General Info

File name

Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe

Full analysis
https://app.any.run/tasks/667bf944-96e1-4b8e-9303-68fa2678d86d
Verdict
Malicious activity
Analysis date
11/8/2019, 17:18:51
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:

MIME:
application/x-dosexec
File info:
PE32 executable (GUI) Intel 80386, for MS Windows
MD5

3e57d59a1c527ba6cd1a464f6672108f

SHA1

d55ce887ad09c77f1a508a3fbf5922a8009433ec

SHA256

971e66d3be1c5a4784ff200bf6d99630e8ea188361fe61f89e47349e844c82bd

SSDEEP

98304:h3fJyxulBXmIgFDfupryC3Kasx5CqLWFqvwcKroMb1RhR4hwY2hgs:/ytIID83KBxkqLWFqvaXnyhWgs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
60 seconds
Additional time used
none
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (75.0.3770.100)
  • Google Update Helper (1.3.34.7)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.7.2 (4.7.03062)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office Access MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office Access MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Access MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Access MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Access MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Access MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Access MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Access MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Groove MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office Groove MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office Groove MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Groove MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Groove MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Groove MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Groove MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Groove MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Groove MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office IME (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office IME (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Language Pack 2010 - French/Français (14.0.4763.1000)
  • Microsoft Office Language Pack 2010 - German/Deutsch (14.0.4763.1000)
  • Microsoft Office Language Pack 2010 - Italian/Italiano (14.0.4763.1000)
  • Microsoft Office Language Pack 2010 - Japanese/日本語 (14.0.4763.1000)
  • Microsoft Office Language Pack 2010 - Korean/한국어 (14.0.4763.1000)
  • Microsoft Office Language Pack 2010 - Portuguese/Português (Brasil) (14.0.4763.1000)
  • Microsoft Office Language Pack 2010 - Russian/русский (14.0.4763.1000)
  • Microsoft Office Language Pack 2010 - Spanish/Español (14.0.4763.1000)
  • Microsoft Office Language Pack 2010 - Turkish/Türkçe (14.0.4763.1013)
  • Microsoft Office O MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office O MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office O MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office O MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office O MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office O MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office O MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office O MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office O MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Arabic) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Basque) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Catalan) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Dutch) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Galician) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (German) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Proof (Ukrainian) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (French) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (German) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office SharePoint Designer MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office SharePoint Designer MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office SharePoint Designer MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office SharePoint Designer MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office SharePoint Designer MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office SharePoint Designer MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office SharePoint Designer MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office SharePoint Designer MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office SharePoint Designer MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office X MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office X MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office X MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office X MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office X MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office X MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office X MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office X MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office X MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
  • Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
  • Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
  • Mozilla Firefox 68.0.1 (x86 en-US) (68.0.1)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB4019990
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Changes settings of System certificates
  • Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe (PID: 1912)
Application was dropped or rewritten from another process
  • OfficeClickToRun.exe (PID: 4084)
  • OfficeClickToRun.exe (PID: 2468)
Loads dropped or rewritten executable
  • OfficeClickToRun.exe (PID: 2468)
  • OfficeClickToRun.exe (PID: 4084)
Adds / modifies Windows certificates
  • Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe (PID: 1912)
Application launched itself
  • Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe (PID: 2840)
Reads Internet Cache Settings
  • Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe (PID: 2840)
  • OfficeClickToRun.exe (PID: 4084)
  • Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe (PID: 1912)
Searches for installed software
  • Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe (PID: 1912)
Creates files in the Windows directory
  • OfficeClickToRun.exe (PID: 2468)
Creates files in the program directory
  • OfficeClickToRun.exe (PID: 2468)
  • Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe (PID: 1912)
Executes PowerShell scripts
  • Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe (PID: 1912)
Creates files in the user directory
  • powershell.exe (PID: 2408)
Executed as Windows Service
  • OfficeClickToRun.exe (PID: 2468)
Removes files from Windows directory
  • OfficeClickToRun.exe (PID: 2468)
Executable content was dropped or overwritten
  • OfficeClickToRun.exe (PID: 2468)
  • Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe (PID: 1912)
Reads settings of System Certificates
  • Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe (PID: 1912)
  • OfficeClickToRun.exe (PID: 2468)
Reads Microsoft Office registry keys
  • OfficeClickToRun.exe (PID: 4084)
  • Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe (PID: 1912)
  • OfficeClickToRun.exe (PID: 2468)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.exe
|   Win32 Executable (generic) (52.9%)
.exe
|   Generic Win/DOS Executable (23.5%)
.exe
|   DOS Executable Generic (23.5%)
EXIF
EXE
MachineType:
Intel 386 or later, and compatibles
TimeStamp:
2019:10:26 04:01:34+02:00
PEType:
PE32
LinkerVersion:
14.13
CodeSize:
3148800
InitializedDataSize:
2551296
UninitializedDataSize:
null
EntryPoint:
0x27eae3
OSVersion:
5.2
ImageVersion:
null
SubsystemVersion:
5.2
Subsystem:
Windows GUI
FileVersionNumber:
16.0.12130.20272
ProductVersionNumber:
16.0.12130.0
FileFlagsMask:
0x003f
FileFlags:
(none)
FileOS:
Windows NT 32-bit
ObjectFileType:
Executable application
FileSubtype:
null
LanguageCode:
Neutral
CharacterSet:
Windows, Latin1
CompanyName:
Microsoft Corporation
FileDescription:
Microsoft Office
FileVersion:
16.0.12130.20272
InternalName:
Bootstrapper.exe
LegalTrademarks1:
Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:
Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:
Bootstrapper.exe
ProductName:
Microsoft Office
ProductVersion:
16.0.12130.20272
Summary
Architecture:
IMAGE_FILE_MACHINE_I386
Subsystem:
IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:
26-Oct-2019 02:01:34
Detected languages
English - United States
TLS Callbacks:
2 callback(s) detected.
Debug artifacts
d:\dbs\el\sep\target\x86\ship\click2run\en-us\Bootstrapper.pdb
CompanyName:
Microsoft Corporation
FileDescription:
Microsoft Office
FileVersion:
16.0.12130.20272
InternalName:
Bootstrapper.exe
LegalTrademarks1:
Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:
Windows® is a registered trademark of Microsoft Corporation.
OriginalFilename:
Bootstrapper.exe
ProductName:
Microsoft Office
ProductVersion:
16.0.12130.20272
DOS Header
Magic number:
MZ
Bytes on last page of file:
0x0090
Pages in file:
0x0003
Relocations:
0x0000
Size of header:
0x0004
Min extra paragraphs:
0x0000
Max extra paragraphs:
0xFFFF
Initial SS value:
0x0000
Initial SP value:
0x00B8
Checksum:
0x0000
Initial IP value:
0x0000
Initial CS value:
0x0000
Overlay number:
0x0000
OEM identifier:
0x0000
OEM information:
0x0000
Address of NE header:
0x00000130
PE Headers
Signature:
PE
Machine:
IMAGE_FILE_MACHINE_I386
Number of sections:
5
Time date stamp:
26-Oct-2019 02:01:34
Pointer to Symbol Table:
0x00000000
Number of symbols:
0
Size of Optional Header:
0x00E0
Characteristics
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
Sections
Name Virtual Address Virtual Size Raw Size Charateristics Entropy
.text 0x00001000 0x00300A58 0x00300C00 IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ 6.66955
.rdata 0x00302000 0x00164724 0x00164800 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 4.68084
.data 0x00467000 0x00022B78 0x00022600 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 3.59906
.rsrc 0x0048A000 0x0009F000 0x0009EA00 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 7.34038
.reloc 0x00529000 0x0004950C 0x00049600 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_DISCARDABLE,IMAGE_SCN_MEM_READ 6.49545
Resources
1

2

3

4

101

188

189

190

191

192

193

194

195

196

197

198

199

219

220

232

251

252

253

254

256

257

258

259

313

314

315

316

317

319

322

376

377

378

379

380

381

382

383

384

438

439

440

449

ID_ANIMATEDLOGO

ID_ANIMATEDLOGO_192

ID_CLOSE

ID_CLOSE_192

ID_CLOSE_192_HC

ID_CLOSE_192_HCW

ID_CLOSE_HC

ID_CLOSE_HCW

ID_ERROR

ID_ERROR_192

ID_LOADINGDOTS

ID_LOADINGDOTS_192

ID_LOADINGDOTS_RTL

ID_LOADINGDOTS_RTL_192

ID_LOGO

ID_LOGO_192

ID_LOGO_192_HC

ID_LOGO_192_HCW

ID_LOGO_HC

ID_LOGO_HCW

ID_MINIMIZE

ID_MINIMIZE_192

ID_MINIMIZE_192_HC

ID_MINIMIZE_192_HCW

ID_MINIMIZE_HC

ID_MINIMIZE_HCW

Imports
    GDI32.dll

    OLEAUT32.dll

    ADVAPI32.dll

    KERNEL32.dll

    ole32.dll

    WINTRUST.dll

    SETUPAPI.dll

    WS2_32.dll

    gdiplus.dll

    RPCRT4.dll

    api-ms-win-core-winrt-string-l1-1-0.dll (delay-loaded)

Exports

    No exports.

Screenshots

Processes

Total processes
42
Monitored processes
5
Malicious processes
4
Suspicious processes
0

Behavior graph

+
start drop and start setup.def.en-us_o365proplusretail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_tx_pr_platform_def_b_64_.exe setup.def.en-us_o365proplusretail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_tx_pr_platform_def_b_64_.exe powershell.exe no specs officeclicktorun.exe officeclicktorun.exe
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
2840
CMD
"C:\Users\admin\AppData\Local\Temp\Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe"
Path
C:\Users\admin\AppData\Local\Temp\Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
Indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Version:
Company
Microsoft Corporation
Description
Microsoft Office
Version
16.0.12130.20272
Modules
Image
c:\users\admin\appdata\local\temp\setup.def.en-us_o365proplusretail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_tx_pr_platform_def_b_64_.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\normaliz.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\netprofm.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\version.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\npmproxy.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\p2pcollab.dll
c:\windows\system32\qagentrt.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\fveui.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\propsys.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\credssp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshqos.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\mpr.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\schannel.dll
c:\windows\system32\userenv.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\powrprof.dll

PID
1912
CMD
"C:\Users\admin\AppData\Local\Temp\Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe" ELEVATED
Path
C:\Users\admin\AppData\Local\Temp\Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
Indicators
Parent process
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
User
admin
Integrity Level
HIGH
Version:
Company
Microsoft Corporation
Description
Microsoft Office
Version
16.0.12130.20272
Modules
Image
c:\users\admin\appdata\local\temp\setup.def.en-us_o365proplusretail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_tx_pr_platform_def_b_64_.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\wininet.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\version.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\netprofm.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\npmproxy.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\credssp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshqos.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\schannel.dll
c:\windows\system32\userenv.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\msxml6.dll
c:\program files\common files\microsoft shared\office14\msoxmlmf.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\propsys.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\program files\common files\microsoft shared\clicktorun\officeclicktorun.exe

PID
2408
CMD
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} "
Path
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Indicators
No indicators
Parent process
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows PowerShell
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\shell32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\version.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system\9e0a3b9b9f457233a335d7fba8f95419\system.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\4bdde288f147e3b3f2c090ecdf704e6d\microsoft.powershell.consolehost.ni.dll
c:\windows\assembly\gac_msil\system.management.automation\1.0.0.0__31bf3856ad364e35\system.management.automation.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management.a#\a8e3a41ecbcc4bb1598ed5719f965110\system.management.automation.ni.dll
c:\windows\system32\psapi.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.core\fbc05b5b05dc6366b02b8e2f77d080f1\system.core.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\e112e4460a0c9122de8c382126da4a2f\microsoft.powershell.commands.diagnostics.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.configuratio#\f02737c83305687a68c088927a6c5a98\system.configuration.install.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.wsman.man#\f1865caa683ceb3d12b383a94a35da14\microsoft.wsman.management.ni.dll
c:\windows\assembly\gac_msil\microsoft.wsman.runtime\1.0.0.0__31bf3856ad364e35\microsoft.wsman.runtime.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.transactions\ad18f93fc713db2c4b29b25116c13bd8\system.transactions.ni.dll
c:\windows\assembly\gac_32\system.transactions\2.0.0.0__b77a5c561934e089\system.transactions.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\82d7758f278f47dc4191abab1cb11ce3\microsoft.powershell.commands.utility.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\583c7b9f52114c026088bdb9f19f64e8\microsoft.powershell.commands.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\6c5bef3ab74c06a641444eff648c0dde\microsoft.powershell.security.ni.dll
c:\windows\microsoft.net\framework\v2.0.50727\culture.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.xml\461d3b6b3f43e6fbe6c897d5936e17e4\system.xml.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\system.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.directoryser#\45ec12795950a7d54691591c615a9e3c\system.directoryservices.ni.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.data\1e85062785e286cd9eae9c26d2c61f73\system.data.ni.dll
c:\windows\assembly\gac_32\system.data\2.0.0.0__b77a5c561934e089\system.data.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorjit.dll
c:\windows\microsoft.net\framework\v2.0.50727\diasymreader.dll
c:\windows\system32\netutils.dll

PID
4084
CMD
deliverymechanism=7ffbc6bf-bc32-4f92-8982-f9dd17fd3114 productreleaseid=O365ProPlusRetail platform=x86 o365proplusretail=0f1e0b3f-e040-4d9a-9a3d-79296f5d9221 tx=PR culture=en-us lcid=1033 b=64 prereleasebuild=4419 defaultplatform=True forcecentcheck= storeid= totalclientcabsize=19530753 productstoadd=O365ProPlusRetail.16_en-us_x-none scenario=unknown O365ProPlusRetail.excludedapps.16=groove updatesenabled.16=True cdnbaseurl.16=http://officecdn.microsoft.com/pr/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114 version.16=16.0.11328.20438 mediatype.16=CDN baseurl.16=http://officecdn.microsoft.com/PR/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114 sourcetype.16=CDN flt.useexptransportinplacepl=unknown flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown
Path
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
Indicators
Parent process
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
User
admin
Integrity Level
HIGH
Version:
Company
Microsoft Corporation
Description
Microsoft Office Click-to-Run (SxS)
Version
16.0.11328.20438
Modules
Image
c:\windows\system32\npmproxy.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\credssp.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\msxml6.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshqos.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\schannel.dll
c:\windows\system32\bcryptprimitives.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystemcontroller.dll
c:\windows\system32\userenv.dll
c:\program files\common files\microsoft shared\clicktorun\c2rui.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\program files\common files\microsoft shared\clicktorun\c2rintl.en-us.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\windowscodecs.dll
c:\program files\common files\microsoft shared\clicktorun\officeclicktorun.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\program files\common files\microsoft shared\clicktorun\vcruntime140.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-runtime-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\ucrtbase.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-timezone-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l2-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-localization-l1-2-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-synch-l1-2-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-processthreads-l1-1-1.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l1-2-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-string-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-heap-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-stdio-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-convert-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\msvcp140.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-locale-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-math-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-multibyte-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-time-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-filesystem-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-environment-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-utility-l1-1-0.dll
c:\windows\system32\rstrtmgr.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shlwapi.dll
c:\program files\common files\microsoft shared\clicktorun\apiclient.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\shell32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\version.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\netprofm.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\powrprof.dll

