gh0strat | 60ab90f343c109734ee5d53b62397d754152c30e7bc2f9ab3114f45d59e4a252

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WPS-Office_10469357_401532.msi
Size

34.7MB
MD5

0648eae1b36fb6c8e1b9b5a5b28abe96
SHA1

52a313b76e9ab28b360b406f2886c324cc931c43
SHA256

60ab90f343c109734ee5d53b62397d754152c30e7bc2f9ab3114f45d59e4a252
SHA512

63e30921921920cd4dba054e3d7c8ff1225f5ce2f2bc987f543bb3c5ea290b87acc0b13e86891c76f72a040a0c821c3da9264212294f66118cc49aa6776f8091
SSDEEP

786432:qddVYfcDIfXi1q8W3TRThlXgBopO+ZgiM2yoLPsa2:qddVYfUspDrO+ZDM2vLPsa2

Score

10^/10

gh0strat purplefox discovery persistence privilege_escalation rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 3 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/2504-85-0x000000002BD20000-0x000000002BEDB000-memory.dmp	purplefox_rootkit
behavioral2/memory/2504-87-0x000000002BD20000-0x000000002BEDB000-memory.dmp	purplefox_rootkit
behavioral2/memory/2504-98-0x000000002BD20000-0x000000002BEDB000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/2504-85-0x000000002BD20000-0x000000002BEDB000-memory.dmp	family_gh0strat
behavioral2/memory/2504-87-0x000000002BD20000-0x000000002BEDB000-memory.dmp	family_gh0strat
behavioral2/memory/2504-98-0x000000002BD20000-0x000000002BEDB000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	EiAuPIYhFE4.exe
File opened (read-only)	\??\W:	EiAuPIYhFE4.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	EiAuPIYhFE4.exe
File opened (read-only)	\??\U:	EiAuPIYhFE4.exe
File opened (read-only)	\??\X:	EiAuPIYhFE4.exe
File opened (read-only)	\??\Z:	EiAuPIYhFE4.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	EiAuPIYhFE4.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	EiAuPIYhFE4.exe
File opened (read-only)	\??\L:	EiAuPIYhFE4.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	EiAuPIYhFE4.exe
File opened (read-only)	\??\R:	EiAuPIYhFE4.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	EiAuPIYhFE4.exe
File opened (read-only)	\??\T:	EiAuPIYhFE4.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	EiAuPIYhFE4.exe
File opened (read-only)	\??\Y:	EiAuPIYhFE4.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	EiAuPIYhFE4.exe
File opened (read-only)	\??\K:	EiAuPIYhFE4.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	EiAuPIYhFE4.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	EiAuPIYhFE4.exe
File opened (read-only)	\??\P:	EiAuPIYhFE4.exe
File opened (read-only)	\??\V:	EiAuPIYhFE4.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	EXCEL.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	EXCEL.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	EXCEL.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	EXCEL.EXE

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\MaximizeBrokerVigorous\EiAuPIYhFE4.exe	OmndZSkNaeRN.exe
File opened for modification	C:\Program Files\MaximizeBrokerVigorous	EiAuPIYhFE4.exe
File created	C:\Program Files\MaximizeBrokerVigorous\wEbXlSkLLbZQWTFxLvFe	msiexec.exe
File created	C:\Program Files\MaximizeBrokerVigorous\xlsx.xlsx	msiexec.exe
File opened for modification	C:\Program Files\MaximizeBrokerVigorous\xlsx.xlsx	EXCEL.EXE
File created	C:\Program Files\MaximizeBrokerVigorous\OmndZSkNaeRN.exe	msiexec.exe
File opened for modification	C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.exe	OmndZSkNaeRN.exe
File opened for modification	C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.xml	OmndZSkNaeRN.exe
File created	C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.exe	OmndZSkNaeRN.exe
File created	C:\Program Files\MaximizeBrokerVigorous\asktao_mini_1.77_360rg.exe	msiexec.exe
File created	C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.xml	OmndZSkNaeRN.exe
File opened for modification	C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.wrapper.log	FfXilmfGmXJX.exe
File opened for modification	C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.wrapper.log	FfXilmfGmXJX.exe
File created	C:\Program Files\MaximizeBrokerVigorous\~$xlsx.xlsx	EXCEL.EXE
File opened for modification	C:\Program Files\MaximizeBrokerVigorous\~$xlsx.xlsx	EXCEL.EXE
File created	C:\Program Files\MaximizeBrokerVigorous\EiAuPIYhFE4.exe	OmndZSkNaeRN.exe
File opened for modification	C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.wrapper.log	FfXilmfGmXJX.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7C0754E9-B650-4E30-9A00-F8320C72891C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE77.tmp	msiexec.exe
File created	C:\Windows\Installer\e57ed31.msi	msiexec.exe
File created	C:\Windows\Installer\e57ed2f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ed2f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes dropped EXE 7 IoCs

pid	Process
3068	OmndZSkNaeRN.exe
2416	EiAuPIYhFE4.exe
1696	FfXilmfGmXJX.exe
2256	FfXilmfGmXJX.exe
3940	FfXilmfGmXJX.exe
1020	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2804	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EiAuPIYhFE4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OmndZSkNaeRN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EiAuPIYhFE4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EiAuPIYhFE4.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000080ecc9f1fa88237c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000080ecc9f10000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090080ecc9f1000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d80ecc9f1000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000080ecc9f100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	EiAuPIYhFE4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EiAuPIYhFE4.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\Registry\User\.Default\Software\Microsoft\MSDAIPP	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\PowerPoint\Security\Trusted Locations\Location2\Description = "10"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\CGTimes_Scale = "CG Times"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\Gothic = "Century Gothic"	EXCEL.EXE
