Timestamp Process TID Area Category EventID Level Message

Correlation
06/13/2023 04:00:01.540 OFFICEC2 (0x12dc) 0x3aa4
OfficeTelemetry_PerfMetrics axbjw Medium RuleFieldNamesImpact
{"ETW_EventId": 196, "ETW_Keywords": 128, "cbMemory": 3630, "count": 118}
06/13/2023 04:00:01.544 OFFICEC2 (0x12dc) 0x55a8 Click-To-Run General
Telemetry aqkhc Medium InitLogging {"MachineId":
"0865d1d0badccd4cba1a837ce4224791", "SessionID": "9c450e83-7493-43ae-a25a-
6acdc86405ef", "GeoID": 244, "Ver": "0.0.0.0", "C2RClientVer": "16.0.16501.20140",
"ContextData":
"{\"AppVVersion\":\"10.0.22000.1878\",\"Bitness\":\"64\",\"CommandLine\":\"/
WatchService\",\"ExeVer\":\"16.0.16501.20140\",\"IntegrityLevel\":\"0x4000\",\"Loca
le\":\"1033\",\"ModulePath\":\"C:\\\\Program Files\\\\Common Files\\\\Microsoft
Shared\\\\ClickToRun\\\\
OfficeC2RClient.exe\",\"OSVersion\":\"10.0\",\"ProcessType\":\"OfficeC2RClient\",\"
ProcessorArch\":\"9\",\"ProductType\":\"1\",\"SecuritySessionId\":\"0\"}"}
06/13/2023 04:00:01.544 OFFICEC2 (0x12dc) 0x55a8 Activity bjtct Medium
ActivityStarted {"Name": "Office.ClickToRun.C2RClient", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.9", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.544 OFFICEC2 (0x12dc) 0x55a8 Click-To-Run aznhv
Medium ClientMonitor::Monitor - Start ServiceWatcher watcher.
06/13/2023 04:00:01.544 OFFICEC2 (0x12dc) 0x55a8 Click-To-Run General
Telemetry aznhc Medium ServiceWatcher::DoWatch {"MachineId":
"0865d1d0badccd4cba1a837ce4224791", "SessionID": "9c450e83-7493-43ae-a25a-
6acdc86405ef", "GeoID": 244, "Ver": "16.0.16501.20196", "C2RClientVer":
"16.0.16501.20140", "ContextData": "ServiceWatcher::DoWatch - Service is running."}
06/13/2023 04:00:01.545 OFFICEC2 (0x12dc) 0x55a8 Activity bjtct Medium
ActivityStarted {"Name": "Office.ClickToRun.Watcher", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.9.1", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.545 OFFICEC2 (0x12dc) 0x55a8 Activity bjtcw Medium
ActivityEnded {"Name": "Office.ClickToRun.Watcher", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.9.1", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.545 OFFICEC2 (0x12dc) 0x55a8 Click-To-Run General
Telemetry bgodb Medium ServiceWatcher::SendMachineInfoState {"MachineId":
"0865d1d0badccd4cba1a837ce4224791", "SessionID": "9c450e83-7493-43ae-a25a-
6acdc86405ef", "GeoID": 244, "Ver": "16.0.16501.20196", "C2RClientVer":
"16.0.16501.20140", "ContextData":
"{'ProductInfoInstalled','O365ProPlusRetail.16_x-none_ro-ro_en-
us','OfficeBitness','x64','WERMachineID',''}"}
06/13/2023 04:00:01.545 OFFICEC2 (0x12dc) 0x55a8 Click-To-Run General
Telemetry a232l Medium Watcher::Watch {"MachineId":
"0865d1d0badccd4cba1a837ce4224791", "SessionID": "9c450e83-7493-43ae-a25a-
6acdc86405ef", "GeoID": 244, "Ver": "16.0.16501.20196", "C2RClientVer":
"16.0.16501.20140", "ContextData": "Watcher is running successfully.