PID
2468
CMD
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
Path
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
Indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Version:
Company
Microsoft Corporation
Description
Microsoft Office Click-to-Run (SxS)
Version
16.0.11328.20438
Modules
Image
c:\program files\common files\microsoft shared\clicktorun\officeclicktorun.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\program files\common files\microsoft shared\clicktorun\vcruntime140.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-runtime-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\ucrtbase.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-timezone-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l2-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-localization-l1-2-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-synch-l1-2-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-processthreads-l1-1-1.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l1-2-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-string-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-heap-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-stdio-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-convert-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\msvcp140.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-locale-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-math-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-multibyte-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-time-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-filesystem-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-environment-l1-1-0.dll
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-utility-l1-1-0.dll
c:\windows\system32\rstrtmgr.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shlwapi.dll
c:\program files\common files\microsoft shared\clicktorun\apiclient.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\shell32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\profapi.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\version.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\netprofm.dll
c:\windows\system32\nlaapi.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystemcontroller.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\npmproxy.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\credssp.dll
c:\program files\common files\microsoft shared\clicktorun\streamserver.dll
c:\windows\system32\msdelta.dll
c:\windows\system32\msxml6.dll
c:\windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\userenv.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\schannel.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\api-ms-win-crt-string-l1-1-0.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\concrt140.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vccorlib140.dll
c:\windows\system32\vcruntime140.dll