Key created	\Registry\User\.Default\SOFTWARE\Microsoft\Office\Excel\Addins\MicrosoftDataStreamerforExcel	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\Common\UserInfo	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ReviewCycle\ReviewToken = "{EA463103-346E-4EB5-802D-25BDD48BE329}"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\ODBC\ODBC.INI\ODBC Data Sources\MS Access Database = "Microsoft Access Driver (.mdb, .accdb)"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xlsx\OpenWithList	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\User Settings\PowerPivotExcelAddin	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\User Settings\OneNoteToWordAddin	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\ODBC\ODBC.INI\dBASE Files\Engines\Xbase\Threads = "3"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.12527&crev=3	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor\ULSCategoriesSeverities = "827 15,2086 15,1000 15,2159 10,1001 15,1282 50,999 15,226 15,1338 10,1338 50,1282 10,831 15,1338 15,1282 15,829 15,1128 15,2087 15,850 15,1622 50,1039 15,998 15,828 15,2088 15,1255 15,830 15,974 15,1249 15,670 15,2159 6,671 15,1002 15,669 15,291 15,1249 10,70 50,1584 50"	EXCEL.EXE
Key created	\Registry\User\.Default\SOFTWARE\ODBC\ODBC.INI\dBASE Files\Engines\Xbase	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=excel.exe&Version=16.0.12527.20482&ClientId={426AAEAB-9667-401F-8C08-F5B952D4AA83}&OSEnvironment=10&MsoAppId=1&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20482&"	EXCEL.EXE
Key created	\Registry\User\.Default\SOFTWARE\Microsoft\Office\Excel	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\Common\Smart Tag	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\Times Roman = "Times New Roman"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.12527&crev=3\0\FilePath = "officeclient.microsoft.com\\5AA98EBB-2437-4B99-B56A-AA4ABE452C24"	EXCEL.EXE
Key created	\Registry\User\.Default\SOFTWARE\Microsoft\Office\Excel\Addins\PowerPivotExcelClientAddIn.NativeEntry.1	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\Tms Rmn = "Times Roman"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\General\FirstRun = "0"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\CrashPersistence\EXCEL\3968\0 = 0b0e101cf74823e703e3489204b0ee19f337f7230046c0ddd289a6abc5ed016a0410240044ef616482a001008500a907556e6b6e6f776ec9062e22616651466170316e33794450344d306355554242704f4c6c7277715a506866744d554d777a79497257746b3d22ca0d420100c50e8908c9100378363400	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Excel\Resiliency\StartupItems	EXCEL.EXE
Key created	\Registry\User\.Default\SOFTWARE\ODBC	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\PowerPoint\Security\Trusted Locations\Location3\Path = "C:\\Program Files\\Microsoft Office\\Root\\Document Themes 16\\"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Netscape\Netscape Navigator\Suffixes\application/msexcel = "XLS"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\Smart Tag\Actions\{06F9A697-9708-422D-A5AF-C559391A850A}\Internet Explorer_Server = "1"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Common\LCCache\Themes	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\OverridePointerMode = "1"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData\1.7 = 726f736f66742e4f66666963652e536861726564546578742e52696368456469742e416c6c6f774475706c696361746555696d557064617465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e52696368456469742e436f7079506173746548544d4c222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e5472616e7363726962652e436f6e666967436865636b44697361626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c6550657270657475616c323031394d6573736167696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c6550657270657475616c436f6e73756d657250726f323031394d6573736167696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e417269614d617854656172646f776e55706c6f616454696d65496e536563222c20225622203a2022696e7433325f747c3222207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e566f6c756d65547261636b696e674d61784576656e7473222c20225622203a2022696e7433325f747c3530303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4169725370616365222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224261636b656e645c22203a207b205c224576656e74735c22203a207b205c224c61796572486f7374496e697469616c697a6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d706f7369746f7253657373696f6e547970655c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2257696e33325c22203a207b205c225375624e616d657370616365735c22203a207b205c224c65676163795c22203a207b205c224576656e74735c22203a207b205c22416e696d6174696f6e50657263656e74556e64657233304650535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416e696d6174696f6e4176674650535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726f737357696e54496d654f6646697273744672616d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224176657261676550726573656e74735065725365636f6e645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4175674c6f6f70222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436c69656e745c22203a207b205c224576656e74735c22203a207b205c22576f726b666c6f7747726170685c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4368617274696e67222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22436861727445326f4c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436861727445326f536176