Analysis
- user interaction
yes - max time kernel
330s - max time network
325s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-es - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows - submitted
27/06/2026, 01:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OfficeSetup.exe
Resource
win10v2004-20260513-es
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
OfficeSetup.exe
Resource
win11ltsc2024-20260618-es
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target OfficeSetup.exe
- Size 7.1MB
- Sample260627-bl45gaf15x
- SHA256 b46aafaed40b976eed3428dc55fa7087e543cb58a4936730e24cdc24e77f88cf
- MD5 7545a11716749bcc50ee9c61a1590ed4
- SHA1 fbc99490b51e093b5801640978f056ebdb58d56b
- SHA512 ac57bc2a23fc6ee560138f82d3fe31e037911a215477c6996724d9c8035525a740f7b1cdb7d0e2c78871a0edec69d5e8f587061e8a78003253f9e8ff8150c679
- SSDEEP 196608:M/GX9kP7fBQ8lmr8jeRX7f6FIxxJzrdkeW1qJG6wBCLs9TSQJ:vNkP7fBQ8l68KheUKBdJ
- TLSH T15A766C226A9440A5F5B2C2726E396F574D69BDF10B33805FE384176D09B4A83B63DF23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 5880 OfficeClickToRun.exe 696 OfficeClickToRun.exe 3204 OfficeC2RClient.exe - Loads dropped DLL 32 IoCs
pid Process 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 696 OfficeClickToRun.exe 696 OfficeClickToRun.exe 696 OfficeClickToRun.exe 696 OfficeClickToRun.exe 696 OfficeClickToRun.exe 696 OfficeClickToRun.exe 696 OfficeClickToRun.exe 3204 OfficeC2RClient.exe 3204 OfficeC2RClient.exe 3204 OfficeC2RClient.exe 3204 OfficeC2RClient.exe 3204 OfficeC2RClient.exe 3204 OfficeC2RClient.exe 3204 OfficeC2RClient.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks system information in the registry 2 TTPs 8 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OfficeC2RClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OfficeC2RClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OfficeSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OfficeSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OfficeClickToRun.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\3BCF3669-4B31-4F1C-9F60-A6E8944316CA OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-wal OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-shm OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D OfficeClickToRun.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt OfficeClickToRun.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\Publisher2021VL_MAK_AE-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Office16\ADDINS\PowerPivot Excel Add-inv16\Microsoft.DataWarehouse.DLL OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Integration\Addons\vc_redist.x64.exe OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\Access2021VL_KMS_Client_AE-ul.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\HomeBusiness2021R_SubTest-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.ProgramSynthesis.Split.Translation.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\ProjectPro2021R_OEM_Perp-pl.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\ProjectPro2021VL_MAK_AE1-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\Standard2024VL_KMS_Client_AE-ul.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Office16\AI\PowerPointCombinedFloatieLreOfflineExplorationV3.onnx OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\WordR_Retail-ul-phn.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\AccessVL_MAK-pl.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\OutlookR_Retail-pl.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\WordVL_MAK-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.20131.20090OfficeC2RB61387AC-D2E1-46E6-A480-5006FDA6BD22\C2RINTL.ko-kr.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\ProPlus2021R_OEM_Perp6-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\Word2024VL_MAK_AE-ul-oob.xrm-ms OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.20131.20090OfficeC2RB61387AC-D2E1-46E6-A480-5006FDA6BD22\C2R64_arm64x.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Office16\MAPISHELL.DLL OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Office16\MSOSB.DLL OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Office16\OutlookWebHost.dll OfficeClickToRun.exe File created C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.20131.20090OfficeC2RB61387AC-D2E1-46E6-A480-5006FDA6BD22\OfficeC2RCom_arm64.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\OneNote2021R_Retail-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\ProjectStd2021VL_KMS_Client_AE-ul.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\PackageManifests\AppXManifestLoc.16.en-us.xml OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-phn.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\ProjectPro2021R_Grace-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\VisioStd2024VL_KMS_Client_AE-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.IO.Pipelines.dll OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Office16\MSVCP140_APP.DLL OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Office16\OFFICEJS_ONENOTE.DLL OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\Access2021R_OEM_Perp-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\Outlook2021VL_MAK_AE-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Office16\MSOSPECTRE.DLL OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\HomeStudent2021R_Grace-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\VisioPro2021R_Trial-ppd.xrm-ms OfficeClickToRun.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20F39E74-365D-4ECF-91EC-5B44FC437558\root\Licenses16\Word2021R_Trial-ul-oob.xrm-ms OfficeClickToRun.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OfficeSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OfficeSetup.exe - Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe - Enumerates system info in registry 2 TTPs 9 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\RemoteClearDate = 0040a7e3a36bc901 OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--rs=en-US&build=16.0.20131&telemetryRegion=GLOBAL&crev=3\0\FilePath = "officeclient.microsoft.com\\3BCF3669-4B31-4F1C-9F60-A6E8944316CA" OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.5 = 22203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e5573655265666163746f726564436f6e666967446570726f766973696f6e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e5573655265666163746f726564436f70696c6f74466561747572654c6f676963222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e55736553657373696f6e4964466f72507974686f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4d616e6167656162696c6974792e436c6f7564506f6c6963792e4e6f6e5075626c6963436c6f7564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4d616e6167656162696c6974792e54656e616e744173736f63696174696f6e4b65792e4e6f6e5075626c6963436c6f7564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4d616e6167656162696c6974792e5573654f637073563255726c496e57696e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4e55492e4368616e6765476174652e456e61626c654b6565705261746554656c656d65747279466f725465787450656e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4e55492e53686f756c64457863656c55736544656661756c74466163746f6964222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4e55492e5465787450656e2e456e61626c65414952656372656174696f6e4f6e4c616e6775616765537769746368222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4e55492e5573654149536b696c6c4173446c6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4e55492e55736544697370617463685175657565466f72437573746f6d576574496e6b52656e6465726572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4e55492e55736544697370617463685175657565466f7253656d69576574496e6b436f6e74726f6c6c6572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4e55492e55736553746f72655265636f676e697a657273222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e426c6f636b41706943616c6c6261636b73496e5072656c6f61644c6f774d656d6f7279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e426c6f636b4576656e747343616c6c6261636b73496e5072656c6f61644c6f774d656d6f7279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e43472e4372656174654a7353657474696e6773222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e43472e4372656174654a7353657474696e677332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e43472e5344582e5072656c6f6164476f7665726e616e6365222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e43472e5570646174654f736652756e74696d654576656e7454656c656d65747279222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4347557365457863656c556466486f737442756e646c6532222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e436163686556657273696f6e222c20225622203a20227374643a3a77737472696e677c31372e3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4368616e6765476174652e44656275674469616c6f67496d70726f76656d656e74222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4368616e6765476174652e446566657272656452657175657374436c65616e7570222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4368616e6765476174652e5365745465616d73416464696e4c61737455736564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4368616e6765476174652e53686172656452756e74696d65466f7246697273745061727479536478222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e44796e616d69634361636865537570706f7274456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e456e61626c6549457874656e73696f6e4469616c6f67496e7374616e6365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e456e61626c654c4543537461747573547261636b696e67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e456e61626c654d656d6f72794d6f6465466f7254686972645061727479222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e456e61626c654d6f734578747261496e4164664361636865222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e456e61626c65506572664c6962436f6c6c656374696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e456e61626c6556616c696461746546756e6374696f6e7346726f6d4d65746164617461436f6e74656e74222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e456e61626c65575632416279646f73466c616773222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e456e61626c655758504175746f72756e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4765744170694361706162696c697469657346726f6d4d6f73222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4a5353657474696e67735265666163746f722e416464696e536b696c6c416374696f6e7332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4a5353657474696e67735265666163746f722e4f6e654e6f74655344585574696c73222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4b6579746970537570706f7274456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4d6f73437573746f6d46756e6374696f6e73456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4f6e446f63756d656e744f70656e6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e52756e45786563757465507974686f6e436f6465417069496e4261746368457865637574696f6e4d6f6465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e53647853616e64626f7844656661756c74546f5638222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f4d45582e43472e506173735061636b616765536f6c7574696f6e546f4c6f6361746f72222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f4d45582e4572666d4c6f67446179436f756e74456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6666696365496e73696465722e5570646174654e6f77222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6e654e6f74652e436f70696c6f742e546f67676c655461736b70616e6548656c7065725265666163746f72222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6e654e6f74652e456e73757265534458496e697469616c697a6174696f6e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f74656c52756c65732e54656c656d6574727952756c6573222c20225622203a20227374643a3a77737472696e677c7b205c22723232343930325f355c22203a20312c205c22723232343930305f315c22203a20312c205c22723232343930325f345c22203a20312c205c22723132303630305f365c22203a20312c205c22723132303130305f335c22203a20312c205c22723132303630385f305c22203a20312c205c22723132303630395f305c22203a20312c205c22723132303631305f305c22203a20312c205c22723132303631315f305c22203a20312c205c22723132303631325f305c22203a20312c205c22723132303631335f305c22203a20312c205c22723132303631345f305c22203a20312c205c22723132303631355f305c22203a20312c205c22723132303631365f305c22203a20312c205c22723132303631375f305c22203a20312c205c22723132303631385f305c22203a20312c205c22723132303631395f305c22203a20312c205c22723132303632305f305c22203a20312c205c22723132303632315f305c22203a20312c205c22723132303632325f305c22203a20312c205c22723132303632335f305c22203a20312c205c22723132303632345f305c22203a20312c205c22723132303632355f305c22203a20312c205c22723132303632365f305c22203a20312c205c22723132303632375f305c22203a20312c205c22723132303632385f305c22203a20312c205c22723132303632395f305c22203a20312c205c22723132303633305f305c22203a20312c205c22723132303633315f305c22203a20312c205c22723132303633325f305c22203a20312c205c22723132303633335f305c22203a20312c205c22723132303633345f305c22203a20312c205c22723132303633355f305c22203a20312c205c22723132303633365f305c22203a20312c205c22723132303633375f305c22203a20312c205c22723132303633385f305c22203a20312c205c22723132303633395f305c22203a20312c205c22723132303634305f305c22203a20312c205c22723132303634315f305c22203a20312c205c22723132303634325f305c22203a20312c205c22723132303634335f305c22203a20312c205c22723132303634345f305c22203a20312c205c22723132303634355f305c22203a20312c205c22723132303634365f305c22203a20312c205c22723132303634375f305c22203a20312c205c22723132303634385f305c22203a20312c205c22723132303634395f305c22203a20312c205c22723132303635305f305c22203a20312c205c22723132303635315f305c22203a20312c205c22723132303635325f305c22203a20312c205c22723132303635335f305c22203a20312c205c22723132303635345f305c22203a20312c205c22723132303635355f305c22203a20312c205c22723132303635365f305c22203a20312c205c22723132303635375f305c22203a20312c205c22723132303635385f305c22203a20312c205c22723132303635395f305c22203a20312c205c22723132303636305f305c22203a20312c205c22723132303636315f305c22203a20312c205c22723132303636325f305c22203a20312c205c22723132303636335f305c22203a20312c205c22723132303636345f305c22203a20312c205c22723132303636355f305c22203a20312c205c22723132303636365f305c22203a20312c205c22723132303636375f305c22203a20312c205c22723132303636385f305c22203a20312c205c22723132303636395f305c22203a20312c205c22723132303637305f305c22203a20312c205c22723132303637315f305c22203a20312c205c22723132303637325f305c22203a20312c205c22723132303637335f305c22203a20312c205c22723132303637345f305c22203a20312c205c22723132303637355f305c22203a20312c205c22723132303637365f305c22203a20312c205c22723132303637375f305c22203a20312c205c22723132303637385f305c22203a20312c205c22723132303637395f305c22203a20312c205c22723132303638305f305c22203a20312c205c22723132303638315f305c22203a20