f19f04c
SHA256e5d4ff06b27cda60acec791d6454679635e21c33c6d8dbddd4e3e052f888fbdd
SHA51239ab69cb62bf4c7ec691aa4738daf4fb57a3114da3481c13b686aed4702601a984d3d431738e4cdde4340b196753b6407c027cd26fc89c42c1d98eb49875acbf
-
Filesize
24KB
MD58665de22b67e46648a5a147c1ed296ca
SHA1b289a96fee9fa77dd8e045ae8fd161debd376f48
SHA256b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f
SHA512bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da
-
Filesize
32.0MB
MD50c35b027efd1f9989218458955bfeb65
SHA1b306d2c4404fa6233f7a75d2d20ff3b276edcc37
SHA256f8b12545547fae5a120d2d6ec06a8c0e157c0f9726934da55800cd92bf069697
SHA5123dd10d74bb3dd42316778dba699d8916f50680d85ec8e859a2c4721ae5a6417f0ac21b6e9c0e17ff74bb307136267c91eee0401a97cd7badeaff08a00a568496
-
C:\Users\Admin\AppData\Local\Temp\OfficeC2RF8FA808E-A987-466B-BAEF-9B6D8ED162C3\VersionDescriptor.xml
Filesize25KB
MD5f90bb7d675b52ca5fe6b8494cd1e1bfb
SHA1a676e3fa737de0e1734a98ce295eb58d130352b3
SHA256987eef8a72ba4088b9910503eacd4da8e937ec7bbd05fd207a7c2d83e1e2be37
SHA51233ebc6d4c3c8927923ee9c8fc471666d290bfe10925e73c87c3b74c072f7a29922aec9ff12181b8af5f0550578be21c17440a057fcff34aadbc39fbd67896976
-
Filesize
9KB
MD55e243f4abaa028970bac382cdbfd226b
SHA1044cfed8df8d4eaeb5a546aef20726caa737af6b
SHA25629d93f00ee0f23cd6b99411f2286a5fcf70df34703d7876dfd0b3c3b953abbf9
SHA5120a526e7c4c85f3334a065727051ac4523b7d9fd92b8fb1df6c725e7a22ae56703fdc02636ba0f7732ef5668f10a4ae2074f48d3194b8f5e20d459dfe16a37e16
-
Filesize
9KB
MD5169a54509a2013a203bf258c1392e419
SHA1c15d2aa84c52ae1e73ea1f8a94255f4cd28d91d2
SHA256f8c6d765c758ceea0b1f3b7c71f0a3063d8120781df2644b3c19e0cca42e13d8
SHA5120a5e1ebf635278f74abf18640c9102d1d3521c56dcbb29656f8a5344954a4b2d295f210bca3a0a324948720bad3c640c404831a7e1b35661c922d96b6fa9b213
-
Filesize
2.4MB
MD542dc75eb64b589d3be7f1dca985ab98c
SHA1bde35baf1c616f3086cc7b26851ba8053964bbfc
SHA256654568d607d97596f65db8058e114a2049293813f4c82183bdfea6a681a3f83d
SHA512d70ffb312aa6452df51e7c3d7c261ce8d6b1cb185c0041e83cf0314cb03b0663b5978f020267472ed13d3907f3729358d1d248c1c7496057817ef03fc1ffa356
-
Filesize
516KB
MD527ba0f0c4d92745be0b1881d9e975cb7
SHA1d73a799384b8580e038a8769a2770007e672ae18
SHA25647e11197cb0558c97533299026439daaccc836ec27ba1c5b21282d00a5cb0464
SHA512b6ce90cdb426c9f8c415304fc1fe21baa1e6b19990aa37fd5e524ae38fafeafa1896862cd24c4eccbf3bfcbdd2643d05aad8bb761ac9686983335ae182f44bae
-
Filesize
2.5MB