655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224368617274696e67456e644c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e436c69636b546f52756e222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c225363656e6172696f5c22203a207b205c224576656e74735c22203a207b205c225570646174655461736b557064617465646574656374696f6e325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b557064617465646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b557064617465636c69656e74646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265706169725461736b46756c6c7265706169725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265706169725461736b52656d6f7665696e7374616c6c6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b436f6e6669677572656c696768745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c69656e747570646174655461736b436c69656e74646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b53747265616d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b437265617465776f726b696e67636f6e66696775726174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b55706461746566696e616c697a655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225461736b4c61737452756e4865617274626561745c22203a207b205c224576656e74735c22203a207b205c225461736b4c61737452756e4865617274626561745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22556e6976657273616c426f6f7473747261707065725c22203a207b205c224576656e74735c22203a207b205c224170706c69636174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6c6c656374506172616d65746572735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6c6c656374456d6265646465645369676e61747572655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616c63756c617465506172616d65746572735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436c69656e744361624d616e616765725c22203a207b205c224576656e74735c22203a207b205c225461736b557064617465436c69656e74446f776e6c6f6164446f457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225461736b436c69656e74446f776e6c6f6164446f457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253747265616d4361625c22203a207b205c224576656e74735c22203a207b205c22446f776e6c6f616453747265616d4361625c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225472616e73706f72745c22203a207b205c225375624e616d657370616365735c22203a207b205c224578706572696d656e74616c5472616e73706f72745c22203a207b205c224576656e74735c22203a207b205c22436162735c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c224576656e74466c61675c22203a20323536207d207d207d2c205c225472616e73616374696f6e616c46696c654f7065726174696f6e735c22203a207b205c224576656e74735c22203a207b205c224170706c794368616e6765735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457865637574655472616e73616374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d2c205c224576656e74735c22203a207b205c225472616e73706f72745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e446961676e6f7374696373222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436f6c6c6563746f725c22203a207b205c224576656e74735c22203a207b205c2253746172745472616365436f6c6c6563746f725c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e446f6373222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22446f63756d656e74416374697669746965735c22203a207b205c224576656e74735c22203a207b205c2241637469766974794c6f67456e7472794372656174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e74727953657453746174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22536572766963654163746976697479526573756c745c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f674f6e436f6e74656e74416374696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e717565756541637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f674469736361726441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225472616e736d69745175657565496e7365727441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225472616e736d697451756575654469736361726441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e71756575654f7574676f696e675c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f6744697363617264466f72446f63756d656e744368616e67655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67547269676765724173796e635461736b576f726b65725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575654c6f61644173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565496e697446696c65506174685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565437265617465496e73616e63655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565417070656e644173796e6342617463685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565577269746541637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756552656d6f76654173796e6342617463685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575655772697465446f63756d656e74496e666f4865616465725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756554727944656c657465456d70747946696c654173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565496e7365727441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e717565756541637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6741646441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674372656174654c6f675c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67536176654e657746696c655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674469736361726441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e71756575654c6f63616c4e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e71756575654f7574676f696e674e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575654469736361726441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224170694f70656e41637469766974794c6f675769746853747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6741646441