Timestamp Process TID Area Category EventID Level Message

Correlation
06/16/2023 07:56:56.818 OFFICEC2 (0xe08) 0x3504 Click-To-Run General
Telemetry aqkhc Medium InitLogging {"MachineId":
"0865d1d0badccd4cba1a837ce4224791", "SessionID": "9c450e83-7493-43ae-a25a-
6acdc86405ef", "GeoID": 244, "Ver": "0.0.0.0", "C2RClientVer": "16.0.16501.20140",
"ContextData":
"{\"AppVVersion\":\"10.0.22000.1878\",\"Bitness\":\"64\",\"CommandLine\":\"/
WatchService\",\"ExeVer\":\"16.0.16501.20140\",\"IntegrityLevel\":\"0x4000\",\"Loca
le\":\"1033\",\"ModulePath\":\"C:\\\\Program Files\\\\Common Files\\\\Microsoft
Shared\\\\ClickToRun\\\\
OfficeC2RClient.exe\",\"OSVersion\":\"10.0\",\"ProcessType\":\"OfficeC2RClient\",\"
ProcessorArch\":\"9\",\"ProductType\":\"1\",\"SecuritySessionId\":\"0\"}"}
06/16/2023 07:56:56.819 OFFICEC2 (0xe08) 0x3504 Activity bjtct Medium
ActivityStarted {"Name": "Office.ClickToRun.C2RClient", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.9", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.819 OFFICEC2 (0xe08) 0x3504 Click-To-Run aznhv
Medium ClientMonitor::Monitor - Start ServiceWatcher watcher.
06/16/2023 07:56:56.819 OFFICEC2 (0xe08) 0x3504 Click-To-Run General
Telemetry aznhc Medium ServiceWatcher::DoWatch {"MachineId":
"0865d1d0badccd4cba1a837ce4224791", "SessionID": "9c450e83-7493-43ae-a25a-
6acdc86405ef", "GeoID": 244, "Ver": "16.0.16501.20196", "C2RClientVer":
"16.0.16501.20140", "ContextData": "ServiceWatcher::DoWatch - Service is running."}
06/16/2023 07:56:56.819 OFFICEC2 (0xe08) 0x3504 Activity bjtct Medium
ActivityStarted {"Name": "Office.ClickToRun.Watcher", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.9.1", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.819 OFFICEC2 (0xe08) 0x3504 Activity bjtcw Medium
ActivityEnded {"Name": "Office.ClickToRun.Watcher", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.9.1", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.820 OFFICEC2 (0xe08) 0x3504 Click-To-Run General
Telemetry bgodb Medium ServiceWatcher::SendMachineInfoState {"MachineId":
"0865d1d0badccd4cba1a837ce4224791", "SessionID": "9c450e83-7493-43ae-a25a-
6acdc86405ef", "GeoID": 244, "Ver": "16.0.16501.20196", "C2RClientVer":
"16.0.16501.20140", "ContextData":
"{'ProductInfoInstalled','O365ProPlusRetail.16_x-none_ro-ro_en-
us','OfficeBitness','x64','WERMachineID',''}"}
06/16/2023 07:56:56.820 OFFICEC2 (0xe08) 0x3504 Click-To-Run General
Telemetry a232l Medium Watcher::Watch {"MachineId":
"0865d1d0badccd4cba1a837ce4224791", "SessionID": "9c450e83-7493-43ae-a25a-
6acdc86405ef", "GeoID": 244, "Ver": "16.0.16501.20196", "C2RClientVer":
"16.0.16501.20140", "ContextData": "Watcher is running successfully.
