gh0strat | 593c2deaacb09860822ec349224494c5aa35ebac3ff8836b43f63ad41d168d60

Analysis

max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2024 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WPSOffice10469357401533.msi
Size

41.1MB
MD5

27ba48360e40e33e30f22f9258ca8aec
SHA1

f86f07a4fde054f77591c7c42a751f4fa566cdd5
SHA256

593c2deaacb09860822ec349224494c5aa35ebac3ff8836b43f63ad41d168d60
SHA512

0ba2009808c661cc9780bdf437f2ca47cfb99daa080f95428f3631752d2f49f6fce1ec747ef9228e49e3df00db61b67d4f52c4411d76cb6551fb6f50eaf90497
SSDEEP

786432:bz9YO2wwhIk3QM8g4fzggu4Pm7WJn8tKFodQrzRIwio026V:Fa3Qg4fzgh4fn8tKFeQr9tiod6V

Score

10^/10

gh0strat purplefox discovery persistence privilege_escalation rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 3 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/1396-95-0x000000002B620000-0x000000002B7DB000-memory.dmp	purplefox_rootkit
behavioral2/memory/1396-97-0x000000002B620000-0x000000002B7DB000-memory.dmp	purplefox_rootkit
behavioral2/memory/1396-98-0x000000002B620000-0x000000002B7DB000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/1396-95-0x000000002B620000-0x000000002B7DB000-memory.dmp	family_gh0strat
behavioral2/memory/1396-97-0x000000002B620000-0x000000002B7DB000-memory.dmp	family_gh0strat
behavioral2/memory/1396-98-0x000000002B620000-0x000000002B7DB000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	EiAuPIYhFE4.exe
File opened (read-only)	\??\L:	EiAuPIYhFE4.exe
File opened (read-only)	\??\Q:	EiAuPIYhFE4.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	EiAuPIYhFE4.exe
File opened (read-only)	\??\H:	EiAuPIYhFE4.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	EiAuPIYhFE4.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	EiAuPIYhFE4.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	EiAuPIYhFE4.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	EiAuPIYhFE4.exe
File opened (read-only)	\??\O:	EiAuPIYhFE4.exe
File opened (read-only)	\??\P:	EiAuPIYhFE4.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	EiAuPIYhFE4.exe
File opened (read-only)	\??\W:	EiAuPIYhFE4.exe
File opened (read-only)	\??\X:	EiAuPIYhFE4.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	EiAuPIYhFE4.exe
File opened (read-only)	\??\V:	EiAuPIYhFE4.exe
File opened (read-only)	\??\Y:	EiAuPIYhFE4.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	EiAuPIYhFE4.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	EiAuPIYhFE4.exe
File opened (read-only)	\??\Z:	EiAuPIYhFE4.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	EiAuPIYhFE4.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	EXCEL.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	EXCEL.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	EXCEL.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	EXCEL.EXE

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.xml	hqUsxQVokjCH.exe
File created	C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe	hqUsxQVokjCH.exe
File opened for modification	C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe	hqUsxQVokjCH.exe
File opened for modification	C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.wrapper.log	bgHAdnVGRnVK.exe
File created	C:\Program Files\SecureSponsorGenerous\OUvlZvvsRHvvVPzWjGvr	msiexec.exe
File created	C:\Program Files\SecureSponsorGenerous\xlsx.xlsx	msiexec.exe
File created	C:\Program Files\SecureSponsorGenerous\~$xlsx.xlsx	EXCEL.EXE
File opened for modification	C:\Program Files\SecureSponsorGenerous\~$xlsx.xlsx	EXCEL.EXE
File opened for modification	C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.wrapper.log	bgHAdnVGRnVK.exe
File opened for modification	C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.wrapper.log	bgHAdnVGRnVK.exe
File created	C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.xml	hqUsxQVokjCH.exe
File opened for modification	C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe	hqUsxQVokjCH.exe
File opened for modification	C:\Program Files\SecureSponsorGenerous\xlsx.xlsx	EXCEL.EXE
File created	C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe	hqUsxQVokjCH.exe
File opened for modification	C:\Program Files\SecureSponsorGenerous	EiAuPIYhFE4.exe
File created	C:\Program Files\SecureSponsorGenerous\hqUsxQVokjCH.exe	msiexec.exe
File created	C:\Program Files\SecureSponsorGenerous\UE4PrereqSetup_x64.exe	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57cbae.msi	msiexec.exe
File created	C:\Windows\Installer\e57cbac.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57cbac.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3E485F47-0D18-4FFA-BDEF-013BE2251AF7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICD23.tmp	msiexec.exe