312c205c22723132303638325f305c22203a20312c205c22723133303031305f305c22203a20312c205c22723132303430325f32315c22203a20312c205c22723132303630325f31305c22203a20312c205c22723132303630315f335c22203a20312c205c22723232343930315f31315c22203a20312c205c227239303430315f335c22203a20312c205c22723730313230315f315c22203a20312c205c22723730313230305f315c22203a20312c205c22723730303230315f315c22203a20312c205c22723730303230305f315c22203a20312c205c22723730323335315f315c22203a20312c205c22723730323335305f315c22203a20312c205c22723730313235315f315c22203a20312c205c22723730313235305f315c22203a20312c205c22723730303035315f315c22203a20312c205c22723730303035305f315c22203a20312c205c22723730323935315f315c22203a20312c205c22723730323935305f315c22203a20312c205c22723730313135315f315c22203a20312c205c22723730313135305f315c22203a20312c205c22723730323230315f315c22203a20312c205c22723730323230305f315c22203a20312c205c22723730303430315f325c22203a20312c205c22723730303430305f325c22203a20312c205c22723730303335315f315c22203a20312c205c22723730303335305f315c22203a20312c205c22723730333930315f305c22203a20312c205c22723730333930305f305c22203a20312c205c22723730313530315f315c22203a20312c205c22723730313530305f315c22203a20312c205c22723730323830315f315c22203a20312c205c22723730323830305f315c22203a20312c205c22723730333335315f305c22203a20312c205c22723730333335305f305c22203a20312c205c22723730333530315f305c22203a20312c205c22723730333530305f305c22203a20312c205c22723730313830315f315c22203a20312c205c22723730313830305f315c22203a20312c205c22723730313035315f315c22203a20312c205c22723730313035305f315c22203a20312c205c22723730323735315f315c22203a20312c205c22723730323735305f315c22203a20312c205c22723730323330315f315c22203a20312c205c22723730323330305f315c22203a20312c205c22723730333430315f305c22203a20312c205c22723730333430305f305c22203a20312c205c22723730323530315f315c22203a20312c205c22723730323530305f315c22203a20312c205c22723730303530315f315c22203a20312c205c22723730303530305f315c22203a20312c205c22723730323535315f315c22203a20312c205c22723730323535305f315c22203a20312c205c22723730313335315f315c22203a20312c205c22723730313335305f315c22203a20312c205c22723730323135315f315c22203a20312c205c22723730323135305f315c22203a20312c205c22723730333030315f315c22203a20312c205c22723730333030305f315c22203a20312c205c22723730303735315f315c22203a20312c205c22723730303735305f315c22203a20312c205c22723730303135315f315c22203a20312c205c22723730303135305f315c22203a20312c205c22723730333435315f315c22203a20312c205c22723730333435305f315c22203a20312c205c22723730303930315f315c22203a20312c205c22723730303930305f315c22203a20312c205c22723730323235315f315c22203a20312c205c22723730323235305f315c22203a20312c205c22723730323635315f315c22203a20312c205c22723730323635305f315c22203a20312c205c22723730333130315f315c22203a20312c205c22723730333130305f315c22203a20312c205c22723730323930315f315c22203a20312c205c22723730323930305f315c22203a20312c205c22723730333630315f305c22203a20312c205c22723730333630305f305c22203a20312c205c22723730333835315f305c22203a20312c205c22723730333835305f305c22203a20312c205c22723730333830315f305c22203a20312c205c22723730333830305f305c22203a20312c205c22723730333730315f305c22203a20312c205c22723730333730305f305c22203a20312c205c22723730333735315f305c22203a20312c205c22723730333735305f305c22203a20312c205c22723730313330315f315c22203a20312c205c22723730313330305f315c22203a20312c205c22723730343035315f305c22203a20312c205c22723730343035305f305c22203a20312c205c22723730313730315f315c22203a20312c205c22723730313730305f315c22203a20312c205c22723730323035315f315c22203a20312c205c22723730323035305f315c22203a20312c205c22723730303730315f315c22203a20312c205c227237303037 OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|13" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|15" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ApplicationUpgradeCandidate OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|14" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = f94f307abf528200f889cacdd145d44fcfe0bb32d23195063263266fa20ba1dd OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "504928405,17110992,7153487,17110988,7202265,507286179,41816131,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|6" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|9" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\FlightCacheProviderId OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\SessionId = 434ce3a9a5e8094098b83f0a2e635c29 OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 886dab166d17ab3ec196f0ae508a996f5e3cebc9a56210dc16d597a9ac9c3fa9 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|4" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\FlightCacheAudience = "Production" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Experiment\WindowsFlightsInfo OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\ApplicationFlags = "1" OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.21 = 74656779222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e5573654f66666c696e6553746f72616765507265666978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e557365526567696f6e4177617265436f6e66696755726c73222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f313122203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4d6f6465726e4d657373616765426f782e467269656e646c79436861726163746572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4d6f6465726e4d657373616765426f782e467269656e646c79436861726163746572537973416c657274222c20225622203a2022626f6f6c7c3122207d205d207d207d OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.6 = 30305f315c22203a20312c205c22723730303535315f315c22203a20312c205c22723730303535305f315c22203a20312c205c22723730333635315f305c22203a20312c205c22723730333635305f305c22203a20312c205c22723730303630315f315c22203a20312c205c22723730303630305f315c22203a20312c205c22723730333135315f315c22203a20312c205c22723730333135305f315c22203a20312c205c22723730333935315f305c22203a20312c205c22723730333935305f305c22203a20312c205c22723730323835315f315c22203a20312c205c22723730323835305f315c22203a20312c205c22723730303030315f325c22203a20312c205c22723730303030305f325c22203a20312c205c22723730313430315f315c22203a20312c205c22723730313430305f315c22203a20312c205c22723730313935315f315c22203a20312c205c22723730313935305f315c22203a20312c205c22723730303835315f315c22203a20312c205c22723730303835305f315c22203a20312c205c22723730313835315f315c22203a20312c205c22723730313835305f315c22203a20312c205c22723730333035315f335c22203a20312c205c22723730333035305f335c22203a20312c205c22723730303130315f315c22203a20312c205c22723730323130315f315c22203a20312c205c22723730323130305f315c22203a20312c205c22723730303130305f315c22203a20312c205c22723730303935315f315c22203a20312c205c22723730303935305f315c22203a20312c205c22723730333535315f305c22203a20312c205c22723730333535305f305c22203a20312c205c22723730303435315f315c22203a20312c205c22723730323730315f315c22203a20312c205c22723730323730305f315c22203a20312c205c22723730303435305f315c22203a20312c205c22723730313930315f315c22203a20312c205c22723730313930305f315c22203a20312c205c22723730343030315f305c22203a20312c205c22723730343030305f305c22203a20312c205c22723730333235315f315c22203a20312c205c22723730333235305f315c22203a20312c205c22723730323430315f315c22203a20312c205c22723730323430305f315c22203a20312c205c22723730313535315f315c22203a20312c205c22723730313535305f315c22203a20312c205c22723730303330315f315c22203a20312c205c22723730303330305f315c22203a20312c205c22723730323030315f315c22203a20312c205c22723730323030305f315c22203a20312c205c22723730323630315f315c22203a20312c205c22723730323630305f315c22203a20312c205c22723730333230315f315c22203a20312c205c22723730333230305f315c22203a20312c205c22723730303235315f315c22203a20312c205c22723730303235305f315c22203a20312c205c22723730303635315f315c22203a20312c205c22723730303635305f315c22203a20312c205c22723730333330315f305c22203a20312c205c22723730333330305f305c22203a20312c205c22723730313735315f315c22203a20312c205c22723730313735305f315c22203a20312c205c22723730313635315f315c22203a20312c205c22723730313635305f315c22203a20312c205c22723730323435315f315c22203a20312c205c22723730323435305f315c22203a20312c205c22723730313130315f315c22203a20312c205c22723730313130305f315c22203a20312c205c22723132303132385f305c22203a20312c205c22723233303130345f315c22203a20312c205c22723233303135375f305c22203a20312c205c22723233303135385f315c22203a20312c205c22723233303136325f315c22203a20312c205c22723233303136345f305c22203a20312c205c22723233303136355f305c22203a20312c205c22723233303136365f305c22203a20312c205c22723233303136375f305c22203a20312c205c22723233303136385f305c22203a20312c205c22723233303136395f305c22203a20312c205c22723233303137305f315c22203a20312c205c22723233303137315f305c22203a20312c205c22723233303137325f315c22203a20312c205c22723233303137335f305c22203a20312c205c22723233303137345f305c22203a20312c205c22723132303131395f305c22203a20312c205c22723730343130315f305c22203a20312c205c22723730343130305f305c22203a20312c205c22723730343230315f305c22203a20312c205c22723730343230305f305c22203a20312c205c22723730343135315f305c22203a20312c205c22723730343135305f305c22203a20312c205c22723232363030395f305c22203a2031207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e41676176652e4a736f6e5265666163746f725061727432222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e41676176652e4a736f6e5265666163746f725061727434222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e526970636f72642e3131303839343031222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572666f726d616e63652e426c6f636b696e6757616974732e4f737250726f63657373222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572666f726d616e63652e496e70757444656c61794d6f6e69746f722e494f486f6f6b73526970636f7264222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572666f726d616e63652e496e70757444656c61794d6f6e69746f722e536f6e6172557365506f73744d657373616765222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572666f726d616e63652e4e65745374617475732e557365436163686564537461747573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572736f6e616c697a6174696f6e2e456e61626c6543616d706169676e4964734c6f6767696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572736f6e616c697a6174696f6e2e456e61626c65476574496e736967687473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4175674c6f6f702e496e636c7564654d617374657273222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4175676c6f6f702e436f6d70726568656e73696f6e53756d6d6172792e456e61626c654465666572726564526169222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4175676c6f6f702e436f6d70726568656e73696f6e53756d6d6172792e656e61626c654f666669636550726f6d70745369676e616c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4175676c6f6f702e436f70696c6f742e50726f64696779537065616b65724e6f746573456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4175676c6f6f702e436f70696c6f742e53617665456e746572707269736550726f7669646572496e666f496e5344534361636865222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4175676c6f6f702e436f70696c6f742e537065616b65724e6f7465734c6f63616c697a65644d65737361676573456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4175676c6f6f702e456e61626c6541736b557365725175657374696f6e546f6f6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4175676c6f6f702e456e61626c654272616e64496d616765546f6f6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4175676c6f6f702e456e61626c654578706c6963697447726f756e64696e67456d70686173697a654d657373616765222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4175676c6f6f702e456e61626c6552696368436f6e74656e7452657475726e55706c6f61644572726f72436f646573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4175676c6f6f702e456e746572707269736553656172636850726f6d707456657273696f6e222c20225622203a20227374643a3a77737472696e677c656e746572707269736553656172636850726f6d7074436f6e6669675f76305f3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4175676c6f6f702e50707456697375616c735265666163746f726564436f6465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4175676c6f6f702e526577726974652e52756e74696d654576616c53616d706c6552617465222c20225622203a2022696e7436345f747c313022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4368616e6765476174652e456e61626c65546162466f72444142222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4368616e6765476174652e456e74657270726973654173736574416c6c6f774c697374456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4368616e6765476174652e52656c656173654b6579626f617264466f6375734f6e446162457363617065222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4368616e6765476174652e53637265656e5265636f726465722e456e61626c654c6963656e73696e67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e436f6d6d616e64732e44656c657465556e646f456e7472794166746572526f6c6c6261636b5472616e73616374696f6e436f6d6d6974222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e436f70696c6f742e456e61626c65496e736572744f7267616e697a6174696f6e496d61676573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4578706f72742e5374616e64616c6f6e654578706f7274526f7574696e65222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e46413030303030303132392e4973537567676573746564516e414369746174696f6e73456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e46413030303030303135362e49734372656174654e65775050544c61756e6368456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e46413030303030303135362e4973526571756573744964496e414c54696d656f7574526573706f6e7365456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e46413030303030303135362e49735573654f435646656174757265496e666f46726f6d53657474696e6773456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e46413030303030303135362e4c696e6b496e50726f6d70744e6f74537570706f72746564456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e46413030303030303139322e497341646f62654578704d616e6167657250726f7669646572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e46413030303030303139322e497354656d706c61667950726f7669646572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e46456e61626c654f5346466978466f72456d626564646564466f6e7473505054222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e46456e61626c654f5346466978466f724e6f6e456d626564646564466f6e7473505054222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e5265736f75726365496457696e646f7750726f7065727479222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e52696368436f6e74656e742e55706c6f61644661696c75726544656661756c7454696d656f75744d73222c20225622203a2022696e7436345f747c31353030303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e456e61626c6542697a43686174436f6e7465787452656c6f61644f6e4c6963656e73656446656174757265734368616e6765222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e456e61626c655072656c6f616449734575222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e456e61626c6551756572794265666f7265416e6e6f746174696f6e4c6f6164222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e456e61626c655265777269746553544b4d697373696e674b656570466978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e456e61626c6554344c616e677561676573466f725472616e736c61746550726573656e746174696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e497344657369676e6572436f70696c6f74456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e497348616e646f6666426f6f6b656e64696e67456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e49735265616c74696d65566f69636543757272656e7450616765456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e4e657743686174496e486561646572436f6e74726f6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e5265616c74696d65566f696365436f70696c6f74526573706f6e736554696d656f7574222c20225622203a2022696e7436345f747c3730303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e53686f77526566696e65644572726f72537472696e6773222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e5570646174654167656e74537461746553746f72654f6e446f634d6f64654368616e6765222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e586176696572456e61626c6542697a43686174436f6e7465787452656c6f61644f6e4c6963656e73656446656174757265734368616e6765222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e586176696572456e61626c654461746147726964427574746f6e4c6162656c73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e586176696572456e61626c65496d70726f766564415551536b6970416c6c4d657373616765222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.16 = 6e74697479506172656e744d617463685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526f616d696e6750726f7879496e69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536861726564437265645265667265736846726f6d53746f72655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526561644f6e6546726f6d43726564656e7469616c4c6973745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22435265616453796e635461736b52756e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f6d61696e4a6f696e65644f72436c6f7564446f6d61696e4a6f696e656453657373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744164616c416363657373546f6b656e46726f6d4372656450726f76696465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574536572766963655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574436f6e666967546f6b656e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574426c6f636b696e67536572766963655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22506f70756c617465536572766963654d61705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657441757468656e74696361746564536572766963655469636b65745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526566726573684964656e7469746965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765745365727669636555726c466f7246656465726174696f6e50726f7669646572416e616c797369735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225365727669636555726c5374617475735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2241637175697265536572766963655469636b6574466f724144414c5c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2253697465735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e496e736967687473222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22496e73696768747350616e655c22203a207b205c224576656e74735c22203a207b205c22415c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22445c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2248746d6c5072656665746368526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436163686546696c654e6f7456616c69645c22203a207b205c224576656e74466c61675c22203a20323536207d207d2c205c225375624e616d657370616365735c22203a207b205c224f66666963655c22203a207b205c224576656e74735c22203a207b205c2253797374656d616c69645c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c22496e7369676874735c22203a207b205c224576656e74735c22203a207b205c22496e73696768747350616e655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e73696768747350616e65305c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e73696768747350616e65725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253797374656d5c22203a207b205c224576656e74735c22203a207b205c224163746976697479715c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224163746976697479735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d2c205c22536d6172744c6f6f6b75705c22203a207b205c224576656e74735c22203a207b205c22415c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f7079466561747572654761746573315c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f7079466561747572654761746573325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573315c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331305c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331315c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331335c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331355c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573335c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573345c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573355c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573365c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573375c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573385c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573395c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2248746d6c5072656665746368526571756573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225265667265736843616368656446696c65735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446f776e6c6f61645265736f757263655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2241757468656e7469636174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22526573756c7447726f7570546f52656e6465725c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253656e64576562536f636b6574526571756573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22576562536f636b657450696e67506f6e674c6174656e63795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446961676e6f737469635c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2238564d65686c6c5c22203a207b205c225375624e616d657370616365735c22203a207b205c22356b69614b3747426b7a505746675c22203a207b205c224576656e74735c22203a207b205c22373139305c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c22385c22203a207b205c225375624e616d657370616365735c22203a207b205c227a424b387872415553554e52497859484e4b55415c22203a207b205c224576656e74735c22203a207b205c22393133335c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c224f66666963655c22203a207b205c224576656e74735c22203a207b205c2253797374656d644d617463685c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c22496e7369676874735c22203a207b205c224576656e74735c22203a207b205c22536d6172744c6f6f6b75705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536d6172744c6f6f6b75705f5f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536d6172744c6f6f6b75705f5f5f5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253797374656d5c22203a207b205c224576656e74735c22203a207b205c2241637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253797374656d68633863674f6a46515c22203a207b205c224576656e74735c22203a207b205c22383635335c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d2c205c22556952756e74696d655c22203a207b205c224576656e74735c22203a207b205c22437265617465576562536f636b65745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2250726f636573735265717565737451756575655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22496e74656e745365727669636550726f78794f6e436f6e6e656374696f6e436c6f7365645c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f6e436f6e6e656374696f6e436c6f7365645c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4c6963656e73696e67222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22476574436f756e747279436f64655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2243616e52756e53657276696365506c616e46656174757265466f724964656e746974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744964656e746974696573466f725365727669636544656c697665726564466561747572655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d70617265427573426172735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6963656e73696e67427573626172416374696f6e5c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c22487244697370617463685375625461736b53746172745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22517569636b56616c69646174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253617665416c6c536b75696473546f52656769737472795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2257616974546f52657472794865617274626561745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536561726368466f7253657373696f6e546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224e554c56616c69646174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2256616c696461746553657373696f6e546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2243616e52756e4665617475726543616368655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22506572666f726d4c6963656e73696e674e6f74696669636174696f6e735c22203a207b205c224576656e74466c61675c22203a20323536207d207d2c205c225375624e616d657370616365735c22203a207b205c224e756c5c22203a207b205c225375624e616d657370616365735c22203a207b205c224d6f64656c5c22203a207b205c224576656e74735c22203a207b205c224765744d6f64656c466f724964656e746974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22476574416c6c4c6963656e736543617465676f726965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744c6963656e6e736543617465676f72795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744c6963656e736543617465676f72795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446573657269616c697a655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225061727365526177526573706f6e73655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2243616e52756e46656174757265526573756c74735c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2253746f726167655c22203a207b205c224576656e74735c22203a207b205c22476574556e766572696669656453746f72616765506174685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2247657447726163654c6963656e736553746f72616765506174685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2247657450657270657475616c4c6963656e736553746f72616765506174685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22476574556e766572696669656446696c655061746846726f6d4d6f64656c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22476574556e766572696669656446696c655061746846726f6d4d657461646174614964416e64507269645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225265616446726f6d46696c654e616d655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225265616446726f6d46696c6548616e646c655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2247657453746f72616765506174685c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c6f61644d6f64656c735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c6f61644d6f64656c5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2252656e616d6546696c65546f55736555706461746564486173685c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22466574636865725c22203a207b205c224576656e74735c22203a207b205c224765744e756c4f626a656374466f724964656e746974795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2246657463684d6f64656c46726f6d4f6c735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224765744c6963656e73654665617475726573466f724964656e746974795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2243726561746552657175657374426f64795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d6f64655c22203a207b205c224576656e74735c22203a207b205c224765744d6f64655c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c224170695c22203a207b205c224576656e74735c22203a207b205c22437265617465526571756573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253656e64526571756573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2252656365697665526573706f6e73655c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2256616c69646174696f6e5c22203a207b205c224576656e74735c22203a207b205c22517569636b56616c69646174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2256616c696461746f725c22203a207b205c224576656e74735c22203a207b205c224d61746368696e67486172776172656449645c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d2c205c224c6963656e73696e675c22203a207b205c224576656e74735c22203a207b205c22487244697370617463685375625461736b5c22203a207b205c224576656e74466c61675c22203a20353132207d207d207d2c205c2253657276696365506c616e46656174757265735c22203a207b205c224576656e74735c22203a207b205c2243616e52756e53657276696365506c616e46656174757265466f724964656e746974795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224c5655585c22203a207b205c224576656e74735c22203a207b205c224e6f456e7469746c656d656e74735c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c224e6f456e7469746c656d656e74734578706572696d656e74547269676765725c22203a207b205c224576656e74466c61675c22203a203439343038207d207d207d2c205c224f6666696365436c69656e744c6963656e73696e675c22203a207b205c224576656e74735c22203a207b205c224c6963656e7365436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6567616379416374697669747953756363657373436f756e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c656761637941637469766974794661696c757265436f756e745c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c22436c69656e745c22203a207b205c224576656e74735c22203a207b205c224653686f756c6441637469766174655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c224865617274626561745c22203a207b205c224576656e74735c22203a207b205c22577269746543616368655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265616443616368655c22203a207b205c224576656e74466c61675c22203a OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|16" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--rs=en-US&build=16.0.20131&telemetryRegion=GLOBAL&crev=3\0\Url = "https://officeclient.microsoft.com/config16/?rs=en-US&build=16.0.20131&telemetryRegion=GLOBAL&crev=3" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--rs=en-US&build=16.0.20131&telemetryRegion=GLOBAL&crev=3\Last = "0" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--rs=en-US&build=16.0.20131&telemetryRegion=GLOBAL&crev=3 OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t|0" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|7" OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.8 = 