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674361636865446f63756d656e74496e666f5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e74727946696e616c697a655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6746696c7465724f757443757272656e7455736572416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674c6f616446726f6d53747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6753617665546f53747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565436865636b5265766f6b65644544505c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565526570616972436f7272757074656446696c654173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674d6f64696679436c6f6e655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c654f70656e4572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c65526561644572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c655265706c6163654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c6557726974654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565536574456e74657270726973654461746150726f74656374696f6e4173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575655472756e6361746551756575655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67436c6f73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d6974517565756548656c706572456e737572654469726563746f72795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d697451756575654d616e61676572437265617465496e73616e63655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2241706943726561746541637469766974794c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224170694372656174654c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d69745175657565536574456e74657270726973654461746150726f74656374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2241637469766974794c6f674173796e635461736b5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22536861726564436f6d6d656e74735c22203a207b205c224576656e74735c22203a207b205c22436f6d6d6974436f6d6d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469736361726444726166744173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469736361726444726166744e61746976655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22447261667453746174654d616e61676572456e644472616674696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456e644472616674696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22506f737444726166745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244656c657465506f7374416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244656c657465546872656164416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2245324550657266547261636b65725c22203a207b205c224576656e74466c61675c22203a2032207d2c20	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Excel\ExcelName = "Excel"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\User Settings\OneNoteToWordAddin\Count = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\Courier 5cpi = "Roman 5cpi"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\Helvetica = "Arial"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Excel\ExcelWorkbookOpenedCount = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\oregres.dll,-206 = "Excel"	MsiExec.exe
Key created	\Registry\User\.Default\Software\Microsoft\MSDAIPP\Providers\{9FECD570-B9D4-11D1-9C78-0000F875AC61}	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word\AutoJournaled = "1"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData\1.18 = 6963652e5543492e54656c6c4d652e5375627374726174654175746f446973636f766572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e537562737472617465496e737472756d656e746174696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e5375627374726174655365727669636543616c6c48657369746174696f6e44656c6179466f724e6f6e456d7074795175657279222c20225622203a2022696e7433325f747c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e53756273747261746553796e6368726f6e697a6174696f6e54797065222c20225622203a2022696e7433325f747c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e537562737472696e674d6174636851756572794c656e677468222c20225622203a2022696e7433325f747c313022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e57617465726d61726b506172616d65746572697a6174696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e5a65726f417373697374616e6365526573756c7473456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e5573655365617263684170695632222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4973506572736f6e6150726f66696c65504358456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4c6f6753686f77436f6e7465787475616c5549222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4d65436f6e74726f6c32222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4d65436f6e74726f6c324f72674964222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4e6f746966794f6e4163636573736962696c697479497373756573466f756e64222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4e6f746966794f6e4163636573736962696c697479497373756573466f756e64496e4578706f7274506c616365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4e6f746966794f6e4163636573736962696c697479497373756573466f756e64496e496e666f506c616365222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4e6f746966794f6e4163636573736962696c697479497373756573466f756e64496e536176654173506c616365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e52656d6f76654d53414148616e646c6572466f7254657874426f78222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5465616368696e6743616c6c6f757454696d654f6e53637265656e54656c656d65747279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5468656d696e672e5573654d656469756d4c756d696e616e63655468726573686f6c64222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5569614e