Executes dropped EXE 7 IoCs

pid	Process
436	hqUsxQVokjCH.exe
3376	EiAuPIYhFE4.exe
3644	bgHAdnVGRnVK.exe
744	bgHAdnVGRnVK.exe
4248	bgHAdnVGRnVK.exe
2240	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1196	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EiAuPIYhFE4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EiAuPIYhFE4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hqUsxQVokjCH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EiAuPIYhFE4.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a2808484d8f468e90000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a28084840000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a2808484000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da2808484000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a280848400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	EiAuPIYhFE4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EiAuPIYhFE4.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\Registry\User\.Default\SOFTWARE\ODBC\ODBC.INI\MS Access Database\Engines	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Excel\Security\Trusted Locations\Location5\Path = "C:\\Program Files\\Microsoft Office\\Root\\Office16\\Library\\"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Word\Security\Trusted Locations\Location0\Path = "%APPDATA%\\Microsoft\\Templates"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Common\Roaming	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.12527&crev=3\0\EndDate = e0d2d657c00ddb01	EXCEL.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{F562BB8E-422D-4B5C-B20E-90D710F7D11C}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\CGTimes_Scale = "CG Times"	EXCEL.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	MsiExec.exe
Key created	\Registry\User\.Default\SOFTWARE\Microsoft\Office\Excel\Addins\PowerPivotExcelClientAddIn.NativeEntry.1	EXCEL.EXE
Key created	\Registry\User\.Default\SOFTWARE\ODBC	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\ASF Stream Descriptor File	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Excel\Security\Trusted Locations\Location1\Path = "%APPDATA%\\Microsoft\\Excel\\XLSTART"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\ProtocolExecute\ms-word\WarnOnOpen = "0"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Word\Security\Trusted Locations\Location2\Description = "2"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Common\Licensing	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\msoridEnableAtomicsOnRequestHelper = "0"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData\ChunkCount = "uint64_t\|11"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\General\Favorites = "Favorites"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\ProtocolExecute\word\WarnOnOpen = "0"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\RemoteClearDate = 0040a7e3a36bc901	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigIds = "std::wstring\|P-R-1098158-1-5,P-R-76757-1-2,P-R-26146-5-17,P-D-29635-1-1,P-D-27087-1-9,P-R-79688-1-3,P-R-53532-1-5,P-R-51436-1-6,P-R-51427-18-12,P-R-40464-18-9,P-X-98518-6-9,P-R-38390-18-21,blockedgraphicsadapter5:475899,P-R-35099-2-4,P-R-61408-18-3,P-R-55746-2-5,P-R-53512-1-4,P-R-46974-18-18,P-R-38953-1-11,P-R-36551-18-18,P-R-71414-1-6,P-R-40253-6-19,P-R-40254-6-18,P-R-35401-6-7,P-R-32107-22-22,P-R-39146-14-15,P-R-39147-14-20,P-R-28546-6-11,P-R-28165-6-28,P-R-24980-8-48,P-R-24390-5-12,P-R-18279-2-65,P-D-34200-4-5,P-R-51145-2-7,P-R-37721-11-47,P-R-29928-2-20,P-R-73334-3-9,P-R-67932-1-4,P-R-67201-1-4,P-R-64545-1-4,P-R-64035-1-4,P-R-53515-18-9,P-R-53280-1-6,P-R-52247-1-5,P-R-51958-1-5,P-R-51842-1-5,P-R-51277-2-6,P-R-47451-18-20,P-R-46577-18-14,P-R-45984-18-17,P-R-45919-18-19,P-R-45085-18-12,P-R-41442-18-18,P-R-38085-12-9,P-R-18744-6-22,P-D-34239-1-6,P-R-1034169-10-7,P-X-1418180-2-3,P-X-1416129-1-5,P-X-1315162-2-3,P-X-1269026-2-3,P-X-1249328-1-3,P-X-1232877-1-3,P-X-1159291-2-3,P-X-1157811-2-3,P-X-1150274-2-3,P-X-1069820-2-5,P-X-1007231-1-5,P-X-110928-1-7,P-X-84249-1-5,P-E-28677-2-3,P-R-1418833-14-16,P-R-1416513-13-19,P-R-1378374-14-12,P-R-1269039-14-16,P-R-1249345-13-15,P-R-1232880-13-11,P-R-1159304-14-13,P-R-1157836-14-15,P-R-1150379-14-14,P-R-75020-1-4,P-R-71457-1-4,P-R-70427-1-4,P-R-69608-1-4,P-R-66155-18-6,P-R-61931-1-4,P-R-59969-1-4,P-R-59664-1-4,P-R-58090-18-6,P-R-55122-8-8,P-R-54971-1-4,P-R-54435-1-6,P-R-54374-1-4,P-R-53862-1-5,P-R-53448-1-4,P-R-53007-1-5,P-R-52812-1-4,P-R-52056-1-4,P-R-51740-1-5,P-R-51941-18-19,P-R-51687-1-4,P-R-51670-18-13,P-R-51244-1-9,P-R-46541-26-20,P-R-51112-2-6,P-R-51036-18-3,P-R-49735-18-12,P-R-50408-18-15,P-R-49894-18-14,P-R-50255-10-9,P-R-50164-1-5,P-R-50118-26-16,P-R-49943-18-31,P-R-49774-18-14,P-R-48626-18-13,P-R-48713-18-12,P-R-48444-18-16,P-R-48445-18-15,P-R-48298-C17-13,P-R-46450-18-20,P-R-44907-1-9,P-R-46288-18-6,P-R-44929-8-40,P-R-46174-18-12,P-R-46000-18-14,P-R-45022-18-16,P-R-45314-10-16,P-R-45091-18-26,P-R-43367-18-32,P-R-44965-2-6,P-R-44703-18-26,P-R-42516-18-13,P-R-43472-4-7,P-R-43378-18-18,P-R-43060-18-20,P-R-43036-18-11,P-R-41912-1-3,P-R-40828-2-3,P-R-37551-20-9,P-R-38013-18-20,P-R-37373-18-27,P-R-36659-2-5,P-R-36590-2-8,P-R-33312-6-18,P-R-32214-58-55,P-R-32173-22-18,P-R-32170-20-22,P-R-31415-1-4,P-R-30540-1-5,P-R-30539-4-7,P-R-30534-8-10,P-D-1004644-9-1,P-D-92545-9-1,P-D-62373-9-1,P-D-61717-9-1,P-D-61583-1-2,P-D-51798-9-1,P-D-50612-3-2,P-D-50611-1-1,analyzedatafallbacktoelse-treatment:634807,36cd3799:634885,augloopanalyzedataworkflowtimeout-treatment:622946,llmchartreco-treatment3:614622,79c1c370:614623,12c81978:521049,usev2auth-treatment:477115,analyzedatatimeout-treatment:478412,xls-excelsharedcopilot-treatment:475885,insights-logrecommendationssignalsdesktopon:384222,exins226:233377,exins412:217538,exins463:120765,analyzedatafallbacktoelse-treatment:634807,augloopanalyzedataworkflowtimeout-treatment:622946,llmchartreco-treatment3:614622,usev2auth-treatment:477115,analyzedatatimeout-treatment:478412,xls-excelsharedcopilot-treatment:475885,P-X-1240823-2-3,P-E-38231-C1-4,P-R-1245662-16-4,P-R-94560-14-12,P-R-94189-14-13,P-R-93882-14-26,P-R-54728-16-23,P-R-54698-16-16,P-R-54658-18-19,P-R-38306-18-3,P-R-35717-5-30,P-R-34019-4-3,win32devicecanarycf:541484,win32devicecanarycf:541484,P-R-19657-22-43,P-X-53845-1-9,P-X-53772-1-3,P-X-51790-1-3,P-R-1025232-24-9,P-R-71358-1-4,P-R-70941-1-4,P-R-69065-1-3,P-R-67160-1-7,P-R-59781-1-4,P-R-55631-1-4,P-R-54215-1-4,P-R-53751-1-4,P-R-53752-1-4,P-R-53526-1-4,P-R-52110-1-4,P-R-49765-15-32,P-R-48818-17-25,P-R-50679-1-4,P-R-50486-18-12,P-R-44830-18-13,P-R-49416-4-14,P-R-48457-2-6,P-R-47468-16-19,P-R-47974-16-18,P-R-46544-18-11,P-R-45609-14-6,P-R-45197-2-6,P-R-44046-18-11,P-R-44015-18-20,P-R-43723-2-6,P-R-42457-18-6,P-R-41994-9-24,P-R-41742-18-32,P-R-41721-18-13,P-R-37963-18-26,P-R-40980-18-16,P-R-40359-2-10,P-R-39029-5-18,P-R-38835-18-48,P-R-38193-28-39,P-R-37676-18-46,P-R-38162-24-67,P-R-37467-18-44,P-R-36478-4-6,P-R-36310-4-5,P-R-35945-10-5,P-R-35854-20-8,P-R-35165-2-7,P-R-35143-4-4,P-R-33553-4-6,P-R-33536-12-13,P-R-29809-1-7,P-R-26968-3-9,P-R-18425-8-62,P-R-18426-5-30,P-R-18424-4-34,fiser190:377704,happy03172020-1:61977,happy02062020-0:28428,P-R-53545-4-5,P-R-50711-18-11,P-R-49736-6-22,P-R-48706-18-18,P-R-48467-18-18,P-R-42696-18-12,P-R-32106-7-33,P-R-30085-1-9,P-R-29138-38-83,P-R-29315-36-69,P-R-27574-6-38,P-R-25157-8-14,P-R-24363-6-13,P-R-22238-10-21,P-R-21631-10-64,P-R-19898-1-22,P-R-19814-1-62,P-R-19014-1-26,P-R-19012-1-57,P-X-50220-1-3,P-X-49730-1-3,P-R-69347-1-5,P-R-64574-1-4,P-R-54116-1-4,P-R-53585-18-18,P-R-52594-18-5,P-R-52386-1-4,P-R-50980-2-4,P-R-50938-1-4,P-R-50152-18-20,P-R-49175-18-22,P-R-36683-18-40,P-R-47260-18-23,P-R-46773-18-20,P-R-44156-18-26,P-R-43284-18-19,P-R-43285-12-22,P-R-42482-1-4,P-R-40990-12-15,P-R-39333-18-28,P-R-35972-2-5,P-R-35572-14-3,P-R-35439-12-21,P-R-33215-18-19,P-R-31352-12-25,P-R-28751-2-20,P-D-34269-2-5,gruse488:570358,grico406:19777,P-R-1044721-8-5,P-R-49830-18-15,P-R-40586-18-27,P-R-40732-18-16,P-R-39143-18-23,P-R-32996-18-24,P-D-40316-9-5,P-R-50429-18-8,P-R-36539-10-5,P-R-24084-1-16,P-R-23391-1-9,P-R-65295-18-30,P-R-61861-1-4,P-R-61737-1-4,P-R-51777-18-8,P-R-50920-1-6,P-R-50366-18-19,P-R-35985-14-23,P-R-35891-18-5,P-R-32004-2-5,P-X-1276509-1-5,P-R-1280425-13-17,P-R-68336-2-4,P-R-67286-2-6,P-R-51513-2-4,P-R-49589-18-37,i0d76970:598689,P-R-79963-1-2,P-R-52043-1-3,P-R-51764-1-4,P-R-49388-2-6,P-R-48335-4-16,P-R-47308-3-9,P-R-42392-2-4,P-R-39073-1-5,P-R-1123376-10-12,P-R-1009855-12-14,P-R-98856-18-48,P-R-43489-30-15,P-R-38410-12-23,P-X-1291246-2-3,P-X-1019581-1-3,P-X-1006174-1-5,P-R-25943-8-15,P-R-66436-1-4,P-R-64178-18-9,P-R-62873-1-4,P-R-51097-1-5,P-R-50706-18-7,P-R-50055-18-7,P-R-49315-18-5,P-R-45382-18-7,P-R-42660-18-35,P-R-36649-8-9,ch371179:600396,oemic639:397753,oeall843:375887,P-R-42379-2-3,P-R-42378-2-3,P-R-66539-1-4,P-R-66538-1-4,P-R-65278-1-4,P-R-65279-1-4,P-R-59180-1-4,P-R-48070-1-5,P-R-47386-1-4,P-R-55342-2-2,P-R-53377-2-6,P-R-52481-2-5,P-R-49759-2-8,P-R-46100-20-9,P-R-38510-2-10,P-R-37550-20-13,P-R-32186-28-29,P-R-58135-2-4,P-R-56618-1-3,P-R-56027-1-4,P-R-46145-18-18,P-R-35513-4-4,P-R-33892-1-8,P-R-33696-1-5,P-R-33569-1-9,P-R-31987-1-6,P-R-55749-1-4,P-R-53662-1-4,P-R-52246-1-4,P-R-52245-1-4,P-R-52238-1-5,P-R-43644-6-13,P-R-39912-1-2,P-R-39283-4-10,P-R-50380-18-18,P-R-50379-18-17,P-X-117740-1-3,P-R-68146-1-5,P-R-63409-1-5,P-R-50542-18-14,P-R-50500-18-16,P-R-48365-18-24,P-R-48161-18-32,P-R-46597-1-4,P-R-33943-54-44,P-R-33737-1-4,graphicsfilterextralockdown:496048,P-E-29662-C1-3,P-R-29303-2-20,P-R-56654-2-4,P-R-53785-18-9,P-R-51703-1-5,P-R-50133-2-9,P-R-47242-18-11,P-R-46410-1-5,P-R-45550-C17-46,P-R-45490-16-9,P-R-44885-18-20,P-R-42512-1-3,P-R-40169-8-13,P-R-38704-4-6,P-R-37581-18-17,P-R-37313-18-22,P-R-36664-4-4,P-R-35973-2-4,P-R-35946-6-4,P-R-35476-2-5,P-R-35407-4-3,P-R-35237-14-11,P-R-35150-2-4,P-R-35129-2-4,P-R-35056-4-5,P-R-34889-8-4,P-R-34044-2-4,P-R-33718-6-5,P-R-33459-1-5,P-R-30292-4-8,P-R-28644-1-4,P-R-24037-1-7,P-R-23445-3-7,P-R-23434-3-7,P-R-18513-1-30,P-D-34699-4-4,P-D-34697-2-4,P-D-34675-1-4,P-D-34673-1-4,P-D-34654-1-4,P-D-34609-1-3,P-D-34587-3-5,P-D-34266-1-4,P-D-34262-1-5,P-D-34260-1-5,P-D-34258-2-5,P-D-34250-1-3,P-D-32465-1-5,P-D-32459-2-4,P-D-32458-5-4,P-X-1083427-2-5,P-R-69529-1-5,P-R-65011-1-3,P-R-53622-18-4,P-R-50541-2-7,P-R-49893-22-9,P-R-36932-2-13,jh8ab447:380633,P-R-69232-18-13,P-R-26442-1-8,P-R-23681-2-7,P-D-32502-2-3,P-D-32501-2-3,P-D-32415-2-3,P-R-64513-18-11,P-R-51916-84-31,P-R-23746-32-46,P-R-38248-20-26,P-R-1001617-5-11,P-R-1286642-1-3,P-R-1280186-1-3,P-R-49459-15-25,P-R-1267084-2-5,P-R-1262663-1-3,P-R-1258784-3-5,P-R-1248414-1-3,P-R-1245296-4-6,P-R-1239218-1-3,P-R-1236953-3-5,P-R-1157570-2-4,P-R-1152538-1-3,P-R-1132821-2-4,P-R-1119013-1-3,P-R-1098796-1-3,P-R-1097039-1-3,P-R-1094445-1-3,P-R-1080412-1-3,P-R-1073291-4-6,P-R-1071033-5-7,P-R-1069769-2-4,P-R-1068115-1-3,P-R-1049175-1-3,P-R-1045118-2-4,P-R-25269-14-21,P-R-1044408-1-3,P-R-1044141-7-9,P-R-1042159-1-3,P-R-1037887-1-3,P-R-1037879-1-3,P-R-1036293-1-3,P-R-1036292-1-3,P-R-1036289-2-4,P-R-1036288-1-3,P-R-1036068-2-4,P-R-1036039-2-4,P-R-1035933-2-4,P-R-1035149-2-4,P-R-1033817-1-3,P-R-1028168-1-3,P-R-1009717-3-5,P-R-1000061-2-4,P-R-117548-2-4,P-R-115946-3-5,P-R-114468-2-4,P-R-111853-2-4,P-R-111682-1-3,P-R-109880-4-6,P-R-107832-2-4,P-R-105731-36-38,P-R-104435-13-15,P-R-100294-1-3,P-R-99633-1-3,P-R-98929-2-4,P-R-98250-1-3,P-R-93077-1-3,P-R-90895-3-5,P-R-88419-3-5,P-R-86118-1-3,P-R-80517-7-9,P-R-78112-4-6,P-R-77403-1-3,P-R-77397-1-3,P-R-77266-5-7,P-R-77140-2-4,P-R-77129-2-4,P-R-76944-6-8,P-R-76942-2-4,P-R-76939-3-5,P-R-76918-2-4,P-R-76721-1-3,P-R-76659-2-4,P-R-76432-4-6,P-R-76128-3-5,P-R-75440-2-4,P-R-73676-1-3,P-R-72829-2-4,P-R-72461-4-6,P-R-72449-7-10,P-R-72030-4-6,P-R-68069-2-4,P-R-66975-1-3,P-R-65567-1-3,P-R-62596-1-3,P-R-62212-2-4,P-R-60602-3-5,P-R-58471-2-4,P-R-58093-1-3,P-R-52633-1-3,P-R-52236-2-4,P-R-52171-2-4,P-R-52011-2-4,P-R-51921-8-10,P-R-51258-8-10,P-R-50752-2-4,P-R-50681-2-4,P-R-50599-4-6,P-R-50596-4-8,P-R-50553-1-3,P-R-49597-3-5,P-R-49458-2-4,P-R-48530-7-9,P-R-47948-1-4,P-R-46580-3-5,P-R-46484-10-12,P-R-46122-1-3,P-R-45858-2-4,P-R-44950-1-3,P-R-43966-2-4,P-R-43502-19-21,P-R-43238-3-5,P-R-43188-6-8,P-R-41430-1-3,P-R-40751-8-10,P-R-40273-4-6,P-R-39238-5-7,P-R-38878-2-4,P-R-38682-3-5,P-R-37588-2-4,P-R-37548-4-6,P-R-37376-2-4,P-R-34355-8-10,P-R-26266-4-9,P-R-26834-3-8,P-R-24662-16-22,P-R-27479-6-11,P-R-26056-7-15,P-R-27006-7-12,P-R-32191-9-11,P-R-30338-3-7,P-R-30178-79-81,P-R-30080-21-23,P-R-30053-8-10,P-R-27458-1-5,P-R-25822-16-19,P-R-25083-6-9,P-R-24690-42-46,P-R-24689-2-5,P-R-24666-2-5,P-R-24663-6-11,P-R-24659-7-10,P-R-23762-5-8,P-R-23744-7-9,P-R-23739-7-9,P-R-23736-14-17,P-R-23734-7-9,P-R-23730-21-24,P-R-23723-10-12,P-D-32588-1-3,P-D-32534-1-3,P-D-32524-1-3,P-D-32518-1-3,P-D-32512-1-3,P-D-32509-1-3,P-D-32504-1-3,P-D-32485-1-4,P-D-32484-1-4,P-D-32405-1-3,P-X-93407-1-5,P-X-73179-1-7,P-E-38455-2-4,P-R-1087141-4-7,P-R-60033-12-29,P-R-50705-14-15,P-R-49160-12-12,P-R-48282-14-16,P-R-47046-C17-23,P-R-47601-18-13,P-R-46834-12-14,P-R-46900-18-8,P-R-46202-18-11,P-R-45817-20-16,P-R-44018-18-13,P-R-43355-18-12,P-R-40152-18-16,P-R-39981-18-9,P-R-39509-10-14,P-R-39420-12-12,P-R-39377-18-14,P-R-35869-12-10,P-R-35337-16-7,P-R-33916-1-5,P-R-33739-1-7,P-R-33580-8-9,P-R-32042-2-14,P-R-31966-21-25,P-D-65084-5-51,ucsha513:233051,enablenotesearch:149734,P-X-117400-1-3,P-R-59175-18-4,P-R-53292-14-10,P-R-49130-18-23,P-R-46913-18-8,P-R-46820-18-18,P-R-42780-14-19,P-R-41493-18-21,P-R-37449-18-15,P-R-25867-1-6,uxmediumiconluminance:353455,P-R-48549-18-11,P-R-19262-2-12,P-E-44774-2-9,P-E-29661-2-3,P-R-44869-16-16,P-R-33918-1-11,P-R-1128630-1-7,P-R-1098412-1-5,P-R-1091267-1-53,P-R-81720-1-2,P-R-58406-1-5,P-D-50697-2-4,P-D-29719-1-1,P-D-29718-1-1,P-D-29593-1-6"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\msacm.imaadpcm\MaxRTDecodeSetting = "6"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\User Settings\PowerPoint_Core\Count = "1"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\User Settings\Excel_Core\Count = "1"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\Smart Tag\Actions\{06F9A697-9708-422D-A5AF-C559391A850A}\Internet Explorer_Server = "1"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Excel\Resiliency	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\ShowDates = "ON"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Identity\DisableWinHttpCertAuth = "0"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData\1.10 = 657370616365735c22203a207b205c2241637469766174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6173744f70656e6564446f63756d656e744d657461646174615c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d6f6465726e446f6354656d706c617465536572766963655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225361766550726f6d707448656c7065725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e74436861745c22203a207b205c224576656e74735c22203a207b205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e6572436f6e6e65637465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e6572436f6e6e656374696e674576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e6572446973636f6e6e65637465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e6572446973636f6e6e656374696e674576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e65725265667265736850657273697374656e7453746174654173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e65725265667265736850657273697374656e7453746174654173796e63496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e65725265667265736850657273697374656e7453746174654173796e6352657472795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e657253746172745265616c74696d65436f6e6e656374696f6e4c697374656e696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e7443686174417661696c6162696c6974795274634c697374656e657253746f705265616c74696d65436f6e6e656374696f6e4c697374656e696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572436f6e6e65637465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572436f6e6e656374696e674576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572446973636f6e6e65637465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572446973636f6e6e656374696e674576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e7453746174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e745374617465496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e74537461746552657472795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e7453746174655265747279496e6e65724c6f6f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f61646361737465725265667265736850657273697374656e7453746174654173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f616463617374657253746172745265616c74696d65436f6e6e656374696f6e4c697374656e696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f616463617374657253746f705265616c74696d65436f6e6e656374696f6e4c697374656e696e675c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253686172696e6755495c22203a207b205c225375624e616d657370616365735c22203a207b205c22436f6c6c616250616e65557365725c22203a207b205c224576656e74735c22203a207b205c22536861726550616e65436f6d706c657465446973706c61795c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2253686172654469616c6f675c22203a207b205c224576656e74735c22203a207b205c224e61766967617465546f5765624469616c6f675c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253656e6441734174746163686d656e745c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d2c205c224544505c22203a207b205c224576656e74735c22203a207b205c22506f6c6963794d657461646174615c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c225369746573536572766963654170695c22203a207b205c224576656e74735c22203a207b205c22526571756573744173796e635c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225265616446726f6d43616368655c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d2c205c224576656e74735c22203a207b205c22536861726564436f6d6d656e74735f447261667443617264556e6d6f756e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224544502a5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456e74657270726973654461746150726f74656374696f6e2a5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f456e74657270726973654461746150726f74656374696f6e2a5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e44796e616d696343616e766173222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224a6176615363726970744170695c22203a207b205c224576656e74735c22203a207b205c224c61756e63684f6e6544726976655c22203a207b205c224576656e74466c61675c22203a203439343038207d207d207d2c205c22457870657269656e6365735c22203a207b205c224576656e74735c22203a207b205c224d6f62696c65557073656c6c496e7075744469616c6f674d6f756e7465645c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c224d6f62696c65557073656c6c4f6e53656e645c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c224d6f62696c65557073656c6c526563697069656e74547970655c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c224d6f62696c65557073656c6c53656e644d6573736167655c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c22537562736372697074696f6e5368617265496e7075744469616c6f674d6f756e7465645c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c22537562736372697074696f6e53686172654f6e53656e645c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c22537562736372697074696f6e536861726550726566657463684c6963656e736549645c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c22537562736372697074696f6e536861726553656e64537562736372697074696f6e53686172655c22203a207b205c224576656e74466c61675c22203a203439343038207d207d207d2c205c2250726f677265737355695c22203a207b205c224576656e74735c22203a207b205c22556e6578706f727461626c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224578706f727461626c655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2243616e7661735c22203a207b205c225375624e616d657370616365735c22203a207b205c225765624469616c6f675c22203a207b205c225375624e616d657370616365735c22203a207b205c2242726f777365724576656e7448616e646c65725c22203a207b205c224576656e74735c22203a207b205c224f6e4c6f616465645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c224e617669676174696f6e48616e646c65725c22203a207b205c224576656e74735c22203a207b205c224f6e4e61766967617465645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d207d207d207d2c205c224576656e74735c22203a207b205c224f7574537061636543616e7661735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e457863656c222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436f617574685c22203a207b205c224576656e74735c22203a207b205c224e616d656453686565745669657744656665727265644170706c795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f70656e46696c655c22203a207b205c224576656e74466c61675c22203a203330393632323437343338323231303536207d2c205c22536176655872725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22456e737572654d6572676552656a656374496e666f5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436c65616e50726573656e63655549486f7374735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f617574684175746f53617665496e53796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22457865637574654d65726765496e7374616e63655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224c6f6164436d644c696e655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225274634d616e616765724872496e697469616c697a655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f4d536574576f726b626f6f6b446f7453617665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253757370656e64526573756d654d657267655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f63734f704b6e6f776e426c6f62735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22576f726b626f6f6b44697274794e6f5265766973696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224b69636b4f6666517569636b536176655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22586c53796e6353746174654368616e67654c697374656e65724f6e53796e6353746174654368616e67655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f63734765744f70496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c6f7365576f726b626f6f6b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224261636b67726f756e6451756575655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f637350756c6c4f704f6e4765745265766973696f6e436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f637350756c6c4f704f6e4765745265766973696f6e526573706f6e736552656365697665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f637350756c6c4f70464275696c644765745265766973696f6e526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f637350756c6c4f704f6e436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b5061636b61676546696c6553746172745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b5061636b61676546696c6553746f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b456e637279707465644d6574726f46696c6553746172745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b456e637279707465644d6574726f46696c6553746f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536b697070656443686743656c6c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243717532674872446f456e74657243656c6c466d6c61584c5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22416464696e446566696e656446756e6374696f6e5c22203a207b205c224576656e74735c22203a207b205c22437573746f6d46756e6374696f6e73416c6c496e4f6e655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22437573746f6d46756e6374696f6e73496e7374616c6c50726f706572746965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22437573746f6d46756e6374696f6e734173796e6350726f706572746965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22437573746f6d46756e6374696f6e73506572665c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22437573746f6d46756e6374696f6e734f736641646650726f7065727469657348656c706572537a41637469766546696c65536861726553746f726555726c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22437573746f6d46756e6374696f6e734f736641646650726f7065727469657348656c706572464f6666696365457874656e73696f6e73456e61626c65645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22437573746f6d46756e6374696f6e734f736641646650726f7065727469657348656c706572537a44656661756c74486173685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22437573746f6d46756e6374696f6e734f736641646650726f7065727469657348656c706572537a41637469766546696c65536861726553746f726555726c486173685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22437573746f6d46756e6374696f6e734f73664164664964656e746974794368616e6765537563636573735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22437573746f6d46756e6374696f6e734f736641646650726f7065727469657348656c706572464f6d657853746f7265456e61626c65645c22203a207b205c224576656e74466c61675c22203a20353132207d207d207d2c205c2246696c65536176655c22203a207b205c224576656e74735c22203a207b205c225361766541735361766546696c655c22203a207b205c224576656e74466c61675c22203a203330393632323437343338323231303536207d2c205c2253617665536f757263655c22203a207b205c224576656e74466c61675c22203a20353132207d207d207d2c205c2246696c654c6f61645c22203a207b205c224576656e74735c22203a207b205c2244656661756c74436f6c756d6e57696474685c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436f6d6d616e645c22203a207b205c224576656e74735c22203a207b205c22446f4e65775c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224365436f70795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436550617374655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2245646974496e736572745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22446f436c6f73655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224365506173746553705c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22466f6e7450726f706572746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225363616c6557696e646f775c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2243616e63656c436f70795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2243654375745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22416c69676e43656c6c735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224365466f6e74735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22477269645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22466f725061745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224d6572676543656c6c735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224365457a46696c7465725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\PerpetualLicenseInfo = "std::wstring\|2016"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\LastClean = e0126d2df70cdb01	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\PowerPoint\Addins\OneNote.PowerPointAddinTakeNotesService\FriendlyName = "OneNote Notes about PowerPoint Presentations"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\PowerPoint\Security	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\PowerPoint\Security\Trusted Locations\Location1\AllowSubFolders = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Word\Options\PROGRAMDIR = "C:\\Program Files\\Microsoft Office\\Root\\Office16\\"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\User Settings\Word_Core\Count = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Licensing\NextUserLicensingLicensedUserIds	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\PowerPoint\Security\Trusted Locations\Location2\Description = "10"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\Univers (W1) = "Arial"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Extensions\dotm = "C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE ^.dotm"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Licensing\LastKnownC2RProductReleaseId\PowerPoint = "ProPlusRetail"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\NLQ = "Roman 10cpi"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Extensions\dotx = "C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE ^.dotx"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\UISnapshotLanguages = "en-us"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\ODBC\ODBC.INI\dBASE Files\UID	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Word\Security\Trusted Locations	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Excel\Options	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Excel\ExcelPreviousSessionVersion = "16.0.12527.20470"	EXCEL.EXE
Key created	\Registry\User\.Default\SOFTWARE\ODBC\ODBC.INI\dBASE Files	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft PowerPoint\Large Icon = "[15]"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel\Large Icon = "[14]"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Word	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Word\Security\Trusted Locations\Location0\Description = "0"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\New York = "Times New Roman"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ASF Stream Descriptor File\Settings\Don't Show Boot Dialog = "0"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Excel\Security\Trusted Locations\Location0\Path = "C:\\Program Files\\Microsoft Office\\Root\\Office16\\XLSTART\\"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData\ChunkCount = "uint64_t\|0"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData\1.14 = 656374696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225a65726f4279746546696c6555706c6f6164417474656d707465645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c2252756e74696d6550726f706572746965735c22203a207b205c224576656e74735c22203a207b205c22496e636f6d70617469626c6543736956657273696f6e44657465637465645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c224f66666963655c22203a207b205c225375624e616d657370616365735c22203a207b205c2246696c65494f5c22203a207b205c225375624e616d657370616365735c22203a207b205c224353495c22203a207b205c225375624e616d657370616365735c22203a207b205c2253746f726167655c22203a207b205c224576656e74735c22203a207b205c2243616368654f707469637356325c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d2c205c224d6f6373695c22203a207b205c224576656e74735c22203a207b205c22557064617465486f73745469705c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4772617068696373222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22496e6b416e616c797a657254726565526573756c745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22487962726964496e6b54657874416e616c797a6572526573756c74735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536d617274496e6b416e616c797a6572526573756c74735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22415243457863657074696f6e53636f70655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2245326f5669657752656e646572506572666f726d616e636541637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224172745669657756616c69646174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224175746f6669745368617065546f54657874436d645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546f704c6576656c456666656374447261775c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224372656174654269746d617046726f6d506c6174666f726d4269746d61705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e6b496e70757453757266616365426173655570646174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250617468576964656e657246576964656e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250617468576964656e657246576964656e53696d706c65506174685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224776697a536d61727441727450726f7065727469657354656c656d657472795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726561746544657669636544334431305c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22537065637472655472616e73636f646541637469766974795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22496e73657274496e646976696475616c4d6f64656c334441637469766974795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c6f61646564496d61676550726f706572746965735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22496e736572744d6f64656c334441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22537065637472654372656174655363656e6541637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224d6f64656c334452656e64657241637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4964656e74697479222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22456e7375726550726f7669646572496e697465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574506572736f6e50726f66696c6553657475705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224964656e74697479536e617073686f745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657450726f7669646572466f7241757468536368656d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472794964656e74697479506172656e744d617463685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526f616d696e6750726f7879496e69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536861726564437265645265667265736846726f6d53746f72655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526561644f6e6546726f6d43726564656e7469616c4c6973745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22435265616453796e635461736b52756e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f6d61696e4a6f696e65644f72436c6f7564446f6d61696e4a6f696e656453657373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744164616c416363657373546f6b656e46726f6d4372656450726f76696465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574536572766963655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574436f6e666967546f6b656e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574426c6f636b696e67536572766963655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22506f70756c617465536572766963654d61705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657441757468656e74696361746564536572766963655469636b65745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526566726573684964656e7469746965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765745365727669636555726c466f7246656465726174696f6e50726f7669646572416e616c797369735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225365727669636555726c5374617475735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2241637175697265536572766963655469636b6574466f724144414c5c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2253697465735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e496e736967687473222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22496e73696768747350616e655c22203a207b205c224576656e74735c22203a207b205c2252657365617263686572436f6e74656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22415c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22445c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2248746d6c5072656665746368526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436163686546696c654e6f7456616c69645c22203a207b205c224576656e74466c61675c22203a20323536207d207d2c205c225375624e616d657370616365735c22203a207b205c224f66666963655c22203a207b205c224576656e74735c22203a207b205c2253797374656d616c69645c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c22496e7369676874735c22203a207b205c224576656e74735c22203a207b205c22496e73696768747350616e655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e73696768747350616e65305c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e73696768747350616e65725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253797374656d5c22203a207b205c224576656e74735c22203a207b205c224163746976697479715c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224163746976697479735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d2c205c22536d6172744c6f6f6b75705c22203a207b205c224576656e74735c22203a207b205c2252657365617263686572436f6e74656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22415c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f7079466561747572654761746573315c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f7079466561747572654761746573325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573315c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331305c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331315c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331335c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331355c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573335c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573345c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573355c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573365c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573375c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573385c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573395c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2248746d6c5072656665746368526571756573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225265667265736843616368656446696c65735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446f776e6c6f61645265736f757263655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2241757468656e7469636174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22526573756c7447726f7570546f52656e6465725c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253656e64576562536f636b6574526571756573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22576562536f636b657450696e67506f6e674c6174656e63795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446961676e6f737469635c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2238564d65686c6c5c22203a207b205c225375624e616d657370616365735c22203a207b205c22356b69614b3747426b7a505746675c22203a207b205c224576656e74735c22203a207b205c22373139305c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c22385c22203a207b205c225375624e616d657370616365735c22203a207b205c227a424b387872415553554e52497859484e4b55415c22203a207b205c224576656e74735c22203a207b205c22393133335c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c224f66666963655c22203a207b205c224576656e74735c22203a207b205c2253797374656d644d617463685c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c22496e7369676874735c22203a207b205c224576656e74735c22203a207b205c22536d6172744c6f6f6b75705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536d6172744c6f6f6b75705f5f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536d6172744c6f6f6b75705f5f5f5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253797374656d5c22203a207b205c224576656e74735c22203a207b205c2241637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253797374656d68633863674f6a46515c22203a207b205c224576656e74735c22203a207b205c22383635335c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