gh0strat | 593c2deaacb09860822ec349224494c5aa35ebac3ff8836b43f63ad41d168d60

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2024 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WPS-Office_10469357_401533.msi
Size

41.1MB
MD5

27ba48360e40e33e30f22f9258ca8aec
SHA1

f86f07a4fde054f77591c7c42a751f4fa566cdd5
SHA256

593c2deaacb09860822ec349224494c5aa35ebac3ff8836b43f63ad41d168d60
SHA512

0ba2009808c661cc9780bdf437f2ca47cfb99daa080f95428f3631752d2f49f6fce1ec747ef9228e49e3df00db61b67d4f52c4411d76cb6551fb6f50eaf90497
SSDEEP

786432:bz9YO2wwhIk3QM8g4fzggu4Pm7WJn8tKFodQrzRIwio026V:Fa3Qg4fzgh4fn8tKFeQr9tiod6V

Score

10^/10

gh0strat purplefox discovery persistence privilege_escalation rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 3 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/1920-82-0x000000002C080000-0x000000002C23B000-memory.dmp	purplefox_rootkit
behavioral2/memory/1920-84-0x000000002C080000-0x000000002C23B000-memory.dmp	purplefox_rootkit
behavioral2/memory/1920-85-0x000000002C080000-0x000000002C23B000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/1920-82-0x000000002C080000-0x000000002C23B000-memory.dmp	family_gh0strat
behavioral2/memory/1920-84-0x000000002C080000-0x000000002C23B000-memory.dmp	family_gh0strat
behavioral2/memory/1920-85-0x000000002C080000-0x000000002C23B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	EiAuPIYhFE4.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	EiAuPIYhFE4.exe
File opened (read-only)	\??\N:	EiAuPIYhFE4.exe
File opened (read-only)	\??\P:	EiAuPIYhFE4.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	EiAuPIYhFE4.exe
File opened (read-only)	\??\J:	EiAuPIYhFE4.exe
File opened (read-only)	\??\Y:	EiAuPIYhFE4.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	EiAuPIYhFE4.exe
File opened (read-only)	\??\Z:	EiAuPIYhFE4.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	EiAuPIYhFE4.exe
File opened (read-only)	\??\G:	EiAuPIYhFE4.exe
File opened (read-only)	\??\W:	EiAuPIYhFE4.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	EiAuPIYhFE4.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	EiAuPIYhFE4.exe
File opened (read-only)	\??\X:	EiAuPIYhFE4.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	EiAuPIYhFE4.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	EiAuPIYhFE4.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	EiAuPIYhFE4.exe
File opened (read-only)	\??\S:	EiAuPIYhFE4.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	EiAuPIYhFE4.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	EXCEL.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	EXCEL.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	EXCEL.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	EXCEL.EXE

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\SecureSponsorGenerous\hqUsxQVokjCH.exe	msiexec.exe
File created	C:\Program Files\SecureSponsorGenerous\xlsx.xlsx	msiexec.exe
File created	C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.xml	hqUsxQVokjCH.exe
File created	C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe	hqUsxQVokjCH.exe
File opened for modification	C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe	hqUsxQVokjCH.exe
File created	C:\Program Files\SecureSponsorGenerous\OUvlZvvsRHvvVPzWjGvr	msiexec.exe
File opened for modification	C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.xml	hqUsxQVokjCH.exe
File opened for modification	C:\Program Files\SecureSponsorGenerous	EiAuPIYhFE4.exe
File opened for modification	C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.wrapper.log	bgHAdnVGRnVK.exe
File opened for modification	C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe	hqUsxQVokjCH.exe
File created	C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe	hqUsxQVokjCH.exe
File created	C:\Program Files\SecureSponsorGenerous\UE4PrereqSetup_x64.exe	msiexec.exe
File opened for modification	C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.wrapper.log	bgHAdnVGRnVK.exe
File opened for modification	C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.wrapper.log	bgHAdnVGRnVK.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{3E485F47-0D18-4FFA-BDEF-013BE2251AF7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI967E.tmp	msiexec.exe
File created	C:\Windows\Installer\e5894ac.msi	msiexec.exe
File created	C:\Windows\Installer\e5894aa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5894aa.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Executes dropped EXE 7 IoCs