203a20224d6963726f736f66742e4f66666963652e53656375726974792e466f726d7333456e61626c65416374697665584f7261706932222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e4c6f775269676874732e53686f756c6452656461637450747273222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e534255736553746446696c6553797374656d222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e53686f756c6452756e436c6f75645365637572697479506f6c696379436865636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e557365537464566563746f72496e4f7267222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e57617465726d61726b696e672e5573654269746d6170427275736854696c696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4175676c6f6f702e44796e616d69635175657374696f6e47656e657261746f722e656e61626c654f666669636550726f6d70745369676e616c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4368616e6765476174652e44656c617943757272656e745549416374697665506c616365557064617465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4368616e6765476174652e456d697448797065726c696e6b556e64657254657874626f7854616732222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4368616e6765476174652e456e73757265456469744f636375727265644669726573466f72416c6c4564697473456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4372634261736564556964222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e446f634578706f72742e4d6174684d4c537570706f7274466f72466f726d756c61546167222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e446f634578706f72742e4e6f53756254616773466f7247726f757057697468416c745465787432222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e446f635265636f7665727955495f556e696e697433222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772617068496d706f72744865647769675558222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772617068496d706f7274496e73657274416c6c4f626a6563747356696577222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772617068496d706f72744f75746c6f6f6b496e7365727446696c65222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e47726170686963732e4368616e6765476174652e5570646174655461626c65426f756e6473466f72547970696e67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4c6173744d696c654661636164652e46656174757265466c69676874222c20225622203a2022696e7436345f747c3722207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4c6173744d696c6554656c656d657472792e46656174757265466c69676874222c20225622203a2022696e7436345f747c3722207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4c6173744d696c6554656c656d657472792e46656174757265466c69676874456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4c69746572616c4e6577456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e41766f6964526177507472466f724d656d6f7279416c6c6f636174696f6e496e436c6f7564466f6e744e6f74696669636174696f6e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e436f6c6f72466f6e74537570706f7274456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e48696464656e466f6e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e53686f756c64436f6e766572744c6567616379456e636f64656453796d626f6c43686172616374657273222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e536b697048696464656e436c6f7564466f6e7473496e457863656c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e5472616e7363726962652e436f6e666967436865636b44697361626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e556961506c616365486f6c64657253746f7279466978222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e55706772616465546f466f6e74536572766963653163646e456e64706f696e74222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e5573655374796c654177617265466f6e7446616c6c6261636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e416461707469766553616d706c696e67222c20225622203a20227374643a3a77737472696e677c7b205c22436f6e666967315c22203a207b205c224576656e744672657175656e63795c22203a205c224c6573735468616e506f696e745a65726f466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130303030207d2c205c22436f6e666967325c22203a207b205c224576656e744672657175656e63795c22203a205c224c6573735468616e506f696e745a65726f466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130303030207d2c205c22436f6e666967335c22203a207b205c224576656e744672657175656e63795c22203a205c224c6573735468616e506f696e745a65726f466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031303030207d2c205c22436f6e666967345c22203a207b205c224576656e744672657175656e63795c22203a205c224c6573735468616e506f696e745a65726f466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e666967355c22203a207b205c224576656e744672657175656e63795c22203a205c224c6573735468616e506f696e745a65726f466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e666967365c22203a207b205c224576656e744672657175656e63795c22203a205c224c6573735468616e506f696e745a65726f466976655c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130207d2c205c22436f6e666967375c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e745a65726f46697665546f4c6573735468616e506f696e744f6e655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130303030207d2c205c22436f6e666967385c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e745a65726f46697665546f4c6573735468616e506f696e744f6e655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130303030207d2c205c22436f6e666967395c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e745a65726f46697665546f4c6573735468616e506f696e744f6e655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20323030207d2c205c22436f6e66696731305c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e745a65726f46697665546f4c6573735468616e506f696e744f6e655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203230207d2c205c22436f6e66696731315c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e745a65726f46697665546f4c6573735468616e506f696e744f6e655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130207d2c205c22436f6e66696731325c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e745a65726f46697665546f4c6573735468616e506f696e744f6e655c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2032207d2c205c22436f6e66696731335c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e744f6e65546f4c6573735468616e506f696e7454776f466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130303030207d2c205c22436f6e66696731345c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e744f6e65546f4c6573735468616e506f696e7454776f466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2032303030207d2c205c22436f6e66696731355c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e744f6e65546f4c6573735468616e506f696e7454776f466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e66696731365c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e744f6e65546f4c6573735468616e506f696e7454776f466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130207d2c205c22436f6e66696731375c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e744f6e65546f4c6573735468616e506f696e7454776f466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130207d2c205c22436f6e66696731385c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e744f6e65546f4c6573735468616e506f696e7454776f466976655c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696731395c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7454776f46697665546f4c6573735468616e506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130303030207d2c205c22436f6e66696732305c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7454776f46697665546f4c6573735468616e506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031303030207d2c205c22436f6e66696732315c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7454776f46697665546f4c6573735468616e506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a20313030207d2c205c22436f6e66696732325c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7454776f46697665546f4c6573735468616e506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203130207d2c205c22436f6e66696732335c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7454776f46697665546f4c6573735468616e506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696732345c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7454776f46697665546f4c6573735468616e506f696e74466976655c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696732355c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7446697665546f4c6573735468616e506f696e74536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f4f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2032303030207d2c205c22436f6e66696732365c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7446697665546f4c6573735468616e506f696e74536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e745a65726f54776f5c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031303030207d2c205c22436f6e66696732375c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7446697665546f4c6573735468616e506f696e74536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e744f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a203230207d2c205c22436f6e66696732385c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7446697665546f4c6573735468616e506f696e74536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e7454776f466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2032207d2c205c22436f6e66696732395c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7446697665546f4c6573735468616e506f696e74536576656e5c222c205c224d617267696e4f664572726f725c22203a205c22506f696e74466976655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2031207d2c205c22436f6e66696733305c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e7446697665546f4c6573735468616e506f696e74536576656e5c222c205c224d617267696e4f664572726f725c22203a205c224f6e655c222c205c2253616d706c655261746550657254656e54686f7573616e645c22203a2030207d2c205c22436f6e66696733315c22203a207b205c224576656e744672657175656e63795c22203a205c22506f696e74536576656e546f4c657373 OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb010000008da51746822f3c479dc754843af4d9500000000002000000000010660000000100002000000075f029d08047dad59f8c3dde77d22fac5e0c03a45a67d5e6a6ca762bb539dadd000000000e800000000200002000000039d2e08ceb5759a891f87117b9d59ed3b1abfe6a154658aa479cd041089c7578200600003ec674a20cc8ee9fee561fadc517cc72591a88a700eaadadbb87cd7ed960e31ce46c9b26e48c211be32762c8a67a7342424965a7e339a9155abe977ec21db2892d950c815c8d4d818b76ecda9e718638d374cf7672fef6b2ec64c81e1b5e897f90c9c58ae915be928db4eb5b9ef3b40d651c232b7d065b77fb2de34470d13b81703fb5c84bdde2c8c9bfd5c8b7f9d466a53fb85eb2df78ce4ea3d8dda4e267322647a0cd5b3739120be05e6aa358a3bc6f8cad1e82b850b29c265ebe3edb6957055b57698f322845c884c0dd3c3d26cda7e060fcc316bc60ccf75f79fbaa1b243201d9ac5e1e9577e2ed73526191fc81a5ab0fa4bf247cc94241c32ba423cadd91f7451a0ff9a5fae33157d8da170c4f68bb68b643d5a5068a7c78c7abb11d90c84001c6de25c87f5a92738ad69c9465e757e1ed6fb8a9af370aab985ce457a1704e92761889dca173715280589617f9d85cb87b9410b38419ba0136518627bb0f0c00fcc73361568a65efadc215c820e808b6354a4da31167af30f49abbe9a9ca6b97889622c95448fd13183b59c2beb2d2f7dfbe8b6553cbf15a10100a21a934266dd064b8f0d4899c3cea00b6aec8a39eb92e768425a9e5fb55388d5b46a6209841ece50b9fc2df3e9eb2fa5481b9541ec3c4b8dfac422b30c3a1b9d79a9e4b2c4795dce5ad739e75d2d1afa6cef0d2f8fa10f6b1ea65502f8614a8eb780035b60d01aeeb80b99a4861ad4d00780a8be56a39eea5f4cc763a18fc7d5b6491b8f260a3804a3171e00aaf658517fb426f6cf58fa00710be91271bee19fad563b6476654f865ce866d4d806af925447c3d0a0d7e3cd2c3c8d2e755b3a6615af9c99d07f3f3236c9c0c2e101f80f3d3c9c8a291d36046c3753ed2bcc3187f932dd1156f2903145532ba9d6e53037bad2bc0233f94b617887220475e38d9fc6ad2e73ea7666f119c2ad7477c44424ab5e62cb14da640742b15799f4ffcbca0f478cb35a84219f5dd061d614169fd1bdee4cf38b67999801e8b215c3edfbe4d4cdae71c148e4a1f476f95a1d72667be75eb29b09162acd25dff60db24a38355bc1064fb6b8d02f7c7902a83ca7eef6f7c8568fc1600bdba775d02490d41777a3603ce05801b06b74a07f60718cfb766b27ec548779bf6d57b434f29bce8683f7449e07fbfe766406f7ee0069f38264db924b5be92d53c7ad9e3338a6366f5d15626cc9768203abba598d3a31b4c749a96e54dcfe5f4483aeafaf04392156ca1b9053907a8fa5e42e61e456ef01538727578835eae68828198f8d18892692969b2a6e72ed227bfac114c2a3bbbc6a27b1e72178476215bc26cdba8980b36dd6e73123cc1fb1babdf8475b0c40d6490c912dd2da519d24a4ebb006ff09f35d8fc5a685684330ecfb761b18b928e82ae5fdd5eb62cbbcd3cc7f064c310f532b6cc48bc346c8fd03d9ee0a594d81fec77f8c60389ea89681ff45482fdad2717bf8f4f38c789938d6e25fdb0283940451d60cfe4f3de55890297c0df692ee38d7eea7ab56224f9fcf2ae4e9353332eaec279a9ecdec3781a0ebbef6a12677f4c44bb1b9358a120d79265f298a1d36734778514dbdbd7dd42bce94587de75617988b6261ad09ba0fef1467fa217c06b59bf85e488e9fdd8ba39cc2b6cd38b7655a4843567fe464ed2cdaa818c41a00b14088252b7900922120f81921b6b1d78d0a244e7d339173c133fd030c8b2874eda71810e4756cb674dbfaeb50a92fc95701ea28fe746c82a0ebb708b305b2eb5e21877c45ba00ea841e5959499cda10c82aa0e9f0e5c376aa4ce9d1fe1019a09ed38ed6af562b3e13a39d2c692b0ce71594f25879a86568eab84949cc0760859ceb1be74fe8a620fd80f2295a682e833e95b836439366b50a2299bd3ef86d3976a5acc1806daa99b4aeaf9a93d427b4c010bd9598b63c8f27740c0dfb01892f69c469398f743c6ffb20af6b8bffd546ba133699ac7d40ce9e6132a64f83767815734305dd61d028d9497c8ec896966d3fe8d6e097c4523488eef92f8dc16f33f1c069bade5dbe568b6cb37a929cf806f6a649d48effeaa9ca58ec055ef26be43c903cd894c27e5fe713e37fa1053623613eeab3c63a8da9439dd5eb0dfd1886d15c63fafa213d4d2bad61975cda640b3a86dd551ab9c44607d9deae0b66353312ec876df84acee5c5a820b784ddab7371ee194b9bb4000000025ebfa018650694c38cdede5c43c785ecb6b0f2ed1375cb797c6437892c003b24279c86be2c4c9adcc07e3eee50e4974ac520df028293405a1cb666e152b9d53 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\00188018A82D9B50 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb010000008da51746822f3c479dc754843af4d950000000000200000000001066000000010000200000006792e9d7d0a5f863c9b8378745a8ef99c8050f5ab6cf4bc3844334308d4257e7000000000e8000000002000020000000b8849e6024207e3523bef27770e424693204c520abaff46596d9645ccdfb680580000000ea60907a20d42c280349ce3adcaa1e84974b3adf79af52adf95f9c4034f25e91d9ea57f650cb932658d0e2fe69ef79ffdb31a49a29432c1bbebf660e6d0d9d19225ef350f05d05261ad225810889fb17454c250a71950bad7347733a056882056d8c9cea75d4f4209cf092df3c240420ecc4acfe9a9f962de22979acdb4dc50540000000e2e6724058dec68b054ca4c7e46c7bf79f3725995e006bf1f794f91aec3ba21fa9141d921be5012f39522b063d49b26df1c34a02a300e2325c096c31772ea278 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935} OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = f816000074a57596d205dd01 OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.1 = 