6f74696669636174696f6e73466f72427573426172456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5569614e6f74696669636174696f6e73466f725465616368696e6743616c6c6f7574456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5573654e65775465616368696e6743616c6c6f7574436f6465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e566973696f2e484f50657266496d70726f76656d656e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e57686174734e65772e454353446174614c6f61646564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d3130304b42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d3130304d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d31304d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d314742416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d314d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d3530304b42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d3530304d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d35304d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d354d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d5265616c6c79426967416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e456e61626c655061747465726e73496e41746e74786e64222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e52616973655569614175746f436f72726563744576656e7457697468456e74697265576f7264222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d617022203a207b2022464347726f75704d61705f3122203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657231222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383434343234393330373838333230323b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657232222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383434343234393330373838323936373b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657233222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383434343234393330373838333231313b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657234222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383434343234393330373934313932373b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657235222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383732353732343238343635343239363b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b6564477261706869637341646170746572436f756e74222c20225622203a2022696e7433325f747c3522207d205d2c2022464347726f75704d61705f3222203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e476c6f62616c5265736f75726365496e666f4361636865456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e53686f756c644d69677261746546726f6d4f72617069222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f3322203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e41697254726166666963436f6e74726f6c2e416c6c6f77556e446f63756d656e7465644d65737361676573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e41697254726166666963436f6e74726f6c2e4173736574734c6f61646572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e41697254726166666963436f6e74726f6c2e476f7665726e616e6365456e67696e65456e61626c6564222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f3422203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e456e61626c65506572736f6e616c697a6174696f6e43616d706169676e7350726f7669646572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e4964656e746974794d616e61676572496e697454696d656f75744d696c6c697365636f6e6473222c20225622203a2022696e7433325f747c34303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572736f6e616c697a6174696f6e2e456e61626c6543616d706169676e52656672657368222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f3522203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e42697a426172222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e766173426f6f742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e766173446f63756d656e7452656164792d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e766173466c6f6f64676174652d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734c6963656e73696e674469616c6f6752656e65772d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734c6f63616c4f70656e446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734c6f63616c53617665446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f444253617665446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f6e6544726976654f70656e446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f6e65447269766553617665446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f757453706163654f70656e2d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f757453706163655361766541732d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d466c6f6f6447617465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d496e41707050757263686173652d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f75745370616365222c20225622203a2022626f6f6c7c3022207d205d207d207d	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\00180011D2FE5E42 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000370c7571dcf2d14a8064ce50d3dc411600000000020000000000106600000001000020000000d20f631b813897761eebba0919bd7099522e79633072182a53dd93880abbea83000000000e800000000200002000000035d645ced03086bfcf7541be8ad7ecfce825bec85d46b216aac29d736299e1ad80000000deaa25db8b2ef15a64063d8520b55e45762e5c117b1f2eb4a36ad44c657b238c43a8b320d529decab5e76dab7e8b37b3f5be47f56c210ed3e76754e485c9210344e1970ac9e7f821cfab2c9ef16c9c7d9294942959c1832daa1ae075e2a75979856f5fdf315d902601adc01d76000d4a97b08be9177fa0aa5db01e72968c1bcd40000000f4497c0db349ff1f1c93aebeb8aab6c9f8e531554f0fdf8a21460cd3667cf3b0a453ab1b499bdbeaa665b0da5ae47e18b234b6087ac3c1c0a6da5d068c78e5ec	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile\MsaDevice = "t=GwAWAbuEBAAUbVtUa9wjWgmEIwjX9d7dccnghw8OZgAAEBgRSibi9RldxyqIL4Xx3qbgANo5WtHla51RHb0uFLC6ZqU5mKB9Z9X4YCy1Yy/vEHvWyaEG3+ovcQPEsx39E3gXWwSQ/KWmjJtzMK7DatDa+qkEntz8tezpPyu/AY6AHhxs3YGlmWl98A/XAf9+DloeM468R9iny3GnCeBFJdQ1CoGPBH8JsQQoK/43WZTg2d5ktRLogbI10PA9UnJ5ecTAt3HhhvZn2GYyAc2/jUibmDp7xWATuwA7GvcrhuEKmDaM5X8bZIca0+8rAg8xQ3VKI1nk/Jct/bOJt7RzUzVVBSqcWRtHVHkuMLIA4Q2om6brHgE=&p="	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MSDAIPP\Providers\{9FECD571-B9D4-11D1-9C78-0000F875AC61}\Priority = "16777216"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Excel\Security\Trusted Locations\Location0\Description = "3"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData\1.16 = 7573746564456e636f756e7465725c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22416363657373456e636f756e7465725c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22426c6f636b6564657874656e73696f6e735c22203a207b205c224576656e74735c22203a207b205c2246696c65457874656e73696f6e4c69737446726f6d536572766963655c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22536563757265526561646572486f73745c22203a207b205c224576656e74735c22203a207b205c224f70656e496e4f53525c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d2c205c224576656e74735c22203a207b205c22436c70547279557067726164654c6162656c4661696c7572655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e54617267657465644d6573736167696e67222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c224275736261725468656d6553656c656374696f6e5374617475735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e54656c656d65747279222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22436c69656e7453616d706c696e674f76657272696464656e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2253797374656d4865616c74684d657461646174614e6574776f726b436f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224576656e7451756172616e74696e65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f6164586d6c52756c65735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2250726f6365737349646c6551756575654a6f625c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22466c7573684576656e744275666665725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2254656c656d6574727953656e74696e656c56616c75655c22203a207b205c224576656e74466c61675c22203a2030207d207d2c205c224c6f636b65645c22203a2066616c7365207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e54656c6c4d65222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c2254656c6c4d655741435c22203a207b205c224576656e74735c22203a207b205c225175657279526573706f6e73655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e54657874222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c225265736f75726365436c69656e745c22203a207b205c224576656e74735c22203a207b205c22446573657269616c697a655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656164466f6e74456c656d656e74735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2250757267654d756c7469706c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526561645265736f757263654d657461446174615c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2257726974655265736f757263654d657461446174615c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22474449417373697374616e745c22203a207b205c224576656e74735c22203a207b205c225265676973746572436c6f7564466f6e7443616c6c6261636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2248616e646c6543616c6c6261636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22466f6e744d616e6167657244657374727563746f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464436c6f7564466f6e745265736f757263655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22466f6e74537562737469747574696f6e5c22203a207b205c224576656e74735c22203a207b205c22436f6c6c656374466f6e74537562737469747574696f6e55736167655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e5472616e736c61746f72222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22416c7465726e6174655472616e736c6174696f6e735265747269657665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6e7465787475616c53756767657374696f6e734c6f616465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745465787453656c65637465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745472616e736c617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745472616e736c61746564466565646261636b547269676765725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745472616e736c6174696f6e43616e63656c6c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745472616e736c6174696f6e53756767657374696f6e436c69636b65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224578636c756465644c616e677561676541646465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224578636c756465644c616e677561676552656d6f7665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d6963726f666565646261636b566f746553656c65637465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6f786d6c5472616e736c617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253657474696e6773436c6f7365645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253657474696e67734f70656e65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536f75726365446f63756d656e744c616e674368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536f75726365546172676574537761707065645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536f75726365546578744c616e674368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546172676574446f63756d656e744c616e674368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546172676574546578744c616e674368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546578745472616e736c617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736c6174696f6e496e7365727465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736c6174696f6e4c616e6775616765734c6f616465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