pid	Process
2544	hqUsxQVokjCH.exe
3652	EiAuPIYhFE4.exe
2608	bgHAdnVGRnVK.exe
1932	bgHAdnVGRnVK.exe
1020	bgHAdnVGRnVK.exe
3732	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2664	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hqUsxQVokjCH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EiAuPIYhFE4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EiAuPIYhFE4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EiAuPIYhFE4.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f7b83aff83bcb26e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f7b83aff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f7b83aff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df7b83aff000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f7b83aff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	EiAuPIYhFE4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EiAuPIYhFE4.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\msacm.imaadpcm\MaxRTDecodeSetting = "6"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\PowerPoint\Security\Trusted Locations\Location3	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\User Settings\PowerPoint_Core\Count = "1"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	EXCEL.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\ODBC\ODBC.INI\Excel Files\SafeTransactions = "0"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\ODBC\ODBC.INI\Excel Files\DriverId = "1046"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\ODBC\ODBC.INI\ODBC Data Sources\dBASE Files = "Microsoft Access dBASE Driver (.dbf, .ndx, *.mdx)"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData\1.7 = 656c4368616e67656446616c73654576656e7473222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e576f72642e57726974696e67417373697374616e63654372697469717565466f724347415049222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e57726974696e67417373697374616e636555492e50616e652e46697857726f6e67436c6f73654c6f676963222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e436f6c6f72466f6e74537570706f7274456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e46696c6556657273696f6e696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e48696464656e466f6e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e4f4172745465787456616c696461746552616e6765564544222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e52696368456469742e416c6c6f774475706c696361746555696d557064617465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e52696368456469742e436f7079506173746548544d4c222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e5472616e7363726962652e436f6e666967436865636b44697361626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c6550657270657475616c323031394d6573736167696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c6550657270657475616c436f6e73756d657250726f323031394d6573736167696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e417269614d617854656172646f776e55706c6f616454696d65496e536563222c20225622203a2022696e7433325f747c3222207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e566f6c756d65547261636b696e674d61784576656e7473222c20225622203a2022696e7433325f747c3530303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4169725370616365222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224261636b656e645c22203a207b205c224576656e74735c22203a207b205c224c61796572486f7374496e697469616c697a6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d706f7369746f7253657373696f6e547970655c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2257696e33325c22203a207b205c225375624e616d657370616365735c22203a207b205c224c65676163795c22203a207b205c224576656e74735c22203a207b205c22416e696d6174696f6e50657263656e74556e64657233304650535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416e696d6174696f6e4176674650535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726f737357696e54496d654f6646697273744672616d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224176657261676550726573656e74735065725365636f6e645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4175674c6f6f70222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436c69656e745c22203a207b205c224576656e74735c22203a207b205c22576f726b666c6f7747726170685c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4368617274696e67222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22436861727445326f4c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436861727445326f536176655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224368617274696e67456e644c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e436c69636b546f52756e222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c225363656e6172696f5c22203a207b205c224576656e74735c22203a207b205c225570646174655461736b557064617465646574656374696f6e325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b557064617465646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b557064617465636c69656e74646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265706169725461736b46756c6c7265706169725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265706169725461736b52656d6f7665696e7374616c6c6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b436f6e6669677572656c696768745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c69656e747570646174655461736b436c69656e74646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b53747265616d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b437265617465776f726b696e67636f6e66696775726174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b55706461746566696e616c697a655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225461736b4c61737452756e4865617274626561745c22203a207b205c224576656e74735c22203a207b205c225461736b4c61737452756e4865617274626561745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22556e6976657273616c426f6f7473747261707065725c22203a207b205c224576656e74735c22203a207b205c224170706c69636174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6c6c656374506172616d65746572735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6c6c656374456d6265646465645369676e61747572655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616c63756c617465506172616d65746572735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436c69656e744361624d616e616765725c22203a207b205c224576656e74735c22203a207b205c225461736b557064617465436c69656e74446f776e6c6f6164446f457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225461736b436c69656e74446f776e6c6f6164446f457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253747265616d4361625c22203a207b205c224576656e74735c22203a207b205c22446f776e6c6f616453747265616d4361625c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225472616e73706f72745c22203a207b205c225375624e616d657370616365735c22203a207b205c224578706572696d656e74616c5472616e73706f72745c22203a207b205c224576656e74735c22203a207b205c22436162735c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