{'WatcherName':'ServiceWatcher'}"}
06/16/2023 07:56:56.820 OFFICEC2 (0xe08) 0x3504 Click-To-Run General
Telemetry auqvk Medium MonitoredScope::ExecuteUnderStopWatch {"MachineId":
"0865d1d0badccd4cba1a837ce4224791", "SessionID": "9c450e83-7493-43ae-a25a-
6acdc86405ef", "GeoID": 244, "Ver": "16.0.16501.20196", "C2RClientVer":
"16.0.16501.20140", "ContextData": "Watcher::Watch - Watching
ServiceWatcher.Approximate duration : 0 milliseconds."}
06/16/2023 07:56:56.821 OFFICEC2 (0xe08) 0x3504 Click-To-Run azfea
Medium ::wWinMain {"MachineId": "0865d1d0badccd4cba1a837ce4224791",
"SessionID": "9c450e83-7493-43ae-a25a-6acdc86405ef", "GeoID": 244, "Ver":
"16.0.16501.20196", "C2RClientVer": "16.0.16501.20140", "ContextData": "ClientExe
complete. {'Action':'11','Result':'0'}"}
06/16/2023 07:56:56.821 OFFICEC2 (0xe08) 0x3504 Activity bjtcw Medium
ActivityEnded {"Name": "Office.ClickToRun.C2RClient", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.9", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.821 OFFICEC2 (0xe08) 0x3504 Activity bjtct Medium
ActivityStarted {"Name": "Office.Telemetry.DynamicConfig.FetchConfigs", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.821 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.1", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.821 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.2", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.821 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.3", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.821 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.4", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.822 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.5", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.822 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.6", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.822 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.7", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.824 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.8", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.824 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.9", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.824 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.10", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.824 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.11", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.824 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.12", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.824 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.13", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.824 OFFICEC2 (0xe08) 0x1064 Activity bjtcw Medium
ActivityEnded {"Name": "Office.Telemetry.LoadXmlRules", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.5.1", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.824 OFFICEC2 (0xe08) 0x1064 Telemetry Event biyhq
Medium SendEvent {"EventName": "Office.Telemetry.LoadXmlRules", "Flags":
33777014401990913, "InternalSequenceNumber": 10, "Time": "2023-06-16T04:56:56Z",
"AriaTenantToken": "f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-
6afac5325183-7405", "Contract": "Office.System.Activity", "Activity.CV":
"2ZjlIgrnX0uN0xktYTmYgQ.5.1", "Activity.Duration": 16224, "Activity.Count": 1,
"Activity.AggMode": 0, "Activity.Success": true, "Activity.Result.Code": 0,
"Activity.Result.Type": "HRESULT"}
06/16/2023 07:56:56.824 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.14", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.824 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.15", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.824 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.16", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.824 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.17", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.825 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.18", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.825 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.19", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.825 OFFICEC2 (0xe08) 0x1064 Activity bjtcw Medium
ActivityEnded {"Name": "Office.Telemetry.ProcessIdleQueueJob", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.5", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.825 OFFICEC2 (0xe08) 0x1064 Telemetry Event biyhq