736c6174696f6e5461624368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416c7465726e6174655472616e736c6174696f6e4578616d706c655265747269657665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416c7465726e6174655472616e736c6174696f6e436f706965645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464496e4c6f616465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e5558222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22436f6c6f725069636b65725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d696e67536f6f6e54435348574e445c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d696e67536f6f6e48724d616b65526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e6f46696c65457874656e73696f6e49636f6e4d617070696e675c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c225344585c22203a207b205c225375624e616d657370616365735c22203a207b205c224d65436f6e74726f6c5c22203a207b205c224576656e74735c22203a207b205c22547261636b65645363656e6172696f5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c225465616368696e6743616c6c6f75745c22203a207b205c224576656e74735c22203a207b205c225465616368696e6743616c6c6f7574416c726561647953686f776e4d617854696d65735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465616368696e6743616c6c6f7574416c726561647953686f776e5468697353657373696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465616368696e6743616c6c6f7574546f6f4d616e7953686f776e5468697353657373696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2244796e616d69634470695c22203a207b205c224576656e74735c22203a207b205c22446973706c6179546f706f6c6f6779456e756d65726174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446973706c6179546f706f6c6f67794368616e6765645c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22446f63756d656e745265636f766572795c22203a207b205c224576656e74735c22203a207b205c22496e76616c696461746550616e65735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224465736b746f705c22203a207b205c224576656e74735c22203a207b205c22536d617274436f6e746578744d656e754974656d5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22466c6578436c6970626f6172645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546f6f6c746970735c22203a207b205c224576656e74735c22203a207b205c2253686f77546f6f6c7469705c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22416e63686f7252656769737472795c22203a207b205c224576656e74735c22203a207b205c224765744f72437265617465416e63686f7252656769737472795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22526962626f6e546162735c22203a207b205c224576656e74735c22203a207b205c22526962626f6e5461624163746976617465645f466c6f6f64676174655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e576f7264222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224c696e6b6564496e5c22203a207b205c224576656e74735c22203a207b205c224372656174654c696e6b6564496e526573756d65417373697374616e745461736b50616e655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c2246696c65536176655c22203a207b205c224576656e74735c22203a207b205c225361766541735361766546696c655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22416374436d64476f7375625361766541735c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f435349464f4353536176655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22436d645361766546696c65436f7265325c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2246696c654f70656e5c22203a207b205c224576656e74735c22203a207b205c22446f634e6f7469667943616c6c6261636b5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22446f4e6f746966794d657267654469616c6f675c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22464e4d45696453657446726f6d5873747a46747970466e6d4469725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e697469616c697a6542696e6172794261636b696e6753746f72654361636865735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436f417574686f72696e675c22203a207b205c224576656e74735c22203a207b205c2253686f77526573747269637465644d6163726f45646974696e674275734261725c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2246586c7255736572507265666572656e63655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f63735472616e736974696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22436f617574684d657267655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225365745464725265616479466f725472616e736974696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22536164426172546167735c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f6373446f776e6c6f6164526566557064617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244796e616d696353617665496e697469616c496e666f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22507573684f70526571756573745374617475735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22507573684f70436f6d706c657465645374617475735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22466f726d735c22203a207b205c224576656e74735c22203a207b205c224c6561726e696e67546f6f6c73576b4f6e446f63756d656e744f70656e5c22203a207b205c224576656e74466c61675c22203a203439343038207d207d207d2c205c22446961676e6f737469635c22203a207b205c224576656e74735c22203a207b205c22566563416c6c6f634661696c7572655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22496e636f73697374656e74526561644f6e6c79446f6350726f70657274795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224f4353425c22203a207b205c224576656e74735c22203a207b205c2256636c6f6b4f6e446f63446973706c61795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2256636c6f6b4f6e53617665436f6d706c6574655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2256636c6f6b4f6e55706c6f6164436f6d706c6574655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c22536176655c22203a207b205c224576656e74735c22203a207b205c22436f61757468436f6e74656e744c6174656e6379496e536176655