d2c205c22556952756e74696d655c22203a207b205c224576656e74735c22203a207b205c22437265617465576562536f636b65745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2250726f636573735265717565737451756575655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22496e74656e745365727669636550726f78794f6e436f6e6e656374696f6e436c6f7365645c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f6e436f6e6e656374696f6e436c6f7365645c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4c6963656e73696e67222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224469616c6f67735c22203a207b205c225375624e616d657370616365735c22203a207b205c22576562566965774469616c6f675c22203a207b205c224576656e74735c22203a207b205c22476574457870657269656e63654964466f724552464d5c22203a207b205c224576656e74466c61675c22203a203439343038207d207d207d207d207d2c205c224c5655585c22203a207b205c224576656e74735c22203a207b205c224e6f456e7469746c656d656e74735c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c224e6f456e7469746c656d656e74734578706572696d656e74547269676765725c22203a207b205c224576656e74466c61675c22203a203439343038207d207d207d2c205c224f6666696365436c69656e744c6963656e73696e675c22203a207b205c224576656e74735c22203a207b205c224c6963656e7365436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6567616379416374697669747953756363657373436f756e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c656761637941637469766974794661696c757265436f756e745c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c22436c69656e745c22203a207b205c224576656e74735c22203a207b205c224653686f756c6441637469766174655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c224865617274626561745c22203a207b205c224576656e74735c22203a207b205c22577269746543616368655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265616443616368655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22517569636b56616c69646174696f6e5c22203a207b205c224576656e74735c22203a207b205c224c6f61644c6963656e73655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2246756c6c56616c69646174696f6e5c22203a207b205c224576656e74735c22203a207b205c224c6f61644c6963656e73655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2250726f706572746965735c22203a207b205c224576656e74735c22203a207b205c224765744c6963656e736543617465676f72795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546f6b656e697a654c6963656e736543617465676f726965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174654c6963656e736543617465676f726965735c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c224272616e64696e675c22203a207b205c224576656e74735c22203a207b205c2247657441707056616c75655c22203a207b205c2245	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData\1.18 = 66666963652e5543492e54656c6c4d652e5375627374726174654175746f446973636f766572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e537562737472617465496e737472756d656e746174696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e5375627374726174655365727669636543616c6c48657369746174696f6e44656c6179466f724e6f6e456d7074795175657279222c20225622203a2022696e7433325f747c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e53756273747261746553796e6368726f6e697a6174696f6e54797065222c20225622203a2022696e7433325f747c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e537562737472696e674d6174636851756572794c656e677468222c20225622203a2022696e7433325f747c313022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e57617465726d61726b506172616d65746572697a6174696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e5a65726f417373697374616e6365526573756c7473456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e5573655365617263684170695632222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4973506572736f6e6150726f66696c65504358456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4c6f6753686f77436f6e7465787475616c5549222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4d65436f6e74726f6c32222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4d65436f6e74726f6c324f72674964222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4e6f746966794f6e4163636573736962696c697479497373756573466f756e64222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4e6f746966794f6e4163636573736962696c697479497373756573466f756e64496e4578706f7274506c616365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4e6f746966794f6e4163636573736962696c697479497373756573466f756e64496e496e666f506c616365222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4e6f746966794f6e4163636573736962696c697479497373756573466f756e64496e536176654173506c616365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e52656d6f76654d53414148616e646c6572466f7254657874426f78222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5465616368696e6743616c6c6f757454696d654f6e53637265656e54656c656d65747279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5468656d696e672e5573654d656469756d4c756d696e616e63655468726573686f6c64222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5569614e6f74696669636174696f6e73466f72427573426172456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5569614e6f74696669636174696f6e73466f725465616368696e6743616c6c6f7574456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5573654e65775465616368696e6743616c6c6f7574436f6465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e566973696f2e484f50657266496d70726f76656d656e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e57686174734e65772e454353446174614c6f61646564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d3130304b42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d3130304d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d31304d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d314742416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d314d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d3530304b42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d3530304d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d35304d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d354d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d5265616c6c79426967416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e456e61626c655061747465726e73496e41746e74786e64222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e52616973655569614175746f436f72726563744576656e7457697468456e74697265576f7264222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d617022203a207b2022464347726f75704d61705f3122203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657231222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383434343234393330373838333230323b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657232222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383434343234393330373838323936373b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657233222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383434343234393330373838333231313b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657234222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383434343234393330373934313932373b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657235222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383732353732343238343635343239363b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b6564477261706869637341646170746572436f756e74222c20225622203a2022696e7433325f747c3522207d205d2c2022464347726f75704d61705f3222203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e476c6f62616c5265736f75726365496e666f4361636865456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e53686f756c644d69677261746546726f6d4f72617069222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f3322203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e41697254726166666963436f6e74726f6c2e416c6c6f77556e446f63756d656e7465644d65737361676573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e41697254726166666963436f6e74726f6c2e4173736574734c6f61646572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e41697254726166666963436f6e74726f6c2e476f7665726e616e6365456e67696e65456e61626c6564222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f3422203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e456e61626c65506572736f6e616c697a6174696f6e43616d706169676e7350726f7669646572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e4964656e746974794d616e61676572496e697454696d656f75744d696c6c697365636f6e6473222c20225622203a2022696e7433325f747c34303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572736f6e616c697a6174696f6e2e456e61626c6543616d706169676e52656672657368222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f3522203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e42697a426172222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e766173426f6f742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e766173446f63756d656e7452656164792d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e766173466c6f6f64676174652d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734c6963656e73696e674469616c6f6752656e65772d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734c6f63616c4f70656e446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734c6f63616c53617665446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f444253617665446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f6e6544726976654f70656e446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f6e65447269766553617665446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f757453706163654f70656e2d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f757453706163655361766541732d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d466c6f6f6447617465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d496e41707050757263686173652d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f75745370616365222c20225622203a2022626f6f6c7c3022207d205d207d207d	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\E57DC47\E57DC47 = 04000000d00c00003000000043003a005c00500072006f006700720061006d002000460069006c00650073005c00530065006300750072006500530070006f006e0073006f007200470065006e00650072006f00750073005c0078006c00730078002e0078006c0073007800000000002700000043003a005c00500072006f006700720061006d002000460069006c00650073005c00530065006300750072006500530070006f006e0073006f007200470065006e00650072006f00750073005c000100000001000000004eb9c1e109db0147dc570e47dc570e00000000e0020000640000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000db50898a6ce2a64ca84681cd4a6c9f50000000000200000000001066000000010000200000006a7d96738a66d350950c0ef4ba6d1d07b75f7cf0ae75ac0def605b707011dcf8000000000e8000000002000020000000da43dbb9fece27cbe5816e1e92e288b3a6fad59ecd5ecf1a0d7392a840bdc103f00300008a56df07d5af69ad581d8cd2ec33dc57b7dc47506e5f6e42a692f48ee84e29761353ef59393d40a886b5a47e3622c16dccd7ef89b1abe664f1c943639b96ed748bf14e3449e3652a65357cc0a927213ee9777346385c9af544649d4a03e5fa0c56c9d017c6cb83b6acd1cb62915c3bb04b56f412f34d18548236cdda36b3c4a90b37480d71725f2736dc1c18a939858fbf356d376cd13c1754ed4070f1504aaf86e84970eadfdba68ac45df8a586c45a1b8538195616e321bcb8ae3057b716f25fba1f27f74e44eea395cf3dc3ef7ad0f43070e532d8a77d7b89986721c6687c97b18303e95bbbf2baa39d367ab60f89ecaf1ee3823c8040438eb320dd1e858056ae4409c9b6fb6d2d8d0dcb31b4e9373028c5bab6b427dae73b38ccecc5f4d2b97d2fb2712869371459d59bffb24b6e6251e4227e4271e5a1d576fdf090e58588a744466e0c72feecf684222d1a90178e5e20b4d99deea67d34579ce0824927d5e967ba914b4a9bf52ed94e7e8ab4aacfa3f6ad423b5c659ec843a0e191519e49250eb31ceb03ac74aeb277b01ec93f4171d773444ae49ed62fbecb6b28b82989479be7499426b7daa5cf591a46602b6cca7324f9dda887d9f2e6f59c6d7d9a67f7b9ef229503a2e292cbc4715320d391caf9678d9e7353c99dcbf4136fc43632a0180e64e924f1f106911a50689ca30ba6f2fc361577551b708d77c345876a65716224f380725978abe2be6fd64f08ab2cdbbc86b3a1d60ac2d09cc8c70c70e1ab5be1df6c8ff9a39e95006954fa1458219fb082ab3cdc70f04dea3b7383a4dac5adf54c659e0bb422ab2190b0caf3d6c1549497c1e6c4d9984f52c3e3fdff537744c3358cbf397cc5b2513dff96c1dcc0c986ab68532b841f8b97af3774c49d1c7ddedd9a28b98ade0f54e7267850f513455076536227885b4d225df891a11b5919440532cc9bc90b8eb8ed6a873d5c47a95a2ac7e6329cd64ecc2e243c506ff04f0747d78cda1980d500d927c87016845f116dea3bdda6ae776fe3d3e45d8edf84f3548978bb2f588af38c71f61a96c400aa2bfe12b7b5dfc192afb4679974e42f5f033420827c67d9fcc4aa3b3850893ea1d6c8ff209bd0fb1088eaaa5d2968325e8754845db75674f16651322a2a87d80569d8c8b5c4e16d9256da8dd598f831321e98f43ec82e800b94b7bfe43de3f3903a1a799cc1d1ba1c3ad50f5fa3873b4257366052805a5d6aa0aef280693aa70939f39ffdd1c229d51aa8352601ae53394f808170619c251d5253b0c314c2a80062aa24a9273e8238bc7db9751286ef99f48c3a5c904fe6c01d34789299ea276970f81634caeed5dc23363e08670b167a3f653e61a3bb2de7a911d65f38fac7685aba4cbbe9b74084bfdd67ad1b4ad391f1daf28e6f013566703febc340000000dc0698d359f75addc0fa8e8ce50620842ff6048419e4b15641025b8c718af063a420eaaa43df3d8ab46d5a990f8cc06f86d2710ac0aece8ddc0f192913937a57	EXCEL.EXE