Registry activity

Total events
1269
Read events
978
Write events
287
Delete events
4

Modification events

PID
Process
Operation
Key
Name
Value
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Experiment\officeclicktorun
FirstSessionTriggered
1
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
UIFallbackLanguages
x-none
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
HelpLanguageTag
en-US
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
PreferredEditingLanguage
en-US
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
PreviousPreferredEditingLanguage
en-US
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
WordChangeInstallLanguage
No
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
WordMailChangeInstallLanguage
No
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
XLChangeInstallLanguage
No
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
PPTChangeInstallLanguage
No
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
AccessChangeInstallLanguage
No
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
OutlookChangeInstallLanguage
No
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
SharePointDesignerChangeInstallLanguage
No
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
PublisherChangeInstallLanguage
No
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
ProjectChangeInstallLanguage
No
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
InfoPathChangeInstallLanguage
No
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
OneNoteChangeInstallLanguage
No
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
WebDesignerChangeInstallLanguage
No
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources
LangTuneUp
OfficeCompleted
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-US
1
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\Common
UID
0E3EF52917837F4CB72FF1D28AACCD65
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Experiment\officeclicktorun
EcsRequestPending
0
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ClientTelemetry\RulesLastAudienceReported
setup.def.en-us_o365proplusretail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_tx_pr_platform_def_b_64_.exe
Production_DC
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
LanguageList
en-US
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
@%SystemRoot%\system32\p2pcollab.dll,-8042
Peer to Peer Trust
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
@%SystemRoot%\system32\qagentrt.dll,-10
System Health Authentication
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
@%SystemRoot%\system32\dnsapi.dll,-103
Domain Name System (DNS) Server Trust
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
@%SystemRoot%\System32\fveui.dll,-843
BitLocker Drive Encryption
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
@%SystemRoot%\System32\fveui.dll,-844
BitLocker Data Recovery Agent
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Registration\USER-PC
O365ProPlusRetail.AttemptGetKey
1
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Licensing\OlsToken
o365proplusretail
0f1e0b3f-e040-4d9a-9a3d-79296f5d9221
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs
CountryCode
std::wstring|GB
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Experiment\officeclicktorun
BuildNumber
16.0.12130
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
Expires
int64_t|0
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
ChunkCount
uint64_t|0
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
ChunkCount
uint64_t|1
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
ChunkCount
uint64_t|2
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
ChunkCount
uint64_t|3
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
1.4
6962696C6974794973737565734E6F74696669636174696F6E4578706F7274506C6163655C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C224163636573736962696C6974794973737565734E6F74696669636174696F6E496E666F506C6163655C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C2253686F775461736B70616E655C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C2244697361626C6564526573756C74735C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C22416363436865636B657246696E616C56696F6C6174696F6E436F756E7450657252756C655C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C22416363436865636B657256696F6C6174696F6E496E666F726D6174696F6E5C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C2246697849744D656E754F70656E436C6F73655C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C2256696F6C6174696F6E53656C65637465645C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C2246697849744D656E754974656D53656C656374696F6E5C22203A207B205C224576656E74466C61675C22203A203438383936207D207D207D2C205C22446F63756D656E745265636F766572795C22203A207B205C224576656E74735C22203A207B205C22496E76616C696461746550616E65735C22203A207B205C224576656E74466C61675C22203A2032207D207D207D2C205C22536869704173736572745C22203A207B205C224576656E74735C22203A207B205C225741534B5C22203A207B205C224576656E74466C61675C22203A203438383936207D207D207D207D207D22207D2C207B20224622203A20224D6963726F736F66742E4F66666963652E54656C656D6574727944796E616D6963436F6E6669672E576F7264222C20225622203A20227374643A3A77737472696E677C7B205C225375624E616D657370616365735C22203A207B205C224544505C22203A207B205C224576656E74735C22203A207B205C22446F63756D656E744964656E746974794368616E67655C22203A207B205C224576656E74466C61675C22203A2032207D207D207D2C205C2250726F6F66696E675C22203A207B205C224576656E74735C22203A207B205C2250726F6F66696E674E6F50726F6F66526567696F6E5C22203A207B205C224576656E74466C61675C22203A2032207D2C205C225453706C4C6F61644C6962726172795C22203A207B205C224576656E74466C61675C22203A2032207D2C205C22436C6F75645370656C6C6572436865636B5C22203A207B205C224576656E74466C61675C22203A2032207D207D207D2C205C22536176655C22203A207B205C224576656E74735C22203A207B205C22436D64446F53617665446F63436F7265436F6D6D616E64416374696F6E5C22203A207B205C224576656E74466C61675C22203A2032207D2C205C22436D64446F53617665446F63436F7265416374696F6E5C22203A207B205C224576656E74466C61675C22203A2032207D2C205C22464D617953746172745472616E73616374696F6E5C22203A207B205C224576656E74466C61675C22203A2032207D207D207D2C205C22576F72645C22203A207B205C225375624E616D657370616365735C22203A207B205C22426F6F745C22203A207B205C225375624E616D657370616365735C22203A207B205C2254696D696E675C22203A207B205C224576656E74735C22203A207B205C22446174615C22203A207B205C224576656E74466C61675C22203A2032207D207D207D207D207D207D207D2C205C22426F6F745C22203A207B205C224576656E74735C22203A207B205C22416464696E4D6F6E69746F7256616C6964617465426F6F745C22203A207B205C224576656E74466C61675C22203A2032207D2C205C22416464696E44697361626C65644469616C6F675C22203A207B205C224576656E74466C61675C22203A2032207D207D207D2C205C2246696C654F70656E5C22203A207B205C224576656E74735C22203A207B205C22464E4D45696453657446726F6D5873747A46747970466E6D4469725C22203A207B205C224576656E74466C61675C22203A2032207D207D207D2C205C22576F72644D61696C5C22203A207B205C224576656E74735C22203A207B205C2248724C6F61645C22203A207B205C224576656E74466C61675C22203A2032207D207D207D2C205C22446F6354696C696E675C22203A207B205C224576656E74735C22203A207B205C2254696C696E6749646C6542756E646C654576656E745C22203A207B205C224576656E74466C61675C22203A2032207D2C205C2254696C696E6749646C655C22203A207B205C224576656E74466C61675C22203A2032207D2C205C2254696C696E6749646C654865617274626561745C22203A207B205C224576656E74466C61675C22203A2032207D2C205C2254696C696E6749646C654669726542756E646C65644576656E74735C22203A207B205C224576656E74466C61675C22203A2032207D207D207D2C205C2246696C65536176655C22203A207B205C224576656E74735C22203A207B205C2241637446436F6E6669726D53617665446F63436F72655175657279536176655C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C2241637446436F6E6669726D53617665446F63436F72654175746F5265636F76657279536176655C22203A207B205C224576656E74466C61675C22203A20323536207D2C205C225361766541735361766546696C655C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C22416374436D64476F7375625361766541735C22203A207B205C224576656E74466C61675C22203A203438383936207D207D207D2C205C22436F417574686F72696E675C22203A207B205C224576656E74735C22203A207B205C224F63735472616E736974696F6E5C22203A207B205C224576656E74466C61675C22203A203438383936207D207D207D207D207D22207D205D207D
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
ChunkCount
uint64_t|4
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
VersionId
uint16_t|1
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
ConfigIds
P-D-29635-1-1,P-D-27087-1-9,P-D-29719-1-1,P-D-29718-3-1,P-D-29593-1-1,P-D-37560-2-4,P-R-38462-1-11,P-R-23767-8-43,P-R-22763-23-51,P-R-22752-23-61,P-R-19898-11-20,P-R-19814-16-53,P-R-19012-11-49,P-R-48375-1-3,P-R-47564-2-4,P-R-46580-3-5,P-R-46484-2-4,P-R-46122-1-3,P-R-46068-2-4,P-R-46067-2-4,P-R-46066-2-4,P-R-46065-2-4,P-R-46064-2-4,P-R-46062-2-4,P-R-46060-2-4,P-R-46059-2-4,P-R-46058-2-4,P-R-46056-2-4,P-R-46055-2-4,P-R-46054-2-4,P-R-46041-2-4,P-R-45858-1-3,P-R-43502-5-7,P-R-41430-1-3,P-R-40892-1-3,P-R-40273-3-5,P-R-39238-1-3,P-R-38682-2-4,P-R-37588-1-3,P-R-34355-4-6,P-R-26211-3-9,P-R-26266-3-8,P-R-23733-14-19,P-R-26834-2-7,P-R-24662-12-18,P-R-27205-3-10,P-R-27299-2-7,P-R-27479-5-10,P-R-26056-5-13,P-R-27006-6-11,P-R-23722-17-22,P-R-30338-1-5,P-R-30178-11-13,P-R-30053-2-4,P-R-27458-1-5,P-R-25822-7-10,P-R-25653-1-4,P-R-25269-6-9,P-R-25083-5-8,P-R-24690-13-17,P-R-24686-2-5,P-R-24685-2-5,P-R-24663-4-9,P-R-24659-6-9,P-R-24486-7-9,P-R-23738-9-11,P-R-23736-11-13,P-R-23730-15-18,P-R-23712-10-12,P-D-32588-1-3,P-D-32534-1-3,P-D-32518-1-3,P-D-32486-1-3,P-D-32485-1-3,P-D-32484-1-3
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
ETag
std::wstring|"ippakGKcmUp4lNzwpv1h5Jrv/VGNqT1jJ2iCaCPmSGk="
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
Expires
int64_t|1573233556
2840
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
DeferredConfigs
std::wstring|
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-US
2
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-US
1
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
LanguageList
en-US
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Registration\USER-PC
O365ProPlusRetail.AttemptGetKey
1
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Licensing\OlsToken
o365proplusretail
0f1e0b3f-e040-4d9a-9a3d-79296f5d9221
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
4600000093000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Updates
UpdatesThrottleValue
318
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474
Blob
040000000100000010000000ACB694A59C17E0D791529BB19706A6E40B0000000100000030000000440069006700690043006500720074002000420061006C00740069006D006F0072006500200052006F006F007400000053000000010000006200000030603020060A2B06010401B13E01640130123010060A2B0601040182373C0101030200C0301F06096086480186FD6C020130123010060A2B0601040182373C0101030200C0301B060567810C010130123010060A2B0601040182373C0101030200C00F0000000100000014000000CE0E658AA3E847E467A147B3049191093D055E6F140000000100000014000000E59D5930824758CCACFA085436867B3AB5044DF01D0000000100000010000000918AD43A9475F78BB5243DE886D8103C030000000100000014000000D4DE20D05E66FC53FE1A50882C78DB2852CAE47419000000010000001000000068CB42B035EA773E52EF50ECF50EC52909000000010000003E000000303C06082B0601050507030106082B0601050507030406082B0601050507030206082B0601050507030306082B0601050507030906082B0601050507030862000000010000002000000016AF57A9F676B0AB126095AA5EBADEF22AB31119D644AC95CD4B93DBF3F26AEB20000000010000007B030000308203773082025FA0030201020204020000B9300D06092A864886F70D0101050500305A310B300906035504061302494531123010060355040A130942616C74696D6F726531133011060355040B130A43796265725472757374312230200603550403131942616C74696D6F7265204379626572547275737420526F6F74301E170D3030303531323138343630305A170D3235303531323233353930305A305A310B300906035504061302494531123010060355040A130942616C74696D6F726531133011060355040B130A43796265725472757374312230200603550403131942616C74696D6F7265204379626572547275737420526F6F7430820122300D06092A864886F70D01010105000382010F003082010A0282010100A304BB22AB983D57E826729AB579D429E2E1E89580B1B0E35B8E2B299A64DFA15DEDB009056DDB282ECE62A262FEB488DA12EB38EB219DC0412B01527B8877D31C8FC7BAB988B56A09E773E81140A7D1CCCA628D2DE58F0BA650D2A850C328EAF5AB25878A9A961CA967B83F0CD5F7F952132FC21BD57070F08FC012CA06CB9AE1D9CA337A77D6F8ECB9F16844424813D2C0C2A4AE5E60FEB6A605FCB4DD075902D459189863F5A563E0900C7D5DB2067AF385EAEBD403AE5E843E5FFF15ED69BCF939367275CF77524DF3C9902CB93DE5C923533F1F2498215C079929BDC63AECE76E863A6B97746333BD681831F0788D76BFFC9E8E5D2A86A74D90DC271A390203010001A3453043301D0603551D0E04160414E59D5930824758CCACFA085436867B3AB5044DF030120603551D130101FF040830060101FF020103300E0603551D0F0101FF040403020106300D06092A864886F70D01010505000382010100850C5D8EE46F51684205A0DDBB4F27258403BDF764FD2DD730E3A41017EBDA2929B6793F76F6191323B8100AF958A4D46170BD04616A128A17D50ABDC5BC307CD6E90C258D86404FECCCA37E38C637114FEDDD68318E4CD2B30174EEBE755E07481A7F70FF165C84C07985B805FD7FBE6511A30FC002B4F852373904D5A9317A18BFA02AF41299F7A34582E33C5EF59D9EB5C89E7C2EC8A49E4E08144B6DFD706D6B1A63BD64E61FB7CEF0F29F2EBB1BB7F250887392C2E2E3168D9A3202AB8E18DDE91011EE7E35AB90AF3E30947AD0333DA7650FF5FC8E9E62CF47442C015DBB1DB532D247D2382ED0FE81DC326A1EB5EE3CD5FCE7811D19C32442EA6339A9
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
Expires
int64_t|0
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
ChunkCount
uint64_t|0
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
ChunkCount
uint64_t|1
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
ChunkCount
uint64_t|2
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
ChunkCount
uint64_t|3
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
0.4
736962696C6974794973737565734E6F74696669636174696F6E4578706F7274506C6163655C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C224163636573736962696C6974794973737565734E6F74696669636174696F6E496E666F506C6163655C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C2253686F775461736B70616E655C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C2244697361626C6564526573756C74735C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C22416363436865636B657246696E616C56696F6C6174696F6E436F756E7450657252756C655C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C22416363436865636B657256696F6C6174696F6E496E666F726D6174696F6E5C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C2246697849744D656E754F70656E436C6F73655C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C2256696F6C6174696F6E53656C65637465645C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C2246697849744D656E754974656D53656C656374696F6E5C22203A207B205C224576656E74466C61675C22203A203438383936207D207D207D2C205C22446F63756D656E745265636F766572795C22203A207B205C224576656E74735C22203A207B205C22496E76616C696461746550616E65735C22203A207B205C224576656E74466C61675C22203A2032207D207D207D2C205C22536869704173736572745C22203A207B205C224576656E74735C22203A207B205C225741534B5C22203A207B205C224576656E74466C61675C22203A203438383936207D207D207D207D207D22207D2C207B20224622203A20224D6963726F736F66742E4F66666963652E54656C656D6574727944796E616D6963436F6E6669672E576F7264222C20225622203A20227374643A3A77737472696E677C7B205C225375624E616D657370616365735C22203A207B205C224544505C22203A207B205C224576656E74735C22203A207B205C22446F63756D656E744964656E746974794368616E67655C22203A207B205C224576656E74466C61675C22203A2032207D207D207D2C205C2250726F6F66696E675C22203A207B205C224576656E74735C22203A207B205C2250726F6F66696E674E6F50726F6F66526567696F6E5C22203A207B205C224576656E74466C61675C22203A2032207D2C205C225453706C4C6F61644C6962726172795C22203A207B205C224576656E74466C61675C22203A2032207D2C205C22436C6F75645370656C6C6572436865636B5C22203A207B205C224576656E74466C61675C22203A2032207D207D207D2C205C22536176655C22203A207B205C224576656E74735C22203A207B205C22436D64446F53617665446F63436F7265436F6D6D616E64416374696F6E5C22203A207B205C224576656E74466C61675C22203A2032207D2C205C22436D64446F53617665446F63436F7265416374696F6E5C22203A207B205C224576656E74466C61675C22203A2032207D2C205C22464D617953746172745472616E73616374696F6E5C22203A207B205C224576656E74466C61675C22203A2032207D207D207D2C205C22576F72645C22203A207B205C225375624E616D657370616365735C22203A207B205C22426F6F745C22203A207B205C225375624E616D657370616365735C22203A207B205C2254696D696E675C22203A207B205C224576656E74735C22203A207B205C22446174615C22203A207B205C224576656E74466C61675C22203A2032207D207D207D207D207D207D207D2C205C22426F6F745C22203A207B205C224576656E74735C22203A207B205C22416464696E4D6F6E69746F7256616C6964617465426F6F745C22203A207B205C224576656E74466C61675C22203A2032207D2C205C22416464696E44697361626C65644469616C6F675C22203A207B205C224576656E74466C61675C22203A2032207D207D207D2C205C2246696C654F70656E5C22203A207B205C224576656E74735C22203A207B205C22464E4D45696453657446726F6D5873747A46747970466E6D4469725C22203A207B205C224576656E74466C61675C22203A2032207D207D207D2C205C22576F72644D61696C5C22203A207B205C224576656E74735C22203A207B205C2248724C6F61645C22203A207B205C224576656E74466C61675C22203A2032207D207D207D2C205C22446F6354696C696E675C22203A207B205C224576656E74735C22203A207B205C2254696C696E6749646C6542756E646C654576656E745C22203A207B205C224576656E74466C61675C22203A2032207D2C205C2254696C696E6749646C655C22203A207B205C224576656E74466C61675C22203A2032207D2C205C2254696C696E6749646C654865617274626561745C22203A207B205C224576656E74466C61675C22203A2032207D2C205C2254696C696E6749646C654669726542756E646C65644576656E74735C22203A207B205C224576656E74466C61675C22203A2032207D207D207D2C205C2246696C65536176655C22203A207B205C224576656E74735C22203A207B205C2241637446436F6E6669726D53617665446F63436F72655175657279536176655C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C2241637446436F6E6669726D53617665446F63436F72654175746F5265636F76657279536176655C22203A207B205C224576656E74466C61675C22203A20323536207D2C205C225361766541735361766546696C655C22203A207B205C224576656E74466C61675C22203A203438383936207D2C205C22416374436D64476F7375625361766541735C22203A207B205C224576656E74466C61675C22203A203438383936207D207D207D2C205C22436F417574686F72696E675C22203A207B205C224576656E74735C22203A207B205C224F63735472616E736974696F6E5C22203A207B205C224576656E74466C61675C22203A203438383936207D207D207D207D207D22207D205D207D
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
ChunkCount
uint64_t|4
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
VersionId
uint16_t|0
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
ConfigIds
P-D-29635-1-1,P-D-27087-1-9,P-D-29719-1-1,P-D-29718-3-1,P-D-29593-1-1,P-D-37560-2-4,P-R-38462-1-11,P-R-23767-8-43,P-R-22763-23-51,P-R-22752-23-61,P-R-19898-11-20,P-R-19814-16-53,P-R-19012-11-49,P-R-48375-1-3,P-R-47564-2-4,P-R-46580-3-5,P-R-46484-2-4,P-R-46122-1-3,P-R-46068-2-4,P-R-46067-2-4,P-R-46066-2-4,P-R-46065-2-4,P-R-46064-2-4,P-R-46062-2-4,P-R-46060-2-4,P-R-46059-2-4,P-R-46058-2-4,P-R-46056-2-4,P-R-46055-2-4,P-R-46054-2-4,P-R-46041-2-4,P-R-45858-1-3,P-R-43502-5-7,P-R-41430-1-3,P-R-40892-1-3,P-R-40273-3-5,P-R-39238-1-3,P-R-38682-2-4,P-R-37588-1-3,P-R-34355-4-6,P-R-26211-3-9,P-R-26266-3-8,P-R-23733-14-19,P-R-26834-2-7,P-R-24662-12-18,P-R-27205-3-10,P-R-27299-2-7,P-R-27479-5-10,P-R-26056-5-13,P-R-27006-6-11,P-R-23722-17-22,P-R-30338-1-5,P-R-30178-11-13,P-R-30053-2-4,P-R-27458-1-5,P-R-25822-7-10,P-R-25653-1-4,P-R-25269-6-9,P-R-25083-5-8,P-R-24690-13-17,P-R-24686-2-5,P-R-24685-2-5,P-R-24663-4-9,P-R-24659-6-9,P-R-24486-7-9,P-R-23738-9-11,P-R-23736-11-13,P-R-23730-15-18,P-R-23712-10-12,P-D-32588-1-3,P-D-32534-1-3,P-D-32518-1-3,P-D-32486-1-3,P-D-32485-1-3,P-D-32484-1-3
