Analysis
-
max time kernel
116s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2024 17:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e7f791aa2520164a47e3508799731630N.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
120 seconds
Behavioral task
behavioral2
Sample
e7f791aa2520164a47e3508799731630N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
16 signatures
120 seconds
General
-
Target
e7f791aa2520164a47e3508799731630N.exe
-
Size
7.2MB
-
MD5
e7f791aa2520164a47e3508799731630
-
SHA1
7d8fd0113ea4b533f26321029f6f455181b3b6e2
-
SHA256
0fe7a99aff99a6508bb18a424f95ff6c748379d5e8353842b06a82bf02190fa7
-
SHA512
193d487a6fb7369896b765bd9d456738fc47198fd7b4c6013b27a7e00046104ba5e49748307d5480c7282b3220cfc3b26775a07ea66ae7f853eb4760ed7de805
-
SSDEEP
196608:Waz9NxpZCsiavWWbI+PxZiDfJuopQb+FjC8lla8D+hknOO/xaI6HMaJTtGbU:tt1bvWx+P7izJuoFjm4a
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation e7f791aa2520164a47e3508799731630N.exe Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation OfficeC2RClient.exe -
Executes dropped EXE 3 IoCs
pid Process 4136 OfficeClickToRun.exe 2076 OfficeClickToRun.exe 4400 OfficeC2RClient.exe -
Loads dropped DLL 31 IoCs
pid Process 4136 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 2076 OfficeClickToRun.exe 2076 OfficeClickToRun.exe 2076 OfficeClickToRun.exe 2076 OfficeClickToRun.exe 2076 OfficeClickToRun.exe 2076 OfficeClickToRun.exe 2076 OfficeClickToRun.exe 4400 OfficeC2RClient.exe 4400 OfficeC2RClient.exe 4400 OfficeC2RClient.exe 4400 OfficeC2RClient.exe 4400 OfficeC2RClient.exe 4400 OfficeC2RClient.exe 4400 OfficeC2RClient.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry 2 TTPs 8 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OfficeC2RClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OfficeC2RClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer e7f791aa2520164a47e3508799731630N.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName e7f791aa2520164a47e3508799731630N.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OfficeClickToRun.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120639v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230171v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703051v3.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120610v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703900v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700651v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703250v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703351v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701150v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701400v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701401v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701551v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703300v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120664v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700451v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703601v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703701v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120650v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120657v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700901v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702651v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703201v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120627v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120662v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120671v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702401v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120633v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230166v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700250v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700301v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700450v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701350v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702600v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703550v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120677v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703751v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701951v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702400v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700300v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702900v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120653v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120668v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700400v2.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700601v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701201v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702901v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703101v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120631v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120649v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700151v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702851v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704050v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120643v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120609v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120603v9.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701351v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702501v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703850v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701200v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702051v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702450v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702700v1.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120128v0.xml OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701050v1.xml OfficeClickToRun.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.de-de.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\inventory.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\SharedPerformance.man OfficeClickToRun.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ClickToRun\msvcp140.dll.bak OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\api-ms-win-core-localization-l1-2-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\api-ms-win-core-synch-l1-2-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.lt-lt.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.uk-ua.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe.bak OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2R64.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\api-ms-win-crt-time-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.et-ee.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\api-ms-win-crt-math-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\api-ms-win-crt-string-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\c2r64werhandler.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.fr-ca.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.pt-br.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\ClientCapabilities.json OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\InspectorOfficeGadget.exe OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\msvcp120.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ClickToRun\vcruntime140.dll.bak OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RHeartbeatConfig.xml OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.nb-no.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\manageability.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\vcruntime140_1.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\api-ms-win-crt-convert-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\api-ms-win-crt-utility-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\AppVClient.man OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\AppVIsvApi.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\AppvIsvSubsystems64.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2R32.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.en-us.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.fi-fi.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\ClientEventLogMessages.man OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\i640.hash OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\vccorlib140.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.zh-tw.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\MavInject32.exe OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\AppVIsvVirtualization.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.sv-se.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\policy.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\api-ms-win-crt-runtime-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\AppvIsvSubsystems64_arm64x.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\AppVIsvSubsystems64_msix.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\AppVPolicy.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.lv-lv.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\OfficeOEMPlugin.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\api-ms-win-crt-heap-l1-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\AppvIsvSubsystems32_msix.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.en-gb.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\msvcp140.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\AppVClientIsv.man OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.kk-kz.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.pl-pl.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\vcruntime140.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\AppVShNotify.exe OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.sk-sk.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.zh-cn.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\offreg.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.id-id.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.ja-jp.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\ServiceWatcherSchedule.xml OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\api-ms-win-core-file-l2-1-0.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17726.20160OfficeC2RDBFF3BD4-F92B-4FFA-8E35-307F73CE7863\C2RINTL.es-mx.dll OfficeClickToRun.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e7f791aa2520164a47e3508799731630N.exe -
Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe -
Enumerates system info in registry 2 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|18" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0 = 4d736f3a3a436865636b73756d52656769737472793a3a446174617c75696e7436345f747c373230333238373532383935303031343131353b456373436f6e666967526573706f6e7365446174617c7b202256657222203a2022696e7433325f747c30222c2022436f6e6649647322203a20227374643a3a77737472696e677c502d522d313039383135382d312d352c502d522d313038353730312d312d312c502d522d37363735372d312d322c502d522d35343930332d312d332c502d522d32363134362d372d31372c502d442d32393633352d312d312c502d442d32373038372d312d392c502d522d37393638382d312d332c502d522d313137333439332d342d392c502d522d313139363439302d342d342c502d522d313139333138392d342d362c502d522d313037333732342d342d342c502d522d313036353130332d342d352c502d522d313034303537342d342d342c502d522d313032313439312d342d342c502d522d313032303733302d322d362c502d522d313031393539312d342d342c502d522d313030343536312d342d342c502d582d313234353038332d322d332c502d582d313233363435392d312d332c502d582d313134363830352d322d352c502d582d39383531382d362d392c502d582d313134363832312d312d352c502d582d313036313437302d322d332c502d582d313032313936352d312d372c502d582d313032313936382d322d332c502d522d313032353434342d342d352c37616964623231343a3536333533312c30683933333737393a3535323434392c69376534313433393a3437363437342c626c6f636b6564677261706869637361646170746572353a3437353839392c32693838353330343a3532363836352c66653635313636373a3336313635382c37326838623835393a3238343430302c38306562633336353a3236353636392c502d522d35383634302d312d332c502d522d33353039392d322d342c502d522d313233363938302d382d362c502d522d33343834332d342d362c502d582d313233313432362d312d352c502d582d37313237342d312d372c502d582d313131353931322d322d352c502d582d313036373430382d322d332c502d582d313036333834332d322d332c502d582d313031393934352d312d372c502d582d313030363839392d312d352c502d582d3130393833322d312d352c502d582d313032303631372d312d332c502d582d3130373935312d312d392c502d582d3131383137312d312d332c502d582d39353330302d332d31312c502d582d38373033372d312d332c502d522d313237373532392d382d352c502d522d313233333439372d342d352c502d522d313233313633372d31332d31362c502d522d34353438332d31362d35332c502d522d35303731372d31382d36302c502d522d38373538372d342d342c502d522d37353036392d312d332c502d522d37353030312d312d332c502d522d36383135322d31382d32312c502d522d35323331362d31382d33372c502d522d34393136322d31382d31332c502d522d34393136312d31382d31332c502d522d34303235332d362d31392c502d522