{'WatcherName':'ServiceWatcher'}"}
06/13/2023 04:00:01.545 OFFICEC2 (0x12dc) 0x55a8 Click-To-Run General
Telemetry auqvk Medium MonitoredScope::ExecuteUnderStopWatch {"MachineId":
"0865d1d0badccd4cba1a837ce4224791", "SessionID": "9c450e83-7493-43ae-a25a-
6acdc86405ef", "GeoID": 244, "Ver": "16.0.16501.20196", "C2RClientVer":
"16.0.16501.20140", "ContextData": "Watcher::Watch - Watching
ServiceWatcher.Approximate duration : 0 milliseconds."}
06/13/2023 04:00:01.546 OFFICEC2 (0x12dc) 0x55a8 Click-To-Run azfea
Medium ::wWinMain {"MachineId": "0865d1d0badccd4cba1a837ce4224791",
"SessionID": "9c450e83-7493-43ae-a25a-6acdc86405ef", "GeoID": 244, "Ver":
"16.0.16501.20196", "C2RClientVer": "16.0.16501.20140", "ContextData": "ClientExe
complete. {'Action':'11','Result':'0'}"}
06/13/2023 04:00:01.546 OFFICEC2 (0x12dc) 0x55a8 Activity bjtcw Medium
ActivityEnded {"Name": "Office.ClickToRun.C2RClient", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.9", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.546 OFFICEC2 (0x12dc) 0x55a8 Activity bjtct Medium
ActivityStarted {"Name": "Office.Telemetry.DynamicConfig.FetchConfigs", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.546 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.1", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.546 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.2", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.546 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.3", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.546 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.4", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.546 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.5", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.546 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.6", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.547 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.7", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.549 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.8", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.549 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.9", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.549 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.10", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.549 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
 DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.11", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.549 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.12", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.549 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.13", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.549 OFFICEC2 (0x12dc) 0x3aa4 Activity bjtcw Medium
ActivityEnded {"Name": "Office.Telemetry.LoadXmlRules", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.5.1", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.549 OFFICEC2 (0x12dc) 0x3aa4 Telemetry Event biyhq
Medium SendEvent {"EventName": "Office.Telemetry.LoadXmlRules", "Flags":
33777014401990913, "InternalSequenceNumber": 10, "Time": "2023-06-13T01:00:01Z",
"AriaTenantToken": "f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-
6afac5325183-7405", "Contract": "Office.System.Activity", "Activity.CV":
"ZGUzXkeuUE60dywUEPT9vQ.5.1", "Activity.Duration": 12929, "Activity.Count": 1,
"Activity.AggMode": 0, "Activity.Success": true, "Activity.Result.Code": 0,
"Activity.Result.Type": "HRESULT"}
06/13/2023 04:00:01.549 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.14", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.549 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.15", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.549 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.16", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.549 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.17", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.550 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.18", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.550 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.19", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.550 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.20", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.550 