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
ETag
std::wstring|"ippakGKcmUp4lNzwpv1h5Jrv/VGNqT1jJ2iCaJ/rdJg="
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
Expires
int64_t|1573233557
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5
Blob
040000000100000010000000A266BB7DCC38A562631361BBF61DD11B0F000000010000002000000008FBA831C08544208F5208686B991CA1B2CFC510E7301784DDF1EB5BF03932390B00000001000000540000004D006900630072006F0073006F0066007400200052006F006F007400200043006500720074006900660069006300610074006500200041007500740068006F007200690074007900200032003000310030000000620000000100000020000000DF545BF919A2439C36983B54CDFC903DFA4F37D3996D8D84B4C31EEC6F3C163E140000000100000014000000D5F656CB8FE8A25C6268D13D94905BD7CE9A18C41D000000010000001000000083D006C6D15405E6CE2847A90A3F3EC969000000010000000E000000300C060A2B0601040182373C03020300000001000000140000003B1EFD3A66EA28B16697394703A72CA340A05BD51900000001000000100000003C70FAEA25600CE3B2CC5F0B222ED6292000000001000000F1050000308205ED308203D5A003020102021028CC3A25BFBA44AC449A9B586B4339AA300D06092A864886F70D01010B0500308188310B3009060355040613025553311330110603550408130A57617368696E67746F6E3110300E060355040713075265646D6F6E64311E301C060355040A13154D6963726F736F667420436F72706F726174696F6E31323030060355040313294D6963726F736F667420526F6F7420436572746966696361746520417574686F726974792032303130301E170D3130303632333231353732345A170D3335303632333232303430315A308188310B3009060355040613025553311330110603550408130A57617368696E67746F6E3110300E060355040713075265646D6F6E64311E301C060355040A13154D6963726F736F667420436F72706F726174696F6E31323030060355040313294D6963726F736F667420526F6F7420436572746966696361746520417574686F72697479203230313030820222300D06092A864886F70D01010105000382020F003082020A0282020100B9089E28E4E4EC064E5068B341C57BEBAEB68EAF81BA22441F6534694CBE704017F2167BE279FD86ED0D39F41BA8AD92901ECB3D768F5AD9B591102E3C058D8A6D2454E71FED56AD83B4509C15A51774885920FC08C58476D368D46F2878CE5CB8F3509044FFE3635FBEA19A2C961504D607FE1E8421E0423111C4283694CF50A4629EC9D6AB7100B25B0CE696D40A2496F5FFC6D5B71BD7CBB72162AF12DCA15D37E31AFB1A4698C09BC0E7631F2A0893027E1E6A8EF29F1889E42285A2B1845740FFF50ED86F9CEDE2453101CD17E97FB08145E3AA214026A172AAA74F3C01057EEE8358B15E06639962917882B70D930C246AB41BDB27EC5F95043F934A30F59718B3A7F919A793331D01C8DB22525CD725C946F9A2FB875943BE9B62B18D2D86441A46AC78617E3009FAAE89C4412A2266039139459CC78B0CA8CA0D2FFB52EA0CF76333239DFEB01FAD67D6A75003C6047063B52CB1865A43B7FBAEF96E296E21214126068CC9C3EEB0C28593A1B985D9E6326C4B4C3FD65DA3E5B59D77C39CC055B77400E3B838AB839750E19A42241DC6C0A330D11A5AC85234F773F1C7181F33AD7AECCB4160F3239420C24845AC5C51C62E80C2E27715BD8587ED369D9691EE00B5A370EC9FE38D80688376BAAF5D70522216E266FBBAB3C5C2F73E2F77A6CADEC1A6C6484CC3375123D327D7B84E7096F0A14476AF78CF9AE166130203010001A351304F300B0603551D0F040403020186300F0603551D130101FF040530030101FF301D0603551D0E04160414D5F656CB8FE8A25C6268D13D94905BD7CE9A18C4301006092B06010401823715010403020100300D06092A864886F70D01010B05000382020100ACA5968CBFBBAEA6F6D7718743315688FD1C32715B35B7D4F091F2AF37E214F1F30226053E16147F14BAB84FFB89B2B2E7D409CC6DB95B3B64657066B7F2B15ADF1A02F3F551B8676D79F3BF567BE484B92B1E9B409C2634F947189869D81CD7B6D1BF8F61C267C4B5EF60438E101B3649E420CAADA7C1B1276509F8CDF55B2AD08433F3EF1FF2F59C0B589337A075A0DE72DE6C752A6622F58C0630569F40B930AA40771582D78BECC0D3B2BD83C5770C1EAEAF1953A04D79719F0FAF30CE67F9D62CCC22417A07F2974218CE59791055DE6F10E4B8DA836640160968235B972E269A02BB578CC5B8BA69623280899EA1FDC0927C7B2B3319842A63C5006862FA9F478D997A453AA7E9EDEE6942B5F3819B4756107BFC7036841873EAEFF9974D9E3323DD260BBA2AB73F44DC8327FFBD61592B11B7CA4FDBC58B0C1C31AE32F8F8B942F77FDC619A76B15A04E1113D6645B71871BEC92485D6F3D4BA41345D122D25B98DA613486D4BB0077D99930961817457268AAB69E3E4D9C788CC24D8EC52245C1EBC9114E296DEEB0ADA9EDD5FB35BDBD482ECC620508725403AFBC7EECDFE33E56EC3840955032539C0E9355D6531A8F6BFA009CD29C7B336322EDC95F383C15ACF8B8DF6EAB321F8A4ED1E310EB64C11AB600BA412232217A3366482910412E0AB6F1ECB500561B440FF598671D1D533697CA9738A38D7640CF169
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
VersionToReport
16.0.11328.20438
2408
powershell.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
LanguageList
en-US
4084
OfficeClickToRun.exe
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.4
4084
OfficeClickToRun.exe
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.3
4084
OfficeClickToRun.exe
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.2
4084
OfficeClickToRun.exe
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\1.1
4084
OfficeClickToRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-US
2
4084
OfficeClickToRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-US
1
4084
OfficeClickToRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ClientTelemetry\RulesLastAudienceReported
officeclicktorun.exe
Unknown_Error_Read_StreamPackageUrl
4084
OfficeClickToRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
4084
OfficeClickToRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
ClientFolder
C:\Program Files\Common Files\Microsoft Shared\ClickToRun
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OfficeClickToRun_RASAPI32
EnableFileTracing
0
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OfficeClickToRun_RASAPI32
EnableConsoleTracing
0
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
ClientVersionToReport
16.0.11328.20438
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OfficeClickToRun_RASAPI32
FileTracingMask
4294901760
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
WatcherInterval
3600000
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OfficeClickToRun_RASAPI32
ConsoleTracingMask
4294901760
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
PipelineServerName
ClickToRun_Pipeline16
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OfficeClickToRun_RASAPI32
MaxFileSize
1048576
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OfficeClickToRun_RASAPI32
FileDirectory
%windir%\tracing
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OfficeClickToRun_RASMANCS
EnableFileTracing
0
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
PackageLockerPath
C:\ProgramData\Microsoft\Office
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OfficeClickToRun_RASMANCS
EnableConsoleTracing
0
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OfficeClickToRun_RASMANCS
FileTracingMask
4294901760
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OfficeClickToRun_RASMANCS
ConsoleTracingMask
4294901760
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OfficeClickToRun_RASMANCS
MaxFileSize
1048576
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OfficeClickToRun_RASMANCS
FileDirectory
%windir%\tracing
4084
OfficeClickToRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
4084
OfficeClickToRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
4600000094000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
VersionToReport
16.0.11328.20438
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun
ExecutingScenario
INSTALL
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
ScenarioInstanceID
E68087F2-9B8A-44A8-A02F-D4C7DE136204
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
ScenarioName
unknown
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
ProductsToAdd
O365ProPlusRetail.16_en-us_x-none
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
ProductsToRemove
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
Platform
x86
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
ClientCulture
en-us
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
BitfieldValues
64
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
TotalClientCabSize
19530753
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
C2RFlighting.UseExperimentalTransportForInPlacePipe
unknown
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
C2RFlighting.UseOfficeHelperAddon
unknown
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
C2RFlighting.UseOutlookShareAddon
unknown
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
BaseUrl
http://officecdn.microsoft.com/PR/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
Version
16.0.11328.20438
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
MediaType
CDN
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
CDNUrl
http://officecdn.microsoft.com/pr/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
UpdatesEnabled
True
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
SourceType
CDN
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
ExcludedApps
o365proplusretail_groove
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
DeliveryMechanism
7ffbc6bf-bc32-4f92-8982-f9dd17fd3114
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
ScenarioCulture
en-us
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL\TasksState
SCENARIO:{FB9843BB-0D8A-4347-A227-C759C3FC9103}
TASKSTATE_EXECUTING
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL\TasksState
PROMPTUSER:{0468216F-0C80-4620-AA53-3F53A84CDFC4}
TASKSTATE_EXECUTING
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
InstallID
E5348E70-5538-4109-B81A-68A8CE1E300D
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL\Condition
PromptAnswer
Continue
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL\TasksState
PROMPTUSER:{0468216F-0C80-4620-AA53-3F53A84CDFC4}
TASKSTATE_COMPLETED
4084
OfficeClickToRun.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
LanguageList
en-US
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL\TasksState
BRANCH:{DF3BBBD9-F521-43BA-BE89-8749E5F80983}
TASKSTATE_EXECUTING
4084
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL\TasksState
GROUP:{8D3B8D3F-A1B6-4149-8187-5530518A3849}
TASKSTATE_EXECUTING
4084
OfficeClickToRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Experiment\officeclicktorun
BuildNumber
16.0.11328
4084
OfficeClickToRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
Expires
int64_t|0
4084
OfficeClickToRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
1
4D736F3A3A436865636B73756D52656769737472793A3A446174617C75696E7436345F747C323739323531323430343530313832303130303B456373436F6E666967526573706F6E7365446174617C7B202256657222203A2022696E7433325F747C30222C2022436F6E6649647322203A20227374643A3A77737472696E677C502D442D32393633352D312D312C502D442D32373038372D312D392C502D442D32393731392D312D312C502D442D32393731382D312D312C502D442D32393539332D312D312C502D522D31383531332D312D3330222C2022434322203A20227374643A3A77737472696E677C4742222C2022446566436F6E667322203A20227374643A3A77737472696E677C222C202245787054696D6522203A2022696E7436345F747C31353733323333353736222C20224554616722203A20227374643A3A77737472696E677C5C224671555535682B4A473674792F5979642F4D302B2B3935654837364E457565674A326943636C365A6164303D5C22222C202246434D617022203A205B207B20224622203A20224D6963726F736F66742E4F66666963652E4543532E436F6E666967496444656C696D69746572496E4C6F67222C20225622203A20227374643A3A77737472696E677C3B22207D2C207B20224622203A20224D6963726F736F66742E4F66666963652E4543532E456E61626C65536D61727445546167222C20225622203A2022696E7433325F747C3122207D2C207B20224622203A20224D6963726F736F66742E4F66666963652E5365676D656E746174696F6E2E436C6F7564222C20225622203A20227374643A3A77737472696E677C5075626C696322207D2C207B20224622203A20224D6963726F736F66742E4F66666963652E5365676D656E746174696F6E2E50657270657475616C4C6963656E7365222C20225622203A20227374643A3A77737472696E677C3022207D2C207B20224622203A20224D6963726F736F66742E4F66666963652E5365676D656E746174696F6E2E5365676D656E74222C20225622203A20227374643A3A77737472696E677C4E4F4E4652444322207D2C207B20224622203A20224D6963726F736F66742E4F66666963652E5368617265642E4372634261736564556964222C20225622203A2022626F6F6C7C3122207D205D207D
4084
OfficeClickToRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
ChunkCount
uint64_t|0
4084
OfficeClickToRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
VersionId
uint16_t|1
4084
OfficeClickToRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
ConfigIds
P-D-29635-1-1,P-D-27087-1-9,P-D-29719-1-1,P-D-29718-1-1,P-D-29593-1-1,P-R-18513-1-30
4084
OfficeClickToRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
ETag
std::wstring|"FqUU5h+JG6ty/Yyd/M0++95eH76NEuegJ2iCcl6Zad0="
4084
OfficeClickToRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
Expires
int64_t|1573233576
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\Experiment\officeclicktorun
FirstSessionTriggered
1
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
UIFallbackLanguages
x-none
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
HelpLanguageTag
en-US
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
PreferredEditingLanguage
en-US
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
PreviousPreferredEditingLanguage
en-US
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
WordChangeInstallLanguage
No
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
WordMailChangeInstallLanguage
No
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
XLChangeInstallLanguage
No
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
PPTChangeInstallLanguage
No
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
AccessChangeInstallLanguage
No
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
OutlookChangeInstallLanguage
No
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
SharePointDesignerChangeInstallLanguage
No
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
PublisherChangeInstallLanguage
No
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
ProjectChangeInstallLanguage
No
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
InfoPathChangeInstallLanguage
No
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
OneNoteChangeInstallLanguage
No
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
WebDesignerChangeInstallLanguage
No
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources
LangTuneUp
OfficeCompleted
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-US
1
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\Common
UID
686C14227EDC164E8A5890B9B318380E
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\Experiment\officeclicktorun
EcsRequestPending
0
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Shared
OfficeUILanguage
1033
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\RulesLastAudienceReported
officeclicktorun.exe
Unknown_Error_Read_StreamPackageUrl
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
4600000003000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2468
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL\TasksState
CONFIGURELIGHT:{363FEBED-07D2-4993-B860-5925C6FAF115}
TASKSTATE_EXECUTING
2468
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
SourceType
CDN
2468
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
ScenarioSubType
Install
2468
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
LowBandwidthStreaming
True
2468
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Scenario\INSTALL
ProductsOriginalToAdd
O365ProPlusRetail.16_en-us_x-none
2468
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
Platform
x86
2468
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
InstallationPath
C:\Program Files\Microsoft Office
2468
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
ClientCulture
en-us
2468
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
CDNBaseUrl
http://officecdn.microsoft.com/pr/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114
2468
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
AudienceId
7ffbc6bf-bc32-4f92-8982-f9dd17fd3114
2468
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
AudienceData
Production::DC
2468
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
O365ProPlusRetail.MediaType
CDN
2468
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
UpdatesEnabled
True
2468
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag
Version
15.0.9999.9999
2468
OfficeClickToRun.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
O365ProPlusRetail.ExcludedApps
groove
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\12B\52C64B7E
LanguageList
en-US
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
DefaultConnectionSettings
4600000002000000090000000000000000000000000000000400000000000000102E07525096D501000000000000000000000000020000001700000000000000FE80000000000000A179B3FF019923140B000000FC545200FC545200000000000000000004000000000000002055520004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0400000000000000020000000000000002000000C0A864530000000000000000DADADADA0000000000000000060000000000000000000000E67C3A0000000000000000000000000098555200985552000000000000000000FFFFFFFF00000000000000000000000000000000BC555200BC55520000000000C8555200C855520000000000000000000000000000000000
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs
CountryCode
std::wstring|GB
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\Experiment\officeclicktorun
BuildNumber
16.0.11328
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
Expires
int64_t|0
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
1
4D736F3A3A436865636B73756D52656769737472793A3A446174617C75696E7436345F747C373131383133343439323936353935343735393B456373436F6E666967526573706F6E7365446174617C7B202256657222203A2022696E7433325F747C30222C2022436F6E6649647322203A20227374643A3A77737472696E677C502D442D32393633352D312D312C502D442D32373038372D312D392C502D442D32393731392D312D312C502D442D32393731382D312D312C502D442D32393539332D312D312C502D522D31383531332D312D3330222C2022434322203A20227374643A3A77737472696E677C4742222C2022446566436F6E667322203A20227374643A3A77737472696E677C222C202245787054696D6522203A2022696E7436345F747C31353733323333353832222C20224554616722203A20227374643A3A77737472696E677C5C224671555535682B4A473674792F5979642F4D302B2B3935654837364E457565674A3269436454304C3275453D5C22222C202246434D617022203A205B207B20224622203A20224D6963726F736F66742E4F66666963652E4543532E436F6E666967496444656C696D69746572496E4C6F67222C20225622203A20227374643A3A77737472696E677C3B22207D2C207B20224622203A20224D6963726F736F66742E4F66666963652E4543532E456E61626C65536D61727445546167222C20225622203A2022696E7433325F747C3122207D2C207B20224622203A20224D6963726F736F66742E4F66666963652E5365676D656E746174696F6E2E436C6F7564222C20225622203A20227374643A3A77737472696E677C5075626C696322207D2C207B20224622203A20224D6963726F736F66742E4F66666963652E5365676D656E746174696F6E2E50657270657475616C4C6963656E7365222C20225622203A20227374643A3A77737472696E677C3022207D2C207B20224622203A20224D6963726F736F66742E4F66666963652E5365676D656E746174696F6E2E5365676D656E74222C20225622203A20227374643A3A77737472696E677C4E4F4E4652444322207D2C207B20224622203A20224D6963726F736F66742E4F66666963652E5368617265642E4372634261736564556964222C20225622203A2022626F6F6C7C3122207D205D207D
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
ChunkCount
uint64_t|0
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData
VersionId
uint16_t|1
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
ConfigIds
P-D-29635-1-1,P-D-27087-1-9,P-D-29719-1-1,P-D-29718-1-1,P-D-29593-1-1,P-R-18513-1-30
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
ETag
std::wstring|"FqUU5h+JG6ty/Yyd/M0++95eH76NEuegJ2iCdT0L2uE="
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
Expires
int64_t|1573233582
2468
OfficeClickToRun.exe
write
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun
DeferredConfigs
std::wstring|