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\74F584E381D0AFF4DBFE10B32E52A17F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\ProductName = "SecureSponsorGenerous"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\PackageCode = "F55B3AEC34BB71F4F9AA425C412D3435"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\587C2C6BD312F174B88A161D7D7958A7\74F584E381D0AFF4DBFE10B32E52A17F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\SourceList\PackageName = "WPSOffice10469357401533.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\74F584E381D0AFF4DBFE10B32E52A17F\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\Version = "134414336"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\587C2C6BD312F174B88A161D7D7958A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74F584E381D0AFF4DBFE10B32E52A17F\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3280	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
628	msiexec.exe
628	msiexec.exe
3376	EiAuPIYhFE4.exe
3376	EiAuPIYhFE4.exe
4248	bgHAdnVGRnVK.exe
4248	bgHAdnVGRnVK.exe
2240	EiAuPIYhFE4.exe
2240	EiAuPIYhFE4.exe
2240	EiAuPIYhFE4.exe
2240	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe
1396	EiAuPIYhFE4.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1196	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1196	msiexec.exe
Token: SeSecurityPrivilege	628	msiexec.exe
Token: SeCreateTokenPrivilege	1196	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1196	msiexec.exe
Token: SeLockMemoryPrivilege	1196	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1196	msiexec.exe
Token: SeMachineAccountPrivilege	1196	msiexec.exe
Token: SeTcbPrivilege	1196	msiexec.exe
Token: SeSecurityPrivilege	1196	msiexec.exe
Token: SeTakeOwnershipPrivilege	1196	msiexec.exe
Token: SeLoadDriverPrivilege	1196	msiexec.exe
Token: SeSystemProfilePrivilege	1196	msiexec.exe
Token: SeSystemtimePrivilege	1196	msiexec.exe
Token: SeProfSingleProcessPrivilege	1196	msiexec.exe
Token: SeIncBasePriorityPrivilege	1196	msiexec.exe
Token: SeCreatePagefilePrivilege	1196	msiexec.exe
Token: SeCreatePermanentPrivilege	1196	msiexec.exe
Token: SeBackupPrivilege	1196	msiexec.exe
Token: SeRestorePrivilege	1196	msiexec.exe
Token: SeShutdownPrivilege	1196	msiexec.exe
Token: SeDebugPrivilege	1196	msiexec.exe
Token: SeAuditPrivilege	1196	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1196	msiexec.exe
Token: SeChangeNotifyPrivilege	1196	msiexec.exe
Token: SeRemoteShutdownPrivilege	1196	msiexec.exe
Token: SeUndockPrivilege	1196	msiexec.exe
Token: SeSyncAgentPrivilege	1196	msiexec.exe
Token: SeEnableDelegationPrivilege	1196	msiexec.exe
Token: SeManageVolumePrivilege	1196	msiexec.exe
Token: SeImpersonatePrivilege	1196	msiexec.exe
Token: SeCreateGlobalPrivilege	1196	msiexec.exe
Token: SeBackupPrivilege	3432	vssvc.exe
Token: SeRestorePrivilege	3432	vssvc.exe
Token: SeAuditPrivilege	3432	vssvc.exe
Token: SeBackupPrivilege	628	msiexec.exe
Token: SeRestorePrivilege	628	msiexec.exe
Token: SeRestorePrivilege	628	msiexec.exe
Token: SeTakeOwnershipPrivilege	628	msiexec.exe
Token: SeRestorePrivilege	628	msiexec.exe
Token: SeTakeOwnershipPrivilege	628	msiexec.exe
Token: SeBackupPrivilege	4360	srtasks.exe
Token: SeRestorePrivilege	4360	srtasks.exe
Token: SeSecurityPrivilege	4360	srtasks.exe
Token: SeTakeOwnershipPrivilege	4360	srtasks.exe
Token: SeBackupPrivilege	4360	srtasks.exe
Token: SeRestorePrivilege	4360	srtasks.exe
Token: SeSecurityPrivilege	4360	srtasks.exe
Token: SeTakeOwnershipPrivilege	4360	srtasks.exe
Token: SeRestorePrivilege	628	msiexec.exe
Token: SeTakeOwnershipPrivilege	628	msiexec.exe
Token: SeRestorePrivilege	628	msiexec.exe
Token: SeTakeOwnershipPrivilege	628	msiexec.exe
Token: SeRestorePrivilege	628	msiexec.exe
Token: SeTakeOwnershipPrivilege	628	msiexec.exe
Token: SeRestorePrivilege	628	msiexec.exe
Token: SeTakeOwnershipPrivilege	628	msiexec.exe
Token: SeRestorePrivilege	628	msiexec.exe
Token: SeTakeOwnershipPrivilege	628	msiexec.exe
Token: SeRestorePrivilege	628	msiexec.exe
Token: SeTakeOwnershipPrivilege	628	msiexec.exe
Token: SeRestorePrivilege	628	msiexec.exe
Token: SeTakeOwnershipPrivilege	628	msiexec.exe
Token: SeRestorePrivilege	628	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1196	msiexec.exe
1196	msiexec.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE
3280	EXCEL.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 4360	628	msiexec.exe	94
PID 628 wrote to memory of 4360	628	msiexec.exe	94
PID 628 wrote to memory of 2464	628	msiexec.exe	96
PID 628 wrote to memory of 2464	628	msiexec.exe	96
PID 628 wrote to memory of 2464	628	msiexec.exe	96
PID 2464 wrote to memory of 436	2464	MsiExec.exe	97
PID 2464 wrote to memory of 436	2464	MsiExec.exe	97
PID 2464 wrote to memory of 436	2464	MsiExec.exe	97
PID 2464 wrote to memory of 3376	2464	MsiExec.exe	99
PID 2464 wrote to memory of 3376	2464	MsiExec.exe	99
PID 2464 wrote to memory of 3376	2464	MsiExec.exe	99
PID 2464 wrote to memory of 3280	2464	MsiExec.exe	100
PID 2464 wrote to memory of 3280	2464	MsiExec.exe	100
PID 2464 wrote to memory of 3280	2464	MsiExec.exe	100
PID 4248 wrote to memory of 2240	4248	bgHAdnVGRnVK.exe	106
PID 4248 wrote to memory of 2240	4248	bgHAdnVGRnVK.exe	106
PID 4248 wrote to memory of 2240	4248	bgHAdnVGRnVK.exe	106
PID 2240 wrote to memory of 1396	2240	EiAuPIYhFE4.exe	107
PID 2240 wrote to memory of 1396	2240	EiAuPIYhFE4.exe	107
PID 2240 wrote to memory of 1396	2240	EiAuPIYhFE4.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\WPSOffice10469357401533.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1196