Medium SendEvent {"EventName": "Office.Telemetry.ProcessIdleQueueJob",
"Flags": 33777014401990913, "InternalSequenceNumber": 12, "Time": "2023-06-
16T04:56:56Z", "AriaTenantToken": "f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-
4dc5-9dbb-6afac5325183-7405", "Contract": "Office.System.Activity", "Activity.CV":
"2ZjlIgrnX0uN0xktYTmYgQ.5", "Activity.Duration": 16830, "Activity.Count": 1,
"Activity.AggMode": 0, "Activity.Success": true}
06/16/2023 07:56:56.825 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.20", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.825 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.21", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.825 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.22", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.825 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.23", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.825 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.24", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.825 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.25", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.825 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.26", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.825 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.27", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.825 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.28", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.825 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.29", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.825 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.30", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.825 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.31", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.826 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.32", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.826 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.33", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.826 OFFICEC2 (0xe08) 0x3504 Activity bjtco Medium
DroppedAggregatedActivity {"Name":
"Office.Telemetry.DynamicConfig.ParseJsonConfig", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10.34", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.826 OFFICEC2 (0xe08) 0x3504 Activity bjtcw Medium
ActivityEnded {"Name": "Office.Telemetry.DynamicConfig.FetchConfigs", "CV":
"2ZjlIgrnX0uN0xktYTmYgQ.10", "ProcessIdentifier":
"OfficeC2RClient.exe_16.0.16501.20140_X86_{22E598D9-E70A-4B5F-8DD3-192D61399881}"}
06/16/2023 07:56:56.826 OFFICEC2 (0xe08) 0x3504 Telemetry Event biyhq
Medium SendEvent {"EventName":
"Office.Telemetry.DynamicConfig.FetchConfigs", "Flags": 33777014401990913,
"InternalSequenceNumber": 13, "Time": "2023-06-16T04:56:56Z", "AriaTenantToken":
"f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405",
"Contract": "Office.System.Activity", "Activity.CV": "2ZjlIgrnX0uN0xktYTmYgQ.10",
"Activity.Duration": 4792, "Activity.Count": 1, "Activity.AggMode": 0,
"Activity.Success": true, "Data.RejectedConfigsList": "", "Data.ParsedConfigCount":
34, "Data.RejectedConfigCount": 0}
06/16/2023 07:56:56.826 OFFICEC2 (0xe08) 0x3504 Telemetry Event bsq69
Monitorable Deactivated event detected. {"EventName":
"Office.Experimentation.LoadingFirstSessionCache", "IsFromRule": false}
06/16/2023 07:56:56.826 OFFICEC2 (0xe08) 0x3504 Telemetry Event bsq69
Monitorable Deactivated event detected. {"EventName":
"Office.Licensing.Tenant.InitTenantId", "IsFromRule": false}
06/16/2023 07:56:56.826 OFFICEC2 (0xe08) 0x3504 Telemetry Event biyhq
Medium SendEvent {"EventName": "Office.Telemetry.FlushEventBuffer",
"Flags": 33777014401991169, "InternalSequenceNumber": 14, "Time": "2023-06-
16T04:56:56Z", "AriaTenantToken": "f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-
4dc5-9dbb-6afac5325183-7405", "Data.FirstPassCount": 13, "Data.SecondPassCount": 0}
06/16/2023 07:56:56.826 OFFICEC2 (0xe08) 0x3504 Telemetry Event biyhq
Medium SendEvent {"EventName":
"Office.Experimentation.FeatureQueryBatched", "Flags": 33777005812056321,
"InternalSequenceNumber": 15, "Time": "2023-06-16T04:56:56Z", "AriaTenantToken":
"e6e58d16cfb94942b795b4918258153a-765be17b-66ea-435e-8b55-5a128f3decd3-6873",