30342d31312d32302c502d522d313537313236392d312d322c502d522d313534373638382d31302d31332c502d522d313536363035302d31372d32322c502d522d313536333738362d31332d32302c502d522d313534373830342d31332d31362c502d522d313534373437342d31332d31342c502d522d313534373332332d31342d31372c502d522d313534363631392d31342d31352c502d522d313533353530332d31342d31362c502d522d313533343934302d31342d31372c502d522d313533323435302d32332d33352c502d522d313532363131332d392d382c502d522d313437303033302d31342d32302c502d522d313436383138362d31332d31382c502d522d313435343832322d31332d32332c502d522d313435353839382d31322d32332c502d522d313433313037362d31332d31372c502d522d313431333734382d342d362c502d522d313335363632372d31342d31342c502d522d313236333030362d31322d31312c502d522d313235363439362d31342d31372c502d522d313232353939332d31342d31382c502d522d313232313535382d382d31312c502d522d313135323738332d31332d31352c502d522d33393931322d312d322c502d522d313436333531352d31342d31362c502d522d313239333236392d352d382c502d522d35303338302d31382d31382c502d522d313834323336362d382d382c502d522d313830353833322d31342d362c502d522d313830343338352d382d342c502d522d313739303438332d382d372c502d522d313738383335392d31342d31352c502d522d313738323034302d31382d31382c502d522d313737333136322d382d352c502d522d313736313836352d31382d31332c502d522d313732343639302d322d332c502d522d313731323537312d31332d31362c502d522d313730313631372d31342d31382c502d522d313639313632312d31342d31332c502d522d313632303937352d31332d31352c502d522d313630343234302d31382d32362c502d522d313539373339332d382d342c502d522d313538373239382d382d362c502d522d313538353334312d31332d31372c502d522d313535333937352d31342d31372c502d522d313435373130352d342d342c502d522d313434373231312d342d342c502d522d313434323538382d382d372c502d522d313236343735392d342d362c502d522d313232353231382d342d352c502d522d313137383337302d31332d31382c502d522d36333333382d31382d31312c502d522d35383235312d31382d31322c502d522d33333733372d312d342c502d452d32393636322d322d332c502d522d313831303835322d31342d31392c502d522d313735353536342d322d332c502d522d313734363534312d31342d31382c502d522d313635303038352d342d342c502d522d313233323739362d342d342c502d522d313232363735372d342d362c502d522d313135323737372d31342d31352c502d522d36313335382d31382d32322c502d522d36333934372d31382d322c502d522d36313336312d31382d32362c502d522d36313336302d31382d32312c502d522d34373234322d31382d31312c502d522d34323531322d312d332c502d522d33353430372d342d332c502d522d32383634342d312d342c502d522d31383531332d312d33302c502d522d313835363631362d31362d31302c502d522d313835313738382d392d352c502d522d313635333235362d382d362c502d522d313631373838392d31332d31362c502d522d313433373136322d382d342c502d522d313234373635342d31332d31372c502d522d313232303834342d382d342c502d522d36353031312d312d332c502d522d35303534312d322d372c502d522d36393233322d33382d31322c502d522d32333638312d322d372c502d442d33323530322d322d332c502d442d33323530312d322d332c502d442d33323431352d322d332c502d522d313836363531382d382d322c502d522d313835393937362d31332d322c502d522d313835393936362d32392d322c502d522d313633353130312d31342d31342c502d522d313435303531312d31342d31392c502d522d313237383632372d31342d31362c502d522d313233353934322d31342d31362c502d522d313134383531342d312d332c502d522d36343531332d31382d31312c502d522d35313931362d38342d33312c502d442d313136303234302d312d362c502d442d313136303134312d312d342c2c502d522d313835343837392d392d322c502d522d313436323432302d342d342c502d522d313037353139392d362d342c502d522d313031333933302d342d352c502d522d34373630312d31382d31332c502d522d33333931362d312d352c502d522d33333538302d382d392c502d522d313832373533332d31352d31312c502d522d313832373533302d31342d31302c502d522d313832373532302d362d352c502d522d313832373439372d392d332c502d522d313830343934312d382d332c502d522d313739303535372d31342d342c502d522d313736333735392d31382d342c502d522d313735323336352d31342d31352c502d522d313636393235342d31372d31392c502d522d313634343432382d322d392c502d522d313635383031352d31342d31392c502d522d313539363032372d362d352c502d522d313538313339332d342d352c502d522d313437373936312d362d342c502d522d313431393736362d342d352c502d522d313238383833382d31342d31352c502d522d313238383733352d31342d31362c502d522d313238313536382d322d332c502d522d313231393530362d342d342c502d522d313137333830392d342d352c502d522d313136363435342d31342d31332c502d522d313135373435312d342d342c502d522d313131353936352d342d342c502d522d313033353932312d342d342c502d522d35393432362d312d332c502d522d34363931332d31382d382c502d522d313539303835322d342d352c502d522d313830313639332d31342d332c502d522d313739343931342d31342d342c502d522d313739303931312d31322d322c502d522d313236313631332d31342d31362c502d522d31393236322d312d31322c502d522d313832313937392d382d322c502d522d313739383039362d31322d31342c502d522d313634343038382d382d362c502d522d313634313834302d31332d31372c502d522d313632363933382d31332d332c502d522d313632323432312d31312d31312c502d522d313631353736362d31342d33362c502d522d313631333037332d31332d31372c502d522d313630373636322d31342d31352c502d522d313538313636332d31322d31352c502d522d313538313130382d31342d31362c502d522d313537343236392d31302d31302c502d522d313534373638372d31302d31332c502d522d313533383630392d31332d31382c502d522d313437373831352d31342d31352c502d522d313437343733332d31342d32322c502d522d313435363130302d372d31342c502d522d313436323330362d31342d31322c502d522d313435343539342d342d372c502d522d313433303532372d31342d31362c502d522d313239313438322d382d31322c502d522d313235343130392d31332d31342c502d522d313731323737372d31302d31312c502d522d313634393837332d31332d31312c502d522d313634313538372d312d362c502d522d313538333836352d312d362c502d522d313536333934352d312d382c502d522d313132383633302d312d372c502d522d313039383431322d312d352c502d522d313039313236372d312d35392c502d522d38313732302d312d322c502d522d35383430362d312d352c502d442d35303639372d322d342c502d442d32393731392d312d312c502d442d32393731382d312d312c502d442d32393539332d312d36222c2022434322203a20227374643a3a77737472696e677c4742222c2022446566436f6e667322203a20227374643a3a77737472696e677c6f6673683663326231746c61316133312c6f666372756934797664756c626633312c6f6668706578336a7a6e65706f6f3331222c202245787054696d6522203a2022696e7436345f747c31373832353636313933222c20224554616722203a20227374643a3a77737472696e677c5c22305030616f6f68315645353649453978416c3966334e2b303470635a644d44474e4e734b455258696b6f773d5c22222c202246434d617022203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e41492e496e697469616c697a654173796e63466f7257696e646f7773457863656c436c69656e7453756767657374696f6e73496e697469616c697a65456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e41637469766558436f6e74726f6c456e636f756e746572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e4368616e6765476174655f55706461746543726564656e7469616c43616368654f6e4368616e6765222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e446f6e744e617669676174655769746848696464656e53657474696e6773222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e5573654f7574707574496e736572746564466f724f6462634964656e74697479222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4163636573732e756e547261636b4f626a65637473222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e416e64726f69642e416464506172616d4b657954656c656d65747279222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e416e64726f69642e50726566657463682e53686f756c6444656c6179437369436163686552656164222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4170706c652e5469636b6574436163686544697361626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175674c6f6f702e436f6e766572736174696f6e616c436f70696c6f742e456e61626c65537065616b696e67537065656450726f6d7074222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175674c6f6f702e576f726b666c6f7744697361626c65642e5265706c6163654f626a656374576f726b666c6f77222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175674c6f6f702e7465737441416e6577222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e4f66666963654167656e742e436c65616e46756c6c52656163686162696c697479456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e4f66666963654167656e742e456e61626c655070744167656e744272616e644d756c7469416e676c65536561726368222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e4f66666963654167656e742e456e61626c655070744167656e74436c6175646541646170746976655468696e6b696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e4f66666963654167656e742e456e61626c655070744167656e74436f6e74656e74416464726573736564496d61676553746f72616765222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e4f66666963654167656e742e456e61626c655070744167656e7444657369676e5374796c65536b696c6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e4f66666963654167656e742e456e61626c655070744167656e74496d616765536561726368496d70726f76656d656e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e4f66666963654167656e742e456e61626c655070744167656e744f6d69744665746368496e737472756374696f6e73496e50726f6d7074222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e4f66666963654167656e742e456e61626c655070744167656e744f7075733438436f6d6d756e69636174696f6e436164656e6365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e4f66666963654167656e742e456e61626c655070744167656e745161546f646f47756964616e6365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e4f66666963654167656e742e456e61626c655070744167656e7453656c656374696f6e436f6e7465787447756964616e6365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e4f66666963654167656e742e456e61626c655070744167656e745375626167656e7450726f6d707447756964616e6365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e4f66666963654167656e742e456e74657270726973655375627374726174655365617263684f6e6c795f312e312e30222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e4f66666963654167656e742e5070747853637269707444657461696c73496e536b696c6c4f6e6c79456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e4f66666963654167656e742e50707478537472696374536b696c6c496d706572617469766573456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e4f66666963654167656e742e56616c69646174654d697373696e6752656c7346696c65456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e536c69646553656e73652e456e61626c655241495265747279466f72496d61676547656e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4358452e426f6f7449646c655468726f74746c6572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4358452e48696464656e466f6e74734d736f466f6e745069636b657257696e3332222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4358452e4d736f2e52656163742e4f6666696365486f73742e4973436f6e6669677572655344584261736550617468456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e43686172742e446174616c6162656c4e657750726f7045646765416e63686f72222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e43686172742e50726573656e746174696f6e4c696e65456e64696e67466978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e417070564d61785265747279436f756e74222c20225622203a2022696e7436345f747c313422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e417070564d6178526574727954696d654c696d6974222c20225622203a2022696e7436345f747c363030303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e417070565265747279496e74657276616c222c20225622203a2022696e7436345f747c3230303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e4368616e6765476174652e4e6f5370704d7369496e7374616c6c32222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e4368616e6765476174652e5265736574436f6e74726f6c436f6e7461696e6572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e4368616e6765476174652e557365456e756d57696e646f7773546f4761746865725665746f73222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e4368616e6765476174652e5665726966795369676e617475726573222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e446f72694f6e496e7374616c6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e446f72695761746368657243616c6c496e74657276616c222c20225622203a2022696e7436345f747c393030303030303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e446f7269576174636865725175657565496e74657276616c222c20225622203a2022696e7436345f747c36303438303030303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e446f776e6c6f6164436c69656e74576974684d534958222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e49676e6f72655665746f4966557064617465446561646c696e654c657373323468222c20225622203a2022626f6f6c7c312220 OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.11 = 205c2241637469766974794c6f6741646441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674361636865446f63756d656e74496e666f5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e74727946696e616c697a655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6746696c7465724f757443757272656e7455736572416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674c6f616446726f6d53747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6753617665546f53747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565436865636b5265766f6b65644544505c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565526570616972436f7272757074656446696c654173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674d6f64696679436c6f6e655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c654f70656e4572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c65526561644572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c655265706c6163654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c6557726974654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565536574456e74657270726973654461746150726f74656374696f6e4173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575655472756e6361746551756575655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67436c6f73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d6974517565756548656c706572456e737572654469726563746f72795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d697451756575654d616e61676572437265617465496e73616e63655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2241706943726561746541637469766974794c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224170694372656174654c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d69745175657565536574456e74657270726973654461746150726f74656374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436f6c6c6162436f726e65725c22203a207b205c224576656e74735c22203a207b205c22436f6175746847616c6c65727955736572437265617465416374696f6e4875624c69737446726f6d536e617073686f745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22436f6175746847616c6c65727955736572437265617465466c65784c69737446726f6d536e617073686f745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22436f617574686f725570646174654c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f617574686f72476f546f43757272656e744c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795573657252655265676973746572436f6e6e65637469766974794368616e67654e6f7469667949664e65636573736172795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e6443686174427574746f6e497356697369626c654e6f7744617461706f696e745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572436c6f736553696e676c65466c796f75745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e64497343686174417661696c61626c655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572794f6e436f617574686f72735265747269657665644173796e63506f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795265747269657665436f617574686f72735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572794f6e436f617574686f72735265747269657665645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795265747269657665436f617574686f72734265666f72654173796e63506f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279496e6974464d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279436f617574686f72577261707065725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e64436f61757468696e6757697468416c6c4775657374734f724d697373696