Files activity

Executable files
181
Suspicious files
30
Text files
19
Unknown types
13

Dropped files

PID
Process
Filename
Type
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-core-localization-l1-2-0.dll
executable
MD5: 3b9d034ca8a0345bc8f248927a86bf22
SHA256: a7ac7ece5e626c0b4e32c13299e9a44c8c380c8981ce4965cbe4c83759d2f52d
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2R32.dll
executable
MD5: ee8b24a0126231fd74f17d096444b913
SHA256: 537680c5ae6c999f0e94561e38dc99eca3d77a031d5bbca33223a75fb1af3f52
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.en-us.dll
executable
MD5: 6d1138bda92ec5268e955a1aee854a64
SHA256: 015289fd9a96d8fe04fce703e3cfa070167a568100154e5a77f53c529d934e93
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.he-il.dll
executable
MD5: 769de1779d8db07b4b9af307f482e5e6
SHA256: 3ef8e2b45920036b3a11ca4afdb6d698abffe766760f8370f66286dcec7b5999
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.hu-hu.dll
executable
MD5: e4c28852ee1b3cafdb460102d22352b0
SHA256: 992e73e722c7835469531cf1936d6cb90af84b6d010a0d69fd70fcee00f40527
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.da-dk.dll
executable
MD5: 8dbf917e5efb43f5aee8764ce80a1d94
SHA256: f95b4cd49f20ab1e82969831b7446edf44fb9dd7ee958c75120d713ee5c357f4
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.el-gr.dll
executable
MD5: ce175d38c7be3a8b4dddd190aa1553ab
SHA256: f4476047b000a5ac63d9c8618dfe38ceb50918f03dbe66072acdb82dc5e52081
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.id-id.dll
executable
MD5: 4b7eab5fd9c649f2e51579a79214b6de
SHA256: 5fca0bbdb783b82edcbe23e49253651fc0f81a16fbdf5afd1c38c75218aac40e
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.hi-in.dll
executable
MD5: 378b7ce600f060d674be4dbfb88ea794
SHA256: 68f2b46c0453a495e4a7334aec4da67f5a90bbb520bcf97e22628766c45e302e
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.lt-lt.dll
executable
MD5: 3052aa10d416797b1d402cf408a3841e
SHA256: 8d2c2ad828f45021fa7d748fe71a07b746b9c5cead154c29612252efd4791311
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.he-il.dll
executable
MD5: 769de1779d8db07b4b9af307f482e5e6
SHA256: 3ef8e2b45920036b3a11ca4afdb6d698abffe766760f8370f66286dcec7b5999
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.fi-fi.dll
executable
MD5: 2f8575c4baba38e8a1dfbf0cebf1a21c
SHA256: b181c70e1d5a1f98ad78238026cd72b9fc5fc6466bad2394a595fa0afc11ef32
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.nb-no.dll
executable
MD5: 4dada128456ed3473c317988ccb303d4
SHA256: 4a48901b5ff3fb6dee773201b507bdc174c4d4cc54fca3b6211d0b53b77045c4
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.es-es.dll
executable
MD5: eeba333404ba34cf2e474f65c6ae181a
SHA256: 66181838687516b509e1e3e37a0f0eeb28f359ac6aaa4c52d2df2309f7d150e8
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.fr-fr.dll
executable
MD5: 3fd94125c414887082d81f8e3892f6df
SHA256: f3d89f8133184d14ba5c9b1455048635023a2cf27a4bae7732dfbaf5f8dce33e
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.fr-fr.dll
executable
MD5: 3fd94125c414887082d81f8e3892f6df
SHA256: f3d89f8133184d14ba5c9b1455048635023a2cf27a4bae7732dfbaf5f8dce33e
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.hu-hu.dll
executable
MD5: e4c28852ee1b3cafdb460102d22352b0
SHA256: 992e73e722c7835469531cf1936d6cb90af84b6d010a0d69fd70fcee00f40527
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.cs-cz.dll
executable
MD5: 800206406b18e194410d92f2a803a2f4
SHA256: 219dac452f509d2e5f6ede2c9c444fae7691b4fc0987ba2b663e4e966f216e2c
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.bg-bg.dll
executable
MD5: e61914d1678f11d0ab7fa73850113f9d
SHA256: a26c0e5558a520e1dc51f8c8a4ba1e8f014b0582352b348c0e971df5cc700804
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.bg-bg.dll
executable
MD5: e61914d1678f11d0ab7fa73850113f9d
SHA256: a26c0e5558a520e1dc51f8c8a4ba1e8f014b0582352b348c0e971df5cc700804
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.it-it.dll
executable
MD5: ae2d7c57c4c1d590ea4d1ae7e887b3e4
SHA256: f0899eff0cbb69d3705ef635075677c1ee084e917b8e0033ba20cfe717e23c07
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.fi-fi.dll
executable
MD5: 2f8575c4baba38e8a1dfbf0cebf1a21c
SHA256: b181c70e1d5a1f98ad78238026cd72b9fc5fc6466bad2394a595fa0afc11ef32
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.it-it.dll
executable
MD5: ae2d7c57c4c1d590ea4d1ae7e887b3e4
SHA256: f0899eff0cbb69d3705ef635075677c1ee084e917b8e0033ba20cfe717e23c07
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.el-gr.dll
executable
MD5: ce175d38c7be3a8b4dddd190aa1553ab
SHA256: f4476047b000a5ac63d9c8618dfe38ceb50918f03dbe66072acdb82dc5e52081
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.lv-lv.dll
executable
MD5: 9ce3bb8667e8555b49c1ce3737d3b5c4
SHA256: 14fde48b7f3fd55cae8f4f482d30d7dae3bc1718793682cb9716ddb0b63d83a8
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.de-de.dll
executable
MD5: 98e3b6be0a0cda57e37c5c0b7949faf5
SHA256: 266d6e5eb5d372b6c9129b0b288101e0fc4d0d91ec57fb4616f3f892b7f1bbdf
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2R32.dll
executable
MD5: ee8b24a0126231fd74f17d096444b913
SHA256: 537680c5ae6c999f0e94561e38dc99eca3d77a031d5bbca33223a75fb1af3f52
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.cs-cz.dll
executable
MD5: 800206406b18e194410d92f2a803a2f4
SHA256: 219dac452f509d2e5f6ede2c9c444fae7691b4fc0987ba2b663e4e966f216e2c
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.kk-kz.dll
executable
MD5: 9dcf41e7073655d812dca70f203b5ea5
SHA256: 1b28690a264a4a6c87dad531658ef91bec1e1d71ed32bca12fa949b6efb9b824
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.id-id.dll
executable
MD5: 4b7eab5fd9c649f2e51579a79214b6de
SHA256: 5fca0bbdb783b82edcbe23e49253651fc0f81a16fbdf5afd1c38c75218aac40e
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.ar-sa.dll
executable
MD5: 70e47d768ffebb4e75461d12f4d6d4d5
SHA256: bad374881938e84854cf790f5fcc73821196cb726ccffa4014fdef1e124fa344
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.en-us.dll
executable
MD5: 6d1138bda92ec5268e955a1aee854a64
SHA256: 015289fd9a96d8fe04fce703e3cfa070167a568100154e5a77f53c529d934e93
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.ja-jp.dll
executable
MD5: 603aec17b0059aa7cbdd8272322e4b46
SHA256: c9bba15d732a635c8cb1332542e3093237cf751ee8987a80b2ed30a65c49f75b
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.et-ee.dll
executable
MD5: e8b9509a1ea21a4923a670c4020a6130
SHA256: d2ff415027e0107a7170dcd61d6c8ca45502b6c49fa8ae307f3165f6a331d9ac
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\AppVScripting.dll
executable
MD5: ae1480d5aa041369e6f6f4fa6c07cb24
SHA256: 12f14ec2eb07c9748d61b2e58799b6d2eef5b9a25f38da434538ee8f35ddf82a
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.es-es.dll
executable
MD5: eeba333404ba34cf2e474f65c6ae181a
SHA256: 66181838687516b509e1e3e37a0f0eeb28f359ac6aaa4c52d2df2309f7d150e8
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.nl-nl.dll
executable
MD5: 8ecaa2c052f7ab6941871e0252e3072c
SHA256: 4c5d56ac60b1d4f7605ebdb1f05e329057c601235ec54a387d9dd448ef6c2675
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.hr-hr.dll
executable
MD5: 443791dee5e011878dc9e96f29489e23
SHA256: 9359ba7944c24fc7ec5f534c24cfa5374ab076e0fcc529ea64b08f97851f7ad2
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\AppVShNotify.exe
executable
MD5: 33fdb87540089ef5c19ee48695a2eb5f
SHA256: 1b23a3dc6339424be174f7da61701a98d7c89a19dfe8ead07a8d974fb4ef0611
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.da-dk.dll
executable
MD5: 8dbf917e5efb43f5aee8764ce80a1d94
SHA256: f95b4cd49f20ab1e82969831b7446edf44fb9dd7ee958c75120d713ee5c357f4
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.ko-kr.dll
executable
MD5: 01fd7b64b4c4efaac043597869e60d0e
SHA256: bea5f8c46f01cba180db75918188ffc9fb3f10960a75c6d0fe4848c16ddb9f79
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.lt-lt.dll
executable
MD5: 3052aa10d416797b1d402cf408a3841e
SHA256: 8d2c2ad828f45021fa7d748fe71a07b746b9c5cead154c29612252efd4791311
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\AppVPolicy.dll
executable
MD5: e235fae7a0378921b4c15557faba05a4
SHA256: c06f284332652d8944da935cdc437211d57b5a952a37bdbad6fd226ae1092587
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.ar-sa.dll
executable
MD5: 70e47d768ffebb4e75461d12f4d6d4d5
SHA256: bad374881938e84854cf790f5fcc73821196cb726ccffa4014fdef1e124fa344
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.ms-my.dll
executable
MD5: 7c91d1d6b5247db2195d2cc222f9bb21
SHA256: e3cad6fc4116bdbd3252d611240f3fddf2131efd4f6fadfba1f12c6c5278ca79
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.pl-pl.dll
executable
MD5: 8d580dea5351ede866ef47a4a5bd5a32
SHA256: 31c782fc43035418cb866b15f6339208cf71e83926b1ea70ead4d30b7c93595a
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\AppVOrchestration.dll
executable
MD5: e136e3aca68c0a49c83019df0e8474b6
SHA256: 4eedfa8cbfad1a52f23f5e1087a0573fc2475c53ce0dee78d931b91677e73f4b
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.de-de.dll
executable
MD5: 98e3b6be0a0cda57e37c5c0b7949faf5
SHA256: 266d6e5eb5d372b6c9129b0b288101e0fc4d0d91ec57fb4616f3f892b7f1bbdf
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.hr-hr.dll
executable
MD5: 443791dee5e011878dc9e96f29489e23
SHA256: 9359ba7944c24fc7ec5f534c24cfa5374ab076e0fcc529ea64b08f97851f7ad2
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.nb-no.dll
executable
MD5: 4dada128456ed3473c317988ccb303d4
SHA256: 4a48901b5ff3fb6dee773201b507bdc174c4d4cc54fca3b6211d0b53b77045c4
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\AppVManifest.dll
executable
MD5: 3638cc9b7551c0dbe78fb0416226c0aa
SHA256: 201b3db79483400a70f4e74d19707b22d171faa99f2a69e44b10f2a5d791c112
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.et-ee.dll
executable
MD5: e8b9509a1ea21a4923a670c4020a6130
SHA256: d2ff415027e0107a7170dcd61d6c8ca45502b6c49fa8ae307f3165f6a331d9ac
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.sk-sk.dll
executable
MD5: e0467f28126762b31a3c8f38024cce7a
SHA256: 11a6ea7001e32ce2bf2e56080c57813286704ae279654a8ce40805bf2512b03f
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.sk-sk.dll
executable
MD5: e0467f28126762b31a3c8f38024cce7a
SHA256: 11a6ea7001e32ce2bf2e56080c57813286704ae279654a8ce40805bf2512b03f
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\AppvIsvSubsystems32.dll
executable
MD5: a7672739670aa1cb0bdd61a3fe71afb6
SHA256: 4ed783f88ecf404faec4b029efe3655e8665250caf10a268fb1fce6cf8da5086
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVPolicy.dll
executable
MD5: e235fae7a0378921b4c15557faba05a4
SHA256: c06f284332652d8944da935cdc437211d57b5a952a37bdbad6fd226ae1092587
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.pt-pt.dll
executable
MD5: 827977cd7e41d951ab077e605961dcd4
SHA256: 79b48f6411242c96f6aacbdee954665c1da9d2bf49e1ad96459e1e846cdab934
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.ms-my.dll
executable
MD5: 7c91d1d6b5247db2195d2cc222f9bb21
SHA256: e3cad6fc4116bdbd3252d611240f3fddf2131efd4f6fadfba1f12c6c5278ca79
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\AppVIsvVirtualization.dll
executable
MD5: e84fde960d9c4bacd33affb01560abaf
SHA256: d9b7943dc2ba6d4825fc5756541d7e88e1961ffe03d797ee0339466ac7ffaa8d
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVScripting.dll
executable
MD5: ae1480d5aa041369e6f6f4fa6c07cb24
SHA256: 12f14ec2eb07c9748d61b2e58799b6d2eef5b9a25f38da434538ee8f35ddf82a
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.sr-latn-rs.dll
executable
MD5: 9a65c3cfbc4b4259219fb23cf46ce6d4
SHA256: 7b4cee10295ecd67bed2abe962b47db303f5438cdfde68b21f41415416a7910a
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.sr-latn-rs.dll
executable
MD5: 9a65c3cfbc4b4259219fb23cf46ce6d4
SHA256: 7b4cee10295ecd67bed2abe962b47db303f5438cdfde68b21f41415416a7910a
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\AppVIsvSubsystemController.dll
executable
MD5: 4e64f7c2bdc6b854c8666a3239c7fad1
SHA256: 25eda314f1b72d7dd45a447bfc206db9cddd830d4057e6977e9b3c81fd2e888e
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppvIsvSubsystems32.dll
executable
MD5: a7672739670aa1cb0bdd61a3fe71afb6
SHA256: 4ed783f88ecf404faec4b029efe3655e8665250caf10a268fb1fce6cf8da5086
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.sl-si.dll
executable
MD5: 01b2e8b9b49b561b1d2bacb0cd0d6342
SHA256: 1b0f892b9191254d794a6f3043a72973a8ce66223ae8d181ba5630bc405af804
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.ru-ru.dll
executable
MD5: 057c1b5c9a7bc1cca34dcd73a84fede3
SHA256: a77835183b791164e0689a1c08ecad7d81951318d229f63cace96fad7b440781
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\AppVIsvStreamingManager.dll
executable
MD5: 30507dd2e3e890dd7e4773f4f2aa58a3
SHA256: a99cc7bb4ecea5d111740e613942679883ea41c399eedb9ef6d4f5ca15012bc3
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe
executable
MD5: 33fdb87540089ef5c19ee48695a2eb5f
SHA256: 1b23a3dc6339424be174f7da61701a98d7c89a19dfe8ead07a8d974fb4ef0611
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.pl-pl.dll
executable
MD5: 8d580dea5351ede866ef47a4a5bd5a32
SHA256: 31c782fc43035418cb866b15f6339208cf71e83926b1ea70ead4d30b7c93595a
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.lv-lv.dll
executable
MD5: 9ce3bb8667e8555b49c1ce3737d3b5c4
SHA256: 14fde48b7f3fd55cae8f4f482d30d7dae3bc1718793682cb9716ddb0b63d83a8
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\AppVIntegration.dll
executable
MD5: e2ed5ba835ac654f1b9668ef86d5dcd8
SHA256: 6d8b8fef8b13df580fc28f2c3a88b3cb764b2b517e7be0a3882fdd4d66b0cdd5
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dll
executable
MD5: e2ed5ba835ac654f1b9668ef86d5dcd8
SHA256: 6d8b8fef8b13df580fc28f2c3a88b3cb764b2b517e7be0a3882fdd4d66b0cdd5
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.tr-tr.dll
executable
MD5: 7972eb501a0b50cae62ee763bcc9a27b
SHA256: 8d21d48cf5a706a0f35a8969c1bb12f4f7ab962094f1d2ef0afff7aa988ffcb3
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.nl-nl.dll
executable
MD5: 8ecaa2c052f7ab6941871e0252e3072c
SHA256: 4c5d56ac60b1d4f7605ebdb1f05e329057c601235ec54a387d9dd448ef6c2675
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\AppVIsvApi.dll
executable
MD5: f4af62dc442bcd3d19f730e13e5414bc
SHA256: deacfffa77f22a6d5540422911343087030a594628eb76b974f8443e714a2ba5
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVManifest.dll
executable
MD5: 3638cc9b7551c0dbe78fb0416226c0aa
SHA256: 201b3db79483400a70f4e74d19707b22d171faa99f2a69e44b10f2a5d791c112
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll
executable
MD5: 5245f303e96166b8e625dd0a97e2d66a
SHA256: 90a63611d9169a8cd7d030cd2b107b6e290e50e2beba6fa640a7497a8599aff5
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.pt-br.dll
executable
MD5: e87b971f8a1a8cbe5e142e26b881120a
SHA256: d36172f5d9d0423cce1c40d08ef1c5f50a2ebf25155d2cc591779a3e6a62e08c
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\AppVFileSystemMetadata.dll
executable
MD5: 1eef31d805e8791b4dd1c8c4f79d7239
SHA256: 38e14a71b92a75633926610560a1311114131492f6780bb11f93de7939737249
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll
executable
MD5: e136e3aca68c0a49c83019df0e8474b6
SHA256: 4eedfa8cbfad1a52f23f5e1087a0573fc2475c53ce0dee78d931b91677e73f4b
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.ru-ru.dll
executable
MD5: 057c1b5c9a7bc1cca34dcd73a84fede3
SHA256: a77835183b791164e0689a1c08ecad7d81951318d229f63cace96fad7b440781
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.pt-pt.dll
executable
MD5: 827977cd7e41d951ab077e605961dcd4
SHA256: 79b48f6411242c96f6aacbdee954665c1da9d2bf49e1ad96459e1e846cdab934
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\appvcleaner.exe
executable
MD5: 16b0494f59a563ce023ad26d4dfe4e10