"Data.Sequence": 0, "Data.Count": 37, "Data.Features": "[ { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.TrackCPSWrites\", \"V\" : false, \"S\" :
1, \"P\" : 0, \"T\" : \"2023-06-16T04:56:56.7976856Z\", \"C\" : \"33\", \"Q\" :
5.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.CPSMaxWrites\", \"V\" : 2, \"S\" :
1, \"P\" : 0, \"T\" : \"2023-06-16T04:56:56.7976856Z\", \"C\" : \"33\", \"Q\" :
5.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.CrashPersistenceProcessList\", \"V\" : \"\
", \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.7976856Z\", \"C\" : \"33\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 5 },
{ \"ID\" : 37, \"N\" : \"Microsoft.Office.Word.UAEOnSafeModeEnabled\", \"V\" :
true, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-16T04:56:56.7976856Z\", \"C\" : \"\",
\"Q\" : 5.0, \"M\" : 0, \"F\" : 5, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.UAE.ProcessCrashSecurelyChangeGate\", \"V\
" : true, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.7976856Z\", \"C\" : \"\", \"Q\" : 0.0, \"M\" : 0, \"F\" :
5, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.Diagnostic.UAE.SilentAppExitVerifyElseDump
\", \"V\" : false, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-16T04:56:56.7976856Z\",
\"C\" : \"\", \"Q\" : 3.0, \"M\" : 0, \"F\" : 5, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.UAE.WERSessionFlags\", \"V\" :
false, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.7976856Z\", \"C\" : \"\", \"Q\" : 0.0, \"M\" : 0, \"F\" :
5, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Graphics.TestGate.EnableDirectXDebugLayer\", \"V\" :
false, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.7976856Z\", \"C\" : \"33\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 5 },
{ \"ID\" :
37, \"N\" : \"Microsoft.Office.AirSpace.EnableWinCompForSACUsers\", \"V\" :
true, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-16T04:56:56.7976856Z\", \"C\" : \"\",
\"Q\" : 1.0, \"M\" : 0, \"F\" : 5, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.AirSpace.UseWincompInWin32\", \"V\" : false, \"S\" :
1, \"P\" : 0, \"T\" : \"2023-06-16T04:56:56.7976856Z\", \"C\" : \"33\", \"Q\" :
1.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Licensing.UseCanRunFeatureCacheUpdate\", \"V\" :
true, \"S\" : 0, \"P\" : 0, \"T\" : \"2023-06-16T04:56:56.7976856Z\", \"C\" : \"\",
\"Q\" : 0.0, \"M\" : 0, \"F\" : 5, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.AirSpace.TestGate.UseWincompInAutomation\", \"V\" :
false, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.7976856Z\", \"C\" : \"33\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 5 },
{ \"ID\" :
37, \"N\" : \"Microsoft.Office.AirSpace.TestGate.UseHardwareDeviceInAutomation\", \
"V\" : false, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.7986973Z\", \"C\" : \"\", \"Q\" : 1.0, \"M\" : 0, \"F\" :
5, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Graphics.EnableWin32HardwareAcceleration\", \"V\" :
true, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.7986973Z\", \"C\" : \"39\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 5 },
{ \"ID\" : 37, \"N\" : \"Microsoft.Office.Graphics.DrawGlyphPerfFixEnabled\", \"V\"
: true, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.7986973Z\", \"C\" : \"1\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 5 },
{ \"ID\" :
37, \"N\" : \"Microsoft.Office.Graphics.CompositionOnlyAdapterSupportEnabled\", \"V
\" : true, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-16T04:56:56.7996805Z\", \"C\" :
\"1\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.AirSpace.BlockedGraphicsAdapterCount\", \"V\" :
0, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.8016761Z\", \"C\" : \"33\", \"Q\" : 6.0, \"M\" : 0, \"F\" : 5 },
{ \"ID\" : 37, \"N\" : \"Microsoft.Office.Graphics.SupportGDIPlusFactory\", \"V\" :
true, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-16T04:56:56.8026735Z\", \"C\" : \"\",
\"Q\" : 1.0, \"M\" : 0, \"F\" : 5, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.DisableTelemetry\", \"V\" : false, \"S\" :
1, \"P\" : 0, \"T\" : \"2023-06-16T04:56:56.8036704Z\", \"C\" : \"33\", \"Q\" :
0.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.AriaAdditionalProcessExclusionList\", \"V\
" : \"\", \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.8036704Z\", \"C\" : \"33\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 5 },