e67456d61696c456469746f72735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22476f546f4c6f636174696f6e416374696f6e487562416374696f6e4a756d70546f417574686f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572557064617465417574686f724c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572557064617465456d61696c416e64436861745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6e7461637443617264416374696f6e487562416374696f6e53686f77436f6e74616374436172645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279557365724a756d70546f417574686f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279557365724f70656e53696e676c65466c796f75745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22456d61696c416374696f6e487562416374696f6e53656e64456d61696c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e6453657456616c75655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224d736f494d5365727669636573536642506861736531496d70726f76656d656e7473456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224368617443616c6c6f757455736572496e697455495c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f494d5365727669636573497357616343686174456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f494d536572766963657353664257616343686174456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f494d536572766963657353664357616343686174456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617455494d6f64656c4f6e55494576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224368617443616c6c6f7574557365724f6e5061727469636970616e744c6973744368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22486973746f727955585c22203a207b205c224576656e74735c22203a207b205c22556e7365656e416374697669747943616c6c6f757450726573656e7443616c6c6f75745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224163746976697479506167654d616e6167657252656769737465725669736962696c697479436f6e74726f6c6c65725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224275734261724f70656e4c6f63616c56657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434163746976697469657341676772656761746f72496e69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434163746976697469657341676772656761746f7252657475726e4572726f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243437369446f63756d656e74537461746545787465726e616c556e7265676973746572446f63756d656e744c697374656e65725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243486973746f727941637469766974696573466163746f727952656672657368416674657252656e616d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f62616c744163746976697469657346696c6556657273696f6e4c697374557064617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243536f61704461746150726f7669646572496e69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616765436c6f73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616765436f707956657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616765436f707956657273696f6e496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f7279506167654372656174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616765526573746f726556657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f72795061676553656c65637456657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616e654e6f6e436c69636b61626c654974656d53656c65637465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f63616c41637469766974696573426567696e526566726573685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6666696365436f6c6c61624163746976697479436f6d6d616e644d534f446f63756d656e7450726f76696465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225368617265506f696e74436865636b4f757446696c65546f4c6f63616c466f6c6465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546f67676c65486964655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546f67676c6553686f775c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225759574143616c6c6f757453686f7743616c6c6f75745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7365656e41637469766974794765744c6173745669657754696d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7365656e416374697669747946696e6443757272656e74557365724c6f67696e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7365656e416374697669747943616c6c6f7574436c69636b65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253686f77536d616c6c53637265656e435759574143616c6c6f75745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253686172696e6755495c22203a207b205c225375624e616d657370616365735c22203a207b205c22436f6c6c616250616e65557365725c22203a207b205c224576656e74735c22203a207b205c22536861726550616e65436f6d706c657465446973706c61795c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2253686172654469616c6f675c22203a207b205c224576656e74735c22203a207b205c224e61766967617465546f5765624469616c6f675c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253656e6441734174746163686d656e745c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d2c205c224544505c22203a207b205c224576656e74735c22203a207b205c22506f6c6963794d657461646174615c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c225369746573536572766963654170695c22203a207b205c224576656e74735c22203a207b205c22526571756573744173796e635c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225265616446726f6d43616368655c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c224f666669636553706163655c22203a207b205c225375624e616d657370616365735c22203a207b205c224465736b746f704261636b73746167654e617669676174696f6e5c22203a207b205c224576656e74735c22203a207b205c2252656164446f634c6962466f6c646572427956726f6f6d5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22526561644d696772617465644f4443466f6c646572427956726f6f6d5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c617a794c6f616446696c6543616368655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224c6f616446726f6d46696c6543616368655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2253617665496e746f46696c6543616368655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2252656164546869735043526f6f745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22526561644c6f63616c466f6c6465725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225265616453697465526f6f74427956726f6f6d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224765744974656d57656244617655726c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2247657452656d6f74654974656d496e666f726d6174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d207d207d207d207d2c205c22436f6c6c61625c22203a207b205c225375624e616d657370616365735c22203a207b205c22436f617574686f725c22203a207b205c225375624e616d657370616365735c22203a207b205c22436f617574686f72446f63756d656e7448656c7065725c22203a207b205c224576656e74735c22203a207b205c22547269676765725265747269657665446f63756d656e74436f617574686f72735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225265747269657665456469746f72735461626c654d616e616765725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225265747269657665527463557365725c22203a207b205c224576656e74466c61675c22203a20353132207d207d207d207d207d207d207d2c205c2241744d656e74696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22446f63756d656e744163746976697479496e746567726174696f6e5c22203a207b205c224576656e74735c22203a207b205c224164645265636f7665726564416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2250726f6365737341744d656e74696f6e4e6f74696669636174696f6e734c6973745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6d6d656e74734e6f74696669636174696f6e436f6c6c6563746f7252656d6f766564436f6d6d656e74735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2250726f63657373436f6d6d656e74734e6f74696669636174696f6e734c6973745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22536176654c6f67466f725265636f766572795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22437265617465446f63756d656e7441637469766974794c6f674d616e616765725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c657465436f6d6d656e7441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22446973636172644c6f63616c416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c6574655265706c7941637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2243726561746541744d656e74696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c65746541744d656e74696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c6574654d6f6465726e436f6d6d656e7441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224372656174654d6f6465726e41744d656e74696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f70656e4c6f6746726f6d5265636f766572795c22203a207b205c224576656e74466c61675c22203a2035313220 OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\VersionId = "uint16_t|0" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs OfficeClickToRun.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeBackupPrivilege 5880 OfficeClickToRun.exe Token: SeRestorePrivilege 5880 OfficeClickToRun.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 696 OfficeClickToRun.exe 696 OfficeClickToRun.exe 696 OfficeClickToRun.exe 3204 OfficeC2RClient.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 696 OfficeClickToRun.exe 696 OfficeClickToRun.exe 696 OfficeClickToRun.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 5532 OfficeSetup.exe 3260 OfficeClickToRun.exe 5880 OfficeClickToRun.exe 696 OfficeClickToRun.exe 3204 OfficeC2RClient.exe 3204 OfficeC2RClient.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1420 wrote to memory of 5532 1420 OfficeSetup.exe 89 PID 5532 wrote to memory of 3260 5532 OfficeSetup.exe 93 PID 5532 wrote to memory of 696 5532 OfficeSetup.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\OfficeSetup.exe"C:\Users\Admin\AppData\Local\Temp\OfficeSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\OfficeSetup.exeOfficeSetup.exe RELAUNCHED2⤵
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeOfficeClickToRun.exe platform=x64 culture=es-es productstoadd=O365AppsBasicRetail.16_es-es_x-none cdnbaseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version=16.0.20131.20090 mediatype=CDN sourcetype=CDN O365AppsBasicRetail.excludedapps=groove updatesenabled=False bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown uninstallcentennial=True scenario=CLIENTUPDATE3⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:3260
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeOfficeClickToRun.exe platform=x64 culture=es-es productstoadd=O365AppsBasicRetail.16_es-es_x-none cdnbaseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version.16=16.0.20131.20090 mediatype.16=CDN sourcetype.16=CDN O365AppsBasicRetail.excludedapps.16=groove updatesenabled.16=False bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown uninstallcentennial=True3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:696
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5880
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /progressandlaunch AppTargets="root\office16\excel.exe|root\office16\onenote.exe|root\office16\powerpnt.exe|root\office16\winword.exe" ManualUpgrade=False ScenarioToTrack="Scenario:{477E0208-58BD-4F33-978A-09BCC9AA9EB1}@INSTALL"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3204
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\APPVMANIFEST.dll
- Size 858KB
- SHA256 26b092d6651bf7df19ef13fdc8b6f4edc23f716f44da9b306315b00e68e8a4bb
- MD5 08988de4b86569035b887dc58277bf3e
- SHA1 a9fa3a9b9db6a51fd19166ff3ac8f5d657115ed2
- SHA512 1e5c6cb02c0dd22725e0530c8eff6d34de75807ff4c0c29a2b7ae6e6d0f4e73d8a9a0d552c4291bc19aff93d114523aa842d7141a4bccac09bd0ab25cfce9724
- SSDEEP 6144:OOwlecZe1QcdtTmqz2XKTPRnc84tufOFaUtcYVdoPmOFa1KWGNU6ITLNlY5fe5F3:3cZJcdRDVscsdXJGNUbTbp2cXm8
- TLSH T1B915B503BAEE4610F2B79AB8DA738560EB777C411934D30D01A9954E4FA3F409DA7F62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\APPVPOLICY.dll
- Size 944KB
- SHA256 67616e4012d8c6471d98f6da1e41854ccf2d7795c27e3c0234dff5fdbe235ae3
- MD5 71d8b0e0702f251b5a4cdd7365674faa
- SHA1 88d21aaba5f60b13ebf3bff9d182f230b94ee27e
- SHA512 6bd2c34ec7670ddd64e7726bc9d6f9b16cf13c6188b110b88af2266ddad2e3d42328c0c71a013eb77ea5c54c957075349cf81c298ed66b4662b36a28ae378746
- SSDEEP 12288:LAlU6Wls12ZnMncFoTfcGNUbTzGUUzZ8/BYSzePkXpWACfE:gcnMncFYfWGUUzZ8/BYSzePkXpWACfE
- TLSH T1DF2583036AEE4210F2B79EB9DA734460AB777C414934E30D419D694D8FA3F40D9A7FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll
- Size 131KB
- SHA256 72f4614196570969975123af1dd2e2c7a28726342edded20c6ea11d592ad6eca
- MD5 611c8c2619ee94241d740ea4e6045566
- SHA1 29c7caa83cf3737110eb2b63c40208a586efe36a
- SHA512 70a2b3d8e1ae943d0c1be281ec4db1b3568c641b87f9e0926ec5dafd1851bfe414e658c89935e3f44569fecc433af732b5714548cb519276bc9a28c8961f3a78
- SSDEEP 3072:CpYpvpepZpiYAvQFGG72UJWS34b0mdCYEtgr:CpYpvpepZpiYAvQkG7L94bNdf
- TLSH T12DD33961F22451EBD1ABD170C1AB9C77FB72BCAA0952A30F47B2D1161EA37407F1EA41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvApi.dll
- Size 360KB
- SHA256 4b2af96928e174ed97031c3859b16e879ca54c3972b10ffcb6048e3d31ac55bd
- MD5 88b91b6010799857ee56f18cf04b4cbd
- SHA1 bbacb5c2628bb29211b60e55680bd272303efcf3
- SHA512 7436079fef579d874796b3d2e5824c238710bf2277ffb0736d7c3d8b395fb15b3a4eddb86bdae49aa5eba86f1608e4080f4f198979480dc4b69f9a37f51ed3ef
- SSDEEP 6144:5tllGjuqSeZ9F8MBWOkRwADpHm5BWGNU6ITLizGqIN5Iw:GaeZ9FjQDo5cGNUbTnqIj
- TLSH T195741926DFA0E521EABB9EBC9B37C630D7B774511231D30EC2A1C109BE173D06A59E25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvStreamingManager.dll
- Size 181KB
- SHA256 91dccc2e5f92f8c70747c41617d1f4f3953ce2ca2cb3861dbb27001be116878a
- MD5 c27fca7bf8a26a6ac5187c0c0c6eaafe
- SHA1 5e0f037ae0e3bd422edfc2e2a2a4637200dedf1a
- SHA512 f7ea9a25ae2d63afbfddffedd95cd6044fd8e7967e99bab7865349de76e681e27276218ca7c08ede54b56cb73248c5feab387fc181d2786ea18fec9860636109
- SSDEEP 3072:kT8//4KypQhxoWGNU6ITLmP00u1tlFVNFVNdt7Zw1BsOGjHbK6R:K8//phCWGNU6ITLmP002eY5R
- TLSH T1FB04A4BBCD34E413C3BE5CB49763CF20AB76E2605681220AD275D16D1D433D1AF9AD2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll
- Size 909KB
- SHA256 5da89a3c8c14c63f318bb836a1fbebe4d89fc225c31c8884ef982cbe42070088
- MD5 a23d6077fc48a6551ce4ddb0b054f6f1
- SHA1 af24e2d3a3ee0190d3e09586e69e68353b30bff6
- SHA512 4ffd4bd8f2adcf147859a394cb2e40637e354d7172912b3132a50084cfc615dbc683c46c465bf06bf1dc7d930e74995d018309c69b7123915d1666e0289d7eaf
- SSDEEP 12288:6ceu/Rs1dlghuQ2Oe5aKyfo0IYQCoHvdu9bGNUbTA796858Mngc7gI:a0Rs1d+KyA0IAoHs9+ngc7gI
- TLSH T18C156D2FDBA88165F5BBD6F69A73C532E7F3B4451230530742A1C60A7F237A05A1DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll
- Size 462KB
- SHA256 18beb1ccc4fef771ab6c8b0b2ab8f808bf9099a75993d7c60f82296472f5df92
- MD5 8c97e8fac3a5a3402b5aef471ccafc94
- SHA1 bc354086249dbadb50d11e8677cabfd3db68c0e1
- SHA512 8d7905650d2fd185ff89bc617f780dc590cec5beb368364eab97693f7ca11586e6ee68eeea9e2af45d08693f7683a0251317c7d17816204d628ae10533186b51