d34303235342d362d31382c502d522d33353430312d362d372c502d522d33323130372d32322d32322c62653765343538343a3538383136392c636c70726f3130353a3436363736322c63376a33683733363a3437353836342c36633932393731393a3339333435382c6a6a6432663231333a3336353635352c636c3132303a3238353532342c636c7265703130363a3238343830372c636c7265703238323a3333353536382c636c63646e3338393a3234313632352c636c3937313a3239363531342c636c7265703730333a3232343731392c757073656c6c5f616e645f686172646c696e6b696e673a3137363837342c636c7573653537363a3234333839332c502d522d32343938302d382d34382c502d522d31383237392d322d36352c502d522d3131333931352d382d372c502d522d35323938322d31382d33342c502d522d35313134352d322d372c502d582d313232373439362d322d352c502d582d313232373439352d312d352c502d582d313137363638352d312d352c502d582d313031323533332d312d352c502d522d313233383832352d342d342c502d522d313232373531372d31342d31372c502d522d313232373531362d31332d31372c502d522d313138363930352d31382d31362c502d522d313137363639382d31332d31382c68696863333338373a3536383436332c36633664313534373a3536383436342c62356630313434353a3536383436322c64696173793933323a3237333238302c502d522d313236373631362d312d332c502d582d38353335392d312d31332c502d582d38393031322d312d31312c502d522d313232383532342d31322d31342c502d522d313232313238362d31302d392c502d522d313232313235322d31342d31392c502d522d313136313934392d31342d31352c502d522d313034323432302d342d332c502d522d313033363136342d342d372c502d522d37393631362d312d332c502d522d37373632312d312d332c502d522d37373230342d312d332c502d522d37363130372d312d332c502d522d37343333342d312d332c502d522d37343433392d312d332c502d522d37333634322d312d332c502d522d36323837352d322d342c502d522d36303537392d322d322c502d522d36303333332d312d332c502d522d35383130372d322d322c502d522d35353734332d312d332c502d522d35313935382d312d352c502d522d33383038352d31322d392c6e617469766577696e333272646c3a3138363734342c646f6373686f6d6570616765736561726368656e61626c65616767726567617465646d7275736561726368736f757263653a3137353733392c502d522d313033343136392d31302d372c502d582d313235313332362d322d332c502d582d313235303339302d312d332c502d582d313037383537362d322d332c502d582d39333738372d332d31312c502d582d313035363137372d312d332c502d582d37393936312d312d372c502d582d313032363439382d312d352c502d582d313030333830362d312d372c502d582d39393034342d312d332c502d582d39363134312d312d332c502d452d32383637372d43312d332c502d522d313235313333322d312d312c502d522d313235303430352d322d322c502d522d35353132322d382d382c502d522d35303235352d31302d392c502d522d34353331342d31302d31362c64697361626c656f666669636576736f5f383835373934385f726f77616e64636f6c756d6e736570617261746f723a3535303135372c64697361626c656367666978646f75626c65636f6c756d6e696e73657274696f6e3a3534383533352c37393332313738393a3335353439302c65787069766f746e6f6e64657374727563746976656175746f67726f75703a3338373137392c32696539633230333a3333363131332c657861766f3833333a3234393839332c34616265633934343a3333333233302c65783231373a3538333736372c6d6f6465726e62726f777365726f617574686469616c6f673a3230383934332c65786973723434383a3230383933342c64697361626c656f666669636576736f5f383835373934385f726f77616e64636f6c756d6e736570617261746f723a3535303135372c64697361626c656367666978646f75626c65636f6c756d6e696e73657274696f6e3a3534383533352c502d582d313235353832302d312d332c502d582d313234303832332d322d332c502d452d33383233312d322d342c502d522d313237383439392d342d342c502d522d313235373635352d31332d31362c502d522d313234353636322d31362d342c502d522d39343536302d31342d31322c502d522d39343138392d31342d31332c502d522d39333838322d31342d32362c502d522d36313134372d31382d322c502d522d35343732382d31362d32332c502d522d35343639382d31362d31362c502d522d35343635382d31382d31392c502d522d33383330362d4331372d332c502d522d33343031392d342d332c36313934693338363a3538393635372c77696e333264657669636563616e61727963663a3534313438342c77696e333264657669636563616e61727963663a3534313438342c502d582d313035313539312d322d352c502d582d313133373135372d312d332c502d582d313037393733332d322d372c502d582d313036343438332d322d332c502d582d38353839362d312d31392c502d582d39313739302d312d352c502d582d3130373539352d312d352c502d582d36313130322d332d31312c502d582d35313236322d312d31312c502d582d35323539312d312d31312c502d582d39383635352d312d352c502d582d38343436342d312d352c502d582d35343335382d312d372c502d582d35333937352d332d392c502d582d36393138392d312d372c502d582d35363237342d312d392c502d582d36333133342d312d372c502d582d35383637382d312d352c502d582d35353833322d312d362c502d582d35363134372d312d352c502d582d35363135342d312d352c502d582d35343231322d312d352c502d452d34323730302d322d342c502d522d313237333334332d342d342c502d522d313236383639382d342d352c502d522d313235353037392d382d352c502d522d313235303933352d342d342c502d522d313234333631322d382d342c502d522d313234303834312d382d342c502d522d313233363836392d382d342c502d522d313232393636362d362d342c502d522d313232393631312d382d382c502d522d313136373231332d362d342c502d522d313135373737322d31332d31312c502d522d313135333933372d382d342c502d522d313134363233322d382d342c502d522d313132393434332d382d342c502d522d313132373034302d342d392c502d522d313038353239392d382d352c502d522d313038323936382d382d352c502d522d313037343033302d382d342c502d522d313036333936382d31342d32312c502d522d313035333236392d382d352c502d522d39333937302d382d342c502d522d36393036352d312d332c502d522d35393139332d312d332c502d522d34353630392d31342d362c502d522d34353139372d322d362c502d522d34303938302d31382d31362c502d522d33393032392d352d31382c502d522d33353136352d322d372c502d522d32393830392d312d372c502d522d32363936382d332d392c686e6c6162656c6374726c3a3630333036382c36336439373330323a3531313533352c6d756c7469706c6574696d656f75747374726561746d656e743a3432313835312c646f63756d656e7473756d6d617279656e61626c65643a3430353339352c66696c69733436363a3333303234372c66696d6f633234383a3139333439312c66696261633936373a3335393434312c66697465733231373a3136313436382c66697265663334363a33343532352c66696d6f633538393a32383937392c6f6e656472697665636f6e76657267656e6365656e6c69676874656e6564726f6c6c6f75743a3135393033382c66696f6d693239333a3131383038312c6669656e613934373a33303633352c66697374613430373a36313032372c6669656e613930333a36353934342c66696461763236353a35353033352c66696361633834313a34393636342c6669656e613431353a33383738302c6669656e613439303a33343138312c72656d6f74656d6f76656465766963653a34323530302c6669656e613237363a34313030342c6669656e613338313a34393939372c502d522d313239323337352d4331372d362c502d522d313235323036362d31382d382c502d522d313038383738382d31382d362c502d522d313037383537312d31382d382c502d522d35333534352d342d352c502d522d34393733362d362d32322c502d522d33303038352d312d392c502d522d32353030392d312d382c502d522d32343336332d312d31332c502d522d31393831342d312d36322c502d522d31393031322d312d35372c502d582d313233393234362d312d352c502d582d313234373734312d322d332c502d582d313130323633312d332d31302c502d582d313137383236342d312d332c502d582d313136393731382d312d332c502d582d313132363236332d312d332c502d582d313031313434322d312d31312c502d582d313031303331342d312d352c502d582d3130383336342d312d332c502d582d37373734322d312d352c502d582d38343332312d312d352c502d582d34393733302d312d332c502d522d313233393236382d32322d32392c502d522d313236343132352d342d342c502d522d313234383831342d31342d31342c502d522d313137383236362d31332d31332c502d522d313136393938362d31322d31352c502d522d313136373631332d342d362c502d522d313134363235352d382d362c502d522d313031343435322d382d382c502d522d36343834312d32322d31352c502d522d36333130302d32382d31302c502d522d34303939302d31322d31352c502d522d33323734342d31342d31352c502d522d33323734312d33322d31362c3530616a323839363a3630343937362c65356138303436333a3537313336342c33623638683438353a3530333538332c646a6869693135323a3539373030312c756e636163686563616e72756e666561747572653a3533313834362c36666769643938363a3433333838362c67726766783930363a3432333930352c67723331323a3231383934392c67723337303a3538333038372c677264656c3334373a3132373632382c67727573653434343a3132343039312c677269636f3430363a31393737372c756e636163686563616e72756e666561747572653a3533313834362c502d522d35303432392d31382d382c502d582d313232343939362d312d372c502d582d313134383534372d312d352c502d582d313131363136302d352d392c502d582d313037313632372d312d352c502d582d313130353330362d312d352c502d582d313031393831382d312d372c502d582d37353232322d32322d37352c502d582d313034393232352d312d332c502d582d313033333336302d312d352c502d582d313031313137332d312d352c502d522d313234303535362d382d362c502d522d313232383036332d31332d31332c502d522d313137363338372d31332d31342c502d522d313135383639332d31382d31332c502d522d313135383530372d382d362c502d522d313135383135342d342d342c502d522d313131303137332d342d362c502d522d313131303435392d31382d32302c502d522d313038353730372d31382d35312c502d522d313032363534322d382d342c502d522d313032313732352d31382d34392c502d522d36373039382d3132362d3237372c502d522d35333432312d32382d31342c502d522d34303437352d32382d32382c502d522d33323030342d322d352c33356135673533343a3539393432302c37656666623930393a3531363739382c39633836333136333a3530363036312c686170707930323233323032332d313a3530363033392c686170707930363236323032332d313a3534373935382c696466673139373a3338353337382c65786f6f6e6c7963663a3339383433372c39373935633332303a3335393832302c32646262623537393a3238363232352c69643539323a3238383731342c502d522d313237323337362d342d342c502d522d313234383830352d342d342c502d522d313137373930352d342d352c502d522d313136313730342d342d31302c502d582d38383033352d312d352c6c616c616e3233313a3134303738312c502d582d313237363530392d312d352c502d582d313236353735362d322d362c502d582d313235363338382d312d332c502d582d313234373137302d352d31322c502d522d313238303432352d31332d31362c502d522d313236353830382d392d31342c502d522d313235393530372d31312d352c502d522d313235363430392d31322d31322c502d522d36313234382d31382d362c502d522d35313939352d31382d32382c69306437363937303a3539383638392c64613361633632323a3539303234352c39396265353533373a3538363034332c76305f373a3537313933352c502d582d313233363835332d312d392c502d582d313034343531342d322d372c502d582d313135353533392d322d352c502d582d313133323436372d322d31352c502d582d313039373038372d342d31322c502d582d313036313732332d322d352c502d582d313038383535362d322d332c502d582d313037363235322d312d362c502d582d313035383139372d322d332c502d582d313032363133312d322d352c502d582d313032373931332d312d31312c502d582d313031373734352d382d31342c502d582d38303736372d312d33372c502d582d3130383634332d322d372c502d522d313233373139372d31322d31342c502d522d313236343932302d31332d312c502d522d313236343931392d31342d312c502d522d313234363231332d362d342c502d522d313233383738352d342d332c502d522d313232343937382d342d342c502d522d313135383935392d392d372c502d522d313135383136332d392d31312c502d522d313035383637352d382d342c502d522d313033363537362d342d342c502d522d39383131302d342d352c502d522d37393936332d312d322c502d522d36303831362d31302d31392c502d522d35313736342d312d342c502d522d34323339322d322d342c502d522d33393037332d312d352c31386461313633333a3539333633312c70697063687962726964743a3333363236352c67363836353339343a3534333437362c35656131673530383a3531333133382c69646268303835323a3431313136392c326766396a3631383a3336323439302c66323567343231343a3337393830332c396a6734633839333a3335373434342c63673032633239353a3434343538362c6a6a3035303832373a3234353136322c61306537323236393a3332323039342c37673633363833323a3236383639382c65396268363531353a3234343439392c37366534673937353a3332343937392c502d522d313132333337362d31302d31322c502d522d313030393835352d31322d31342c502d522d39383835362d31382d34382c502d582d313131333731312d322d352c502d582d313131333731372d312d31312c62386539663137373a3531393132342c35676834333935323a3531393132352c502d582d313235353237302d312d332c502d582d313230303837362d312d332c502d522d313235363038362d31332d31362c502d522d313232303733392d31322d31352c502d522d34333438392d33302d31352c30396865643537353a3539373131362c636865636b666f7273656c656374696f6e3a3534323135372c636865636b666f7273656c656374696f6e3a3534323135372c502d582d313239313234362d322d332c502d582d313234373936322d322d352c502d582d313233313730372d312d332c502d582d313135313133372d322d352c502d582d313030393233372d342d31372c502d582d313034313735362d322d352c502d582d35313735392d312d332c502d522d313234393337302d342d342c502d522d313233373138312d382d352c502d522d313233313130342d342d362c502d522d313132363239382d362d362c502d522d313038393139322d362d352c502d522d3131373934312d342d342c502d522d35393533 OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.19 = 