SHA256: 054bd69e40ab4f82c373de1036560108855f99f55af29c748b40b8d786151980
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvApi.dll
executable
MD5: f4af62dc442bcd3d19f730e13e5414bc
SHA256: deacfffa77f22a6d5540422911343087030a594628eb76b974f8443e714a2ba5
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.pt-br.dll
executable
MD5: e87b971f8a1a8cbe5e142e26b881120a
SHA256: d36172f5d9d0423cce1c40d08ef1c5f50a2ebf25155d2cc591779a3e6a62e08c
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.ja-jp.dll
executable
MD5: 603aec17b0059aa7cbdd8272322e4b46
SHA256: c9bba15d732a635c8cb1332542e3093237cf751ee8987a80b2ed30a65c49f75b
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\AppVCatalog.dll
executable
MD5: 874d28540b3d1c5ea2647c32f5e60b10
SHA256: dca54dc20b9be93335c15c75b56cdcdca05d91323efa49971afba85ec3650495
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVFileSystemMetadata.dll
executable
MD5: 1eef31d805e8791b4dd1c8c4f79d7239
SHA256: 38e14a71b92a75633926610560a1311114131492f6780bb11f93de7939737249
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.th-th.dll
executable
MD5: b57c898e06c94ac0bf7ce71d6b557f80
SHA256: 19ca52c55f7748b93991709a750edb436c57cbd4413c1a943147a7177fbcb82e
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.ko-kr.dll
executable
MD5: 01fd7b64b4c4efaac043597869e60d0e
SHA256: bea5f8c46f01cba180db75918188ffc9fb3f10960a75c6d0fe4848c16ddb9f79
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\ApiClient.dll
executable
MD5: e073b5c279df23f88bf2c09fbd06b9b7
SHA256: 0f20f73a70afd86733dd376d922e310c2c991e0b62effe0fb6879af8c3c6e2a9
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll
executable
MD5: 4e64f7c2bdc6b854c8666a3239c7fad1
SHA256: 25eda314f1b72d7dd45a447bfc206db9cddd830d4057e6977e9b3c81fd2e888e
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.vi-vn.dll
executable
MD5: cb9d23918f9bd62da1a58312640d06ee
SHA256: 2276101ebbaf5ba48b8709fc0cf2c0585ef97a6a704ff5d5ebce51c41bba00ce
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.kk-kz.dll
executable
MD5: 9dcf41e7073655d812dca70f203b5ea5
SHA256: 1b28690a264a4a6c87dad531658ef91bec1e1d71ed32bca12fa949b6efb9b824
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-crt-private-l1-1-0.dll
executable
MD5: 1dd5666125b8734e92b1041139fa6c37
SHA256: d0ff5f6bb94961d4c17f0709297a6b5a5fa323c9ac82f4fe27187912b4b13cf3
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvStreamingManager.dll
executable
MD5: 30507dd2e3e890dd7e4773f4f2aa58a3
SHA256: a99cc7bb4ecea5d111740e613942679883ea41c399eedb9ef6d4f5ca15012bc3
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.zh-cn.dll
executable
MD5: 7db35a6c644ac66823db9cb8869c4e65
SHA256: aa20ec7da55719108c8ee793f4ebf53f06b637a69cf156c883c32076a5a6d8cc
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.ro-ro.dll
executable
MD5: 93f3200640e1ceac32f35426d8bb8e17
SHA256: 593c4d18c6d2ba5e5b37788dc9734c2b94f46a14c6a9ad76e257829b3d9a9e3a
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-crt-math-l1-1-0.dll
executable
MD5: d0d380af839124368a96d6aa82c7c8ae
SHA256: 06985d00bf4985024e95442702bbdb53c2127e99f16440424f3380a88883f1a5
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll
executable
MD5: e84fde960d9c4bacd33affb01560abaf
SHA256: d9b7943dc2ba6d4825fc5756541d7e88e1961ffe03d797ee0339466ac7ffaa8d
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.ro-ro.dll
executable
MD5: 93f3200640e1ceac32f35426d8bb8e17
SHA256: 593c4d18c6d2ba5e5b37788dc9734c2b94f46a14c6a9ad76e257829b3d9a9e3a
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.sl-si.dll
executable
MD5: 01b2e8b9b49b561b1d2bacb0cd0d6342
SHA256: 1b0f892b9191254d794a6f3043a72973a8ce66223ae8d181ba5630bc405af804
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-crt-stdio-l1-1-0.dll
executable
MD5: 32d7b95b1bce23db9fbd0578053ba87f
SHA256: 104a76b41cbd9a945dba43a6ffa8c6de99db2105d4ce93a717729a9bd020f728
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll
executable
MD5: d0d380af839124368a96d6aa82c7c8ae
SHA256: 06985d00bf4985024e95442702bbdb53c2127e99f16440424f3380a88883f1a5
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.uk-ua.dll
executable
MD5: bd8e4acc6058c024527761a00accf1d1
SHA256: d5da1e4578d444effb8d4dce3da6077c763ac18c35a43ae721c437109e254b16
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.zh-tw.dll
executable
MD5: cb4ef1dc00ff3e1db210beaed88c4322
SHA256: f4f871f3932533bc57ca953e5ae274adfee924eca1f7ddcd938a34ddf7c34e00
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-core-synch-l1-2-0.dll
executable
MD5: f6b4d8d403d22eb87a60bf6e4a3e7041
SHA256: 25687e95b65d0521f8c737df301bf90db8940e1c0758bb6ea5c217cf7d2f2270
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll
executable
MD5: 1dd5666125b8734e92b1041139fa6c37
SHA256: d0ff5f6bb94961d4c17f0709297a6b5a5fa323c9ac82f4fe27187912b4b13cf3
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.zh-tw.dll
executable
MD5: cb4ef1dc00ff3e1db210beaed88c4322
SHA256: f4f871f3932533bc57ca953e5ae274adfee924eca1f7ddcd938a34ddf7c34e00
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.th-th.dll
executable
MD5: b57c898e06c94ac0bf7ce71d6b557f80
SHA256: 19ca52c55f7748b93991709a750edb436c57cbd4413c1a943147a7177fbcb82e
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-crt-string-l1-1-0.dll
executable
MD5: 5e72659b38a2977984bbc23ed274f007
SHA256: 44a4db6080f6bdae6151f60ae5dc420faa3be50902e88f8f14ad457dec3fe4ea
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll
executable
MD5: 1fa7c2b81cdfd7ace42a2a9a0781c946
SHA256: cafdb772a1d7acf0807478fdba1e00fd101fc29c136547b37131f80d21dacffd
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\InspectorOfficeGadget.exe
executable
MD5: 195fb8173288632c67a6126cda457e42
SHA256: e0c96b28359eccb2e571fb5f5c4ada943021ddac4088fb73f1cc4d2da68047b0
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.sv-se.dll
executable
MD5: 564bcc03e916df3bec873174144626c5
SHA256: 0b03ccadde6cf9ac7bef36734fc476cf2e82033060ce36fa46c7d97104b85ade
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-crt-time-l1-1-0.dll
executable
MD5: 1fa7c2b81cdfd7ace42a2a9a0781c946
SHA256: cafdb772a1d7acf0807478fdba1e00fd101fc29c136547b37131f80d21dacffd
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll
executable
MD5: e073b5c279df23f88bf2c09fbd06b9b7
SHA256: 0f20f73a70afd86733dd376d922e310c2c991e0b62effe0fb6879af8c3c6e2a9
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RUI.dll
executable
MD5: 75522553fbc58c09cf2c4b74aa9396e6
SHA256: 7e5cdf3249eb251f7870c3ed94a3d9868983f90069758d92db640d1b9be85c72
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.tr-tr.dll
executable
MD5: 7972eb501a0b50cae62ee763bcc9a27b
SHA256: 8d21d48cf5a706a0f35a8969c1bb12f4f7ab962094f1d2ef0afff7aa988ffcb3
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-crt-runtime-l1-1-0.dll
executable
MD5: ae3fa6bf777b0429b825fb6b028f8a48
SHA256: 66b86ed0867fe22e80b9b737f3ee428be71f5e98d36f774abbf92e3aaca71bfb
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVCatalog.dll
executable
MD5: 874d28540b3d1c5ea2647c32f5e60b10
SHA256: dca54dc20b9be93335c15c75b56cdcdca05d91323efa49971afba85ec3650495
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\cpprestsdk.dll
executable
MD5: 85a83853a712cd728529142f6b249c3f
SHA256: db2daef69bc0f45d6479e5891f104baed212701c830f7a111e84dbfe3a033b06
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.zh-cn.dll
executable
MD5: 7db35a6c644ac66823db9cb8869c4e65
SHA256: aa20ec7da55719108c8ee793f4ebf53f06b637a69cf156c883c32076a5a6d8cc
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-crt-utility-l1-1-0.dll
executable
MD5: d6abf5c056d80592f8e2439e195d61ac
SHA256: 8858d883d180cea63e3bf4a3f5bc9e0f9fa16c9a35a84c4efe65308cea13a364
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll
executable
MD5: 8f8a47617dfd829a63e3ec4aff2718d9
SHA256: 6d4a1aad695a3451c2d3f564c7cc8d37192cd35539874df6ae55e24847e51784
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\IntegratedOffice.exe
executable
MD5: 84010750e97840008ef1e9bad5a23dca
SHA256: bb78ca462f5c216a14661b48ee27dd5e6bb21f07c3123ddf30ac333a35117866
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.uk-ua.dll
executable
MD5: bd8e4acc6058c024527761a00accf1d1
SHA256: d5da1e4578d444effb8d4dce3da6077c763ac18c35a43ae721c437109e254b16
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-crt-locale-l1-1-0.dll
executable
MD5: e70d8fe9d21841202b4fd1cf55d37ac5
SHA256: e087f611b3659151dfb674728202944a7c0fe71710f280840e00a5c4b640632d
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\appvcleaner.exe
executable
MD5: 16b0494f59a563ce023ad26d4dfe4e10
SHA256: 054bd69e40ab4f82c373de1036560108855f99f55af29c748b40b8d786151980
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\concrt140.dll
executable
MD5: 1e5b9799a91d80b9a82df786ad98fd47
SHA256: 9068d558632422427e8c6a3e6b3223d314717009498f4566365699ebe8a040eb
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RINTL.vi-vn.dll
executable
MD5: cb9d23918f9bd62da1a58312640d06ee
SHA256: 2276101ebbaf5ba48b8709fc0cf2c0585ef97a6a704ff5d5ebce51c41bba00ce
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-crt-conio-l1-1-0.dll
executable
MD5: 3b038338c1eb179d8eee3883cf42bc3e
SHA256: c17786e9031062f56e4b205f394a795e11ef9367b922763ddf391f2acab2e979
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll
executable
MD5: d6abf5c056d80592f8e2439e195d61ac
SHA256: 8858d883d180cea63e3bf4a3f5bc9e0f9fa16c9a35a84c4efe65308cea13a364
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RCom.dll
executable
MD5: 5cd0c9f0a682274aa2a138ef53199674
SHA256: d21c39def166117a17d6f1455a2a9e6be59f180e1769cb16cae54ac19c8cf219
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RUI.dll
executable
MD5: 75522553fbc58c09cf2c4b74aa9396e6
SHA256: 7e5cdf3249eb251f7870c3ed94a3d9868983f90069758d92db640d1b9be85c72
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-crt-heap-l1-1-0.dll
executable
MD5: 39d81596a7308e978d67ad6fdccdd331
SHA256: 3d109fd01f6684414d8a1d0d2f5e6c5b4e24de952a0695884744a6cbd44a8ec7
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll
executable
MD5: 5e72659b38a2977984bbc23ed274f007
SHA256: 44a4db6080f6bdae6151f60ae5dc420faa3be50902e88f8f14ad457dec3fe4ea
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
executable
MD5: 5d18f625862478ae3884c6e1308ad078
SHA256: e88a10c6528ef5074f63cd7dcacec90f79a77972e5b1f25756ac45e5b3bc1ebb
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\concrt140.dll
executable
MD5: 1e5b9799a91d80b9a82df786ad98fd47
SHA256: 9068d558632422427e8c6a3e6b3223d314717009498f4566365699ebe8a040eb
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-crt-convert-l1-1-0.dll
executable
MD5: 5245f303e96166b8e625dd0a97e2d66a
SHA256: 90a63611d9169a8cd7d030cd2b107b6e290e50e2beba6fa640a7497a8599aff5
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll
executable
MD5: 32d7b95b1bce23db9fbd0578053ba87f
SHA256: 104a76b41cbd9a945dba43a6ffa8c6de99db2105d4ce93a717729a9bd020f728
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\msvcp120.dll
executable
MD5: e3244fdcec84c99e4b60227eb3b70893
SHA256: 81fbc2824e73f0d101d91854694a52e79db0ffaadbb2a10deaaf47b3b7f9b2b0
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\InspectorOfficeGadget.exe
executable
MD5: 195fb8173288632c67a6126cda457e42
SHA256: e0c96b28359eccb2e571fb5f5c4ada943021ddac4088fb73f1cc4d2da68047b0
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-crt-filesystem-l1-1-0.dll
executable
MD5: ab8734c2328a46e7e9583befeb7085a2
SHA256: 921b7cf74744c4336f976db6750921b2a0960e8aa11268457f5ed27c0e13b2c8
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll
executable
MD5: ab8734c2328a46e7e9583befeb7085a2
SHA256: 921b7cf74744c4336f976db6750921b2a0960e8aa11268457f5ed27c0e13b2c8
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\msvcr120.dll
executable
MD5: 1a22ac29230ff06e278cf85992f48c86
SHA256: 3a3f61f1d187142bba9b37b318f6052a09743ff24fcdb3cee478d1bc5c68d300
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\cpprestsdk.dll
executable
MD5: 85a83853a712cd728529142f6b249c3f
SHA256: db2daef69bc0f45d6479e5891f104baed212701c830f7a111e84dbfe3a033b06
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-crt-multibyte-l1-1-0.dll
executable
MD5: 809bc1010eaf714cd095189af236ce2f
SHA256: b52f2b9de19d12b0e727e13e3dde93009e487bfb2dd97fd23952c7080949d97e
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll
executable
MD5: ae3fa6bf777b0429b825fb6b028f8a48
SHA256: 66b86ed0867fe22e80b9b737f3ee428be71f5e98d36f774abbf92e3aaca71bfb
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\msvcp140.dll
executable
MD5: 774997bd018a0cc54c42bb545ebb400c
SHA256: 7bf763dab6ec4c1840e1ec884e23c42ab78ab1e59d706b7fa994025c8d31219a
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\IntegratedOffice.exe
executable
MD5: 84010750e97840008ef1e9bad5a23dca
SHA256: bb78ca462f5c216a14661b48ee27dd5e6bb21f07c3123ddf30ac333a35117866
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-crt-process-l1-1-0.dll
executable
MD5: 8f8a47617dfd829a63e3ec4aff2718d9
SHA256: 6d4a1aad695a3451c2d3f564c7cc8d37192cd35539874df6ae55e24847e51784
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll
executable
MD5: 809bc1010eaf714cd095189af236ce2f
SHA256: b52f2b9de19d12b0e727e13e3dde93009e487bfb2dd97fd23952c7080949d97e
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\vcruntime140.dll
executable
MD5: 9b22263a62dcd0556e4bd9cea223cb3b
SHA256: 2b51c69681ed57f3092e9cac1ee364e9c8ae70ef1c25bfd5d83448dda2704a96
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\msvcp140.dll
executable
MD5: 774997bd018a0cc54c42bb545ebb400c
SHA256: 7bf763dab6ec4c1840e1ec884e23c42ab78ab1e59d706b7fa994025c8d31219a
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-crt-environment-l1-1-0.dll
executable
MD5: 45c54a21261180410091cefb23f6a5ae
SHA256: 2b0fea07db507b7266346eab3ca7ede3821876aadc519daf059b130b85640918
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll
executable
MD5: e70d8fe9d21841202b4fd1cf55d37ac5
SHA256: e087f611b3659151dfb674728202944a7c0fe71710f280840e00a5c4b640632d
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\vccorlib140.dll
executable
MD5: 150b1beaf80266c2c9fbedcaed4167b0
SHA256: 74621e9d25a2087565489bd702b3145635764a5a29fe40003239086066dd0bcf
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\msvcp120.dll
executable
MD5: e3244fdcec84c99e4b60227eb3b70893
SHA256: 81fbc2824e73f0d101d91854694a52e79db0ffaadbb2a10deaaf47b3b7f9b2b0
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-core-xstate-l2-1-0.dll
executable
MD5: e20c50cb320a5718ae869d8ec4d460ca
SHA256: 48c776f38eaed72cb05a993484f60cbfdf5af59aebc48e53481a997ae7ded8dc
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll
executable
MD5: 39d81596a7308e978d67ad6fdccdd331
SHA256: 3d109fd01f6684414d8a1d0d2f5e6c5b4e24de952a0695884744a6cbd44a8ec7
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\StreamServer.dll
executable
MD5: 350ead591cbe1a96277eeb9867cc8e03
SHA256: d1b36992d75d5790567931c758c868253ee88f77e532e371f0f64241ea79a560
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\msvcr120.dll
executable
MD5: 1a22ac29230ff06e278cf85992f48c86
SHA256: 3a3f61f1d187142bba9b37b318f6052a09743ff24fcdb3cee478d1bc5c68d300
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-core-timezone-l1-1-0.dll
executable
MD5: a20084f41b3f1c549d6625c790b72268
SHA256: 0fa42237fd1140fd125c6edb728d4c70ad0276c72fa96c2faabf7f429fa7e8f1
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll
executable
MD5: 3b038338c1eb179d8eee3883cf42bc3e
SHA256: c17786e9031062f56e4b205f394a795e11ef9367b922763ddf391f2acab2e979
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
executable
MD5: 903f01d1f192fba50322786a82f26ea4
SHA256: 84557000132464b79b1166a34c633246b5fe5c6c3411d72a72320b08dcb06679
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll
executable
MD5: a20084f41b3f1c549d6625c790b72268
SHA256: 0fa42237fd1140fd125c6edb728d4c70ad0276c72fa96c2faabf7f429fa7e8f1
