220.127.116.11 CryptoAPI RC4 Encryption
CryptoAPI RC4 encryption is performed on portions of Office binary documents. The documents will contain a new stream to contain encrypted information but can also encrypt other streams in place. For more information about how to determine whether CryptoAPI RC4 encryption is being used and the placement of the password verifier, see [MS-XLS], [MS-DOC], and [MS-PPT]. The same mechanisms for generating the password verifier, storing data specifying the cryptography, deriving the encryption key, and encrypting data are used for all file formats supporting CryptoAPI RC4 encryption.