7b20224622203a20224d6963726f736f66742e4f66666963652e4f6e654e6f74652e4f6e654e6f746553686172654d656e75222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f313122203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e44616e697368456e744469736162696c69747942696173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e44616e697368456e744d656e74616c4865616c746842696173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e48756e67617269616e456e744469736162696c69747942696173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e48756e67617269616e456e744d656e74616c4865616c746842696173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e506f7274756775657365456e744469736162696c69747942696173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772616d6d6172436865636b696e672e506f7274756775657365456e7452616369616c42696173222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f313222203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e766173426f6f742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e766173446f63756d656e7452656164792d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e766173466c6f6f64676174652d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734c6963656e73696e674469616c6f6752656e65772d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734c6f63616c4f70656e446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734c6f63616c53617665446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f444253617665446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f6e6544726976654f70656e446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f6e65447269766553617665446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f757453706163654f70656e2d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f757453706163655361766541732d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d466c6f6f6447617465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d496e41707050757263686173652d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f75745370616365222c20225622203a2022626f6f6c7c3022207d205d2c2022464347726f75704d61705f313322203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e44697361626c654d617852756c655265717565737473222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e45637343646e52756c657342756e646c65456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e45637343646e52756c6573456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e456e61626c6553687574646f776e4f6e526567696f6e4368616e6765222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e4d617852756c6552657175657374734d616a6f7241707073222c20225622203a2022696e7436345f747c313022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e5573654f66666c696e6553746f72616765507265666978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e557365526567696f6e4177617265436f6e66696755726c73222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f313422203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e456e61626c65456d6f6a6973466f7257504d222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e456e61626c654c69737473466f7257504d222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e456e61626c654f617274466f7257504d222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e456e61626c655374796c6573466f7257504d222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e5072616775654578706572696d656e74222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e5072616775654578706572696d656e747638222c20225622203a2022626f6f6c7c3122207d205d207d207d OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSessionUpgradeCandidate OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.17726&crev=3\0\FilePath = "officeclient.microsoft.com\\C7482456-3D65-4D66-AF69-1D0A2FE0AE76" OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.4 = 6556657273696f6e496e666f222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4874747054696d696e67734f6e4572726f7273222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4874747054696d696e67734f6e4572726f727332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e496e74656772617465546f5265736f75726365496e666f222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4c4f52537570706f7274466f7256616e697479446f6d61696e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4c697374656e546f486f73744e6f74696669636174696f6e73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4d6561737572654e6f74696669636174696f6e48616e646c696e674c6174656e6379222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4d6f63736944656665727261626c65426c6f6273222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4d6f6373695761746368646f674661696c757265486973746f7279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4f6d697455706c6f6164426c6f636b6564466f7242617365446f776e6c6f61644661696c757265222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4f6e654472697665436f6e76657267656e6365456e6c69676874656e6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e50616e69634f6e4261645061727469616c52656164222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e50726f746f636f6c5061727365724c69626c65744368616e676547617465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e5265666163746f7265644d6f63736953796e634368616e6e656c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e5265667265736855706f6e526573746f726174696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e52656d6f7665426174636853796e634c6f636b657246726f6d436f6e74656e74456e64706f696e74222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e52756e74696d655472616e73616374696f6e52656d6f766564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e53656e6454656c656d657472794576656e74466f72416c6c4572726f7273222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e536572766572496e666f52657472794c696d6974456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e536861726555726c456e64706f696e744361636865456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e536b69704f63736949676e6f72654d6f756e74506f696e7473222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e536b6970556e636f6d70617261626c65446f776e6c6f61645265766973696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e5374616e64617264456e6372797074696f6e50726f7669646572496e557365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e537562736372696265546f4c6162656c55706461746573222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e54656c656d657472794f6e46696c6552656f70656e5363656e6172696f222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e54656c656d657472794f6e46696c6552656f70656e5363656e6172696f5f5632222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e54657374476174652e4f6463436c69656e74466c69676874696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e5468726f77526566726573685265636f6d6d656e6465644572726f72222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e556e7365745265736f757263654964496646696c655761734e6f745361766564546f536572766572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e556e74616e676c6541757468466f72416c6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e556e74616e676c654175746846726f6d5349222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e56616c69646174654d617050617468734c697465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e6e6f646f63756d656e7476657273696f6e73636f6d6d616e6473666f72686973746f72696376657273696f6e73222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e44656661756c744368616e6e656c436f6f6c646f776e2e42616e6e6572222c20225622203a2022696e7436345f747c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e44656661756c744368616e6e656c436f6f6c646f776e2e4469616c6f67222c20225622203a2022696e7436345f747c383634303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e456e61626c65557064617465644e7073526174696e674c6162656c73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e496e7369646572546f6173744c61756e63686572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e49735375727665794578706572696d656e74496e746567726174696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e4d617843616d706169676e73506572417070222c20225622203a2022696e7436345f747c323522207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e4d6178446961676e6f73746963436f6c6c656374696f6e73506572417070222c20225622203a2022696e7436345f747c323022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e50726976616379436865636b466f724e6f6e436f6e74726f6c6c657253657276696365466f72537572766579222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e53757276657973456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e43472e557365474449506c7573415243466163746f7279222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4368616e6765476174652e485641547970696e67496e536861706573222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4368616e6765476174652e536b6970506978656c427566666572496e4172634269746d617054617267657432222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e44656c657465456469746f724561726c7952657475726e4f6e5265656e747279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e45326f56696577536861706546696c74657249734d61746368696e675368617065466978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e456e61626c654175746f416c7454657874466565646261636b5549466f7247726f7570456c656d656e74222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e456e61626c654368616e676550696374757265436f6d6d616e64466f72426c697046696c6c73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e456e61626c65496e6b4d696e7574657354656c656d747279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e456e61626c654f7074696d616c52656374616e676c654f6e416c6c5465787475726573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e457874656e64506c61795365636f6e64734f6e49646c65222c20225622203a2022696e7436345f747c31353022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e49636f46696c746572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4e6f436163686545766963744f6e5669657744746f72222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4f61727453706f6f6b794861736850657263656e74616765222c20225622203a2022696e7436345f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4f7074696d697a654269746d61704361636865222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e5265706c616365427574746f6e54616257697468546162436f6e74726f6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e55736541726344656275674c61796572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e5573654c6f6754656c656d65747279466c6167222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e48656c702e496e636c756465436f6d6d616e6454797065222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e416c6c6f7743726f7373436c6f7564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4368616e6765476174652e46656465726174696f6e496e666f457870697265222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4368616e6765476174652e49676e6f7265576f706955736572496446726f6d55726c222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4368616e6765476174652e57656256696577546578745363616c696e67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e436f6e6669675365727669636554656c656d65747279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e44657072656361746542617369634175746853746167654164646974696f6e616c222c20225622203a2022696e7436345f747c3222207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e46472e49734f6e52657175657374436f6d706c657465644163746976697479456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e46472e526f616d696e67436c69656e744f7074696373456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e46472e557365436f6e66696775726174696f6e496e666f466f724964656e74697479222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e46656174757265476174652e45786368616e67654f6e5072656d4d6f6465726e41757468456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e46656174757265476174652e50617373486561646572546f467053657276696365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4c6f636b57616d476574416363657373546f6b656e46726f6d4372656450726f766964657243616c6c73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4c6f67436f6e666967456e7669726f6e6d656e744368616e6765222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4e65774d53414775657374466c6f77222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4f6e65417574684361636865496e4d656d6f7279466f72416164546f6b656e73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4f6e6541757468456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4f6e65417574684964656e746974792e557365436f6e66696775726174696f6e496e666f4469726563746c79222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e536572766963655265717565737454656c656d65747279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e53657276696365734d616e616765724f7074696373456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e54656c656d65747279526567696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e5570646174654d6574614461746150657253657373696f6e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e5573654964656e7469747943726564656e7469616c734661696c757265496e666f222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e5573654e657750726f66696c6553657276696365466f72414144222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e5573654e657750726f66696c6553657276696365466f7241414450686f746f73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e5573654e657750726f66696c6553657276696365466f7241414450726f66696c6573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4a53486f73 OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.8 = 