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.21", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.550 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.22", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.550 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.23", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.550 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.24", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.550 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.25", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.550 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.26", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.550 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.27", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.550 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.28", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.550 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.29", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.551 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.30", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.551 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.31", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.551 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.32", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.551 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.33", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.551 OFFICEC2 (0x12dc) 0x55a8 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10.34", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.551 OFFICEC2 (0x12dc) 0x55a8 Activity bjtcw Medium
ActivityEnded {"Name": "Office.Telemetry.DynamicConfig.FetchConfigs", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.10", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.551 OFFICEC2 (0x12dc) 0x55a8 Telemetry Event biyhq
Medium SendEvent {"EventName":
"Office.Telemetry.DynamicConfig.FetchConfigs", "Flags": 33777014401990913,
"InternalSequenceNumber": 12, "Time": "2023-06-13T01:00:01Z", "AriaTenantToken":
"f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405",
"Contract": "Office.System.Activity", "Activity.CV": "ZGUzXkeuUE60dywUEPT9vQ.10",
"Activity.Duration": 4889, "Activity.Count": 1, "Activity.AggMode": 0,
"Activity.Success": true, "Data.RejectedConfigsList": "", "Data.ParsedConfigCount":
34, "Data.RejectedConfigCount": 0}
06/13/2023 04:00:01.551 OFFICEC2 (0x12dc) 0x55a8 Telemetry Event bsq69
Monitorable Deactivated event detected. {"EventName":
"Office.Experimentation.LoadingFirstSessionCache", "IsFromRule": false}
06/13/2023 04:00:01.551 OFFICEC2 (0x12dc) 0x55a8 Telemetry Event bsq69
Monitorable Deactivated event detected. {"EventName":
"Office.Licensing.Tenant.InitTenantId", "IsFromRule": false}
06/13/2023 04:00:01.551 OFFICEC2 (0x12dc) 0x55a8 Telemetry Event biyhq
Medium SendEvent {"EventName": "Office.Telemetry.FlushEventBuffer",
"Flags": 33777014401991169, "InternalSequenceNumber": 13, "Time": "2023-06-
13T01:00:01Z", "AriaTenantToken": "f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-
4dc5-9dbb-6afac5325183-7405", "Data.FirstPassCount": 12, "Data.SecondPassCount": 0}
06/13/2023 04:00:01.551 OFFICEC2 (0x12dc) 0x55a8 Telemetry Event biyhq
Medium SendEvent {"EventName":
"Office.Experimentation.FeatureQueryBatched", "Flags": 33777005812056321,
"InternalSequenceNumber": 14, "Time": "2023-06-13T01:00:01Z", "AriaTenantToken":
"e6e58d16cfb94942b795b4918258153a-765be17b-66ea-435e-8b55-5a128f3decd3-6873",
"Data.Sequence": 0, "Data.Count": 37, "Data.Features": "[ { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.TrackCPSWrites\", \"V\" : false, \"S\" :
1, \"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5272558Z\", \"C\" : \"33\", \"Q\" :
2.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.CPSMaxWrites\", \"V\" : 2, \"S\" :
1, \"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5272558Z\", \"C\" : \"33\", \"Q\" :
5.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.CrashPersistenceProcessList\", \"V\" : \"\
", \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5272558Z\", \"C\" : \"33\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 5 },
{ \"ID\" : 37, \"N\" : \"Microsoft.Office.Word.UAEOnSafeModeEnabled\", \"V\" :
true, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5272558Z\", \"C\" : \"\",
\"Q\" : 3.0, \"M\" : 0, \"F\" : 5, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.UAE.ProcessCrashSecurelyChangeGate\", \"V\
" : true, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5272558Z\", \"C\" : \"\", \"Q\" : 1.0, \"M\" : 0, \"F\" :
5, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.Diagnostic.UAE.SilentAppExitVerifyElseDump
\", \"V\" : false, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5272558Z\",
\"C\" : \"\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 5, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.UAE.WERSessionFlags\", \"V\" :
false, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5272558Z\", \"C\" : \"\", \"Q\" : 0.0, \"M\" : 0, \"F\" :
5, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Graphics.TestGate.EnableDirectXDebugLayer\", \"V\" :
false, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5272558Z\", \"C\" : \"33\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 5 },
{ \"ID\" :
37, \"N\" : \"Microsoft.Office.AirSpace.EnableWinCompForSACUsers\", \"V\" :
true, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5272558Z\", \"C\" : \"\",
\"Q\" : 1.0, \"M\" : 0, \"F\" : 5, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.AirSpace.UseWincompInWin32\", \"V\" : false, \"S\" :
1, \"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5272558Z\", \"C\" : \"33\", \"Q\" :
1.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Licensing.UseCanRunFeatureCacheUpdate\", \"V\" :
true, \"S\" : 0, \"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5272558Z\", \"C\" : \"\",
\"Q\" : 0.0, \"M\" : 0, \"F\" : 5, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.AirSpace.TestGate.UseWincompInAutomation\", \"V\" :
false, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5272558Z\", \"C\" : \"33\", \"Q\" : 0.0, \"M\" : 0, \"F\" : 5 },
{ \"ID\" :
37, \"N\" : \"Microsoft.Office.AirSpace.TestGate.UseHardwareDeviceInAutomation\", \
"V\" : false, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5282528Z\", \"C\" : \"\", \"Q\" : 1.0, \"M\" : 0, \"F\" :
5, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Graphics.EnableWin32HardwareAcceleration\", \"V\" :
true, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5282528Z\", \"C\" : \"39\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 5 },
{ \"ID\" : 37, \"N\" : \"Microsoft.Office.Graphics.DrawGlyphPerfFixEnabled\", \"V\"
: true, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5282528Z\", \"C\" : \"1\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 5 },
{ \"ID\" :
37, \"N\" : \"Microsoft.Office.Graphics.CompositionOnlyAdapterSupportEnabled\", \"V
\" : true, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5292495Z\", \"C\" :
\"1\", \"Q\" : 2.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.AirSpace.BlockedGraphicsAdapterCount\", \"V\" :
0, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5312444Z\", \"C\" : \"33\", \"Q\" : 7.0, \"M\" : 0, \"F\" : 5 },
{ \"ID\" : 37, \"N\" : \"Microsoft.Office.Graphics.SupportGDIPlusFactory\", \"V\" :
true, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5312444Z\", \"C\" : \"\",
\"Q\" : 1.0, \"M\" : 0, \"F\" : 5, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.DisableTelemetry\", \"V\" : false, \"S\" :
1, \"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5322420Z\", \"C\" : \"33\", \"Q\" :
0.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.AriaAdditionalProcessExclusionList\", \"V\
" : \"\", \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5322420Z\", \"C\" : \"33\", \"Q\" : 2.0, \"M\" : 0, \"F\" : 5 },
{ \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.ULSQueueSizeInKilobytes\", \"V\" :
5120, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5362316Z\", \"C\" : \"33\", \"Q\" : 5.0, \"M\" : 0, \"F\" : 5 },
{ \"ID\" :
37, \"N\" : \"Microsoft.Office.Experimentation.FeatureQueryLogger.EnableStaticLoggi
ng\", \"V\" : true, \"S\" : 0, \"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5372284Z\",
\"C\" : \"\", \"Q\" : 0.0, \"M\" : 0, \"F\" : 52, \"G\" : \"Opt\" }, { \"ID\" : 37,
\"N\" : \"Microsoft.Office.Telemetry.Sampling.NumberlinePosition\", \"V\" :
200, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5372284Z\", \"C\" : \"33\", \"Q\" : 6.0, \"M\" : 0, \"F\" : 52 },