- SSDEEP 6144:Zh9hVzg+HkFfLECfKiYsAm6fTUhByfNNdiWGNU6ITLIpwDgNg5Um7l:XkFfNCHse7UrydjGNUbTGgvl
- TLSH T1EFA45B76DE649821E2BB99B89B73CB31EA727C1502609307F3A1E1562F33FD06609F15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll
- Size 740KB
- SHA256 0c2eb6902b9b45a5b9426dd047b7ee8c66359b456286d411ba0360fa74458c9f
- MD5 db9c54c1bf931f37bb8c9b5529cb3d1a
- SHA1 f773db9837324da9dce2a7ef61adb65fa54a9908
- SHA512 e7a154021f56ca0e1c4b72bc720785bc7db520e8d099fb124876f8d3fb0bfb4bfde5468b0596328d9cba3a7eabc3f308ac6404d0b06ea199f5392f3b2cf35708
- SSDEEP 6144:lLBH8o9ezpjKm1E524HuvqoswpOQG+7V+wB0XNWMPyy/aUe55E3Hiyt7eBa5p3O5:8o9/oTh2RV1d3OY7BGNUbTu9J
- TLSH T146F43A259AA49664F1FBDBF59A338631FB73B8895230930B4391D13B3E23790591DF22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RUI.dll
- Size 2.9MB
- SHA256 85e5bd11896a0bdbd3e988dc8622af2f6c960a4937ac38bf8a651e536c5a3b6d
- MD5 3b1b8624062fb013e5982f1811db6ad9
- SHA1 f66a060d6f0d41dddf1efe50219475c454c05c36
- SHA512 1c61c0627b4df35cd0ed1d706c194367580d3c27fc81cfe1b01027be126c769b3f3080545c23e05786a463f4c355b5810367a05ed014cd621acc81e0fd003c17
- SSDEEP 49152:C7ldz9Wx9AUCCI353ZLHkGaanBilKpzoajPF9Qco01xWZ3sl41w5cc50zjr:slZsSyan1rzFnx23r
- TLSH T1AAE56C1667F806A9F4BBE6B4CA778532EB727C061631934F0661C68A1F377214E3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\IntegratedOffice.exe
- Size 4.5MB
- SHA256 40e14c3104504972c53880b932d877b213f5dbe014ec3076517abe2b4365e92b
- MD5 f639078c9e493cf843322e1e336fbbe2
- SHA1 3c955f04d7ea18665abd675334466d93059ad492
- SHA512 63575c362b840237e120fa41e16ca9a9fb879fcc055625c79a3f25f84bd2fe5498c59e755e00ddd23ccad9e6f0df966fcc7f57ff9a780ab05c8d6a0973d86d0a
- SSDEEP 49152:ymZD4ksS+/WgNTu2AAJRMQpaLu6GVJaaGa2WWX/ju9r1Rr7YxggIYTc0dlsNZ+0z:PsS0uWnaaXHm/a9hsrHFI0I
- TLSH T1CA267E5663E415E9F0BBD2B9CA778533EBB2B8460231974F06A0C75B1F376205E2D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\MSIX.dll
- Size 657KB
- SHA256 cd443b5645bf2c66c883cbf0df091a3d5519c9f534fc6003867b10af0bb499e8
- MD5 499a1a771d95cac5174c44c8314e9e09
- SHA1 bbab3646c3147c9815fd97a8a7583c570fb034c0
- SHA512 72421dd277cd336f043448d4652b633fd5d81d87f177fe41f78da96726c16e1995be7ee373db6d5f564b6837126ac8b52e2f2e5831a2bead623d5daa06fe6791
- SSDEEP 12288:MVtleLjozn6qBXCiQnprBPzGnjST2l8crdHp+f:MVv5zn6qBSiQnplEj82lNtpK
- TLSH T143E48D3AEAAC4026D1F6D17CC9A34526FBB678050372A7DB47A056892F277E01F3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\MSVCP140.dll
- Size 555KB
- SHA256 b30327d49edc035869ce340ee60680d2bbd0684cc359bf5771695fca9aafbb42
- MD5 f852e4ce8718e3f70317a713997d9c89
- SHA1 f7b8966b18a5f29a46d931d7076da2af649045b8
- SHA512 151880d00db1db6ec34b23541ebbd3f8160b32750ffaefc7bbeff2943bd536f2e2b786dbd45eaf3cd2de63ac14875f4f485dfc5efb8bf9e04b0c6b5732e1fdaa
- SSDEEP 12288:fdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa6b:fdnGoU/7m/V5WZkdQEKZm+jWodEER7b
- TLSH T116C41A27F74906E0E195E3B8A1838702D7F1BC4A8322E3C752EB955D2F573D0A67B690
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\VCRUNTIME140.dll
- Size 132KB
- SHA256 b573edb6f63037c8ca94cbb333b48111b5679b59dbf081c8ba5d62053111ea3e
- MD5 70c0d3f99d77a04c0881f9ef448d77de
- SHA1 39c49abcf5686d29e99bfd4a24d1f48ca0188d29
- SHA512 de3840d628f9690fac01d3435cf96b77ca01626950ae02f51e7e36a502b8e4a5da9700228b636a7935b1da3f8458be15825651a6939e1dee6802968c9a115459
- SSDEEP 3072:ctkenID0f6aifkHWBXjGVBuecbfmzZT7w+ywS:lWSIHWBXjGiecbf4PSv
- TLSH T158D38C42B2B801FBC16BD174C2A2AE23FB76B546476097DF03A99A640F637D06D3D349
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\appvisvsubsystems32.dll
- Size 1.0MB
- SHA256 10fe48686fdb3d5d144bae3bfe8e2a39508812e116b2802d3afa6af0709b7ed0
- MD5 074a92570849392cd28c061503b3a1e0
- SHA1 5ac663ce317f74818c4f37edd831bd347c873d4f
- SHA512 c2070e173d3585693bcf704bd6e3d423a2e50b5e3b570643500e1f7e623fb52dfe1fdf8c611238c1573853f63975f84ff6eb9c723a3a6cca77e9a52d8c9c2ff5
- SSDEEP 24576:a/lVKSvUo0xeMQ64ZUNJvRPuTTwPdogUB74WalxX:0N34eMQ64ZmRPuTACgbWalxX
- TLSH T11E256D73B658C439F27E06711A35E7B44266B8710EB1820BB7E4979D2E709D1DB2BB03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\c2rintl.es-es.dll
- Size 55KB
- SHA256 ea253675f562540da7c911498557439dbc223187cf5213bb6251aa8e466a31a3
- MD5 9f3dd6ac1e642e183b122fa30a5b8662
- SHA1 4e98aab5228e48ba2ed623cbe583ca83c2f9eec0
- SHA512 51584901bc814c6f86b263738d0bf247287f147f4015fd96a0d6e41b5bd3ab1110035d4bb7975f0c705752aff0e5fa2f0c2d57ee7e3240f6e9ce972287538de6
- SSDEEP 768:Nwxdft6WltnyVcoFFazhjPrNhExoC9AICQXKA67PHpd0qpbdWy+ePF9zU7X9zp:NsdftEVg94gICQXU7vpCqphWePz4zp
- TLSH T142439F9AC6D94943EAA368B543C1DD57FE3C46C73844C66399EFD42900C37C8E33AA69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\repoman.dll
- Size 2.4MB
- SHA256 c0522ff864e01f07d55208476e998de7b1e435c8aee21b493c94643a5e330fdd
- MD5 109c1d73700eb47ba44b184518170cd4
- SHA1 71adc54cf22b05a2dc075c701f49da5725ab7cd3
- SHA512 acba93c58aa93f2f4afac273b276cbd8eceedf780df16bbfc0f4e2972ecd7258ab7f8d5cd36f8c8b37eab172c2a66b30dcc4da7d8cba005ba583c00c0ca6a9e2
- SSDEEP 49152:Qtdc1neeKRQhAfFwmc83QlGaQ0H17x5Al:hKLOmcLlG10V8
- TLSH T199C57C2BB36C40E4E076D279C98A25A7F7B2305B937163CB02E0DB595F637B2553AB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll
- Size 511KB
- SHA256 26da69d6ece289a73e3e9a1659d201d10fee1160ca04bcd6ec174fc68665aaf8
- MD5 0655c81cb6d4dd676afaab0ab59e0927
- SHA1 7237ae89d9766c34a6fb52032eae95e830b56219
- SHA512 fa9d955ff9b8f77078c09c873d8a6e6298dbc28d4e4b978318abbb0f9eadfecba4139454abedfbb2a6c97f831729169b02f4c1624e795e57bc125f9894200e12
- SSDEEP 6144:IxYdnG2XQbLEiBjddKEDGFxV20iRbEk3W7lWGNU6ITLz4cdCGOXbP9UQrmFd:HQbNBfKEyF720SmkGNUbTgGA9UeQd
- TLSH T11AB43C29DA609625E1BBD9F89B33C631EB737C415270930AE3E1D1167E33F906A1AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll
- Size 247KB
- SHA256 5b28a8458d805865ff1a8c47eced122f4f9341474bf284ef02494d34c76e29c5
- MD5 33f18561080f0b8cffe3f0bcba92a134
- SHA1 3727cea87922bea8abfcd3ae699e33d73a1b027a
- SHA512 e024bea659f36942b28e7b34c280d33f9af85e1fcf18bd910b2b900eb2a2db6e0c0acd1b86baf34bfa17a2efb743a2334a9fbc8066900e0a0dd10b603a819bba
- SSDEEP 3072:QmQQiKfLty64XeX4gBY43hJWGNU6ITL4ABSqMqn5x8jrR86L8wPuzw:QEzcpOXs43HWGNU6ITLrx81
- TLSH T19A440777CEA5E413DABF6DB45B338620EB3278104670930DC268D12D9E477D0AE69F29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll
- Size 1.5MB
- SHA256 005be5975a82b238a0208b0b777478b24a334c076583e61f56aa7ba52a9ea840
- MD5 e3ba94f9efcd9d98e68e35b7f4f1e2e2
- SHA1 a267a2e649375a942959322c2b58848d7875e4cd
- SHA512 4e14b38438258bebcb3c49137f9fc3e8e3f08e0f979ce9b6af6cfd278131678d98b9394fff72fe20695484c22907e4408b3bc1703f13c3de01b791fd970fc650
- SSDEEP 24576:IIoBkQS2/mJMsNV1wZ8Xqn4edZPlrPVkXCg7aVGd:IIoMMokZ8qnFzVkXCg5
- TLSH T178653A16A6E48668F1F7E7F8DE374932E77378495630830F43A2C6197E237605929F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 27.2MB
- SHA256 ca77621fb48825f0fe55b76937b5be937d19996e7c5dabf4c161162a32d14a3a
- MD5 46ffc4d77fbcff5d505ee3832b81b38b
- SHA1 98bb8ffd8fe4a66ae601a83f529c56824f6e7df2
- SHA512 da1835aa1c1e1ebb6c3b42c7317550980a802614093d38e4a4903b21046672f415c252bea9e21a8f4195a15a435564b53d0a8c40662f8ad653962ee061ea2da8
- SSDEEP 196608:WoirOzEwZGfvFHu7U7uXfRCCYacXMwYdM7lIjgKIoggp7NpbDUgjejamLuhi+1VD:Li5vFO7rfRhYacXMwY6/wBD
- TLSH T1B657379AB2A817D6F2A6D13085765233E2B17C1D1B21D32B0D34F50ADEB73535C29F2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
- Size 12.8MB
- SHA256 b25677bf096359738860167e0a1b66ac1e83dd0dc9b295c1806c1e35532077cd
- MD5 e604a3202e29077798b11b6930c841d2
- SHA1 b807b074d93ebbad893ee562d596fa00befb9653
- SHA512 79a90866b2a1d5392aecc604a9a8497c8eb53ec515b94cd902ad690906d02c3c5db6243a88e738ca1a1d718e278310863141a64ed1cd2c6326406c3a5a952bb4
- SSDEEP 98304:dW2AEc7Hp58/aaYssyhmEhuUNkTZjczHmrG8sbsnLqfZPczqoRB:dW2AZf8jIM24HmrGFbuqfZ+qyB
- TLSH T173D64A89A2E926E5E0F6D1B4D92A44B3EE717815D5B1A31F06E0C6C71F27A308F3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\Updates\16.0.20131.20090\i640.cab.cat
- Size 33KB
- SHA256 b9fe5bb99d32ba5631e9234cad815a6b3efe752711dc985405cb08e7b69b5338
- MD5 9227b7b1c8d6afa3bb12b2248df9a8f2
- SHA1 93e8cab35df86d4f5060f47de85801a749bb5ab2
- SHA512 be87e8bff45b4569d0775941244f9de0d4eac7b2fdf8b10307a2221d382c8c0467bef84a3c350f7291fd2667bae3eba59ce53fae359b63071b84adfd2bc8cd2e
- SSDEEP 384:sKlKiHQwG1ik6kWaW75nURp6NILvbYJ/oWy59b5WBlN0KhAscmeR9z+T3F:h4iH2X6RnURp6NILsoR59bCA7N9zM3F
- TLSH T128E20E2194000683C15F693854AAFA3ED0FB8FBE9091623EB5B7B6740577295F72FA13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\Updates\16.0.20131.20090\i640.hash
- Size 106B
- SHA256 f4e41f0876ed6d7669dc36e64fb7a242954648315d63c9cd9f388e9510f870fa
- MD5 77f49be15a3b7357f2b3466c2de0e3bc
- SHA1 da9d1d5210d67a7fb5566046ab9e9757ac4f461c
- SHA512 a7caf16e7c239c59f4aa1629e109c8abbc2cde1082ba2cb7284481b93d0a5f6d889f04909c90f517f29d32a54e3a94c71de7f4e504f6923d96744c0394cd462e
- TLSH T153B0123D0474131B8070C29451C081F336445527F1444B3101C98F8287C628370C19FB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140_1.dll
- Size 59KB
- SHA256 4d7f36ff507edb8b712129500b2b2c405db44818a5ceeaf82f6f46d73639a071
- MD5 50fb26d12be84d962a41ef4f497e29cc
- SHA1 7ae2368b0bca9e2e41b637aae3a641fac1e67971
- SHA512 65cd3ba610a943e6ff4bd3f59a326d64c06814bd79f4f0cbb65078099e1f2899e25f90b1bc9db284b30d0656fcf3660dc46203d0168d0b43585770c2b481894a
- SSDEEP 768:73oZYctpzcx0pdESj95Q8cTgU9GOa9zv2QZs49znbTUDM/9zU:Dc6MjVcT3Azv6wznvUYzU
- TLSH T138437CE157785083E8ABE87081D6EE577D38F3931B50925B06A5E5481FA37C0FB3922E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\20F39E74-365D-4ECF-91EC-5B44FC437558\en-us.16\MasterDescriptor.en-us.xml
- Size 40KB
- SHA256 3fbf9c455b05850239640c3cf72ecb77b74abe8c23c65a9b3912819f1b1a35dd
- MD5 2a2643ba4e9b0993e7d121368234fd7f
- SHA1 24cd7e949298675aed1409e4d30f83fbead3005c
- SHA512 78d2e8b02256714fe453aa25ea07ab46b0e9a49a834caf10c3accd48dd33b9b1e209afceef0524d9c49431ee45d4277a05891cf646642ed7187c89ab35f68a15
- SSDEEP 768:h3jnQsJ3namZRxJpSfiBwQqJrZyWj/0jxQDe+OFQdLudiROOqn5yptSEelAaeHbO:J7b
- TLSH T1DF03D34070F988D2F3351946F7E36CEAEE7911F34E262AA5315EAA172F3B9506137443
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\20F39E74-365D-4ECF-91EC-5B44FC437558\en-us.16\stream.x64.en-us.dat.cat
- Size 79KB
- SHA256 966e9c36b9f890d0b31cb09b0a19e90cce70082f3bce232234518052f6fd9b55
- MD5 f6880a586254b4398bdb0322ef74ef9f
- SHA1 670b7498ccf13cccb92e2715918a8683878adbcc
- SHA512 9d4c1a832dba34c54f64262c5b92a4f6e9f2bdaa65efbc1c90a13364faa5ea2f69b4a9ba27d049f51938b18e38488ee0093556739f77d479d04c1bfeb0a92b7c
- SSDEEP 768:6bwbCTBiTiS5s55tXi15q5o+Z8OSvS2hZGZXrkrhXXXXXXX/WhR9zn:6bwbCTBiTibt6+pSvS0WRzn
- TLSH T1EE836721A40006C2C15F693854AAF62ED1FB5FBDA051A23E747BBB700937295FB5FA13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\20F39E74-365D-4ECF-91EC-5B44FC437558\es-es.16\MasterDescriptor.es-es.xml
- Size 41KB
- SHA256 56ba86d8c75f36155713855db50c9bb68356c20fd210847e76100367d7885a98
- MD5 152aed77704fe53742dbe31d8f7f8ee9
- SHA1 13ba175517d025e16f3acb8cdb8efced7ed81d4f
- SHA512 519dd718d2e97263b8483a25ba51d28a5f59c2bbb6be09b4157f391652d2f52522d668b324f88e8a7c1394f41908bf1f256d915ff0c30d653163727a99f35cb5
- SSDEEP 768:Oxq1UsJ3namZRxJpSfiBwQaJFZ6GFHW/xQtI+OvKUdLudiROOqn5yptSEelAaeHP:2wgQ
- TLSH T16113D04070F988D2F3391946B7E36CEAEE7910F74E262AB6315EAA172F379506137443
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\20F39E74-365D-4ECF-91EC-5B44FC437558\es-es.16\stream.x64.es-es.dat.cat
- Size 126KB
- SHA256 6844be7a06f6d0e65b2a3701d1364c5867edf16395520da12af5b0f47358619d
- MD5 fa81b07470db7da588e024f6b56ab840
- SHA1 63ccd8f9ee0d23fcb1c509b5eef0f45728672967
- SHA512 f21a73c454c41b3815ffe099bcf4b1ba82dbcbef97e3844b1d79da15c66b556f61cae9be9a656f48e04b1807af86749235cc4c2d9c79e29b132e437c83aab5c0
- SSDEEP 1536:jdfsfPvH22r54J4cAAydQd+lj+jOv0knksozu:jwvH22rMAAydQdxknkso6
- TLSH T1B6C36620A40006C3C01F6938949AF62ED1F79FBEA065613EB57B77640977291F76FA23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\20F39E74-365D-4ECF-91EC-5B44FC437558\sd640.delta02.cab_extractOfficeC2RD90F964D-EB1B-4642-A282-2589A8DBD9E5\MasterDescriptor.x-none.xml
- Size 35KB
- SHA256 f0101b43f80df770c33cbe3dc86539e4505b1c5c008ff0e3fa53945634e4a81e
- MD5 8882b1b4c35c9e7ac4634057b8db5650
- SHA1 8c0bbdba49b43e6305674900b57fa616e485b87d
- SHA512 9ee1da55ac66b9b45773995bf1bbe9ed2f1efe28e39d699e478518d17d1ea15c149ea7936d4c9328ec20fe09d8b0ae3fedbc0676ffe3b82f88a8cabe1c65436e
- SSDEEP 768:tTsJ3namZRxJpSfiBwQqJrZyWj/0jxQDe+OFQdLudiROOqn5yptSEelAaeHbIBsU:o
- TLSH T12CF26D4070FD88D2F3391641B6E32CEAEEB841F34E262A76355EAA172F379606137443
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\20F39E74-365D-4ECF-91EC-5B44FC437558\sd640.delta03.cab_extractOfficeC2R9B88E861-C961-421C-A41F-44FD2D7BF7AF\stream.x64.x-none.delta03.hash
- Size 128B
- SHA256 8d4e9ad8bee9367259d84156bc7bc7ef667f5c009cb00cd2c9813ba64975c7cb
- MD5 5245130e4fbae3b1fdc3e446310bdf64
- SHA1 449be23c6cdbb14a53967fb79034eca1da7682a3
- SHA512 3fc457f13d2db3b6884adfdd39dec53d0ea0447d91e94e7d4c74a920a0b046f60ad0b83fe17b3215c5dace1bc9e470c42ee099d6af01a262440d64f516c067b6
- TLSH T156B092BA2DBC822B0060C9FC9FC0C01FD105C1F338122B2164D30305D581E4930A303C
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\20F39E74-365D-4ECF-91EC-5B44FC437558\sd641033.delta03.cab_extractOfficeC2RB64C875B-457E-449C-9098-4AC404D3FF6C\stream.x64.en-us.delta03.hash
- Size 128B
- SHA256 6c7e0cc458b668a7549ea64d3d564b34d750fb641b130fc8b4df87211545d4bc
- MD5 030e0344653deb708fa921e42a7133f7
- SHA1 18ad9e9d740912905d98160ba19629a92826f6f2
- SHA512 0b2213b698e9ca4b5f9c52970046230740057e09c2525abd6b9cc12ce3dea8de9ebe895eab7df58adc50258a4e004d2c370fcfe6ceccd1cff475a3a61de23d1e
- TLSH T13FB0927E1CFD82374034D8C92F86D812F008D17350001D65C0D7018801809E032C203D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\20F39E74-365D-4ECF-91EC-5B44FC437558\sd643082.delta02.cab_extractOfficeC2R49B9E33B-6A59-4313-9B4E-6DB93EA94C3C\MasterDescriptor.es-es.xml
- Size 35KB
- SHA256 fb2b3bb9416f17c42bda07c9003d59e1dbf2b73d670449070f860004faf49f40
- MD5 9cc3376750d99321b74537080e6a52d8
- SHA1 55138fcdd6881c0d2c182ae618457443e87729a9
- SHA512 deb7257864ab3104ba9236adf59aaa8ad42269456f72e5fadb659deea7fcf3491db2eede712ed8054b5e53c808493c5aac8cd27cf5570a8976e0478a23bfe60d
- SSDEEP 768:0TsJ3namZRxJpSfiBwQaJFZ6GFHW/xQtI+OvKUdLudiROOqn5yptSEelAaeHbIB2:IQ
- TLSH T15BF25B4070FD88D2F3391651B6E32CEAEEB840F34E266A76715EAA172F379606137443
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\20F39E74-365D-4ECF-91EC-5B44FC437558\sd643082.delta03.cab_extractOfficeC2R8E5C780A-CCE9-47AD-91FF-A420AE21ABCE\stream.x64.es-es.delta03.hash
- Size 128B
- SHA256 8610f7a9c89a3a340ef4ad68766996aeda14c0694213616dc742770eacc28978
- MD5 fc9da07d43c91eac460f27e00360abfb
- SHA1 1b3fa53d068ae2c03424a0ae058c5deca458b98d
- SHA512 44206f2f1ceb91093c934f142f35763f7daa365b16cfd3f3cec144632fe1943b60b5287d1df3e8ca911d35ab663bb2d23c144ffaacda6d4193fa89b8721089b8