22203a205c22506f696e7454776f46697665546f4c6573735468616e506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130303030207d2c205c22436f6e66696732305c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7454776f46697665546f4c6573735468616e506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031303030207d2c205c22436f6e66696732315c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7454776f46697665546f4c6573735468616e506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e66696732325c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7454776f46697665546f4c6573735468616e506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130207d2c205c22436f6e66696732335c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7454776f46697665546f4c6573735468616e506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696732345c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7454776f46697665546f4c6573735468616e506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696732355c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7446697665546f4c6573735468616e506f696e74536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2032303030207d2c205c22436f6e66696732365c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7446697665546f4c6573735468616e506f696e74536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031303030207d2c205c22436f6e66696732375c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7446697665546f4c6573735468616e506f696e74536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203230207d2c205c22436f6e66696732385c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7446697665546f4c6573735468616e506f696e74536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2032207d2c205c22436f6e66696732395c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7446697665546f4c6573735468616e506f696e74536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696733305c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7446697665546f4c6573735468616e506f696e74536576656e5c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696733315c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e74536576656e546f4c6573735468616e4f6e65506f696e7454687265655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031303030207d2c205c22436f6e66696733325c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e74536576656e546f4c6573735468616e4f6e65506f696e7454687265655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031303030207d2c205c22436f6e66696733335c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e74536576656e546f4c6573735468616e4f6e65506f696e7454687265655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130207d2c205c22436f6e66696733345c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e74536576656e546f4c6573735468616e4f6e65506f696e7454687265655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2032207d2c205c22436f6e66696733355c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e74536576656e546f4c6573735468616e4f6e65506f696e7454687265655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696733365c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e74536576656e546f4c6573735468616e4f6e65506f696e7454687265655c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696733375c22203a207b205c224576656e744672657175656e63795c22203a205c224f6e65506f696e745468726565546f4c6573735468616e54776f506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031303030207d2c205c22436f6e66696733385c22203a207b205c224576656e744672657175656e63795c22203a205c224f6e65506f696e745468726565546f4c6573735468616e54776f506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20323030207d2c205c22436f6e66696733395c22203a207b205c224576656e744672657175656e63795c22203a205c224f6e65506f696e745468726565546f4c6573735468616e54776f506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130207d2c205c22436f6e66696734305c22203a207b205c224576656e744672657175656e63795c22203a205c224f6e65506f696e745468726565546f4c6573735468616e54776f506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696734315c22203a207b205c224576656e744672657175656e63795c22203a205c224f6e65506f696e745468726565546f4c6573735468616e54776f506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696734325c22203a207b205c224576656e744672657175656e63795c22203a205c224f6e65506f696e745468726565546f4c6573735468616e54776f506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696734335c22203a207b205c224576656e744672657175656e63795c22203a205c2254776f506f696e7446697665546f4c6573735468616e5468726565506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031303030207d2c205c22436f6e66696734345c22203a207b205c224576656e744672657175656e63795c22203a205c2254776f506f696e7446697665546f4c6573735468616e5468726565506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e66696734355c22203a207b205c224576656e744672657175656e63795c22203a205c2254776f506f696e7446697665546f4c6573735468616e5468726565506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130207d2c205c22436f6e66696734365c22203a207b205c224576656e744672657175656e63795c22203a205c2254776f506f696e7446697665546f4c6573735468616e5468726565506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696734375c22203a207b205c224576656e744672657175656e63795c22203a205c2254776f506f696e7446697665546f4c6573735468616e5468726565506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696734385c22203a207b205c224576656e744672657175656e63795c22203a205c2254776f506f696e7446697665546f4c6573735468616e5468726565506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696734395c22203a207b205c224576656e744672657175656e63795c22203a205c225468726565506f696e7446697665546f4c6573735468616e466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20323030207d2c205c22436f6e66696735305c22203a207b205c224576656e744672657175656e63795c22203a205c225468726565506f696e7446697665546f4c6573735468616e466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e66696735315c22203a207b205c224576656e744672657175656e63795c22203a205c225468726565506f696e7446697665546f4c6573735468616e466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2032207d2c205c22436f6e66696735325c22203a207b205c224576656e744672657175656e63795c22203a205c225468726565506f696e7446697665546f4c6573735468616e466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696735335c22203a207b205c224576656e744672657175656e63795c22203a205c225468726565506f696e7446697665546f4c6573735468616e466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696735345c22203a207b205c224576656e744672657175656e63795c22203a205c225468726565506f696e7446697665546f4c6573735468616e466976655c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696735355c22203a207b205c224576656e744672657175656e63795c22203a205c2246697665546f4c6573735468616e536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20323030207d2c205c22436f6e66696735365c22203a207b205c224576656e744672657175656e63795c22203a205c2246697665546f4c6573735468616e536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e66696735375c22203a207b205c224576656e744672657175656e63795c22203a205c2246697665546f4c6573735468616e536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2032207d2c205c22436f6e66696735385c22203a207b205c224576656e744672657175656e63795c22203a205c2246697665546f4c6573735468616e536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696735395c22203a207b205c224576656e744672657175656e63795c22203a205c2246697665546f4c6573735468616e536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696736305c22203a207b205c224576656e744672657175656e63795c22203a205c2246697665546f4c6573735468616e536576656e5c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696736315c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e546f4c6573735468616e4669667465656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e66696736325c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e546f4c6573735468616e4669667465656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e66696736335c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e546f4c6573735468616e4669667465656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696736345c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e546f4c6573735468616e4669667465656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696736355c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e546f4c6573735468616e4669667465656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696736365c22203a207b205c224576656e744672657175656e63795c22203a205c22536576656e546f4c6573735468616e4669667465656e5c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696736375c22203a207b205c224576656e744672657175656e63795c22203a205c224669667465656e546f4c6573735468616e536576656e7465656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e66696736385c22203a207b205c224576656e744672657175656e63795c22203a205c224669667465656e546f4c6573735468616e536576656e7465656e5c222c205c224d61 OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|10" OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.18 = 6c6574466561747572654761746534222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e48656c7050726f7669646572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e506172616d657465725465726d50726564696374696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e53686f756c6453686f7748656c70416374696f6e73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4163636573736962696c697479417373697374616e742e4d656d4c65616b56696f6c6174696f6e466978222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4163636573736962696c697479417373697374616e742e557365496e697469616c50726f7073222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4163636573736962696c697479417373697374616e742e557365496e697469616c50726f70735f5632222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4164644164646974696f6e616c436f6c6f7273546f6f6c746970222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e436865636b6f75744465766963654f6e5061696e74496e76616c696447616467657473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e446566657272656452656163744e617469766543616c6c6f757453686f77496e7465726e616c4c6f616454696d654163746976697479222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e46697833383934383832222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e466c75656e7453562e4469616c6f6773222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e466c75656e7453564261636b737461676552656672657368222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4e657455492e496d70726f7665644e6f664d4b6579626f617264696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4f7074696d697a6564436f6e7472617374436f6c6f724665746368456e61626c65645633222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e53646d56656357697468496e76616c6964466f6e744d6574726963735f5632222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5468656d696e672e5573654d656469756d4c756d696e616e63655468726573686f6c64222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5573654e65774d65436f6e74726f6c456e61626c65645765616b50747273222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5573655375706572746970734f6e546f6f6c626172436f6e74726f6c73222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e557365537667417069222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e566973696f2e5a7274456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e57686174734e65772e454353446174614c6f61646564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e416464494f5472616e73616374696f6e416374697669747954656c656d65747279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4170706c79416c6c48746d6c50726f70657274794d6f64696669657273436870222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4175676c6f6f702e4d756c74696d6f64616c2e6973416c6c6f774d61783253657631426c6f636b6564576f7264735374726174656779456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e436f6c6c656374506f61706d4368616e6765537461636b44656332303139222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e44657072656361746542616c6c6f6f6e734d617267696e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e456e61626c654c697374735761766532466f7257504d222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e456e73757265414c466c6967687473417265436865636b65645374726963746c794166746572426f6f74222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e466c7569644f75746c6f6f6b2e4c6f6f705374796c6573436f6e746578744d656e75456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e486964654175746f52656164696e674d6f6465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4c696d6974446973706c61794f66526561644f6e6c79416e64547261636b4368616e67657343616c6c6f757447617465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e52656d6f7665494f5472616e73616374696f6e52756c6554656c656d65747279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e53617665427573426172466f7241734661696c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e53656e64446f63756d656e7444697274794279535445222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e5472616e7363726962652e456e61626c654e6577584d4c53746f72616765466f72576f7264222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e5472616e7363726962652e57696e33325472616e736372697074696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e5573654e657748776e6441707046726f6d506974627332222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e66456e73757265426f6f744265666f72655363686564756c6549646c65222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e66613030303030303133392e456e61626c6547657446696c654c6162656c4173796e63222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d617022203a207b2022464347726f75704d61705f3122203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657231222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383434343234393330373838333230323b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657