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4360
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8AEBD53AC61351990517FE6F6C308811 E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Program Files\SecureSponsorGenerous\hqUsxQVokjCH.exe
    "C:\Program Files\SecureSponsorGenerous\hqUsxQVokjCH.exe" x "C:\Program Files\SecureSponsorGenerous\OUvlZvvsRHvvVPzWjGvr" -o"C:\Program Files\SecureSponsorGenerous\" -pBtrCoSaelPTuXoCAcEwA -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:436
- - C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe
    "C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe" -number 242 -file file3 -mode mode3 -flag flag3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3376
- - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Program Files\SecureSponsorGenerous\xlsx.xlsx"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:3280

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe
"C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe" install
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:3644

C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe
"C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe" start
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:744

C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe
"C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe
  "C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe" -number 213 -file file3 -mode mode3 -flag flag3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe
    "C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe" -number 362 -file file3 -mode mode3 -flag flag3
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57cbad.rbs

Filesize
7KB

MD5
1ab7f8e01351c6b50bbf66681d44f9f5

SHA1
f1c16381739dd969791e0548f8d5d638fbe4e75a

SHA256
e5cb3bde8940ed5898f774ee433c0fdc78789c987920f1a54bcee60c3a89c2b5

SHA512
61d78e4303f22e84e441813f54e4d53c54164ee6a5a5e547e06dbe79d9733a193ae6d9f2052eb9752c56f887d36d3b15ea8ff7e8114d380f356e066698033556