MD595208bd98fbe6420ba3d4e63958b8ea1
SHA18b33adf213e03be55b5221f9a6b531735d5c9fab
SHA256dcf2fda5b0ea07ab69c37f88e8064421b74ee17c67a6e0ab6f7db99cc31f39bc
SHA5124e591890c847329eea8975a306d296326f31da388e20b0908e6781976c6751eda9e4aa18793b047e93d56e47964ee14a30d2802de8cc14e3c612c3f46e776a27
-
Filesize
33KB
MD5355ca52938b4a608699ee30588bba52e
SHA1c1eaaa3b078d3d135c8731e41f5deb669bddf142
SHA256cbf6806315a0a21236be2e8f219366a9e85111ca2b2c7135342cf9f26f3822f9
SHA512f39fb01a1a13648aa9dfaf75417ae6db4067726f2d0b807fc3eec1701e918ef8418047b6a24103cd5215ca5b755330e52081c76be9c6cfc296ca1014cd7c1cf6
-
Filesize
33KB
MD5a853c6d1a4d10afee2afbce5832f63b4
SHA1a28b297de5b67f6882081ffe880ad3f49f366269
SHA256aa277bdf1a3f38bb439fdd5380e557a87510c1bb237cdb234c8b950d389bb057
SHA512865f794f8d5462b71a3170403e8812d5f55178df44ce54d6328a4add883249eab2ed2e86027567632f957c0a45b0322bf80faf9fbcc02f896119556ef4465d0a
-
Filesize
33KB
MD5db8c5f9424cb45f1462a319929a7b4f2
SHA1c2cf09c9c4b3c5735e0c1b0d81796eabc50dcdda
SHA2561d5ff9ee98dcf822a2ac777180f58db2c13e1bddb8328a4ef21cb586aa18229c
SHA51276ff2c095535bb5220671afc6e0ede3231299a5b30d93b3b60b5c664e403356b313bd5abfd8d00179bae9e01455847ac6add1ddf22ea586787bff0ee7db4575e
-
Filesize
356KB
MD596ea2c4a6cc7a291dd0c841b519ece11
SHA1694196f92e9f5cf18cfa452c537a805329ec6f4c
SHA256c83f4c285ab3887c6016b74964eaaf8d758ff7786ecc91bd99c214a4d7524a42
SHA51248ed9f5036930154b7d6be8f023ceacca4973feca4cb115384c51e25a470d4f533d082777771dd29b7d560bf02da62bb6820735752930283f2da32fe84f3faf2
-
Filesize
29KB
MD5c91b591a32967c24d389f33b730a8934
SHA1c042653477f0ba63b5fb4191a3a9ee9e0929db4a
SHA256a5af24f4a2027a1fb5421d234f1610b063de149c6e2482a87156efa70d3d13b9
SHA512ca04afc3d8ee1195c3baee1237cbc89428e2956706e4d9479cf66d226008c90b87181b67199a68bfd8f48bc68341a4ded845f21ebbbb93d75a234beaf0c6807c
-
Filesize
29KB
MD5d35bf25df8ddfb70cfd4d3997e680cb7
SHA18cb4bec9711c8f1bdb0f49792570c6a958da49f1
SHA256946ddbceb438da29b348a83d675032fa796fa95dd337df07d4917e7a87995221
SHA5121ebc06dcabd452d88b95c51c65dd506c4f9a8d06e97d592ded774b1e2baaf2a49891fe7471d503556e52aa7429524ea1b988c6bfcaa748aaaab73915506caf4c
-
Filesize
29KB
MD577f59bf350f2088a347d219e09a1c978
SHA1a12f860a9db79f46ae4b82cd286f1c454b0e40a6
SHA256f28381b54e5680dd085abbd335e7845bf1df22d0a899727e0b28766d98fe2c0d
SHA512a4bd875ee0869a94ad22912049c04c1e0201719d676f168650f21cd64391c521a1360adcad2f84975f73757dae22f817dde68589275ccaaac56c3e014cd9d600