232222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383434343234393330373838323936373b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657233222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383434343234393330373838333231313b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657234222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383434343234393330373934313932373b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657235222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383732353732343238343635343239363b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b6564477261706869637341646170746572436f756e74222c20225622203a2022696e7436345f747c3522207d205d2c2022464347726f75704d61705f3222203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5265706f6d616e466c69676874486172646c696e6b4475706c696361746573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5265706f6d616e466c696768744f70656e53616d654442222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5265706f6d616e466c6967687453616d6550617468446966666572656e7443756c74757265446564757065222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5265706f6d616e466c69676874557073656c6c222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f3322203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e4175746f67726f75704e616d657353706563696679536f75726365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e4e6f6e44657374727563746976654175746f67726f7570222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f3422203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e456e61626c65576f726b696e67436f707943616d446973636172644368616e676573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e456e61626c65576f726b696e67436f707943616d53617665222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f3522203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4368726f6d69756d4d656469614469616c6f6773456e61626c6564222c20225622203a2022696e7436345f747c343931353122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e46656174757265476174652e4368726f6d69756d4d65646961457870657269656e636532222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4766784361636865557365556e697175654944222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e556e636163686543616e52756e466561747572654d736f4472222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e556e636163686543616e52756e466561747572654f417274222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e556e636163686543616e52756e466561747572654f417274536861726564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e6f61727455736553706f6f6b7948617368222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e7573656432646d69746572626576656c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e7573656764696d69746572626576656c222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f3622203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e46472e49734f6e6541757468506172736572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4973506f70466f7245786368616e6765456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4f6e654175746850617273657254656c656d65747279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e5265736f75726365496454656c656d65747279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e53686f756c64456e61626c65506f50537570706f7274222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e53686f756c645573655265617574685265717565737450726f787932222c20225622203a2022626f6f6c7c3022207d205d2c2022464347726f75704d61705f3722203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e46413030303030303036392e4772616365526564657369676e56617269616e74222c20225622203a2022696e7436345f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e47726163655472794275792e457870657269656e63654964222c20225622203a20227374643a3a77737472696e677c7472796c76757822207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e4973526564657369676e65644772616365457870657269656e6365456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e53686f77477261636554727942757944696d65222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e55736547726163655632466c6f77222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e5573655265666163746f726564496e7374616c6c4772616365222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f3822203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e4f6172742e41646447726970707948616e646c6573436865636b466f724f6e6553656c656374696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6172742e464164644f724564697454657874436865636b466f724f6e6553656c656374696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6172742e4644656661756c745265706c6163654d756c7469706c6554657874436865636b466f7253656c656374696f6e222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f3922203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4e6f6e57696e646f776c657373546f6f6c734c697374222c20225622203a20227374643a3a77737472696e677c4a61777322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e537769746368546f57696e646f77656449664a617773222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f313022203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e4f6e654e6f74652e4e6f74526571756972654f4c446f63756d656e74466f725368617265222c20225622203a2022626f6f6c7c3122207d2c20 OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.1 = 342d312d332c502d522d35343535372d312d332c63683337313137393a3630303339362c74727573746564636174616c6f67737368617265646c6f61645f66383932323830323a3535383631382c336766646a3936333a3538393831302c6a626937323336353a3531393135342c6f6e6c79737769746368746f77696e646f776564666f726a6177733a3332323035342c67623038643735323a3239323132322c6f656d61633335383a32303530322c502d522d37313336302d31382d31392c502d582d313238313836332d322d372c502d582d313131373738302d312d332c502d582d37363535352d312d332c61693366313835353a3539343033322c30353364393430333a3530353436362c6f6e6d61703336363a38313734302c502d442d313234393537332d342d342c502d442d313134363839352d332d342c502d442d313131303935362d342d332c502d442d313037333031342d352d332c502d442d313033373534332d332d352c502d442d313033373533382d332d352c502d442d313033333339312d322d342c502d442d313033313035302d342d332c502d442d313033303932362d312d332c502d442d313033303932332d322d332c502d442d313033303932322d322d332c502d442d313033303932302d322d332c502d442d313033303931382d322d332c502d442d313033303931362d322d332c502d442d313033303931342d322d332c502d442d313033303931322d322d332c502d442d313033303931302d322d332c502d442d313033303930382d322d332c502d442d313033303930362d322d332c502d442d313033303930342d322d332c502d442d313033303930322d322d332c502d442d313033303930302d322d332c502d442d313033303839382d322d332c502d442d313033303839362d322d332c502d442d313033303839332d322d332c502d442d313033303839312d322d332c502d442d313033303838392d322d332c502d442d313033303838372d322d332c502d442d313033303838352d322d332c502d442d313033303838332d322d332c502d442d313033303838312d322d332c502d442d313033303837392d322d332c502d442d313033303837372d322d332c502d442d313033303837362d322d332c502d442d313033303837352d322d332c502d442d313033303837332d332d332c502d442d313033303837322d322d332c502d442d313033303837312d322d332c502d442d313033303837302d322d332c502d442d313033303836392d322d332c502d442d313033303836382d322d332c502d442d313033303836372d322d332c502d442d313033303836362d322d332c502d442d313033303836352d322d332c502d442d313033303836342d322d332c502d442d313033303836322d322d332c502d442d313033303836302d322d332c502d442d313033303835382d322d332c502d442d313033303835362d322d332c502d442d313033303835342d322d332c502d442d313033303835322d322d332c502d442d313033303835302d322d332c502d442d313033303834382d322d332c502d442d313033303834372d322d332c502d442d313033303834362d322d332c502d442d313033303834342d322d332c502d442d313033303834322d322d332c502d442d313033303834312d322d332c502d442d313033303834302d322d332c502d442d313033303833382d322d332c502d442d313033303833362d322d332c502d442d313033303833342d322d332c502d442d313033303833322d322d332c502d442d313033303833302d322d332c502d442d313033303832382d322d332c502d442d313033303832362d322d332c502d442d313033303832342d322d332c502d442d313033303832322d322d332c502d442d313033303831392d322d332c502d442d313033303831362d322d332c502d442d313033303831322d322d332c502d442d313033303831312d322d332c502d442d313033303831302d322d332c502d442d313033303830382d322d332c502d442d313033303830362d322d332c502d442d313033303830332d322d332c502d442d313033303830312d322d332c502d442d313033303830302d322d332c502d442d313033303739392d322d332c502d442d313033303739382d322d332c502d442d313033303739372d322d332c502d442d313033303739362d322d332c502d442d313033303739352d322d332c502d442d313033303739342d322d332c502d442d313033303739332d322d332c502d442d313033303739322d322d332c502d442d313033303739312d322d332c502d442d313033303738392d322d332c502d442d313033303738372d322d332c502d442d313033303738362d322d332c502d442d313033303738352d322d332c502d442d313033303738332d322d332c502d442d313033303738312d322d332c502d442d313033303737392d322d332c502d442d313033303737372d322d332c502d442d313033303737352d322d332c502d442d313033303737332d322d332c502d442d313033303737312d322d332c502d442d313033303736392d322d332c502d442d313033303736372d322d332c502d442d313033303736352d322d332c502d442d313033303736332d322d332c502d442d313033303736312d322d332c502d442d313033303736302d322d332c502d442d313033303735392d322d332c502d442d313033303735382d322d332c502d442d313033303735372d322d332c502d442d313033303735362d322d332c502d442d313033303735352d322d332c502d442d313033303735332d322d332c502d442d313033303735312d322d332c502d442d313033303734392d322d332c502d442d313033303734372d322d332c502d442d313033303734352d322d332c502d442d313033303734332d322d332c502d442d313033303734302d332d332c502d442d313033303733382d322d332c502d442d313033303733372d322d332c502d442d313033303733362d322d332c502d442d313033303733342d322d332c502d442d313033303733322d322d332c502d442d313033303733302d322d332c502d442d313033303732382d322d332c502d442d313033303732362d322d332c502d442d313033303732342d322d332c502d442d313033303732322d322d332c502d442d313033303731392d322d332c502d442d313033303731372d322d332c502d442d313033303731352d322d332c502d442d313033303731332d322d332c502d442d313033303731322d322d332c502d442d313033303731312d322d332c502d442d313033303730392d322d332c502d442d313033303730382d322d332c502d442d313033303730372d322d332c502d442d313033303730362d322d332c502d442d313033303730352d322d332c502d442d313033303730342d322d332c502d442d313033303730332d322d332c502d442d313033303730322d322d332c502d442d313033303730312d322d332c502d442d313033303639392d322d332c502d442d313033303639372d322d332c502d442d313033303639362d322d332c502d442d313033303639352d322d332c502d442d313033303639332d322d332c502d442d313033303639312d322d332c502d442d313033303639302d322d332c502d442d313033303638392d322d332c502d442d313033303638372d322d332c502d442d313033303638352d322d332c502d442d313033303638332d322d332c502d442d313033303638312d322d332c502d442d313033303637392d322d332c502d442d313033303637372d322d332c502d442d313033303637352d322d332c502d442d313033303637332d322d332c502d442d313033303637312d322d332c502d442d313033303636392d322d332c502d442d313033303636382d322d332c502d442d313033303636352d322d332c502d442d313033303636342d322d332c502d442d313033303636332d322d332c502d442d313033303636312d322d332c502d442d313033303635392d322d332c502d442d313033303635362d312d332c502d442d313033303630302d37302d31302c502d442d313033303531322d312d332c502d442d313032393238392d31342d342c502d442d313032393234332d312d332c502d442d313032393039372d322d332c502d442d313032393039362d322d332c502d442d313032393039332d322d332c502d442d313032393039322d322d332c502d442d313032393039312d322d332c502d442d313032393039302d322d332c502d442d313031383637382d3130312d382c502d582d313234373934382d312d372c3165346a6a3232333a3538383237352c502d582d313130383739302d322d332c502d582d313032303532392d312d332c502d522d313031363533392d382d352c502d522d38323437332d312d342c502d522d35363631382d312d332c69363261643334353a3434393335332c7065696e703639343a3234363834392c502d522d33333639362d312d352c502d582d313235343638362d312d332c502d582d313235323633332d312d332c502d582d313234353533372d312d332c502d582d313234323730302d312d332c502d582d313232353939312d322d332c502d582d313232353938362d312d332c502d582d313232303934322d312d392c502d522d313238383732362d382d312c502d522d313237373431392d382d342c502d522d313237373339392d382d372c502d522d313236323135342d31332d31352c502d522d313235323634362d31332d31322c502d522d313234353534332d31332d31352c502d522d313234323730382d31332d31352c502d522d313232373837302d31332d31352c502d522d313232353939372d31302d31322c502d522d313232353939332d31342d31362c502d522d313232313535382d382d31302c502d522d313135373734342d31332d31342c502d522d313135353439352d31342d31342c502d522d313135323738332d31332d31332c502d522d33393931322d312d322c37656630323637363a3539303434362c66383433373539323a3539353932302c386539306a3732333a3538383036382c31673864663130373a3538383130342c61373939333730353a3533323934302c31373039353138393a3533323933392c38306134693839363a3539313632392c502d582d313239333234302d312d332c502d522d313239333236392d352d362c37366132383533393a3630343735302c502d522d35303338302d31382d31382c502d582d3131353136362d312d332c70753436393a3433343439332c502d582d313039313739362d322d352c502d582d313235383132332d312