Download Submit
C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe

Filesize
3.2MB

MD5
1c3d835b334c146196997f99df3c6f8e

SHA1
0027a83539881abaf1f5cb3a2cc0cd6ba528d000

SHA256
dcd7d379effc6f28e3fc43bdeebc3c39c933a93b09d9dc6691fb64392c432b3f

SHA512
f4da23997640cad08e9c3cc605472bb3b112e01406cc18789bd78d1f735790029cede3cd784d5d66882d571d6d515666a2017463ab5be454df50ddc4498d6042

Download Submit
C:\Program Files\SecureSponsorGenerous\OUvlZvvsRHvvVPzWjGvr

Filesize
2.0MB

MD5
d076e5e2afedcdbd328b5a3f0222b408

SHA1
8d8407cf4006934271fbd1f0c251fb5e91786997

SHA256
7a275f7f2ccf99a65eb4bd5f8cbd944041473b6c804487daf03b720700b760ea

SHA512
1f58ffe864710bc35f790510284b39337e8caaf0cf434517afcf0e894dd99c737aba22da27ddd6ee93ce7791407c7338ad2433b4310815f3f644fc72a212b2d9

Download Submit
C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.wrapper.log

Filesize
270B

MD5
39f2cc40b8e68b5d1d25987d1c05f6db

SHA1
8d983dd3537c75c12e2e85d2d0585496072e70ed

SHA256
d4b449f5357268d6d9a8918d0240afa929e9be8a4424f5122cdde56ac417ba7f

SHA512
85ce9e6cce752ddfe178507491cdaffdb8f1b5d23ba453eed952572ce7873ed135a836c99789c3a7dded814ab7255e5e8ae3cfb3c8a844c3304ada64989a8f06

Download Submit
C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.wrapper.log

Filesize
492B

MD5
6796474416818784f0d2e048816e0292

SHA1
e075c1356cae4bed66ed64a823c39c263e2af7fd

SHA256
f9ecd6e6fbd80e9735864b28e13a473887bed6c19e2aa56dbead4dad12c4998a

SHA512
f25d34dd57041511e0f7b257ea21cb4b0611e32226a17b51cf6d6d789c6e8cb25408c9824fb3cf77da21460b1b6f24e427b6a097b56dde7de4e89f422561facc

Download Submit
C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.wrapper.log

Filesize
596B

MD5
36e23d070aef92216eaa1b671e9ec437

SHA1
f530fdef18386456241617c65138fcfa04bba8d8

SHA256
7dfe14c47403d9dc76c8e77701323b40db58c1e11f8c9347ac841fed91302da1

SHA512
e44b2e1fcf7c198d5072f929da15c214741f52dc3e4ec4e67d8206f8d86ed4711662bce4056d75d51605ad4d4f93b7af4a2d6e9f56522b09deb80a3078585a73

Download Submit
C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.wrapper.log

Filesize
741B

MD5
deb7cc8c2c3d4d688aa8e493d63400cc

SHA1
3c229632b6e875aab4abb8df2a9fc04283ee02a8

SHA256
1b7295c0b508c0f291cc449e0dfba532774e78976af0341d5c726bfdd44a7c45

SHA512
6a216d17cb9170aa0158ec0132144858ef3f73835529733a684a8a0fb32e762ed6450b7608ef2b056693f99bd809952845e2383679ba0b8c14955750c994d25c

Download Submit
C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.xml

Filesize
442B

MD5
5813fb505a190a74c67a360751f71fd8

SHA1
94aff8481367ecd341f6f6aaa99deb5cb1c6a929

SHA256
b05428a2721bad3623587ea39a27f2eec42df1483645a67d4432ddd29feaa885

SHA512
169d429ef514e0b722220ff0af3f00eb2ab30b5e7a4439835f45d9fa2a3d1852e6a80e73ac346a10d244498f2c52e8f745ed6c8458ba3bc3574f7ed1d39e7674

Download Submit
C:\Program Files\SecureSponsorGenerous\hqUsxQVokjCH.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
C:\Program Files\SecureSponsorGenerous\xlsx.xlsx

Filesize
8KB

MD5
5001ead50aa6c32c9d7e6c6dfb4033f0

SHA1
c273c9bc2a996bb9ab65f7d30ccbf38bb755ed57

SHA256
a3d37b43693ef32bfcd324bb4f2523c828648e012828504302f3f182c97c4cda

SHA512
28d970204f02d6bc270fae20cf0ba78a8086e6dd2552f10f6c30d72c324fa2ca5ca44b2aca3830064caa57abd7255edb1147ea2bf0d103b22b75094f20f6d0bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\bgHAdnVGRnVK.exe.log

Filesize
1KB

MD5
122cf3c4f3452a55a92edee78316e071

SHA1
f2caa36d483076c92d17224cf92e260516b3cbbf

SHA256
42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

SHA512
c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
284B

MD5
997d05eab6ed89ba59b6a5abe99bd188

SHA1
318895d1ce4adf5fc088c561aa2591b9598800e6

SHA256
695ea7671599fbffced9774f8b463538a7e6366b5bbf78e8bebf8c0cd41f524b

SHA512
9104049f5227cdedb6367792ac6ba7e8d891343ed25667183283348f02576d04faca8450a2d7842450599879707df6f9fd9b4c637677b5fc39aa2446c227e7d3

Download Submit
C:\Windows\Installer\e57cbac.msi

Filesize
41.1MB

MD5
27ba48360e40e33e30f22f9258ca8aec

SHA1
f86f07a4fde054f77591c7c42a751f4fa566cdd5

SHA256
593c2deaacb09860822ec349224494c5aa35ebac3ff8836b43f63ad41d168d60

SHA512
0ba2009808c661cc9780bdf437f2ca47cfb99daa080f95428f3631752d2f49f6fce1ec747ef9228e49e3df00db61b67d4f52c4411d76cb6551fb6f50eaf90497

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
7f9f06dfaad9df43c665257e836e51bf

SHA1
df227c6e84d1ffcb98813afd16eb7c8bf6e4cf4e

SHA256
35445d068cfc489de31185bc487f2feacde0c40392b456c731922ed1de1bc1dc

SHA512
3ffb511fd425cfdc2fe6f1033602a25351bea71d661e93d27c2cd8e71c8f33384dc3c223dd5382330075ddee9fbdd4d2677afd064d6d7314889ec9b446fd4f74

Download Submit
\??\Volume{848480a2-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{37c7b5a4-33b7-4e80-9026-d4fad047aa50}_OnDiskSnapshotProp

Filesize
6KB

MD5
f89895f9c5d50c2e9f7461efc05cc2ba

SHA1
d2ba76f4b646fcf74c566344bdd922302b674240

SHA256
76faacd42aa72c894d1031bc4f97efc7d0822cdd45c8061ce1c08f3e45f680a9

SHA512
864ecf07aabe77de4b2fe95e5513bfde65ec95afe3915b40ae76bdcfa4600fe591340d84805f32ed673986f16493566abc35af70d2c6949d14e1223dbc3b5743

Download Submit
memory/1396-94-0x0000000029A10000-0x0000000029A53000-memory.dmp

Filesize
268KB

Download
memory/1396-95-0x000000002B620000-0x000000002B7DB000-memory.dmp

Filesize
1.7MB

Download
memory/1396-97-0x000000002B620000-0x000000002B7DB000-memory.dmp

Filesize
1.7MB

Download
memory/1396-98-0x000000002B620000-0x000000002B7DB000-memory.dmp

Filesize
1.7MB

Download
memory/3280-37-0x00007FFD54770000-0x00007FFD54780000-memory.dmp

Filesize
64KB

Download
memory/3280-46-0x00007FFD525B0000-0x00007FFD525C0000-memory.dmp

Filesize
64KB

Download
memory/3280-44-0x00007FFD525B0000-0x00007FFD525C0000-memory.dmp

Filesize
64KB

Download
memory/3280-32-0x00007FFD54770000-0x00007FFD54780000-memory.dmp

Filesize
64KB

Download
memory/3280-41-0x00007FFD54770000-0x00007FFD54780000-memory.dmp

Filesize
64KB

Download
memory/3280-33-0x00007FFD54770000-0x00007FFD54780000-memory.dmp

Filesize
64KB

Download
memory/3280-34-0x00007FFD54770000-0x00007FFD54780000-memory.dmp

Filesize
64KB

Download
memory/3644-52-0x00000000005B0000-0x0000000000686000-memory.dmp

Filesize
856KB

Download