- TLSH T132B092AD0C7D53334020C6D0CFE0C833B440D0A67151043985C3C74A870BD37A5471BC
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\20F39E74-365D-4ECF-91EC-5B44FC437558\x-none.16\MasterDescriptor.x-none.xml
- Size 40KB
- SHA256 ae273673b6050313345f67fcf98e5b657589f2954a6e04921fbd9916b2923687
- MD5 512b9ad22d4bf4a48efb4514f74d7666
- SHA1 c98b74cb61e064737b0d86fe6ce351497ab34fd0
- SHA512 d7844e409322a2a3056a057f0cc5c66eac3596104021bdcf1fd9149a0b20bc0562bae0afa69a95d9737c32ff4da6a28afa5da3d15390b02236fd64bef238465d
- SSDEEP 768:hyMkyhsJ3namZRxJpSfiBwQqJrZyWj/0jxQDe+OFQdLudiROOqn5yptSEelAaeHy:Af
- TLSH T17C03D44070F988E2F3351946B7E36CEAEE7850F34E662AB5315EAA172F3B9506137443
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\20F39E74-365D-4ECF-91EC-5B44FC437558\x-none.16\stream.x64.x-none.dat.cat
- Size 1003KB
- SHA256 5631dfbf7bfe67e036ca0666aea63149ab65b6576d74ed61a403ce1be5982b0b
- MD5 7a243e7aa72cadd38a9696a63d6315e1
- SHA1 e796c8370d71cc53073b539bb09ce55db3c04db2
- SHA512 87691dfd6b27252f86de425433e122d0fb860665455001b4c71427f27bcb60683ebb27fde2492bceb782190e9a04ea977e520814b67782890d2d810f6585400a
- SSDEEP 12288:7/o/cGGGG4CCCCCK2G9G9GTPPq+Z+h2B26:7/o/cGGGGqFPPK2B26
- TLSH T1A4253321940006C3C05F693898AAA63ED1F79F7EA056623E75BB7B744573290FB2F913
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
- Size 471B
- SHA256 0d6d87876eb932aeb927a0ec54d2e94b2bf3c764dede385156b8ea7e51e258b8
- MD5 45d318e1fa1867c903ff6e075cdb6984
- SHA1 176a6a3ffa59c4a7b53bda596673f82567de0cc8
- SHA512 9a8c9eea65b043a0e0513f4c8f47acae22af94fb3ae6c7cfcca25712c6694e2ca8a80b6ce0880e73227cd28c4cfab16b8707922ebfb210d56e78095bdc59be5d
- TLSH T1BDF0D452117DE0013D8A98CC01F0863E3830D0E547B81C16B0ACE97B4CE9734F61D13D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
- Size 412B
- SHA256 d91027d6593e506f47e02bf9a44610c692d36a9016b99ff8774f843da50ccc25
- MD5 59e4898b224a2dae8171176b7a362c08
- SHA1 a3581a7729d68f9f11cf0fa409e01df0fd233057
- SHA512 7365e4d284d78757cb66934996f371bf977c20cbef391778efe0acae9996b04ee97da26ae0bc3d2d9667120dc6064f55ea8bccf93b44d7063e862f727ed938a5
- TLSH T16DE0C62015FB422EF1F0D5390BCEB66486BAF0220421E2B25ED01709AA02B00FC22D38
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\8B7546E3-EF49-4016-89B7-3D6DEC194BA3
- Size 192KB
- SHA256 13c13e80d5a89af30f7a4eac52842cb31c8622efb2ab8a58709c41a8ec33dea5
- MD5 b7d8c5983f978b03a2fa30726b7b7ded
- SHA1 cc62ca0826bc8cc0179e17545668bd37d06bfa9d
- SHA512 bd8ef1c758bd2a74deffca3f0b4babacf6be9c90ba11a381de5de4e898dfe19c8dc2446810902eab9fab32847a3d58d9e5773020fae3aeebc56a545c627392d7
- SSDEEP 1536:urVe3b3yFKx3SNmbQxsghE4qe7HWMDDj/r/Jb2cAZl1p5ihs7VXXhEKD0aO7qam9:Mge7HWMDDj/r/yX257c9
- TLSH T1601402A6B2C75C628B33049D5B57A094FE6E12A708D5202873FAF3578FF2E1CB547291
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db
- Size 24KB
- SHA256 b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f
- MD5 8665de22b67e46648a5a147c1ed296ca
- SHA1 b289a96fee9fa77dd8e045ae8fd161debd376f48
- SHA512 bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da
- SSDEEP 12:TCmqtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:TDqt8VtbDBtDi4kZERDEe
- TLSH T183B24CC26A786161E05A51B7C9B313661779D1A90433936329F254A19CC288A98355FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\OFFICE~1\i640.cab
- Size 31.2MB
- SHA256 6a1e4118008c7c290ea65c43c5cfb35fd985201ff58d91f72a159cc741509d07
- MD5 450c9daba32f73302560792dcb972751
- SHA1 fce9cf45eaa2d97bd949bd4b8411fc3af65d56e2
- SHA512 1e3bf5a7a67d9bfc07d73462d2fd49efe5ef0738c7834228997b75308ea5d48a1879b9b2ecd549f529236c8d34d6d1ccfdfb3691a0e4e22aa1a0dc0b30e28c88
- SSDEEP 786432:sHK5g6VtFPKXS4+MCsXrIsejZyZ2o54bx8Zg4rY89lCnXxNZD4wMop:o6VtgN7IjZW2o5CCZgA/lCnd4wNp
- TLSH T126773305B2412CD7E714973A8F83993CF4FCBD536222AC14B5A97A1F00976B9CDE43A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\OfficeC2R628FF2CA-6E9C-4662-BE06-C80960F1E197\VersionDescriptor.xml
- Size 25KB
- SHA256 ab07ba2009a3df7ab7d6979073a71f11251e8cf8ae55eee7ffcca45629371d06
- MD5 d83f28f36530e12d76181139339bf200
- SHA1 5db6a9300bc2c5ba2846bb3a1ff5989c4eb4ed1f
- SHA512 beff75948c40d942bc7150f8266a33976305877edeb72563b13f676debecc20f8a5eea4907befb4195296a07480f645d613f453c2d76d378656b1a83fa54b19c
- SSDEEP 96:q4wqBjDt5O8qwEB+yY/VqJFWRGB/Aylkmo9g9s5UmiVSItzt3XNIR4ja9a9DMeJK:q4wu/rZ73
- TLSH T186C2456BB8D03D1D413477A7E96336E2EF62826396050458F10D734B3FB285DB3AB619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 70KB
- SHA256 683ddafc08dab83fde5ac8936f6c4e86dbbb44da6fc2c856ab146c82b9f23a02
- MD5 2873266e6fe84b82ca1b83a6b3465870
- SHA1 c19b72bd9fb528b9d4e0a196d4707b73054a5f18
- SHA512 f47502cdad65918468b1872e0d58c84715dc94d6ccda707652594cae7cd58f624e59d0c7f03569d9a5bb2e2cef1ea2dc105fe86c969ca073ba0272102e06a828
- SSDEEP 1536:XAL1QAfh/XARXCXaCBF94SUH2Rl4uuLxl+cbmRlI23yZB3AxPGo8pBXe8qOv4FAD:AQJD
- TLSH T10A635D0984DCC558C5F609627256EF76C93AA587730FCDAA30EC5341AEC3B052FBE869
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\d640.cab
- Size 10KB
- SHA256 6d2eca9bfb18575c6a6a30f8cedc7aa5109334d154c57acdd10d8735f0014ede
- MD5 a1e375fb7860701ba9d7f20577cc50fa
- SHA1 2fd99ead05fad607f54a61c95926c1f9b55e5f4f
- SHA512 580f585897cdefa8b084b049efb612fbbc7699730b8eb031ca9a635c822c6d5f167490a371e193c5e7f511df08881467cf43d23a09debf7cb71ceb4d5995c344
- SSDEEP 192:aScl/cca8LxyQxh4FYqwN4D6+plTNceKyX01k9z3AIUPHSMU:Rcl/ccaGAEh4FYVN4D6+plUyR9zZUPHW
- TLSH T129323AE25E2C9043EDDBBCA092A9EA933D3C83CB1E4099B715D6F58419C37C59B2907C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\d641033.cab
- Size 10KB
- SHA256 90100bb047b78c27eef727b25687b6dce6f52789b54b2fb2623791022c027c01
- MD5 eac1a15918d6ca4aa4dc2d1711f4c296
- SHA1 6bee08d7210bae09305b4bc9f7c20d426a6e34e1
- SHA512 34f01d5dcfc2faf1311d207cc3817974a1696633aa23c2745b0cb75942772bfb3b3aacbc11cfd75763aa55cee0f25a6706f22252c96334933e33c789ef141458
- SSDEEP 192:Etca8LxyQxh4FYqwNtFDHNXcxX01k9z3AlfjOEa9m:EtcaGAEh4FYVNtFDtsxR9zEbX
- TLSH T1E0324BE25B2CD083EEEBADB062D8EA537C3C83D71E40959625A1F84419D73D6EB0517C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\d643082.cab
- Size 10KB
- SHA256 9ba65c7782be72a5f4a420fde897d517749854d1a49cfb8d230d927444ac07db
- MD5 14eb926696e755828f286c09557bd61e
- SHA1 e6614d5b01b1c68fff2f46caa38c3fa072cc9a65
- SHA512 28eff3048f30af5fb0865a19bf3a8f97e2faee38023d58888df97be3c6aa397b12b8824f83607477ddbf477ed0be6cad7b31ce17c754615674245c9801d48c46
- SSDEEP 192:kTca8LxyQxh4FYqwNJcJr7ms+3NxPOxFX01k9z3AgtM:kTcaGAEh4FYVNJV9fPOxFR9zFe
- TLSH T11D324BE24A7C9143EEEABD6093D9FA933C7C93C7195494A325A5F5841CD37CACB1502C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\s640.cab
- Size 2.0MB
- SHA256 a094b8c41a5d999fbc2f5f97ecc194456863646d167271676c8267ab23703eec
- MD5 fbc97a0ec4c5ba167ff44e358d3daa8d
- SHA1 049b0c661ab485447c826b6ec118ca4ca8fb5d9d
- SHA512 d38faeb4e4bc32c04a6a693e5632aa24cc13dbf06c7ed7330feae960c3ab48519bc51e8b146903c852c830d4df5e0fa7082d997f7342b05e91a22da90ca17fec
- SSDEEP 49152:8fOYkpi49OM0UXEMMa5Wvk3imZ+6P7EdPmlUPWwo4Qvb3bU0:8fjMi42atig+iEdP0jbbj
- TLSH T1B3A533990C885E6BE8CEB869A526E9E7C27735D3BD62C0C3567025B20DFCF434B5E406
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\s641033.cab
- Size 340KB
- SHA256 8ccca8ecb5aa44a4179e5c17f4e9ff985efb93815c5dfe98b17ffd1dc436fc19
- MD5 ef481f651eb1f00a094931a9991c4168
- SHA1 0b15e5a0181b529c89b394188fbddced6b20a50c
- SHA512 122eacfa950b4edf62211ff03e50e08c1967a94209403c91386ec25e2f7c761a72f19a26f0361fb19399cb95bc0e0ebefe1bd2cfe7e303fc75860bcd2afff1eb
- SSDEEP 6144:Ykjy1gJopliWF5nuAPASXrw3lmy3PkA9/eVTba37WOOOvSZKlb:YQogJoriA5uq+J38ANeROOO6klb
- TLSH T1947423F6C636C442DC12C473A39884E3B93C03E2587241215A7BADBEB595B9FB74758C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\s643082.cab
- Size 320KB
- SHA256 ff89a083d871197daadb9fb3e120ab848d8e23fdca2f5d72f35450f7ad333eb2
- MD5 25bf1a6fc02bccdba9edeced66a576cf
- SHA1 4609fbae8a1dfd59e438d708001ced109121bb4d
- SHA512 2ee28490f7648c2776df230661852c227d002fed773e71869617935ea5bd60e431243ea8e7a55909bff6a726b9b7fe7773534a7bfa87f5adcd92904af94e92fd
- SSDEEP 6144:g08CAoAddb+Omf6MEZ215mMa3yXV2hPGwIzV3kXzEPDAsH8iNcNfHaDBW:g09GnyOLMEI3mV3yklDYcPjDfHaI
- TLSH T1E76423B9900C31CAD3907BB2A650A1AFF9257EEB16A74D927FA1FC4D61CE3C39D40095
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\sd640.delta00.cab
- Size 1.3MB
- SHA256 e77d00c5fd04a3b5d05e3b6d5339d0919825c29e5ce00bf386e4c8a1f387ba29
- MD5 f1df4ed5b3c8633415943c3e9006ff03
- SHA1 f38bbeab569d2a177b438dd1378b0eabc649ffea
- SHA512 26521ac956df5dfc3ab22e427a9c468b92048d65af3221bf41ef74b76d4f308c60966642ad29a34d590bedcf9c9a7bf56e27ba8dc225b1e57c9ca4b9a2b7c0fb
- SSDEEP 24576:yMla28LPexCUZYgFbfldH4lmNfqd0IIZQ2AqkQcJJ1k+pgLFjPG3vuMrLvasPSQt:yMT8LPeDzYlnx2AtQcWVGfuALvBS2JB
- TLSH T1485533DBE779E2D0FD63FD344FCE88094974402B51A98479A92C76E7284278DC9234AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\sd640.delta01.cab
- Size 33KB
- SHA256 bdcefd897b02441ed679bf8eb3b9101af01824e13599774ed78dd7868c664b10
- MD5 547b10ae75eb6ffa615b67137b55a2cf
- SHA1 a8b4e2ef6e21a696817714fb57dde6ac3776d236
- SHA512 3560b8e602d82947e14d2324a87c5d1e12b50224fe299185bddcf890a5c9018f656b19f47001960f72aecaf62855ac8ada5bd809b1f089bb37fc92d72f750dde
- SSDEEP 768:Vwb5O43EVtUsyfDlmvvrNJXEBDb45Vu79zWiE:6Q43EVeRfDlmrnXEBDkPuRz0
- TLSH T155E2D1A6156CA096FCD7BCB1E9E4D6237E39A3EF1F83E96319A0FA40085B3C2570551C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\sd640.delta02.cab
- Size 33KB
- SHA256 9fa8bd4cc3687d7df983d3636016c58aa7abb47c11060d238a89c76b9c1604b2
- MD5 5f5e500338c390ce676a4c03c47387bc
- SHA1 05b42803662e684404492426201a1ec1d1bf9768
- SHA512 8a7123e13e4fdd3bf596c5b169d1dd17e5cc6c0fdafde10a3e0b8e80a0c6cd6b61fff9043093bf99ad4d2a340ab9d46977aec9503a58e46fbf72f43456d462ac
- SSDEEP 768:Ls7/aMDLSSpy0acryahXFXjAoG2jPwfFb45axDyrr9zJux/:L4yjYy08ahFTAoBPwdkqOBzk
- TLSH T131E2D0E25E3CD0C7FD69DDB0B09BCB936D7C87D75C8550A322A6F4242943B889B1A45C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\sd640.delta03.cab
- Size 33KB
- SHA256 b1a63978edea23f906a083821dea91bb499485be1cb06ac974fd68bd7e6a9d87
- MD5 04c05828994ebc66da49dd3bb43c2bb3
- SHA1 124a2d7cec0d199f04d09f675282d527095787df
- SHA512 42fe2bc385b5e0c623b2658e84f2512c25efdb62396a2aa3d94b9e17e22d1d10614ae01ab7ef553ac859edbcc099e353e35b62cdd038b2287694aab7176f82ae
- SSDEEP 768:HnTgbTxFT4Nt1zayoimu6vQmhL/b45/2rr9zJuGER:Hm9CtkyRd6XbklqBzER
- TLSH T170E2CFC6463C9007E996ED31E0F6EDAA2DBC43CB1E04E99309D6F85834D77529B1A51C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\sd641033.delta00.cab
- Size 196KB
- SHA256 3c475e364225f970998ee5a27d91b6ead524b66459483cb1c6cafb1ef4f3c2a8
- MD5 05cd0fbe25c571528480de14b8b4ac84
- SHA1 5779674bf1a5ba102a2daf4a84c5f5c5739bc197
- SHA512 9deca78f93af8cd571a560a1e72149d4176e0df3bfb642f11e742a7b249a3e07bb5bc7d9cee1459df165b6e1f860043b55680243250d454be6724713f6e51e30
- SSDEEP 6144:RoxBtHGiLvbiHp+xFT7z2xq+wYyrJP8pN5:yBtmijzxt6cJkpz
- TLSH T17D1412AA5C1C4918CC3F6B345185C6934AFA72CF210153B6FCAAE72507833DA9BDA5D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\sd641033.delta01.cab
- Size 29KB
- SHA256 f0577765b5fc4eee0ec77d3048ce111fec61d56916f3789435e6334d78b6912d
- MD5 0298a0b9bf1e9c453d7826d9c1846555
- SHA1 be020cce09aa1a7087404e319e47ad85ef712648
- SHA512 8c6aa59c1ba1f7e319565c757320f25cc86a1a6008ef465f9cf19c094a8fadd6bdd66838d059ce2f836aa849b4a8c394431682d72034a2baa5881a038fcd6eb8
- SSDEEP 768:WaZjeocrc60vb79+nmbSN9dBdSfb45P79zRnN:dZa8JveNvBd2kNRzRN
- TLSH T17AD2C0E25A388057EFABDD70B3A5ED633C3853CB0E48C0D647A1E91109AB7C9939D15C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\sd641033.delta02.cab
- Size 29KB
- SHA256 489364e281e4178206add0cc54f7b066d7105c87a14952dd0fcd4e2bd888ce6e
- MD5 d529f90872baa26140e9a815af05e27a
- SHA1 ce1f8c0d812d97d3b941851b5d590b6bd3dfbb00
- SHA512 24c04e83e09e03d9ffd61dfd3c811400a61d25a40c68316844903eee7b09db9d4058ee0bfb414f59f68568b53e72bd001ca14fb7edc86c0379c83bda80552d97
- SSDEEP 768:Apzc284xlpFOYH6JYoK2ZshEhufUXXbdWy3gE9zy:AW2HxDFVIKws+huf6XhfPzy
- TLSH T153D2D0F78D699103EE88BC61D35CEA53FC3897D71E00D59711A8F99429837C9D7050AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\sd641033.delta03.cab
- Size 29KB
- SHA256 a018d6940f9d9dfdefc89cc66dda50a2a81f65d16e962ce0a635591202230cb2
- MD5 c64311542aeab15d0ce6b87acc124307
- SHA1 5bdb455eabdf39cfc729b17ea963e1955a77cb02
- SHA512 2c3682630a5b7c3b635f79567c31ee4c066f32555f0d8eafede7a07bb1b91c08be31dd35bbe98dc1d067a50fddcebd39e1e4971d004e830235e3f37278802e8c
- SSDEEP 768:fV2tlJdIRe2xZLLD9WohKg6Y1pb45OKe8rjZ9zY66:f3vLLMokg6CpkvtzY1
- TLSH T13AD2C1E64D7C1042ED9BBDB0D2D4D4937D7E57C30EC0C52A55D9F85A1E83BC8AA460AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\sd643082.delta00.cab
- Size 227KB
- SHA256 664077a7422abbcbdb7dbb407365eecf3e71738496bdb8e040ef4da54c4bc089
- MD5 163a4fa1a744586e193d0f42ef7b688d
- SHA1 d6eb85f7ddd5660118fdd1c1ece0f946c51e634e
- SHA512 f6b7618b275e33d9e69a18274a83816c4427487449009cf8f5ede35002d4cc018a03444e263a2400933db17c3c196069a2ab99c302e9dc425ca3db34af5547f3
- SSDEEP 6144:rcvTYypEljAQz3lQ24xtHeWTISEJIHfA93nk114EcV:rcDOjASVQ24mKemHfZ14D
- TLSH T1D83423956448B067CA7A15D4DAEAD167AE3C6D562009F4A49EC4F014FEBCB683FF200D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\sd643082.delta01.cab
- Size 30KB
- SHA256 ebd11be424b016e2ce51296f2b793c70e53d01ea0dabaa044cc8d12cac07900d
- MD5 efb600c9df672e53c257e4d24a0aa90a
- SHA1 876528c791547f44444a02e8c23dc94bc061b1de
- SHA512 435bb2dff263cb56f1a13889401fcd44bc9c9d39f5e47b5e890921c9f8e6d33e6921adb0a482c343b165d03f0afe96310eb4237f0eb434f328dcbbe54c6f60e6
- SSDEEP 768:2xUhsjdODreA+fRIq//POERrdKGSZujbdWyi9zHN:2xAshQz8R/3/ROMhmzHN
- TLSH T1FCD2D1C7C2387941DAD799904368EA327E3493C719708E5B01E5F4182E5F7AEAB2E07D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\sd643082.delta02.cab
- Size 30KB
- SHA256 54f4dd4ef6fe7a3a63f3ad845a99bcb3c47bd9f29b0263372708013470b623d0
- MD5 1bfae74b0bcb6cb9a73d4433e73bfcaf
- SHA1 9a518ce3170a1b281c6bce72caa9f8d2655af834
- SHA512 f8c26031f761ded54d6d8c451b2638a7ba556505ef5e9aac116907cc2cda28f35bb4fbb8c3fdbeca08df35bc16dc85ea781d12d6e62ddc1e888d68c16a8b48e2
- SSDEEP 768:XIPe9dKT4IS3u1/g87jeUbKbdWyoF9zUgk:XAe9i5bjeU+hYzW
- TLSH T17DD2D0D65A789006CE8FBE204250D6D7FC3AA7E768C564626464FE580AE73CCD71813E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\OFFICE~1\sd643082.delta03.cab
- Size 30KB
- SHA256 925cb9407d4dc908cd83deafe7b8d30964814451b9d54dd3508924f5d340fd2b
- MD5 bcb1c3cb39faf8d12432186865a5cc29
- SHA1 1e687fb42d62d1433a24156744963deb9a48d699
- SHA512 605d046117e2585a83bd5618532dab3e95fade53117142ccf0cec3e6ccd950f4bc76e9d9ca95babb780cb358b6704a8d014e88e279d6cc29e0914cc9eb8684f6
- SSDEEP 384:5QwqxGYojZXgFugzle4sSPhu0GYp+QFBUS5Wj0WhcccaGAEh4FYVNZnCrj/R9zZb:2wqxv6+1eYEGx+eWb45IrjZ9z5
- TLSH T1F9D2D0D1855DA283E963AAF0A7C0E9833D7D83C316489C7219B6F25414E77D1BB6A23C
- MD5 SHA1 SHA512 SSDEEP TLSH