c224576656e74466c61675c22203a20323536207d207d207d2c205c225472616e73616374696f6e616c46696c654f7065726174696f6e735c22203a207b205c224576656e74735c22203a207b205c224170706c794368616e6765735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457865637574655472616e73616374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d2c205c224576656e74735c22203a207b205c225472616e73706f72745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e446961676e6f7374696373222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436f6c6c6563746f725c22203a207b205c224576656e74735c22203a207b205c2253746172745472616365436f6c6c6563746f725c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e446f6373222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22446f63756d656e74416374697669746965735c22203a207b205c224576656e74735c22203a207b205c2241637469766974794c6f67456e7472794372656174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e74727953657453746174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22536572766963654163746976697479526573756c745c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f674f6e436f6e74656e74416374696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e717565756541637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f674469736361726441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225472616e736d69745175657565496e7365727441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225472616e736d697451756575654469736361726441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e71756575654f7574676f696e675c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f6744697363617264466f72446f63756d656e744368616e67655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67547269676765724173796e635461736b576f726b65725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575654c6f61644173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565496e697446696c65506174685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565437265617465496e73616e63655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565417070656e644173796e6342617463685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565577269746541637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756552656d6f76654173796e6342617463685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575655772697465446f63756d656e74496e666f4865616465725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756554727944656c657465456d70747946696c654173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565496e7365727441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e717565756541637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6741646441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674372656174654c6f675c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67536176654e657746696c655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674469736361726441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e71756575654c6f63616c4e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e71756575654f7574676f696e674e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575654469736361726441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224170694f70656e41637469766974794c6f675769746853747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6741646441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674361636865446f63756d656e74496e666f5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e74727946696e616c697a655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6746696c7465724f757443757272656e7455736572416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674c6f616446726f6d53747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6753617665546f53747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565436865636b5265766f6b65644544505c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565526570616972436f7272757074656446696c654173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674d6f64696679436c6f6e655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c654f70656e4572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c65526561644572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c655265706c6163654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c6557726974654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565536574456e74657270726973654461746150726f74656374696f6e4173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575655472756e6361746551756575655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67436c6f73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d6974517565756548656c706572456e737572654469726563746f72795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d697451756575654d616e61676572437265617465496e73616e63655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2241706943726561746541637469766974794c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224170694372656174654c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d69745175657565536574456e746572707269736544	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\Common\Smart Tag\Recognizers	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\PowerPoint\Security\Trusted Locations\Location0\AllowSubFolders = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData\ChunkCount = "uint64_t\|12"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData\VersionId = "uint16_t\|1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ETag = "std::wstring\|\"srwZ1PESUzlKxbMPxiMCE1a6l5i107oQMTZZYIhyq6Y=\""	EXCEL.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Word\Addins\OneNote.WordAddinTakeNotesService\CommandLineSafe = "0"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\Letter Gothic = "Courier New"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Experiment\excel\Language = "en-US"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData\1.5 = 3244222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e5573654c6973744e6f6465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e5573654c6f676963616c445049466f72566563746f72496d6167655265736f75726365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e557365536d617274496e6b416e616c797a6572466f72496e6b456469746f72222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e41697254726166666963436f6e74726f6c2e466f726365456e67696e6553657475704f6e4247546872656164222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e41697254726166666963436f6e74726f6c2e4f7074696d697a65526f616d696e6753657474696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e41697254726166666963436f6e74726f6c2e547275737442617244656c6179466f726d6174222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e41697254726166666963436f6e74726f6c2e556e666f726d6174746564427573426172222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e50726f6772616d6d61626c6553757266616365732e42616e6e6572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e50726f6772616d6d61626c6553757266616365732