d332c502d582d313137373839392d312d352c502d582d313039343437352d312d372c502d582d313037383931382d312d31312c502d522d313236343735392d342d362c502d522d313235383339342d31332d31302c502d522d313232353231382d342d352c502d522d313137383337302d31332d31372c502d522d36333333382d31382d31312c502d522d35383235312d31382d31322c502d522d33333733372d312d342c68636436663231373a3538303639342c33626434393133303a3539383539312c62316165353130393a3534333339352c32363838333239333a3432323534382c33666437623836363a3435383131342c502d582d313039313538392d312d352c502d582d3131363238362d312d332c502d582d3131363038352d312d332c502d582d3131363037382d312d352c502d582d3131363036352d312d332c502d582d37383534352d312d332c502d582d37343233342d312d31312c502d582d37333731382d312d332c502d452d32393636322d322d332c502d522d313233323739362d342d342c502d522d313232363735372d342d362c502d522d313135323737372d31342d31332c502d522d313134393034332d322d352c502d522d313134393034302d322d352c502d522d36313335382d31382d32322c502d522d313038393331382d322d362c502d522d313038353339382d322d372c502d522d313035353439352d322d392c502d522d313034393532362d322d382c502d522d313034393533352d322d382c502d522d313034393335322d322d382c502d522d32393330332d352d32302c502d522d33333932322d362d31392c502d522d32393330372d322d31352c502d522d35323138392d322d31352c502d522d32393033312d352d32302c502d522d33363331362d362d32302c502d522d32393139372d322d31382c502d522d33303239302d362d32332c502d522d32383938322d332d31382c502d522d36333934372d31382d322c502d522d36313336312d31382d32362c502d522d36313336302d31382d32312c502d522d35333235362d322d31312c502d522d34383633342d322d31352c502d522d34373234322d31382d31312c502d522d34353535302d4331372d34362c502d522d34323531322d312d332c502d522d34303532312d322d31332c502d522d33353430372d342d332c502d522d33333133342d322d31372c502d522d33303239322d342d372c502d522d32383634342d312d342c502d522d32343033372d312d372c502d522d32333434352d332d372c502d522d32333433342d332d372c502d522d32333430332d332d382c502d522d31383531332d312d33302c736d617274616e646c6f6f706c696e6b63616c6c6f7574656e61626c65643a3431383435302c73686772613439383a3232373730372c73686772613630313a3138343038302c73686772613335353a3230383034392c73686772613530323a3138393932342c73686175743539363a39323130372c73686772613734373a38363637372c73686963723331373a39343532312c502d582d313234353939352d312d332c502d582d313137373539312d312d392c502d582d313130373037302d322d332c502d582d313038363633332d312d372c502d582d313038333432372d322d352c502d522d313234373635342d31332d31362c502d522d313234313433342d382d342c502d522d313234313339362d382d342c502d522d313232333339382d31332d31362c502d522d313232303834342d382d342c502d522d36353031312d312d332c502d522d35303534312d322d372c67683031363434303a3535363735332c34646366663135333a3630313939382c66366562623730383a3433343833322c31306337373639343a3434353737352c6a683861623434373a3338303633332c502d582d37313536382d312d352c502d522d36393233322d33382d31322c502d522d32333638312d322d372c502d442d33323530322d322d332c502d442d33323530312d322d332c502d442d33323431352d322d332c7461656e613537363a39303236352c502d582d313233353934312d322d332c502d582d313232353331322d322d332c502d582d313136363939352d312d332c502d582d313132343831372d322d352c502d582d313134383036352d322d352c502d582d313131323735352d312d382c502d582d313032373136332d322d31312c502d582d313035393231322d322d332c502d582d3130393636322d312d31372c502d522d313237353835372d382d312c502d522d313233353934322d31342d31352c502d522d313232353332302d31342d31352c502d522d313136373830312d31332d31362c502d522d313135393432372d31342d392c502d522d313135393432352d31332d372c502d522d313134383531342d312d332c502d522d36343531332d31382d31312c502d522d35313931362d38342d33312c502d442d313136303234302d312d362c502d442d313136303134312d312d342c61366767653531373a3536393037352c646a6761623339303a3533353739332c34326961393532383a3530363737312c66643837343636303a3532343933322c68323363613736353a3533373333382c31343831363436383a3436323030332c6f74656c657564623a3332363832362c35343637393634363a3336333131312c74656172693335323a3233333737342c502d522d313239303739392d312d332c502d522d313238363634322d312d332c502d522d313238303138362d312d332c502d522d313236373038342d322d352c502d522d313236313931382d322d342c502d522d313235383738342d312d332c502d522d313134363334322d322d362c502d522d313134363334352d322d362c502d522d313134363333372d322d362c502d522d313134363334342d322d362c502d522d313134363334302d322d362c502d522d313134363333332d322d362c502d522d313235343031352d312d332c502d522d313233363935332d322d342c502d522d32373239392d342d31312c502d522d313135373537302d322d342c502d522d313131393031332d312d332c502d522d313039383739362d312d332c502d522d313039343434352d312d332c502d522d313035383634332d352d392c502d522d313037313736312d312d332c502d522d313036393736392d322d342c502d522d313036383131352d312d332c502d522d313032343037362d342d382c502d522d313032343037342d342d382c502d522d313034353131382d322d342c502d522d32353236392d31342d32312c502d522d313034343430382d312d332c502d522d313033373838372d312d332c502d522d313033373837392d312d332c502d522d313033363239332d312d332c502d522d313033363239322d312d332c502d522d313033363238392d322d342c502d522d313033363238382d312d332c502d522d313033363036382d322d342c502d522d313033353933332d322d342c502d522d313033353134392d322d342c502d522d313033333831372d312d332c502d522d313033333632342d322d342c502d522d313032383535302d322d342c502d522d313032383136382d312d332c502d522d313032373533352d332d352c502d522d313032343037312d322d342c502d522d313030363839362d312d332c502d522d313030363839342d312d332c502d522d313030363536322d322d342c502d522d313030303036312d322d342c502d522d3131313638322d312d332c502d522d3130353733312d33362d33382c502d522d3130343433352d31332d31352c502d522d3130303239342d312d332c502d522d39393633332d312d332c502d522d39383932392d322d342c502d522d39383932362d312d332c502d522d39383235302d312d332c502d522d39343535362d322d342c502d522d39343239392d312d332c502d522d39333037372d312d332c502d522d38383330392d322d342c502d522d38363131382d312d332c502d522d37383835322d332d352c502d522d37383131322d342d362c502d522d37363931382d322d342c502d522d37363732312d312d332c502d522d37363235332d312d332c502d522d37353434302d322d342c502d522d37353433362d312d332c502d522d37353433342d312d332c502d522d37353433332d312d332c502d522d37323434392d372d31302c502d522d36383036392d322d342c502d522d36363937352d312d332c502d522d36353536372d312d332c502d522d36303630322d332d352c502d522d35333330392d312d332c502d522d35323633332d312d332c502d522d35323137312d322d342c502d522d35313932312d382d31302c502d522d35313235382d382d31302c502d522d35303735322d322d342c502d522d35303638312d322d342c502d522d35303539392d342d362c502d522d35303539362d342d382c502d522d35303535332d312d332c502d522d34393539372d332d352c502d522d34393435382d322d342c502d522d34383533302d372d OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ETag = "std::wstring|\"Dd9l+AYHbJdUNbQuVH9cs/dvtmkFthU2MPmPFetq+hY=\"" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSessionUpgradeCandidate\officeclicktorun OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.17726&crev=3\Last = "0" OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\LastClean = a0a19a01bcdeda01 OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\VersionId = "uint16_t|0" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|4" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|19" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|3" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2" OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.2 = 392c502d522d34373934382d312d342c502d522d34363538302d332d352c502d522d34363438342d31302d31322c502d522d34363132322d312d332c502d522d34353835382d322d342c502d522d34333936362d322d342c502d522d34333530322d31392d32312c502d522d33383234382d31392d32332c502d522d34313433302d312d332c502d522d34303735312d382d31302c502d522d34303237332d342d362c502d522d33393233382d352d372c502d522d33383638322d332d352c502d522d33373538382d322d342c502d522d33343335352d382d31302c502d522d32363236362d342d392c502d522d32363833342d332d382c502d522d32343636322d31362d32322c502d522d32373437392d362d31312c502d522d32363035362d372d31352c502d522d32373030362d372d31322c502d522d33303333382d332d372c502d522d33303137382d37392d38312c502d522d33303035332d382d31302c502d522d32373435382d312d352c502d522d32353832322d31362d31392c502d522d32353038332d362d392c502d522d32343639302d34322d34362c502d522d32343638392d322d352c502d522d32343636362d322d352c502d522d32343636332d362d31312c502d522d32343635392d372d31302c502d522d32333734342d372d392c502d522d32333733392d372d392c502d522d32333733362d31342d31372c502d522d32333733342d372d392c502d522d32333733302d32312d32342c502d522d32333732332d31302d31322c502d442d33323538382d312d332c502d442d33323533342d312d332c502d442d33323532342d312d332c502d442d33323531382d312d332c502d442d33323531322d312d332c502d442d33323530392d312d332c502d442d33323438352d312d342c502d442d33323438342d312d342c502d442d33323430352d312d332c502d582d37313939392d332d31312c502d522d313037353139392d362d342c502d522d313031333933302d342d352c502d522d34373630312d31382d31332c502d522d33333931362d312d352c502d522d33333538302d382d392c75637368613636303a37363535382c502d582d313233363834392d312d332c502d582d313037343036392d312d352c502d582d313036343937332d312d352c502d582d313035373536362d322d332c502d582d313035313736332d322d372c502d582d3131373430302d312d332c502d582d3130353639372d312d392c502d582d39343937322d312d332c502d582d37313731322d312d352c502d522d313238313536382d322d332c502d522d313235373339342d342d342c502d522d313233373732342d31332d31332c502d522d313231393530362d342d342c502d522d313137333830392d342d352c502d522d313135373435312d342d342c502d522d313131353936352d342d342c502d522d313033353932312d342d342c502d522d35393432362d312d332c502d522d34363931332d31382d382c34643963693433343a3536363332342c39623136663631383a3435343031372c39356167673335373a3334323230302c36366a66383838343a3335383430342c6d65636f6e74726f6c5f7765616b7074725f696e746567726174696f6e5f656e61626c65643a3334303935362c75786d656469756d69636f6e6c756d696e616e63653a3335333435352c666c75656e746261636b7374616765726566726573683a3234363431322c7578656e613130313a3238383831382c636865636b6f75746465766963656f6e7061696e743a3132323131302c502d582d313035363034342d322d352c67383635343130393a3539353133312c502d522d31393236322d312d31322c502d582d313234323639392d322d352c502d582d313235393535382d322d352c502d582d313235383030362d322d332c502d582d313136333237342d312d352c502d582d313131373437362d342d31392c502d582d313231393638342d312d332c502d582d313133363731352d312d392c502d582d313139393837352d322d332c502d582d313137333337392d312d372c502d582d313137343434392d322d352c502d582d313135393235362d322d352c502d582d313135383531392d312d352c502d582d313131343730342d312d332c502d582d313038333937312d312d352c502d582d313034323237352d322d332c502d582d313033373139362d312d332c502d582d313030363435302d312d352c502d582d37373138342d312d332c502d522d313239313732312d382d322c502d522d313235393839362d31342d31342c502d522d313235383034332d31342d31332c502d522d313234343735302d362d372c502d522d313234343137302d31342d31342c502d522d313231393638392d31332d31342c502d522d313230303337372d31342d31362c502d522d313230303132392d392d392c502d522d313139333632392d31342d31382c502d522d313137343934372d31332d31332c502d522d313137333435302d31332d31342c502d522d313136363237372d31372d31382c502d522d313135393235382d31342d31362c502d522d313135383536362d31332d31372c502d522d313134393333352d382d382c66363368643539333a3630313035312c6d6d5f32736576315f6f6e3a3537303037382c67623439343635383a3539393433322c33356137343232353a3630313031372c38636564643535393a3538393832332c366369396a3633383a3536323539302c34336131653939393a3530373734332c7573656e657768776e6461707066726f6d70697462733274663a3535353934382c37383434303631303a3532393232312c38683535313432373a3536323635372c38656633333639323a3536323139372c36663961393939393a3537333235352c37626966633731333a3439363835302c6c6f6f707374796c6573636f6e746578746d656e75656e61626c65643a3431383434372c67316836623639323a3333343638322c34663366623834333a3239313233392c776f77696e3839353a3335373435332c776f636f6c3933363a38303033312c7573656e657768776e6461707066726f6d70697462733274663a3535353934382c502d522d313132383633302d312d372c502d522d313039383431322d312d352c502d522d313039313236372d312d35312c502d522d38313732302d312d322c502d522d35383430362d312d352c502d442d35303639372d322d342c502d442d32393731392d312d312c502d442d32393731382d312d312c502d442d32393539332d312d36222c2022434322203a20227374643a3a77737472696e677c4742222c2022446566436f6e667322203a20227374643a3a77737472696e677c6f6673683663326231746c61316133312c6f666372756934797664756c626633312c6f6668706578336a7a6e65706f6f3331222c202245787054696d6522203a2022696e7436345f747c31373231393733343032222c20224554616722203a20227374643a3a77737472696e677c5c224464396c2b415948624a64554e62517556483963732f6476746d6b46746855324d506d50466574712b68593d5c22222c202246434d617022203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e4368616e6765476174655f446f6e74547275737456424156617269616e74446f75626c6556616c7565222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e4368616e6765476174655f446f6e74547275737456424156617269616e74446f75626c6556616c75654e6577222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e4368616e6765476174655f4e6577556e69636f6465496e556e697175654964656e746966696572436f6c756d6e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