{ \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.ULSQueueSizeInKilobytes\", \"V\" :
5120, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.8077557Z\", \"C\" : \"33\", \"Q\" : 20.0, \"M\" : 0, \"F\" : 5 },
{ \"ID\" :
37, \"N\" : \"Microsoft.Office.Experimentation.FeatureQueryLogger.EnableStaticLoggi
ng\", \"V\" : true, \"S\" : 0, \"P\" : 0, \"T\" : \"2023-06-16T04:56:56.8087291Z\",
\"C\" : \"\", \"Q\" : 0.0, \"M\" : 0, \"F\" : 52, \"G\" : \"Opt\" }, { \"ID\" : 37,
\"N\" : \"Microsoft.Office.Telemetry.Sampling.NumberlinePosition\", \"V\" :
200, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.8087291Z\", \"C\" : \"33\", \"Q\" : 5.0, \"M\" : 0, \"F\" : 52 },
{ \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.Sampling.SamplingRatePerTenThousand\", \"V
\" : 200, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.8087291Z\", \"C\" : \"33\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 52 },
{ \"ID\" : 37, \"N\" : \"Microsoft.Office.Telemetry.ExcludeFromSampling\", \"V\" :
false, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.8087291Z\", \"C\" : \"1\", \"Q\" : 7.0, \"M\" : 0, \"F\" : 52 },
{ \"ID\" : 37, \"N\" : \"Microsoft.Office.Telemetry.PrivacyGuardVerbose\", \"V\" :
false, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.8087291Z\", \"C\" : \"\", \"Q\" : 1.0, \"M\" : 0, \"F\" :
52, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.PrivacyGuard\", \"V\" : false, \"S\" : 11,
\"P\" : 0, \"T\" : \"2023-06-16T04:56:56.8087291Z\", \"C\" : \"\", \"Q\" :
0.0, \"M\" : 0, \"F\" : 52, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Accessibility.Telemetry.SurfaceRegistration\", \"V\"
: true, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.8087291Z\", \"C\" : \"39\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 52 },
{ \"ID\" : 37, \"N\" : \"Microsoft.Office.SharedText.CustomCloudFonts\", \"V\" :
false, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.8087291Z\", \"C\" : \"33\", \"Q\" : 0.0, \"M\" : 0, \"F\" : 52 },
{ \"ID\" :
37, \"N\" : \"Microsoft.Office.Identity.TelemetryRegionEnabled\", \"V\" :
true, \"S\" : 0, \"P\" : 0, \"T\" : \"2023-06-16T04:56:56.8152235Z\", \"C\" : \"\",
\"Q\" : 1.0, \"M\" : 0, \"F\" : 52, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Identity.CG.IgnoreINTInConfigService\", \"V\" :
true, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-16T04:56:56.8182157Z\", \"C\" : \"\",
\"Q\" : 1.0, \"M\" : 0, \"F\" : 52, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Security.CG.AppGuard.ServiceMapFromCache\", \"V\" :
true, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-16T04:56:56.8192130Z\", \"C\" : \"\",
\"Q\" : 1.0, \"M\" : 0, \"F\" : 52, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Identity.OWSA.UseDeferredCacheUpdateStrategy\", \"V\
" : false, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-16T04:56:56.8192130Z\", \"C\" :
\"\", \"Q\" : 1.0, \"M\" : 0, \"F\" : 52, \"G\" : \"Opt\" }, { \"ID\" : 37, \"N\" :
\"Microsoft.Office.Telemetry.EnableDirectCallsForConsentMetadata\", \"V\" :
true, \"S\" : 1, \"P\" : 0, \"T\" : \"2023-06-16T04:56:56.8212075Z\", \"C\" : \"\",
\"Q\" : 1.0, \"M\" : 0, \"F\" : 52, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Identity.ConfigServiceTelemetry\", \"V\" :
false, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.8241997Z\", \"C\" : \"\", \"Q\" : 1.0, \"M\" : 0, \"F\" :
52, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.CCCOChangeGate\", \"V\" : true, \"S\" : 1,
\"P\" : 0, \"T\" : \"2023-06-16T04:56:56.8261940Z\", \"C\" : \"\", \"Q\" :
1.0, \"M\" : 0, \"F\" : 52, \"G\" : \"Opt\" }, { \"ID\" :
37, \"N\" : \"Microsoft.Office.Telemetry.Sampling.InsidersSampling\", \"V\" :
false, \"S\" : 11, \"P\" : 0, \"T\" : \"2023-06-
16T04:56:56.8261940Z\", \"C\" : \"\", \"Q\" : 3.0, \"M\" : 0, \"F\" :
52, \"G\" : \"Opt\" } ]"}
06/16/2023 07:56:56.827 OFFICEC2 (0xe08) 0x3504 Telemetry Event biyhq
Medium SendEvent {"EventName": "Office.Telemetry.SamplingPolicy",
"Flags": 33777022991925505, "InternalSequenceNumber": 16, "Time": "2023-06-
16T04:56:56Z", "Rule": "90401.3", "AriaTenantToken":
"f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405",
"Contract": "Office.Legacy.Metadata", "Data.SamplingMethod": "Unknown",
"Data.SamplingKey": "Unknown", "Data.MeasuresEnabled": true}