e42616e6e6572476f7665726e616e6365496e746567726174696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e50726f6772616d6d61626c6553757266616365732e42616e6e6572506c6163656d656e744964222c20225622203a20227374643a3a77737472696e677c383830303031383622207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e50726f6772616d6d61626c6553757266616365732e42616e6e657254696d656f75744d73222c20225622203a2022696e7433325f747c3135303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e50726f6772616d6d61626c6553757266616365732e49734772656574696e674d65737361676556697369626c655768696c6542616e6e65724c6f616473222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e48656c702e436f6e746163745573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e48656c702e456e61626c65506572736f6e616c697a656457686174734e6577222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e48656c702e48656c70546162436f6d6d756e6974794368756e636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e48656c702e496e636c756465436f6d6d616e6454797065222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4144414c5468726f74746c696e67456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e41766f696453656e64696e675368617265506f696e7448656164657273546f5075626c6963456e64706f696e7473222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4368616e6765476174652e4f6e6c7950657273697374536368656d65466f7253657276657255726c73222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e456e61626c6557616d54656c656d65747279426c6f62222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e456e7375726550726f66696c65466f725072696d6172794964656e746974696573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e49676e6f726544697361626c654144414c61746f7057414d4f76657272696465466f725075726557414d222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e53706f41757468436f6e74657874456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e5573654964656e7469747943726564656e7469616c734661696c757265496e666f222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e55736553706f436f6f6b696546726f6d53616d6554656e616e74222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e44617465546f5573654d6963726f736f6674333635466f72436f6e73756d657273222c20225622203a20227374643a3a77737472696e677c323032302d30342d32315430303a30303a30302e302b30303a303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e44617465546f5573654d6963726f736f6674333635466f72534d42222c20225622203a20227374643a3a77737472696e677c323032302d30342d32315430303a30303a30302e302b30303a303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e456e61626c6547726163655769746857414350726f6d6f427573426172222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e456e61626c654d6f6465726e41464f222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e486561727462656174446179734265666f726545787044617465222c20225622203a2022696e7433325f747c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e4e6f456e7469746c656d656e747353656c6653657276696365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e4e6f456e7469746c656d656e74735472794275794578706572696d656e7454726561746d656e74222c20225622203a2022696e7433325f747c3222207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e53686f77564e6578745369676e4f75744469616c6f67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e5573655265666163746f726564436f6e666967446570726f766973696f6e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e5573655265666163746f726564476574557365724c6963656e7365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4d616e6167656162696c6974792e436c6f7564506f6c6963792e4e6f6e5075626c6963436c6f7564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4d616e6167656162696c6974792e54656e616e744173736f63696174696f6e4b65792e4e6f6e5075626c6963436c6f7564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4d616e6167656162696c6974792e5573654f637073563255726c496e57696e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4e616e63794f66666963655465616d2e7a686574616e34313232303231222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e416c6c6f7741626f7274517569636b436865636b45777353657276696365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e416c6c6f7741626f7274517569636b436865636b4f6d657853657276696365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4368616e6765476174652e44697361626c6557696e646f7745787465726e616c436c6f73655364784469616c6f67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4368616e6765476174652e496e766f6b6546657463684d616e696665737443616c6c6261636b4f6e446f776e6c6f61644d616e6966657374222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4368616e6765476174652e557365436c6f6e6564496e7374616e6365466f724572726f72222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4368616e6765476174652e56616c6964617465446f776e6c6f61645265736f7572636573222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4469616c6f6754776f5761794d6573736167696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4469676974616c5369676e6174757265732e456e61626c65547275737465645075626c697368657273222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e456e61626c654d696e43616368655265667265736820222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4964656e746974794361636865466f72636552656672657368222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4f7366496e7374616c6c6572526567697374657242675461736b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e506572557365724964656e746974794d696e4361636865222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e506572557365724964656e74697479526962626f6e4361636865222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e5461626265645461736b70616e6553657449636f6e427946696c65222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e566265456e61626c6554656c656d65747279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e5765624b69743246756c6c4469616c6f67415049222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f4d45582e456e61626c65456e7465727072697365436f6d416464696e536574436f6e6e656374496e7465726e616c5570646174654576656e7473222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f4d45582e456e61626c65456e7465727072697365436f6d416464696e556e68616e646c6564457863657074696f6e4576656e7473222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6172742e456e61626c65416972537061636547726f757044726167466978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6172742e456e61626c65496e736572744d6564696154656c656d65747279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6e654e6f74652e4170706c652e43576f726b73706163655573657255736555726c46726f6d526177556e69636f6465537472696e67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6e654e6f74652e4368616e6765476174652e53686f77494150456e747279222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6e654e6f74652e44656570426174636853746f7265456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6e654e6f74652e52656e6465725570646174656457696e333252656458222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