e4368616e6765476174655f556e69636f6465496e556e697175654964656e746966696572436f6c756d6e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e4368616e6765476174655f5573654265747465724964656e697469747952657472656976616c4d6574686f64222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e43757272656e6379446563696d616c506c61636573466978222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e446f6e744e617669676174655769746848696464656e53657474696e6773222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e446f6e745265696e697469616c697a654d736f34222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e456e61626c654a65744765745072696d6172794b6579496e416365222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e556e69636f6465496e5072696d6172794b6579222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e44756d6d79443244446576696365436f6e74657874466c75736843616c6c4f6e44656d616e6432222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e50657266496d70726f76656d656e74496e44657175657565222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e53656e64557064617465734e65656465644f6e46756c6c5654496e76616c69646174696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e53656e6457696e436f6d70456e61626c656444617461222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e536574466c697054657874757265557064617465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e53796e6368726f6e6f757353686f7757696e646f77496e4d6f7265436173657332222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e5573654944697265637433644465766963654163636573735633222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e557365554145437261736854656c656d65747279466f72426c6f636b6c697374696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4170706c652e5469636b6574436163686544697361626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175674c6f6f702e576f726b666c6f7744697361626c65642e5265706c6163654f626a656374576f726b666c6f77222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4358452e426f6f7449646c655468726f74746c6572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4358452e48696464656e466f6e74734d736f466f6e745069636b657257696e3332222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4358452e4d736f2e52656163742e4f6666696365486f73742e4973436f6e6669677572655344584261736550617468456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e43686172742e446174616c6162656c4e657750726f7045646765416e63686f72222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e43686172742e50726573656e746174696f6e4c696e65456e64696e67466978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e417070564d61785265747279436f756e74222c20225622203a2022696e7436345f747c313422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e417070564d6178526574727954696d654c696d6974222c20225622203a2022696e7436345f747c363030303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e417070565265747279496e74657276616c222c20225622203a2022696e7436345f747c3230303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e43444e436f6e66696753657276696365507265666978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e4368616e6765476174652e5265736574436f6e74726f6c436f6e7461696e6572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e4368616e6765476174652e557365456e756d57696e646f7773546f4761746865725665746f73222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e436c69656e7444656c74615061636b61676573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e446f72694f6e496e7374616c6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e446f72695761746368657243616c6c496e74657276616c222c20225622203a2022696e7436345f747c393030303030303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e446f7269576174636865725175657565496e74657276616c222c20225622203a2022696e7436345f747c36303438303030303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e446f776e6c6f6164436c69656e74576974684d534958222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e49676e6f72655665746f4966557064617465446561646c696e654c657373323468222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e50726f63657373546f46696c746572416e645465726d696e617465222c20225622203a20227374643a3a77737472696e677c6d736f61646673622e6578652c6d736f6173622e65786522207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5265706f4d616e506970656c696e65456c69676962696c697479222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5265706f6d616e466c69676874446f776e6c6f6164436f7272757074696f6e436865636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5265706f6d616e466c6967687453657454727573744c6576656c4f6e46696c6532222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5265706f6d616e466c6967687455736553696d706c654c6f67676572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5265706f6d616e496e7374616c6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e52756e446f726957617463686572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e55736541707056457870436162222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5573654261636b75704465706c6f796d656e744f7074696f6e57697468496e73706563746f72546f6f6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e55736542696e674164646f6e4f6e496e7374616c6c222c20225622203a20227374643a3a77737472696e677c656e61626c656422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e55736542696e674164646f6e4f6e557064617465222c20225622203a20227374643a3a77737472696e677c656e61626c656422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e55736546696c65426173656453747265616d696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5573655465616d734164646f6e222c20225622203a20227374643a3a77737472696e677c656e61626c656422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5573655465616d734f6e557064617465427573696e657373222c20225622203a20227374643a3a77737472696e677c656e61626c656422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5573655465616d734f6e55706461746550726f506c7573222c20225622203a20227374643a3a77737472696e677c656e61626c656422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e436f686572656e6365457870657269656e6365456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\ApplicationFlags = "1" OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeBackupPrivilege 4136 OfficeClickToRun.exe Token: SeRestorePrivilege 4136 OfficeClickToRun.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2076 OfficeClickToRun.exe 2076 OfficeClickToRun.exe 2076 OfficeClickToRun.exe 4400 OfficeC2RClient.exe 2076 OfficeClickToRun.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2076 OfficeClickToRun.exe 2076 OfficeClickToRun.exe 2076 OfficeClickToRun.exe 2076 OfficeClickToRun.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3988 e7f791aa2520164a47e3508799731630N.exe 4336 OfficeClickToRun.exe 4136 OfficeClickToRun.exe 2076 OfficeClickToRun.exe 4400 OfficeC2RClient.exe 4400 OfficeC2RClient.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3988 wrote to memory of 4336 3988 e7f791aa2520164a47e3508799731630N.exe 94 PID 3988 wrote to memory of 4336 3988 e7f791aa2520164a47e3508799731630N.exe 94 PID 3988 wrote to memory of 2076 3988 e7f791aa2520164a47e3508799731630N.exe 99 PID 3988 wrote to memory of 2076 3988 e7f791aa2520164a47e3508799731630N.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7f791aa2520164a47e3508799731630N.exe"C:\Users\Admin\AppData\Local\Temp\e7f791aa2520164a47e3508799731630N.exe"1⤵
- Checks computer location settings
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeOfficeClickToRun.exe platform=x64 culture=en-us productstoadd=ProPlus2021Retail.16_en-us_x-none cdnbaseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl=http://officecdn.microsoft.com/sg/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version=16.0.17726.20160 mediatype=CDN sourcetype=CDN ProPlus2021Retail.excludedapps=groove updatesenabled=False bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown uninstallcentennial=True scenario=CLIENTUPDATE2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4336
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeOfficeClickToRun.exe platform=x64 culture=en-us productstoadd=ProPlus2021Retail.16_en-us_x-none cdnbaseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl.16=http://officecdn.microsoft.com/sg/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version.16=16.0.17726.20160 mediatype.16=CDN sourcetype.16=CDN ProPlus2021Retail.excludedapps.16=groove updatesenabled.16=False bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown uninstallcentennial=True2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2076
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4136
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /progressandlaunch AppTargets="root\office16\excel.exe|root\office16\msaccess.exe|root\office16\mspub.exe|root\office16\onenote.exe|root\office16\outlook.exe|root\office16\powerpnt.exe|root\office16\teams.exe|root\office16\winword.exe" ManualUpgrade=False ScenarioToTrack="Scenario:{477E0208-58BD-4F33-978A-09BCC9AA9EB1}@INSTALL"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5c9f1a48e9594a1e00a754d0bf50fa6cd
SHA1c07ac2f5d10c007e33a76261dd4b9f5a7ca9a67e
SHA256b9ce70c3b1a73efe80753a05d93d1f84d43456095e1f72358a7cc5c48444d0b3
SHA5123a1edfdce7884558a9ad728e897ef0b3268c18f68b79441fe6eaa4505cbb9ba757b9907ece46781d09e57e32c949e64c973e4ac848bfe9b88c53777e0c05bbff
-
Filesize
569KB
MD515f5792844af082587747a09f1123a0d
SHA1558999ff58818971f96dfff4f433afa596794ba7
SHA256e5188cf139c4af572588fe794b7392479a0bf59aef86666a0a22db121e41da9d
SHA5127de7f740bab5dcafb9f502853963547c7e50993404535dbcd39b88a586a2bf31b50f1eebe4682ee5fa458a00948af44dc104daa0b595c2c02d6901a81beab24f
-
Filesize
829KB
MD5ddc59d3df358f9372708531b977848c3
SHA1e1a0f9b58dc5579bbd5845bb6d3a7da3b5d8b7da
SHA256fedc8cf10ab72e7a0ec3a493356157028fe16d2ae97f73dead28fffde1b7c935
SHA5124b75fe159eeadd71fea2e3b569796ce547808bff5c183d271e3d2aed7ef11311121f7ec768bcbc1c0354b771f971aa2b46836a8a6c2b0c1d2f8b21922943dbd3
-
Filesize
2.9MB
MD5ba9d243da5b67da35b317511cd2021df
SHA106f15dbd12b86cd5cca4ab7d03ca4de83f50b59b
SHA256640e2b924e0daa8d9e4e0d4f533a2f8e1a062052cc25f42d26017de753ebca98
SHA512bcfd1bdc72458989b166a6ff068fce083213c9811650e8a5bdc306329c54473c34cfe86fe626c0789b5d04bb2b4b044356a002d2115e3d168bb7b7c30321c81d
-
Filesize
5.1MB
MD5c5b9b8cc8b4e0d5c17ed1b94630b619b
SHA1e3fcc1b344a3a059ee192250be3825b2a316f368
SHA256a61b0d18f14f483aacc56602e1c46a106f50dd2a711fb9835df8eb2c8db4e3c9
SHA512be3bc29c450477a77db157baa40f0e3be0b4fd250ca39e6659059cfd0819ea149568367a5ec60df6ace6ae581a9dc452459ef9aaf927a1f93018440c9e673995
-
Filesize
559KB
MD5c3d497b0afef4bd7e09c7559e1c75b05
SHA1295998a6455cc230da9517408f59569ea4ed7b02
SHA2561e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98
SHA512d5c62fdac7c5ee6b2f84b9bc446d5b10ad1a019e29c653cfdea4d13d01072fdf8da6005ad4817044a86bc664d1644b98a86f31c151a3418be53eb47c1cfae386
-
Filesize
1.3MB
MD575e832bb1529d87a88ef49034e381930
SHA19b8a52c3c9b3a88c3bdd3b5f5aeb0aecc3df67e8
SHA2564a7ac11ff22d5d842c47be8df6ca98f99c7d48e7ab2f638ccd01eae253e424b0
SHA5126e285a0484d57f6de0ca78a24fb46d9626741d764356d12e2ea6fab32e00a3f285ea0722b89b5a63c11179a5d1ed2a065f97b9399f63f67981fad01967ae654e
-
Filesize
5.9MB
MD5abdc9c4939e0fdde36e81beebcd4015b
SHA14f4875d54e642b88fdfac90a3da519aa75c0ce5e
SHA2565623e0603a7eefb88d323575e29f61996db41841799d6c2c2356acfe5d417cc5
SHA512278e6d6e1e342d2e460298a21b46ac6510f5cda894d4a6c235da7b571dfcf1e2b38ac47a70706cf32ef286917451120720107d120f42d387fbf8bc7c6c83498c
-
Filesize
534KB
MD58d5c8276e4db061fb35089e2c2649307
SHA1e056c9199df7ce4e06d592c2309afdb02283b4e0
SHA25672d17fc98e64b955991390977b2300b3e522fbfac0d4073da81b4feec3bcfd49
SHA5120b77bdf8b296bde5961cc69a59d3bac0c3a937f5be0f641b79a779d20c350280b60932b5377d7f67aef98016a97225d68c7b168c202d3d6d982b82ad51048dbc
-
Filesize
597KB
MD5647a0967315ed80dd590fe111f38bed7
SHA1f311845d591fcab6c9b086f519e6f83b52ba960d
SHA25695a069ff97824a004d4fada58a23c78b775db72de5570a05977355149df67cb6
SHA5120178a3f488e6972ca87a56fcb4bad16679df88149ae265e29c8a2aac3bea75de1cce5e82575de0eef4303bfdbab2593d96e5074f10a7561c83cde22972590d7e
-
Filesize
297KB
MD594d6fb63e0fcc7db6ce26674e61a06f6
SHA134d019f759db4649d89f584437804597b5d02395
SHA25653090adc6e512a6cc52fdd7640736b9352537e757520db7b808857f179bfb3a3
SHA51283a4a927a10fa5210f54908c43c6d68a09ef1aae0aaac40538b4f9252bc01f7b2e3f3e56fe2ee89f0f739918f2559e6af63f58af914f68ba97927245324d7843
-
Filesize
1.6MB
MD5df8403e03a06679d9077a4161849671e
SHA16635f842092ba46af0520ce0fdb978c6b12a7be7
SHA25649738cd60073b83e07957faaf57ac2fee48fb44eb9a69d9a96591b9fb045d06c
SHA512433a869ba671361f7a72601cf9f47dd560aff5abdb69557ae8cf9d7572646a762e711e7f3dba32f5c04b2e8865c8bc29227cd5197a7cb0762131e8baf4ec8b18
-
Filesize
405KB
MD569d9cc8fcfb951ec44c7d9f26bcb3499
SHA1243b233b74a96d2676a0a2c3dec02904944c97cb
SHA2560167466a80c29b10f0cfda34c745930d96a1117d6a9b7838efd6ae77156df495
SHA51218c588224cd6e5a3b82d27c98f6f92bcf6efb111b11f0c6695ecd9ea1b0dfebf1e5575a4d0fa1e193890a3d7409a041fa5f1322262da095a9f16e5b284a48eab
-
Filesize
189KB
MD55cb3f3f7d8d9afe46bf220b1076f7272
SHA1f6ba4dd48e9deddf6094c9f5fb1bcf761e9e31d7
SHA25697119e4ac0b990aabdcb218dce06c2752bf4e37ad7139390cbfd466b1b67889c