{ \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.Sampling.SamplingRatePerTenThousand\", \"V
\" : 200, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5372284Z\", \"C\" : \"33\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 52 },
{ \"ID\" : 37, \"N\" : \"Microsoft.Office.Telemetry.ExcludeFromSampling\", \"V\" :
false, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5372284Z\", \"C\" : \"1\", \"Q\" : 7.0, \"M\" : 0, \"F\" : 52 },
{ \"ID\" : 37, \"N\" : \"Microsoft.Office.Telemetry.PrivacyGuardVerbose\", \"V\" :
false, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5372284Z\", \"C\" : \"\", \"Q\" : 1.0, \"M\" : 0, \"F\" :
52, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.PrivacyGuard\", \"V\" : false, \"S\" : 11,
\"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5372284Z\", \"C\" : \"\", \"Q\" :
0.0, \"M\" : 0, \"F\" : 52, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Accessibility.Telemetry.SurfaceRegistration\", \"V\"
: true, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5372284Z\", \"C\" : \"39\", \"Q\" : 4.0, \"M\" : 0, \"F\" : 52 },
{ \"ID\" : 37, \"N\" : \"Microsoft.Office.SharedText.CustomCloudFonts\", \"V\" :
false, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5372284Z\", \"C\" : \"33\", \"Q\" : 0.0, \"M\" : 0, \"F\" : 52 },
{ \"ID\" :
37, \"N\" : \"Microsoft.Office.Identity.TelemetryRegionEnabled\", \"V\" :
true, \"S\" : 0, \"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5402199Z\", \"C\" : \"\",
\"Q\" : 0.0, \"M\" : 0, \"F\" : 52, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Identity.CG.IgnoreINTInConfigService\", \"V\" :
true, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5442089Z\", \"C\" : \"\",
\"Q\" : 1.0, \"M\" : 0, \"F\" : 52, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Security.CG.AppGuard.ServiceMapFromCache\", \"V\" :
true, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5442089Z\", \"C\" : \"\",
\"Q\" : 1.0, \"M\" : 0, \"F\" : 52, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Identity.OWSA.UseDeferredCacheUpdateStrategy\", \"V\
" : false, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5442089Z\", \"C\" :
\"\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 52, \"G\" : \"Opt\" }, { \"ID\" : 37, \"N\" :
\"Microsoft.Office.Telemetry.EnableDirectCallsForConsentMetadata\", \"V\" :
true, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5462042Z\", \"C\" : \"\",
\"Q\" : 1.0, \"M\" : 0, \"F\" : 52, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Identity.ConfigServiceTelemetry\", \"V\" :
false, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5491965Z\", \"C\" : \"\", \"Q\" : 1.0, \"M\" : 0, \"F\" :
52, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.CCCOChangeGate\", \"V\" : true, \"S\" : 1,
\"P\" : 0, \"T\" : \"2023-06-13T01:00:01.5511912Z\", \"C\" : \"\", \"Q\" :
1.0, \"M\" : 0, \"F\" : 52, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.Sampling.InsidersSampling\", \"V\" :
false, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-
13T01:00:01.5511912Z\", \"C\" : \"\", \"Q\" : 3.0, \"M\" : 0, \"F\" :
52, \"G\" : \"Opt\" } ]"}
06/13/2023 04:00:01.554 OFFICEC2 (0x12dc) 0x3aa4 Activity bjtcw Medium
ActivityEnded {"Name": "Office.Telemetry.ProcessIdleQueueJob", "CV":
"ZGUzXkeuUE60dywUEPT9vQ.5", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{5E336564-AE47-4E50-B477-2C1410F4FDBD}"}
06/13/2023 04:00:01.554 OFFICEC2 (0x12dc) 0x3aa4 Telemetry Event biyhq
Medium SendEvent {"EventName": "Office.Telemetry.ProcessIdleQueueJob",
"Flags": 33777014401991169, "InternalSequenceNumber": 15, "Time": "2023-06-
13T01:00:01Z", "AriaTenantToken": "f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-
4dc5-9dbb-6afac5325183-7405", "Contract": "Office.System.Activity", "Activity.CV":
"ZGUzXkeuUE60dywUEPT9vQ.5", "Activity.Duration": 17615, "Activity.Count": 1,
"Activity.AggMode": 0, "Activity.Success": true}
06/13/2023 04:00:01.554 OFFICEC2 (0x12dc) 0x55a8 Telemetry Event biyhq
Medium SendEvent {"EventName": "Office.Telemetry.SamplingPolicy",
"Flags": 33777022991925505, "InternalSequenceNumber": 16, "Time": "2023-06-
13T01:00:01Z", "Rule": "90401.3", "AriaTenantToken":
"f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405",
"Contract": "Office.Legacy.Metadata", "Data.SamplingMethod": "Unknown",
"Data.SamplingKey": "Unknown", "Data.MeasuresEnabled": true}