6e654e6f74652e53686f756c645573654e6574436f7374496e73746561644f664d736f426c6f636b696e67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e4c6173744d696c6554656c656d6574727954726163657274222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e5063782e417474656d70744f75746c6f6f6b41757468466f7250726f66696c65222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e5063782e427567466978466f7255736572486561646572496e4964656e7469747941757468222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e5063782e4c696e6b6564496e4b32466978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e5063782e5063784a756e65323031394275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e526970636f72642e33363134383230222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e526970636f72642e33393039323635222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e526970636f72642e33393435323833222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5043582e526970636f72642e56534f2e33363432383036222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572666f726d616e63652e426c6f636b696e6757616974732e4f737250726f63657373222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572666f726d616e63652e4368616e6765476174652e586c426f6f74436f6d706c657465416674657246696c654f70656e416e6453706c61736853637265656e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572736f6e616c697a6174696f6e2e456e61626c65476574496e736967687473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572736f6e616c697a6174696f6e2e456e61626c65476f7665726e616e636552756c6552656672657368222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572736f6e616c697a6174696f6e2e456e61626c6553656e645369676e616c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572736f6e616c697a6174696f6e2e456e61626c6553656e6455736572416374696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572736f6e616c697a6174696f6e2e53657474696e672e496e7369676874546f54696d65546f4c6976654d617070696e67222c20225622203a20227374643a3a77737472696e677c7b5c22696e73696768742f757365722f70726573656e746174696f6e735c223a3630343830302c5c22696e73696768742f757365722f69726973636f6e74656e742f38383030303138365c223a3235393230307d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572736f6e616c697a6174696f6e2e557365476574496e736967687473466c6f77466f724665746368696e67476f7665726e616e636544617461222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4368616e6765476174652e436865636b56696577496e536c6964654a616e69746f724f62736572766572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\User Settings\Word_Core\Count = "1"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\PowerPoint\Addins	EXCEL.EXE
Key created	\Registry\User\.Default\SOFTWARE\ODBC\ODBC.INI\dBASE Files\Engines\Xbase	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Windows\CurrentVersion\Extensions	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\User Settings\Excel_Intl\Count = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\ODBC\ODBC.INI\MS Access Database\UID	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\UserInfo\UserName = "SYSTEM"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Identity\DisableWinHttpCertAuth = "0"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Licensing\CurrentSkuIdAggregationForApp\PowerPoint = "{85DD8B5F-EAA4-4AF3-A628-CCE9E77C9A03},"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{579A3C71-2339-4dee-A735-24BF2D1C5814}	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\Smart Tag\Actions\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD}\PPFrameClass = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\Arial Narrow = "Helvetica-Narrow"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\User Settings\XDocs_XMLEditVerbHandler\Count = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\FE Font 1 = "FE Font 1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Fonts\CloudFontsVersion = "4"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\PowerPoint\Security\Trusted Locations\Location0\Path = "%APPDATA%\\Microsoft\\Templates"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#time	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\Common\CrashPersistence\EXCEL\1848	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\General\Proof = "Proof"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\PowerPoint\Security\Trusted Locations\Location1\AllowSubFolders = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\UILanguageTag = "en-us"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Licensing\LicensingNext\MigrationToV5Done = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\RulesLastAudienceReported\excel.exe = "Production"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\Times Roman = "Times New Roman"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word\Large Icon = "[13]"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.12527&crev=3\0\FilePath = "officeclient.microsoft.com\\AB6E4A36-969E-4541-9181-162C91D0B4BA"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=excel.exe&Version=16.0.12527.20482&ClientId={959410B1-FAB7-4847-9BA4-83055CD2FC1B}&OSEnvironment=10&MsoAppId=1&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20482&"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\General\Xlstart = "XLSTART"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\PowerPoint\Addins\OneNote.PowerPointAddinTakeNotesService\Description = "Enable OneNote Linked Notes Content Service for PowerPoint"	EXCEL.EXE
Key created	\Registry\User\.Default\SOFTWARE\ODBC\ODBC.INI\Excel Files\Engines\Jet	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\User Settings\Ace_OdbcCurrentUser\Count = "1"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Netscape	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Licensing\CurrentSkuIdAggregationForApp\Lync = "{85DD8B5F-EAA4-4AF3-A628-CCE9E77C9A03},"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\MS Design Tools\MDTDBD	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MSDAIPP\Providers\{9FECD570-B9D4-11D1-9C78-0000F875AC61}\ = "Microsoft Data Access Internet Publishing Provider DAV"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\General\Actors = "Actors"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\ODBC\ODBC.INI\dBASE Files\UID	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Roaming\RoamingConfigurableSettings = dc00000001000000803a090041060100010001000000000000000000000000000000000000000000201c0000201c00008051010080510100805101008051010080f4030080f4030080f403002c01000084030000805101000000000084030000805101000a0000001e0000001e000000000000000000000080510100010000000100000000000000000000000000000000000000008d2700008d2700008d2700010000000a000000805101000000300000003000000030000000000084030000805101002c0100008403000080510100050000000500000005000000	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#phone\PPFrameClass = "2"	EXCEL.EXE