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-core-file-l2-1-0.dll
executable
MD5: bfb08fb09e8d68673f2f0213c59e2b97
SHA256: 6d5881719e9599bf10a4193c8e2ded2a38c10de0ba8904f48c67f2da6e84ed3e
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll
executable
MD5: 3b9d034ca8a0345bc8f248927a86bf22
SHA256: a7ac7ece5e626c0b4e32c13299e9a44c8c380c8981ce4965cbe4c83759d2f52d
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ucrtbase.dll
executable
MD5: 21e6732ef4ef91b8efe2f17ad0562093
SHA256: ef2a371edb8835629de7a839f5b5d61c554c9e307cc4bf05cd9634817c0914f2
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll
executable
MD5: 45c54a21261180410091cefb23f6a5ae
SHA256: 2b0fea07db507b7266346eab3ca7ede3821876aadc519daf059b130b85640918
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-core-processthreads-l1-1-1.dll
executable
MD5: c2ead5fcce95a04d31810768a3d44d57
SHA256: 42a9a3d8a4a7c82cb6ec42c62d3a522daa95beb01ecb776aac2bfd4aa1e58d62
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll
executable
MD5: f6b4d8d403d22eb87a60bf6e4a3e7041
SHA256: 25687e95b65d0521f8c737df301bf90db8940e1c0758bb6ea5c217cf7d2f2270
2468
OfficeClickToRun.exe
C:\Program Files\Microsoft Office 15\ClientX86\IntegratedOffice.exe
executable
MD5: 84010750e97840008ef1e9bad5a23dca
SHA256: bb78ca462f5c216a14661b48ee27dd5e6bb21f07c3123ddf30ac333a35117866
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll
executable
MD5: e20c50cb320a5718ae869d8ec4d460ca
SHA256: 48c776f38eaed72cb05a993484f60cbfdf5af59aebc48e53481a997ae7ded8dc
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\api-ms-win-core-file-l1-2-0.dll
executable
MD5: f6d1216e974fb76585fd350ebdc30648
SHA256: 348b70e57ae0329ac40ac3d866b8e896b0b8fef7e8809a09566f33af55d33271
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll
executable
MD5: bfb08fb09e8d68673f2f0213c59e2b97
SHA256: 6d5881719e9599bf10a4193c8e2ded2a38c10de0ba8904f48c67f2da6e84ed3e
2468
OfficeClickToRun.exe
C:\Program Files\Microsoft Office 15\ClientX86\OfficeClickToRun.exe
executable
MD5: 84010750e97840008ef1e9bad5a23dca
SHA256: bb78ca462f5c216a14661b48ee27dd5e6bb21f07c3123ddf30ac333a35117866
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll
executable
MD5: f6d1216e974fb76585fd350ebdc30648
SHA256: 348b70e57ae0329ac40ac3d866b8e896b0b8fef7e8809a09566f33af55d33271
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll
executable
MD5: c2ead5fcce95a04d31810768a3d44d57
SHA256: 42a9a3d8a4a7c82cb6ec42c62d3a522daa95beb01ecb776aac2bfd4aa1e58d62
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.hi-in.dll
executable
MD5: 378b7ce600f060d674be4dbfb88ea794
SHA256: 68f2b46c0453a495e4a7334aec4da67f5a90bbb520bcf97e22628766c45e302e
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.sv-se.dll
executable
MD5: 564bcc03e916df3bec873174144626c5
SHA256: 0b03ccadde6cf9ac7bef36734fc476cf2e82033060ce36fa46c7d97104b85ade
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\vcruntime140.dll
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\SubsystemController.man
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\FrequentOfficeUpdateSchedule.xml
xml
MD5: 34c23504fb391504b56f6c9638683c85
SHA256: d9f27a03289fa1186e4c5b525597ec07aa308342967a7227f54904730ed4c40a
4084
OfficeClickToRun.exe
C:\Users\admin\AppData\Local\Temp\.session
binary
MD5: 025337fe21a03b71b9a4ecbbc7545427
SHA256: 1304c1a6872624543e2f07abacac0765e23bbc2868723df52afd2f61041cc354
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\i320.hash
text
MD5: 78c15d396adfe88acd5b45bbb294e230
SHA256: fe41636bae9ac948a50d2156ad8a652531a2d72419817625c7a0150fdbd151a4
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ClientCapabilities.json
text
MD5: 96ce107c5fb9ce67de12d7df7a9275e8
SHA256: 0f3a635894e56d558346837a983473090c866b909872c482c2e9fac65b298ddb
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\i320.hash
text
MD5: 78c15d396adfe88acd5b45bbb294e230
SHA256: fe41636bae9ac948a50d2156ad8a652531a2d72419817625c7a0150fdbd151a4
2468
OfficeClickToRun.exe
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A583E2A51BFBDC1E492A57B7C8325850
binary
MD5: 05f096b316c453d14c4bad189dcfbac0
SHA256: b7d3ac102a3def2a6ebb37215c73d91241aeca78101160d0426653f43bb6e722
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\FrequentOfficeUpdateSchedule.xml
xml
MD5: 34c23504fb391504b56f6c9638683c85
SHA256: d9f27a03289fa1186e4c5b525597ec07aa308342967a7227f54904730ed4c40a
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\C2RHeartbeatConfig.xml
xml
MD5: cdd1fb1c46f6c3b304625a288dbf7c99
SHA256: dcd0aab257eb6514847f82070f947fd3c5a760f9a510084db980f6fdee53c9b0
2468
OfficeClickToRun.exe
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A583E2A51BFBDC1E492A57B7C8325850
der
MD5: 52d6627377fffa0c57b8c557e49a0f15
SHA256: dead1dfb1dda29aac9ff3aff3fb139ab0a1af3322c98d3731eafe21990210337
2468
OfficeClickToRun.exe
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76
binary
MD5: bea5c02105d7c683331d4de9db2fec34
SHA256: e0d7d0e7b2f864c5e6eebd85b845a4f995a27c33cf25a2681581bb0f59eb1255
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\ClientEventLogMessages.man
xml
MD5: 9a9a5f91ca03c8fea03bb8ac25475a12
SHA256: f3dc361d94356c8f4c4632ff98f5e990ebe80a18f0624896dcb9159aff0834e1
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\ClientCapabilities.json
text
MD5: 96ce107c5fb9ce67de12d7df7a9275e8
SHA256: 0f3a635894e56d558346837a983473090c866b909872c482c2e9fac65b298ddb
2468
OfficeClickToRun.exe
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7396C420A8E1BC1DA97F1AF0D10BAD21
der
MD5: 240577671d7136975de89af958f2f78d
SHA256: 08c48d3522f7ccbbf1bcf1860d60c285e43d240a07a141aa270f96faee25b31b
2468
OfficeClickToRun.exe
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7396C420A8E1BC1DA97F1AF0D10BAD21
binary
MD5: f7209666f3f2929f82408b76e35efd28
SHA256: 0cd4c0ceee48c3519543585d4d70dbf2a0f07187003d1bca60bb892ba2adf3ac
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RHeartbeatConfig.xml
xml
MD5: cdd1fb1c46f6c3b304625a288dbf7c99
SHA256: dcd0aab257eb6514847f82070f947fd3c5a760f9a510084db980f6fdee53c9b0
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVClient.man
xml
MD5: 98bf5a6cf9d866640e120894824304f6
SHA256: ac5575f583abf5d0d20b926f7c989131586bda9cf19db3d719af7a01dfc2273a
2468
OfficeClickToRun.exe
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD
binary
MD5: 8727945a60dd1f821e7580a2a6dbe5c3
SHA256: 2e38aa69bb4741907e3ced743d583cf97ef46552a856c1cba731b910b771f5e4
2468
OfficeClickToRun.exe
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD
der
MD5: 3ef59a32c8c5ebadb1f6ab607cbbfcbb
SHA256: 4b81235e2c268a1e9ef7ff2fd807ceb3b921d86108dd60faa6fec0acfc58df0a
2468
OfficeClickToRun.exe
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_C9FB72B5AE80778A08024D8B0FDECC6F
binary
MD5: 04e3d58be468f8057323b5a79cbead7b
SHA256: b5b65f66ca08bb4333bdd35796c40e94d7dea3c4a7e3e4d12b9ee1c778a721ac
2468
OfficeClickToRun.exe
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_C9FB72B5AE80778A08024D8B0FDECC6F
der
MD5: 7efd8517aa3c274c72f6d706b525e068
SHA256: 99cd991a29803d74606aaaa09fa75683c5a35e6dae800ae68b9da5cd5de8c458
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\SubsystemController.man
xml
MD5: aacf231fb3529afd5b2488704f8f9b82
SHA256: 7c112558cd5777f787e3d4bcced67b08cc63541294635e8bdbc0063c3c7fa081
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\AppVClientIsv.man
xml
MD5: eff70efd2c66a9241291560f3977b195
SHA256: 6b5cc677bb215c5f402e1413b0872eba465c8755fdaef0cf9e6af20b1866aaa9
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\AppVClient.man
xml
MD5: 98bf5a6cf9d866640e120894824304f6
SHA256: ac5575f583abf5d0d20b926f7c989131586bda9cf19db3d719af7a01dfc2273a
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\SharedPerformance.man
xml
MD5: e21b7e03173fd8591b9906096c451e1a
SHA256: 6fbbb678f1bf875900bcacc5cdbf73aff82147fbf8f35c0fd57391bfc094693e
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ServiceWatcherSchedule.xml
xml
MD5: eebd1ed93f54772302324ae7fc741ac7
SHA256: f3b0dc236db906b513e7faa2185ee38112079a71cfb8dcf489f8c022f292c82d
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeUpdateSchedule.xml
xml
MD5: 3a883f8166d0a0f41127505491ef19f3
SHA256: ed69a0b39842b0eac3a99ceb1a82985ed226ca823efd95bb5d72c50ec6d9391b
2468
OfficeClickToRun.exe
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4C7F163ED126D5C3CB9457F68EC64E9E
binary
MD5: 1649db6e4d2248d66c409756e876341c
SHA256: cf91f46864e73078904b873bf4452f15d81054ff1e31ce3107ca6c013b177d9c
2468
OfficeClickToRun.exe
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4C7F163ED126D5C3CB9457F68EC64E9E
der
MD5: 7853ab2278fc56208f88cb4e118d9fb8
SHA256: 5e673a872095cab1e204277dafcdeb08afa9d644307cfb0da01337f904030d9b
2468
OfficeClickToRun.exe
C:\Windows\TEMP\.session
binary
MD5: c8eeb31f762c2bffd7057cdfc8df0209
SHA256: 36e7c57f835c88814ababd55dd1ad677b8bde56885e33f086fd67923dde01fd0
2468
OfficeClickToRun.exe
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-journal
––
MD5:  ––
SHA256:  ––
2468
OfficeClickToRun.exe
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2CD1F910DD5DC23C234E99A91DE345C0
binary
MD5: 7d9ecc55e23230bc54a109eff951b985
SHA256: 5d7e8ed443f7ffc6c2eb912c634bfbaf84df6de5b96a16b36a262766e00263e4
2468
OfficeClickToRun.exe
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2CD1F910DD5DC23C234E99A91DE345C0
der
MD5: 31af81a99041b33c6917240458632a2c
SHA256: ef959b381e6d0fe2534328a1c738a5c0d4c01d9c2aff0118165a1244beeb99f1
2468
OfficeClickToRun.exe
C:\Windows\TEMP\Tar33A9.tmp
––
MD5:  ––
SHA256:  ––
2468
OfficeClickToRun.exe
C:\Windows\TEMP\Cab33A8.tmp
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVClientIsv.man
xml
MD5: eff70efd2c66a9241291560f3977b195
SHA256: 6b5cc677bb215c5f402e1413b0872eba465c8755fdaef0cf9e6af20b1866aaa9
4084
OfficeClickToRun.exe
C:\Users\admin\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-journal
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\vccorlib140.dll
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ClientEventLogMessages.man
xml
MD5: 9a9a5f91ca03c8fea03bb8ac25475a12
SHA256: f3dc361d94356c8f4c4632ff98f5e990ebe80a18f0624896dcb9159aff0834e1
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\ucrtbase.dll
––
MD5:  ––
SHA256:  ––
2468
OfficeClickToRun.exe
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76
der
MD5: 4325822339b4ab0ffe6d1a443a7bd516
SHA256: 98e732bda1115d1cfdb13b582f8260585af96ffd6c07ce889780bda40a07cb27
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\StreamServer.dll
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\SharedPerformance.man
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\OfficeClickToRun.exe
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\ServiceWatcherSchedule.xml
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\OfficeUpdateSchedule.xml
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\OfficeC2RCom.dll
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2R8D9F25CB-DDE7-46C8-937D-2EFEEFC4C2C5\OfficeC2RClient.exe
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\Local\Temp\OfficeC2R84C95484-8D34-4789-B700-3AEDF659AEC9\i320.cab
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\i321033.hash
text
MD5: 50a0277caaa91fb3242a69582a59e7a0
SHA256: 26c164388ce81698e493e8a1e750b035aca2c6a8a5701bce8b49cb7738d8f008
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\placeholder.txt
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Program Files\Common Files\Microsoft Shared\ClickToRunOfficeC2RBFA28ED0-A1BE-43CC-9505-BA0FA1D0BF8C\i321033.hash
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\Local\Temp\OfficeC2R1DC97248-9378-4C5D-88D0-A5819D8A96CD\i321033.cab
––
MD5:  ––
SHA256:  ––
2408
powershell.exe
C:\Users\admin\AppData\Local\Temp\Office.ValidateError.scratch
––
MD5:  ––
SHA256:  ––
2408
powershell.exe
C:\Users\admin\AppData\Local\Temp\Office.ValidateResult.scratch
––
MD5:  ––
SHA256:  ––
2408
powershell.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
binary
MD5: 35375f3d71ae42aa9777154d256b33bf
SHA256: bcff55e0934722e7952ea75d73ae7ce376e4adbc73de5e71d629975e9eac87ef
2408
powershell.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF39d1e1.TMP
binary
MD5: 35375f3d71ae42aa9777154d256b33bf
SHA256: bcff55e0934722e7952ea75d73ae7ce376e4adbc73de5e71d629975e9eac87ef
2408
powershell.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VOOJV0OISUF9RZGKTSS0.temp
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76
binary
MD5: 3804ee5e5833ae436682c3cabac4730e
SHA256: 3ae40e8c3674092c224b800f851eae12db90e7b25f83a9f25a2d0a5fbf00ef92
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76
der
MD5: 4325822339b4ab0ffe6d1a443a7bd516
SHA256: 98e732bda1115d1cfdb13b582f8260585af96ffd6c07ce889780bda40a07cb27
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\Local\Temp\OfficeC2R567E3DC4-F0E5-4F19-981B-AC091F262424OfficeC2R767A1A9E-30A2-486E-83E6-41C788B248E6\v32.hash
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\Local\Temp\OfficeC2R567E3DC4-F0E5-4F19-981B-AC091F262424\v32.hash
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\Local\Temp\OfficeC2R567E3DC4-F0E5-4F19-981B-AC091F262424OfficeC2R767A1A9E-30A2-486E-83E6-41C788B248E6\VersionDescriptor.xml
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\Local\Temp\OfficeC2R567E3DC4-F0E5-4F19-981B-AC091F262424\VersionDescriptor.xml
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26E638C519997CC5D7E38BA592ADCFA9
der
MD5: 0228d12fcbe5ebe933ef048488f2764b
SHA256: 6937af489dac2f72688f0106c26c3044fadd7e603014a793dde49b17b670a4b4
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26E638C519997CC5D7E38BA592ADCFA9
binary
MD5: 63e9d150400a13732ac8be8f93850841
SHA256: c82fab39c2627da53b14f01a82c543e1e38bf7a47ce0587ea4d70aa8b90ea3ae
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD
binary
MD5: 41a3309e53c66209e65fe22bc23775d5
SHA256: 46bf95c57c7402b3ecea8540241af91fa76db0529967872d69f93103321d38a6
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD
der
MD5: 3ef59a32c8c5ebadb1f6ab607cbbfcbb
SHA256: 4b81235e2c268a1e9ef7ff2fd807ceb3b921d86108dd60faa6fec0acfc58df0a
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4C7F163ED126D5C3CB9457F68EC64E9E
binary
MD5: 6eee8121c45dbfbd3d35e4a33c902b8d
SHA256: 17791bc3647892ad2b2bacb639e0321ce62fd684f85f41ebe6bac430dbb43e1b
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4C7F163ED126D5C3CB9457F68EC64E9E
der
MD5: 7853ab2278fc56208f88cb4e118d9fb8
SHA256: 5e673a872095cab1e204277dafcdeb08afa9d644307cfb0da01337f904030d9b
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\Local\Temp\TarCF23.tmp
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\Local\Temp\CabCF22.tmp
––
MD5:  ––
SHA256:  ––
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\36AC0BE60E1243344AE145F746D881FE
binary
MD5: 7590b26391682dda868f5bd0d6c2a3b6
SHA256: 92627233bf12861b6fe87c047e5e3739463ba96d586a7cc802ad22322ebdd654
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\36AC0BE60E1243344AE145F746D881FE
der
MD5: 0ac25b9055c5e80d24b083c79046890d
SHA256: e8445b6d8631ccd8825a6787136f805e445902df9f4ed04f026ede582819d538
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A583E2A51BFBDC1E492A57B7C8325850
binary
MD5: e99685b837909e8df61bc31c6a22a2cc
SHA256: d6b107ecc9639863834eef16fd7d87d56b13b1c2cc68373c3750cfff36bf719c
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A583E2A51BFBDC1E492A57B7C8325850
der
MD5: 52d6627377fffa0c57b8c557e49a0f15
SHA256: dead1dfb1dda29aac9ff3aff3fb139ab0a1af3322c98d3731eafe21990210337
1912
Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe
C:\Users\admin\AppData\Local\Temp\OfficeC2R567E3DC4-F0E5-4F19-981B-AC091F262424\v32_16.0.11328.20438.cab
compressed
MD5: 132393fee90cad2c5fdd98914d4d1058
SHA256: d6a6c22de8af8037798fafac9f7a14b08966928aa43dd5cd6b8def08defd0f5c

