Registry key of interest: HKEY_CLASSES_ROOT\Licenses\5C505A59-E312-4B89-9508-E162F8150517\08878. I assume the 08878 subkey may differ from installation to installation (why not, isn't?). I have tested only on my own one. So check other subkeys if you can not match proper values described below. Binary value stored in that key is encrypted with CryptProtectData. So decrypt it first with CryptUnprotectData. Bytes of interest (little-endian):