Modifies registry class 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\587C2C6BD312F174B88A161D7D7958A7\74F584E381D0AFF4DBFE10B32E52A17F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\SourceList\PackageName = "WPS-Office_10469357_401533.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\587C2C6BD312F174B88A161D7D7958A7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\74F584E381D0AFF4DBFE10B32E52A17F\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\PackageCode = "F55B3AEC34BB71F4F9AA425C412D3435"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\Version = "134414336"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\74F584E381D0AFF4DBFE10B32E52A17F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\ProductName = "SecureSponsorGenerous"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\DeploymentFlags = "3"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1848	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4672	msiexec.exe
4672	msiexec.exe
3652	EiAuPIYhFE4.exe
3652	EiAuPIYhFE4.exe
1020	bgHAdnVGRnVK.exe
1020	bgHAdnVGRnVK.exe
3732	EiAuPIYhFE4.exe
3732	EiAuPIYhFE4.exe
3732	EiAuPIYhFE4.exe
3732	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe
1920	EiAuPIYhFE4.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2664	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2664	msiexec.exe
Token: SeSecurityPrivilege	4672	msiexec.exe
Token: SeCreateTokenPrivilege	2664	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2664	msiexec.exe
Token: SeLockMemoryPrivilege	2664	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2664	msiexec.exe
Token: SeMachineAccountPrivilege	2664	msiexec.exe
Token: SeTcbPrivilege	2664	msiexec.exe
Token: SeSecurityPrivilege	2664	msiexec.exe
Token: SeTakeOwnershipPrivilege	2664	msiexec.exe
Token: SeLoadDriverPrivilege	2664	msiexec.exe
Token: SeSystemProfilePrivilege	2664	msiexec.exe
Token: SeSystemtimePrivilege	2664	msiexec.exe
Token: SeProfSingleProcessPrivilege	2664	msiexec.exe
Token: SeIncBasePriorityPrivilege	2664	msiexec.exe
Token: SeCreatePagefilePrivilege	2664	msiexec.exe
Token: SeCreatePermanentPrivilege	2664	msiexec.exe
Token: SeBackupPrivilege	2664	msiexec.exe
Token: SeRestorePrivilege	2664	msiexec.exe
Token: SeShutdownPrivilege	2664	msiexec.exe
Token: SeDebugPrivilege	2664	msiexec.exe
Token: SeAuditPrivilege	2664	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2664	msiexec.exe
Token: SeChangeNotifyPrivilege	2664	msiexec.exe
Token: SeRemoteShutdownPrivilege	2664	msiexec.exe
Token: SeUndockPrivilege	2664	msiexec.exe
Token: SeSyncAgentPrivilege	2664	msiexec.exe
Token: SeEnableDelegationPrivilege	2664	msiexec.exe
Token: SeManageVolumePrivilege	2664	msiexec.exe
Token: SeImpersonatePrivilege	2664	msiexec.exe
Token: SeCreateGlobalPrivilege	2664	msiexec.exe
Token: SeBackupPrivilege	4188	vssvc.exe
Token: SeRestorePrivilege	4188	vssvc.exe
Token: SeAuditPrivilege	4188	vssvc.exe
Token: SeBackupPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeBackupPrivilege	3928	srtasks.exe
Token: SeRestorePrivilege	3928	srtasks.exe
Token: SeSecurityPrivilege	3928	srtasks.exe
Token: SeTakeOwnershipPrivilege	3928	srtasks.exe
Token: SeBackupPrivilege	3928	srtasks.exe
Token: SeRestorePrivilege	3928	srtasks.exe
Token: SeSecurityPrivilege	3928	srtasks.exe
Token: SeTakeOwnershipPrivilege	3928	srtasks.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2664	msiexec.exe
2664	msiexec.exe
1848	EXCEL.EXE
1848	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1848	EXCEL.EXE
1848	EXCEL.EXE
1848	EXCEL.EXE
1848	EXCEL.EXE
1848	EXCEL.EXE
1848	EXCEL.EXE
1848	EXCEL.EXE
1848	EXCEL.EXE
1848	EXCEL.EXE
1848	EXCEL.EXE
1848	EXCEL.EXE
1848	EXCEL.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 3928	4672	msiexec.exe	102
PID 4672 wrote to memory of 3928	4672	msiexec.exe	102
PID 4672 wrote to memory of 4048	4672	msiexec.exe	104
PID 4672 wrote to memory of 4048	4672	msiexec.exe	104
PID 4672 wrote to memory of 4048	4672	msiexec.exe	104
PID 4048 wrote to memory of 2544	4048	MsiExec.exe	105
PID 4048 wrote to memory of 2544	4048	MsiExec.exe	105
PID 4048 wrote to memory of 2544	4048	MsiExec.exe	105
PID 4048 wrote to memory of 3652	4048	MsiExec.exe	107
PID 4048 wrote to memory of 3652	4048	MsiExec.exe	107
PID 4048 wrote to memory of 3652	4048	MsiExec.exe	107
PID 4048 wrote to memory of 1848	4048	MsiExec.exe	108
PID 4048 wrote to memory of 1848	4048	MsiExec.exe	108
PID 4048 wrote to memory of 1848	4048	MsiExec.exe	108
PID 1020 wrote to memory of 3732	1020	bgHAdnVGRnVK.exe	114
PID 1020 wrote to memory of 3732	1020	bgHAdnVGRnVK.exe	114
PID 1020 wrote to memory of 3732	1020	bgHAdnVGRnVK.exe	114
PID 3732 wrote to memory of 1920	3732	EiAuPIYhFE4.exe	115
PID 3732 wrote to memory of 1920	3732	EiAuPIYhFE4.exe	115
PID 3732 wrote to memory of 1920	3732	EiAuPIYhFE4.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\WPS-Office_10469357_401533.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2664