Find more information of the staic content and download it at the full report

Network activity

HTTP(S) requests
20
TCP/UDP connections
14
DNS requests
11
Threats
0

HTTP requests

PID Process Method HTTP Code IP URL CN Type Size Reputation
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe HEAD 301 72.247.224.69:80 http://officecdn.microsoft.com/PR/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114/Office/Data/v32_16.0.11328.20438.cab US
––
––
whitelisted
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe HEAD 301 72.247.224.69:80 http://officecdn.microsoft.com/PR/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114/Office/Data/v32_16.0.11328.20438.cab US
––
––
whitelisted
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe GET 301 72.247.224.69:80 http://officecdn.microsoft.com/PR/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114/Office/Data/v32_16.0.11328.20438.cab US
––
––
whitelisted
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe GET 200 2.16.186.98:80 http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl unknown
der
whitelisted
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe GET 200 2.16.186.98:80 http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl unknown
der
whitelisted
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe GET 200 2.16.186.98:80 http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl unknown
der
whitelisted
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe GET 200 2.16.186.98:80 http://crl.microsoft.com/pki/crl/products/Microsoft%20Code%20Signing%20PCA(2).crl unknown
der
whitelisted
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe GET 200 2.16.186.98:80 http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl unknown
der
whitelisted
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe GET 200 2.16.186.98:80 http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl unknown
der
whitelisted
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe HEAD 301 72.247.224.69:80 http://officecdn.microsoft.com/PR/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114/Office/Data/16.0.11328.20438/i321033.cab US
––
––
whitelisted
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe GET 301 72.247.224.69:80 http://officecdn.microsoft.com/PR/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114/Office/Data/16.0.11328.20438/i321033.cab US
––
––
whitelisted
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe HEAD 301 72.247.224.69:80 http://officecdn.microsoft.com/PR/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114/Office/Data/16.0.11328.20438/i320.cab US
––
––
whitelisted
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe GET 301 72.247.224.69:80 http://officecdn.microsoft.com/PR/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114/Office/Data/16.0.11328.20438/i320.cab US
––
––
whitelisted
2468 OfficeClickToRun.exe GET 200 2.16.186.59:80 http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl unknown
der
whitelisted
2468 OfficeClickToRun.exe GET 200 2.18.233.62:80 http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl unknown
der
whitelisted
2468 OfficeClickToRun.exe GET 200 2.16.186.59:80 http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl unknown
der
whitelisted
2468 OfficeClickToRun.exe GET 200 93.184.220.29:80 http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAtqs7A%2Bsan2xGCSaqjN%2FrM%3D US
der
whitelisted
2468 OfficeClickToRun.exe GET 200 2.16.186.59:80 http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl unknown
der
whitelisted
2468 OfficeClickToRun.exe GET 200 2.16.186.59:80 http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl unknown
der
whitelisted
2468 OfficeClickToRun.exe GET 200 2.16.186.59:80 http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl unknown
der
whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID Process IP ASN CN Reputation
2840 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe 13.107.3.128:443 Microsoft Corporation US whitelisted
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe 13.107.3.128:443 Microsoft Corporation US whitelisted
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe 52.109.76.40:443 Microsoft Corporation IE unknown
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe 72.247.224.69:80 Akamai Technologies, Inc. US whitelisted
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe 2.20.190.34:80 Akamai International B.V. –– whitelisted
1912 Setup.Def.en-us_O365ProPlusRetail_0f1e0b3f-e040-4d9a-9a3d-79296f5d9221_TX_PR_Platform_def_b_64_.exe 2.16.186.98:80 Akamai International B.V. –– whitelisted
4084 OfficeClickToRun.exe 13.107.3.128:443 Microsoft Corporation US whitelisted
2468 OfficeClickToRun.exe 13.107.3.128:443 Microsoft Corporation US whitelisted
2468 OfficeClickToRun.exe 2.16.186.59:80 Akamai International B.V. –– whitelisted
4084 OfficeClickToRun.exe 52.114.128.44:443 Microsoft Corporation US unknown
2468 OfficeClickToRun.exe 2.18.233.62:80 Akamai International B.V. –– whitelisted
2468 OfficeClickToRun.exe 52.114.128.44:443 Microsoft Corporation US unknown
2468 OfficeClickToRun.exe 93.184.220.29:80 MCI Communications Services, Inc. d/b/a Verizon Business US whitelisted
2468 OfficeClickToRun.exe 72.247.224.69:80 Akamai Technologies, Inc. US whitelisted

DNS requests

Domain IP Reputation
config.edge.skype.com 13.107.3.128
whitelisted
mrodevicemgr.officeapps.live.com 52.109.76.40
whitelisted
officecdn.microsoft.com 72.247.224.69
whitelisted
officecdn.microsoft.com.edgesuite.net 2.20.190.34
2.20.189.242
whitelisted
crl.microsoft.com 2.16.186.98
2.16.186.59
whitelisted
self.events.data.microsoft.com 52.114.128.44
whitelisted
www.microsoft.com 2.18.233.62
whitelisted
ocsp.digicert.com 93.184.220.29
whitelisted

Threats

No threats detected.

Debug output strings

Process Message
OfficeClickToRun.exe 2019-11-08 16:19:57.927 T#2060 <E> [AriaSDK] HTTP request WI-1 failed after 9040 ms, events were rejected by the server (403) and will be all dropped
OfficeClickToRun.exe 2019-11-08 16:19:57.927 T#2060 <E> [AriaSDK] HTTP request WI-1 failed after 9040 ms, events were rejected by the server (403) and will be all dropped