SHA51242f8813eb73e1757e200d18e5ae7ee381000466cb9eee11d11993b81ff9b2364995dc293e3109f7e1cb35a2081b0ccc46942afcd03ba24cccbdac61313187f1f
-
Filesize
985KB
MD5b992640abf4ea6cdac53d8b38076f845
SHA1ed480fe74fb663e0192098c99a822022b380481c
SHA256f945dddd970b1bd95c6f713f3a1797a2f0772bbaaee0803f43e39fd748d4502a
SHA512a3b1beef8df9a0f14eda0cd6d01895bd17c346fd930284806cea6657b3c73df8899c699484742a45753dc0cd85b4b92e7e5b6d31b4f94ccc9865959f28fbc0d9
-
Filesize
1.0MB
MD520ae1459b18c035d187ebd44d6fe23c2
SHA19fd7012e099ab2c8a39341e7260f050e6c997a6d
SHA256f694caa849ce8b91e5ff374af38c8fc13af15b477b6f3401a13056da11d6f818
SHA512978ab47b667ca96cb16c02a19692433d1dd46f1209a4fc17e6ebab026b3a665b98298ef1df877faf77d3fd460f052da80c2e6d1ed40cbcb2da97bb648700e585
-
Filesize
50KB
MD5331f05e490914da44395950a1a57755e
SHA1c1961dc9fa4b58393187d32afd4bb6a44828de03
SHA2562072908383ee3b1bc47041600a40ccf92a64ec3046808cd62c61cb408da98e07
SHA5122edd9e0fac061934dcde4b15b39a016bd0b70346b2e830bb06067383252fe349e54f3101cfa26e3498cd0714c541deff9047ca7e7f77f6b575af9a0359334330
-
Filesize
27.2MB
MD5f018259a31f5934aa5df07fb7b0c77ad
SHA1ce9f2addeae01d7806cf0e20b34a4ac01cd27417
SHA2568ecf423a113ad277ea7f4143ed3c57dde66bcfb749c218f434bf3f5a8bbc4208
SHA512f754b4283bbafdd009dbca60e457436bd68867104f68d64d72f8c73411a59a3278f2edcc2a48cc710073eab790eaa1f7d247115dfcfe31761c2da998f8f55770
-
Filesize
13.4MB
MD5437cdf5f592b1bca2ac1e959f82459f3
SHA11e33f01ac13b18f50c1daf08fc691ae5269b7a02
SHA25615f2054066aa9184211eb195f5584fab18cb56fcf93c63834f0a11690c2dae5a
SHA512965bf75507d0af853971299f05551fb6315637e83901ef29c5de0876cb979b6f5605f18d43a903c474fbf2b87cc12031209da1e4ef99053378f4348d1c17a92e
-
Filesize
106B
MD5071b2f8dfe470f21451f7071576b2756
SHA1d95e8d8d6b8e1fc76bdec1da38225968b75f8765
SHA25607c94bcc90c63bdbf16278bd907808ea528b1bbec3249436e4ceecd0886df525
SHA512907207f20b4cfce115666c09b43e39263e901b64d8ff724877b1565db3d875900043465fcb39c981eef7e44563c8fee9d1f25a02496cea78c284051bcb13f504
-
Filesize
31KB
MD51924c9711bc1a8887a731db187531cff
SHA1236830472e273c94271413e017d03f70e77a480e
SHA25687b1c8de6a7843ffd91180da64c47988a170c151ab1d27d0629a5ee3e2bcb615
SHA512da8f9347b0ab9148f6fbacfce314a4144ce190a6f4e9e5e02f4acafff506a5293aed6e7988f526fcc46a80c4448f3ad4672329d7daee025114724aa8a81028cd
-
Filesize
2.0MB
MD58f1e4c70cddbd465286c730667b7553a
SHA154220d75d68c440d37b73d3acac4b0bffef452f2
SHA2563ddfe72d642e7ec6818b03722de6f83911431d82dc4decfb0828d680b6a60e94
SHA5126fc2eee764edbf306a10dd85cb488ce126fc975326c34e84b567c7b41fe83c1f7804402a482c0ac863feb1a0a1775b1bd993af974747676924a961254d2bec98
-
Filesize
116KB
MD5e9b690fbe5c4b96871214379659dd928
SHA1c199a4beac341abc218257080b741ada0fadecaf
SHA256a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8
SHA51200cf9b22af6ebbc20d1b9c22fc4261394b7d98ccad4823abc5ca6fdac537b43a00db5b3829c304a85738be5107927c0761c8276d6cb7f80e90f0a2c991dbcd8c
-
Filesize
48KB
MD5eb49c1d33b41eb49dfed58aafa9b9a8f
SHA161786eb9f3f996d85a5f5eea4c555093dd0daab6
SHA2566d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
SHA512d15905a3d7203b00181609f47ce6e4b9591a629f2bf26ff33bf964f320371e06d535912fda13987610b76a85c65c659adac62f6b3176dbca91a01374178cd5c6
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\2A414B24-A95D-4764-869F-3EF6CE5B978A\en-us.16\MasterDescriptor.en-us.xml.bak
Filesize40KB
MD52a144662586471fc581a5f84096a1a3c
SHA1e18cda8ffb33fd0d0b53ee960dfb684225d5eb5d
SHA25621b0f60ac94a944504f7e64440cc1d665e4e7b3b3d7eb0ca72101698ff80fa0b
SHA5123e26dc06fc1b7fa2bd54def6d5b72e88cde968014ed604c452d898894fd7c11841d07d387f416f8eb4c018e39c7e00868428dae2628b02fd4757d62d64505438
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\2A414B24-A95D-4764-869F-3EF6CE5B978A\en-us.16\stream.x64.en-us.dat.cat
Filesize78KB
MD565a2c6428363ba90c0505f9b55211e62
SHA1762433f1c0326e84e0e7886447611e3f8f90d982
SHA2563b6b7b79695dac02f07628c6422ef866cf1702ad3ad667fb7808d1eb6c0ed656
SHA512af44edda5d68dd202ec6aca9ec951c9fb99c5f29add82647b546e9371815933e72e02037af4603e23afb4446dc28423f13d335169022e4a6259fd6a622d33f59
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\2A414B24-A95D-4764-869F-3EF6CE5B978A\sd640.delta02.cab_extractOfficeC2RF978046C-108F-4C3E-B0F4-91B388D1E018\MasterDescriptor.x-none.xml
Filesize35KB
MD53d27a8f1ad6bda04d754ee7d86b70b45
SHA1d8c2e0f9cab99f63a647dc2635757a94c2ac49a7
SHA256a093494eae0e7211d17f7d50b3523e63f85be1b2c89d5e6c59456c3c0287ad2b
SHA5120f9b5edf7a34ba20bae2811398caefe1858dc1ae3b2727e3be088fa523a87242d98f7cd0e21a28d403593698aa55f01c8c0c54625e4d23769b362d35cd942d78
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\2A414B24-A95D-4764-869F-3EF6CE5B978A\sd640.delta03.cab_extractOfficeC2RB35CA441-EB22-44C9-A961-729B822637F6\stream.x64.x-none.delta03.hash
Filesize128B
MD576267ddf54a8d8ddad6700fc852553cb
SHA18adba88cb633dc804a3be781166b41f4b9b6c6d6
SHA256f7d85ce280305c5aae51a61b7c48c393b1599ff6291eaa5ffa1fca8839a97e69
SHA512d2d407d5dca8266574737ac001c074d9bc3de02a8bd45854610b5da4bbdeb8adef9de25ff4612b0b9b47bf64416677a409c69ba12910917f7d3e3d6c0c321a52
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\2A414B24-A95D-4764-869F-3EF6CE5B978A\sd640.delta03.cab_extractOfficeC2RB35CA441-EB22-44C9-A961-729B822637F6\stream.x64.x-none.delta03.man.dat
Filesize23KB
MD545c01cdced3d5583608814e80a9a6e01
SHA1f8c7ce7788ce0326241184ebedb82a5d044480ff
SHA256d1bdeb6b247ab74b4a09855f3ce65387d43f7926cfb68421419961f42f529109
SHA512f290a2c5089b9ea2f332b0fa02609e22dc1a4c5f3d0e2895d92f75b93c9ec267677a63c8b78636454c8aeab781f7174a32c0db7f40355215ecc2c57a2286663b
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\2A414B24-A95D-4764-869F-3EF6CE5B978A\sd641033.delta03.cab_extractOfficeC2R38C5CE40-C032-4837-8599-FD296DAD4472\stream.x64.en-us.delta03.hash
Filesize128B
MD56c27fd45d64b8f1a6758bc6bcf857262
SHA130d8ceb08a0854927b6cc0e884e0903356d0b742
SHA25627cec0143ae90c960a795b228b8dbf9feae905df4296efcf361f9d20565db87f
SHA512683f36347e6abea29d06b06f1019a9b31ecd05b9fa4bc530e639851e3e07b99a3282619e769843a5eb8fc2eed13e72b3b51d1f95e948af9ad48f9910e2012d74
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\2A414B24-A95D-4764-869F-3EF6CE5B978A\sd641033.delta03.cab_extractOfficeC2R38C5CE40-C032-4837-8599-FD296DAD4472\stream.x64.en-us.delta03.man.dat
Filesize15KB
MD5d5e23963b95edf0606417adf11b76d4e
SHA114400db5d7d0bb1c2e566b3f900287d7f1b66aa5
SHA2563900ee2297711e4bfe6e3e9589b803e55f8263800d4563df0b8a979e540f2225
SHA512dfae96aa225d0766b38aea0499516d8e8dceaca219a66e038429f7372b58af9cffc5d83096e6286e962637b92b2bbc90c3688344894cefc2889cb3fd350b3a92
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\2A414B24-A95D-4764-869F-3EF6CE5B978A\x-none.16\MasterDescriptor.x-none.xml.bak
Filesize40KB
MD55c1576fdf142473b5b091fb9f1affe07
SHA1affa0ff74c907fe5055fd93080d6f12f7b46d301
SHA2567767f57d6a82cae5a2bbb04234c5bfb9565391d5bec875992ec2d9351e575d5c
SHA51292f129ba776b3f4b84912a0a2a86f3a079bd4c624c807f57a764a61208a9eb83eb43682ee1c02536f194a8d2d7250d59ed33413576c9c6429303aed3c7ebc744
-
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\2A414B24-A95D-4764-869F-3EF6CE5B978A\x-none.16\stream.x64.x-none.dat.cat
Filesize683KB
MD56055e9d3d6c4560633e1e831c6804310
SHA1752e6d4a9aa47454e28cfaadd0ecf61c55fa5fd1
SHA256fff10e2abb4ceea5e3dec20486960b9f5f6116746084e99b12e50fa925636eda
SHA512cf94fcb466778725db090761273ce56505d25db17e07517aa16cf3d070d7b993af544a066f637196b57ac457878394169ea36564a84db1efa6bb780ec5f11b66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Filesize471B
MD541fb85998718a60639a4846feca331c7
SHA1c8285ee1823f298765c00efa1a7036a23e03789a
SHA256309bdd62e6ac4b286b0d77f8ae76815b1ae5cc262af5f44d52869839da093ce6
SHA51278331eef9b51b754599eb4de2693de11c84dadbb06394670e359de562e490c484c7b5a218d0357d9cdca99b35ad2d44063b97eeef7ec55759cbbde765c36e23d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Filesize412B
MD59d78ffc974e30d743f4a0c286d866ccd
SHA1c60216de64bfe2918937de0f54ea82098a7cf8ca
SHA256615c2aa0a27c694e7c898df387d80cebdf004fe8bbabe89efb7d7bc9a971cb2d
SHA51236c8582733851820eb9d0cd75e26cac3543efc8015c5eccc901beae4bb4eb07593fad2179113a4165beb4fb0ee7c9f828e9637077206f81cce32cef666de5e88
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\5FC748B3-49BC-4260-A868-24641CFACD71
Filesize171KB
MD51eb5d9dd2a57a7ec4c6d1e243d5a1ce8
SHA1780cad83cdbd415a033cb9878aa3b0fa8d253eff
SHA2567ff82b74c6a09df6be9084555110c00287e1e4e6704f5d570870e820a93da3d8
SHA512f8b59f87c3ad510de4c9a440b20f98e17ef05b44f6daa71361e5cf30e19a6b2eeb356835336554dbe25a2f27d241950e2074389752dd9af0049d6d2e3409c959
-
Filesize
24KB
MD58665de22b67e46648a5a147c1ed296ca
SHA1b289a96fee9fa77dd8e045ae8fd161debd376f48
SHA256b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f
SHA512bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da
-
Filesize
32.3MB
MD584d1b64511188b266e3a8aebc69dde75
SHA144787620932575308ec8991e5e9b762a7ce06f19
SHA256baae716ce703b20662507713dbe5f1d05af2b44c0ccd9162216d7791047ed474
SHA512ac9e87e4e94de628063ce126522c34a22c75b03c2c8c9cbd63b7614559021ca3a2cfff0f5622ddfa7d24be49b86775b1e4ba8d3097443a4f6ef0b3824a7822c9
-
C:\Users\Admin\AppData\Local\Temp\OfficeC2RBA3E3B4F-25B7-44A4-AFFA-C3DA0790A12B\VersionDescriptor.xml
Filesize25KB
MD5532092e95cf9946d2ef9a60f2e01df36
SHA192a0b2394d926cdc0dd446ccb0b6c0e43ddc28fb
SHA256dbd71e9d7ccca9b2e182e9ac45f358c0607b17fe944058e3d59d6fe13ad3740d
SHA51205ce43cf816f9b65382ede35a064df6f6f0c75833c6dbf5b65221d70f76429d62b3549b5bfff286396c1f8eb6fd641437a852afbc23bfe15ac01e3bb2d04fc76
-
Filesize
9KB
MD541c0c88add6348781779814ae3e68b12
SHA10cd6226359adacc63c7887a364b6f7e66f2451c9
SHA2567d9230662b5653eef63e2eafa9081487c16a025798bdd640a3efbbd022b46d85
SHA5123f0687328659504bfa52d97635773d74548b0b6f9226cdf1d61eb3d84c2d8e367c9817fa82a66014651fa76b7c99af663f3c065edabfd4acc1f0626a6cccb6fe
-
Filesize
9KB
MD508535cbac6b8c801534a93c109db31aa
SHA14b069c6593a44d975a1d4a2643e77ba8cd9a7a28
SHA256d500350a6ee6851670e45e4972485e9e8e71e7f7cecec7606bd32188b50c2dcf
SHA512e5b72721c0a5451d70784b38024804657f2c2903e062521f7576acf97a074de312ffe97db49b814e68e74912fe3ea6e0c97b73ab700e3f9fb841e575db7becb6
-
Filesize
3.2MB
MD5c2ab75844cc671476dac5cdeccbec234
SHA1f398f1d5642b84f46497daa4731c9707e432750a
SHA256bc7cba2ac3bfef2ec895c1ede92dc6592fe47e566c0522b198190580132ec5d6
SHA51255c543f5f084977e3d468c3781e880a2edca367ff877b22341c3fd3456042d1992bfc1a2af0cdf5a94768ff8ee745d191217b6e8822ecdc444df7ed8a7bc7294
-
Filesize
516KB
MD5dfffa57ab517121f5ff28f484236d804
SHA1f4b62d0d0fa34f1bf27198a9afb0b75b078662a9
SHA256d401ea10d37ca65a35ff7169b4c2d7318f5b6265968d08c008f7e6e5eea48038
SHA5128b129efbc7040eb473c2c2468f2b5c44b74b00b9f286bf4f303c8dc6bcd0550a909b95c481dd26bb60c66f0133d872dcaf9405a6b3dea41ab67c3adb35d66d65
-
Filesize
2.8MB
MD5a93baaa64020933801d4e394e4778cc6
SHA19585f3350eae17011ac32ab8e839714ac48e4bbc
SHA256941fd0f84a7ad25e93617c59df9a3145769ca5112bbc7fa16a1d058894f71752
SHA5126b12925dd274c6b32eb7330654692a8413bc7f11c6ab376314b9b8381970c8ca0f1dd88e1d2d61749ea66a2b8d218ab105f53411b9eb74b7e7edcd764408370d
-
Filesize
34KB
MD53e0c8e16a17e52c9e581b3defac55150
SHA1674602419c664eb6c6803d2aad91b6383fce583d
SHA256520920186a2608df1011627f0e2b81f5b0a47fb6b5ced624774bb762f930daeb
SHA512d08d4ff8cd6a0ade114678f6e441e8d3b2ebd12ef245f883bfdc57de0ea5aa120e716eadfe801fd497446490a4f14e1024865e13877e870adbfe9d334be88109
-
Filesize
34KB
MD5c8c99346b9de042e2061b837e8674766
SHA19ffcce1583f891d53516b11002ce65bcf1aa4d2c
SHA256bf0d54a199164d1d4835f8cc513daa406994f90178532d6c8735b6d5124d2418
SHA51227792313c9a682c63289ef5364597d034344d673c4a09c01d27720e1aa9810b31a34ab85ceb0754b2b0cd7352c58553fdfaeb361b3c2ffeb2729991979ea0e9e
-
Filesize
34KB
MD56030e9b0228e1723796b8bd64c7ef7d2
SHA1c51a74ecb6df4df680a8b60262a02365c075d20e
SHA256b761d2fdb2c582fec1e192a4b964562fd1b921ef64d1b3a424a368fb0692e86f
SHA512d9eb882fd97cf897f10d886876284fba8b69394e436d1d357237c986be1ccf57e07370d32bb2f9759125335e19909f83b73a2a6ab39daac200bdac31150b21d9
-
Filesize
288KB
MD5386bc8cc14c6d9aeaddfb7ff57e1d941
SHA1e5ba97bfc6df8f99aee6fb336104342db40402f7
SHA256fe6b0d907519b2da0af972cc27f4115b0d38ce11f9897121fecd79b92607d0d9
SHA51269ce14d3a0ee75a85b7634fab8b0e4e55db9b5bef07846e53cd1343344ee971223ab0e14640e04a9e5b2cde520e02e822223ffe11a17301b67d1c2b022aa0a77
-
Filesize
30KB
MD555d76d53965544d439598fdad7f6b904
SHA1a4ac54e882682552be3db3b11f8c89eaa0fc48c3
SHA256c7da09d43eaa5b0f322f09e6573a0ca79ca6d394d9e928844e3bc15d55a42119
SHA512a8075474cc4dcb75fab2e886757fffc77f1b91662d434c21cf2630b2496851bf49ba4991fd8fd079d01223960a6dba243b5c6de6dfde5768234f375128e4ddbf
-
Filesize
30KB
MD5fca6028e04742cbd4e36bf6ecfb72584
SHA192345e46ed71b6ab116be493ecdc00a4cafbcd72
SHA256fad408e0259b45a5fcdf17396f45ab6d92885ebe0246a18bc89574b52e9fd3c0
SHA512dc841e0857c661468e70522497820c6c160bc6ab0090403abd60e5d0a0faee89a6ae40c74e1ef5eb9e0fe91b65003865fd628a06be37cf5e520285176fe1b23b
-
Filesize
30KB
MD558d3194d2238b2551daccff3d503b914
SHA14a7a72fef4d98bd6016a362c0a1586b334095839
SHA25607147b651098627b5dc7f09d0917755cae46a88f54f9b1e1d646d42caa55f8ed
SHA51288eba1789f48021e145e82f416014a356c82dfca493fe60d1331491d6cfbd29088ed82315c9fe426f15557cd87e2415b9788a091650b4d4c1bc666f07e7a2816