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3928
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B3CB3C7097237A4B2068D7CC8274608A E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Program Files\SecureSponsorGenerous\hqUsxQVokjCH.exe
    "C:\Program Files\SecureSponsorGenerous\hqUsxQVokjCH.exe" x "C:\Program Files\SecureSponsorGenerous\OUvlZvvsRHvvVPzWjGvr" -o"C:\Program Files\SecureSponsorGenerous\" -pBtrCoSaelPTuXoCAcEwA -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2544
- - C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe
    "C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe" -number 242 -file file3 -mode mode3 -flag flag3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3652
- - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Program Files\SecureSponsorGenerous\xlsx.xlsx"
    3⤵
    - Drops file in System32 directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1848

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4460,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
1⤵
PID:1112

C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe
"C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe" install
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:2608

C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe
"C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe" start
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:1932

C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe
"C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe
  "C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe" -number 213 -file file3 -mode mode3 -flag flag3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe
    "C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe" -number 362 -file file3 -mode mode3 -flag flag3
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5894ab.rbs

Filesize
7KB

MD5
8f9d556dc6c13fecf0042791750d4504

SHA1
8d9965a4414318317de500110326aa2998a28545

SHA256
d57365d558c27d19bffe9e6b46fcdf649479e1bec7e201e24f31231fa1a48a39

SHA512
55cce8c7b21474c51c5e2ea724cd1eb6204d897b4a4a46068a439f6e9be61d36361c929235dc0f7684f147d98d041499265b954734cba56f1c727cc009907798

Download Submit
C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe

Filesize
3.2MB

MD5
1c3d835b334c146196997f99df3c6f8e

SHA1
0027a83539881abaf1f5cb3a2cc0cd6ba528d000

SHA256
dcd7d379effc6f28e3fc43bdeebc3c39c933a93b09d9dc6691fb64392c432b3f

SHA512
f4da23997640cad08e9c3cc605472bb3b112e01406cc18789bd78d1f735790029cede3cd784d5d66882d571d6d515666a2017463ab5be454df50ddc4498d6042

Download Submit
C:\Program Files\SecureSponsorGenerous\OUvlZvvsRHvvVPzWjGvr

Filesize
2.0MB

MD5
d076e5e2afedcdbd328b5a3f0222b408

SHA1
8d8407cf4006934271fbd1f0c251fb5e91786997

SHA256
7a275f7f2ccf99a65eb4bd5f8cbd944041473b6c804487daf03b720700b760ea

SHA512
1f58ffe864710bc35f790510284b39337e8caaf0cf434517afcf0e894dd99c737aba22da27ddd6ee93ce7791407c7338ad2433b4310815f3f644fc72a212b2d9

Download Submit
C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.wrapper.log

Filesize
270B

MD5
1d338b3066fd6ea39c80a2e91fedfb9f

SHA1
40d57cd527751d1d3388aad289475b0692d54a7b

SHA256
da12f7f765cc808a448b4edb3b5d13575aab9ea0b0aa830bc5cd155c745b1f17

SHA512
883ccfe2cf5d3bac252af864b2fa4a6c3c8399d7e0aaa88faddf52235b2ae87ec9d8c74a1b0310b5206739d3d0e343fba045ecb7b7bfac2f7669c57a918dadc9

Download Submit
C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.wrapper.log

Filesize
428B

MD5
3e0b5614f34b58cc3d6ed56778e8f0d6

SHA1
b327156488ebbd7a4756a0785787e0b26964b443

SHA256
252165b90d3f1eb2d1539409ac0db208ad66602e6afaa4077e49cd5e5fc7018d

SHA512
703c27ecb63843cc360371e0fb49c504db2bb71b66be9b08428ab39b16bbc4a0d82af9b8b59b7feb04b22d4d80aca79aab00c42bc6b2421d0a2995a4db1b453e

Download Submit
C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.wrapper.log

Filesize
596B

MD5
f9f3d11fb398ced7219bc340a503d547

SHA1
941de7d1b67b0f8301cefc7cd4e9d9ea1488d447

SHA256
697069d1292b5a3d80048b131d6770b390447fa86a8d4a5de6df861911811502

SHA512
1eae6a36252982061277ac9e14ef9b33c1d745d0e7cf03043745685cac31ea44b6593c9def3ef9df616d8be6c23a6bf645b5863f62b5529b7a9f619c401efdf1

Download Submit
C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.wrapper.log

Filesize
741B

MD5
6b56fb4911a81c4a05cfafee15ef67e2

SHA1
7c238cb0697dec7344c0598beb9ee511e85058db

SHA256
581b316e1d9aa91629d82e506f60bccb534079a9522ad3145eeedc0b1e7a1223

SHA512
c69e92eaabed962e66dd75be75044883d91d297c507911f58305f646b310cac56fc87b76c42690fd8895bd876744af68f0a890a32555a437220f395ad6ae6bf1

Download Submit
C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.xml

Filesize
442B

MD5
5813fb505a190a74c67a360751f71fd8

SHA1
94aff8481367ecd341f6f6aaa99deb5cb1c6a929

SHA256
b05428a2721bad3623587ea39a27f2eec42df1483645a67d4432ddd29feaa885

SHA512
169d429ef514e0b722220ff0af3f00eb2ab30b5e7a4439835f45d9fa2a3d1852e6a80e73ac346a10d244498f2c52e8f745ed6c8458ba3bc3574f7ed1d39e7674

Download Submit
C:\Program Files\SecureSponsorGenerous\hqUsxQVokjCH.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
C:\Program Files\SecureSponsorGenerous\xlsx.xlsx

Filesize
8KB

MD5
5001ead50aa6c32c9d7e6c6dfb4033f0

SHA1
c273c9bc2a996bb9ab65f7d30ccbf38bb755ed57

SHA256
a3d37b43693ef32bfcd324bb4f2523c828648e012828504302f3f182c97c4cda

SHA512
28d970204f02d6bc270fae20cf0ba78a8086e6dd2552f10f6c30d72c324fa2ca5ca44b2aca3830064caa57abd7255edb1147ea2bf0d103b22b75094f20f6d0bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\bgHAdnVGRnVK.exe.log

Filesize
1KB

MD5
122cf3c4f3452a55a92edee78316e071

SHA1
f2caa36d483076c92d17224cf92e260516b3cbbf

SHA256
42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

SHA512
c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

Download Submit
C:\Windows\Installer\e5894aa.msi

Filesize
41.1MB

MD5
27ba48360e40e33e30f22f9258ca8aec

SHA1
f86f07a4fde054f77591c7c42a751f4fa566cdd5

SHA256
593c2deaacb09860822ec349224494c5aa35ebac3ff8836b43f63ad41d168d60

SHA512
0ba2009808c661cc9780bdf437f2ca47cfb99daa080f95428f3631752d2f49f6fce1ec747ef9228e49e3df00db61b67d4f52c4411d76cb6551fb6f50eaf90497

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
d737436d211bea085affa63bdb80dd7e

SHA1
b7da3f211666ff5ad5ec213b2ebcdd33216c007f

SHA256
412fa287d6d696219ced7e2958b8fab16d6b4f52e6b04bfa45912d769baf3f0c

SHA512
c53c6cbd05a9ee011a36e53e88a243af65efae560512dbd1131e027ee36c38476c3268b7644b89e48432d44644a179aade32bf1b90c83a8944281a65828e067c

Download Submit
\??\Volume{ff3ab8f7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5acae3af-2097-4007-9ad1-6ede4c90e4d3}_OnDiskSnapshotProp

Filesize
6KB

MD5
749046b6e78b1283253cdc64b56ff9ba

SHA1
115c8dfd436dc13cf312281d07aea3f10e708f42

SHA256
e8bf3c5359730dd397f03da67ae2bdfad2c79e8de011378b6a4359963d3802e9

SHA512
3aca02f4993002177e24563616db5487f6b53f9dacf92f66cbf2bba93fcb8fd4f2ee3716754c54f55cfd4161dd6cb2ba73c42c400f6869096bfb6ae9f78d26f6

Download Submit
memory/1848-34-0x00007FF945C50000-0x00007FF945C60000-memory.dmp

Filesize
64KB

Download
memory/1848-41-0x00007FF945C50000-0x00007FF945C60000-memory.dmp

Filesize
64KB

Download
memory/1848-37-0x00007FF945C50000-0x00007FF945C60000-memory.dmp

Filesize
64KB

Download
memory/1848-47-0x00007FF943490000-0x00007FF9434A0000-memory.dmp

Filesize
64KB

Download
memory/1848-33-0x00007FF945C50000-0x00007FF945C60000-memory.dmp

Filesize
64KB

Download
memory/1848-32-0x00007FF945C50000-0x00007FF945C60000-memory.dmp

Filesize
64KB

Download
memory/1848-45-0x00007FF943490000-0x00007FF9434A0000-memory.dmp

Filesize
64KB

Download
memory/1920-81-0x000000002A480000-0x000000002A4C3000-memory.dmp

Filesize
268KB

Download
memory/1920-82-0x000000002C080000-0x000000002C23B000-memory.dmp

Filesize
1.7MB

Download
memory/1920-84-0x000000002C080000-0x000000002C23B000-memory.dmp

Filesize
1.7MB

Download
memory/1920-85-0x000000002C080000-0x000000002C23B000-memory.dmp

Filesize
1.7MB

Download
memory/2608-54-0x0000000000F10000-0x0000000000FE6000-memory.dmp

Filesize
856KB

Download