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22436d64446f53617665446f63436f7265436f6d6d616e64416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436d64446f53617665446f63436f7265416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22464d617953746172745472616e73616374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224669726553746174654f664175746f536176654f6e436c6f73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456964456e737572654f70656e466f72536176655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2242475361766546616c6c6261636b546f46475c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224544505c22203a207b205c224576656e74735c22203a207b205c22446f63756d656e744964656e746974794368616e67655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2250726f6f66696e675c22203a207b205c224576656e74735c22203a207b205c2250726f6f66696e674e6f50726f6f66526567696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225453706c4c6f61644c6962726172795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c6f75645370656c6c6572436865636b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e6f50726f6f6652756e4469666665727346726f6d5061726150726f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c617373696669636174696f6e4372697469717565526573706f6e7365506572664d61704578636565645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22477261	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData\ChunkCount = "uint64_t\|17"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Excel\Place MRU\Item 1 = "[F00000000][T01DB155A671E4AC0][O00000000]*C:\\Program Files\\MaximizeBrokerVigorous\\"	EXCEL.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\ODBC\ODBC.INI\MS Access Database\Engines\Jet\ImplicitCommitSync	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft PowerPoint\Small Icon = "[15]"	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\User Settings\Word_Core	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData\ChunkCount = "uint64_t\|9"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData\1.15 = 6e74466c61675c22203a2032207d2c205c2247657450726f6475637456616c75655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253686f756c645573654d6963726f736f66743336354272616e64696e675c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2254656e616e745c22203a207b205c224576656e74735c22203a207b205c22496e697454656e616e7449645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224e756c5c22203a207b205c225375624e616d657370616365735c22203a207b205c22466574636865725c22203a207b205c224576656e74735c22203a207b205c224765744e756c4f626a656374466f724964656e746974795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2246657463684d6f64656c46726f6d4f6c735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224765744c6963656e73654665617475726573466f724964656e746974795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2243726561746552657175657374426f64795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d6f64656c5c22203a207b205c224576656e74735c22203a207b205c224765744c6963656e736543617465676f72795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22476574416c6c4c6963656e736543617465676f726965735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446573657269616c697a655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225061727365526177526573706f6e73655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2243616e52756e46656174757265526573756c74735c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c224d6f64655c22203a207b205c224576656e74735c22203a207b205c224765744d6f64655c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c224170695c22203a207b205c224576656e74735c22203a207b205c22437265617465526571756573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253656e64526571756573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2252656365697665526573706f6e73655c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2253746f726167655c22203a207b205c224576656e74735c22203a207b205c2247657453746f72616765506174685c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c6f61644d6f64656c735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22476574556e766572696669656453746f72616765506174685c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c6f61644d6f64656c5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2252656e616d6546696c65546f55736555706461746564486173685c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2256616c69646174696f6e5c22203a207b205c224576656e74735c22203a207b205c22517569636b56616c69646174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2256616c696461746f725c22203a207b205c224576656e74735c22203a207b205c224d61746368696e67486172776172656449645c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d2c205c22466c6f77735c22203a207b205c224576656e74735c22203a207b205c22536561726368466f72534341546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d2c205c224576656e74735c22203a207b205c224c6963656e73696e67427573626172416374696f6e5c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c22487244697370617463685375625461736b53746172745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22517569636b56616c69646174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253617665416c6c536b75696473546f52656769737472795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2257616974546f52657472794865617274626561745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536561726368466f7253657373696f6e546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224e554c56616c69646174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2256616c696461746553657373696f6e546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2243616e52756e4665617475726543616368655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22506572666f726d4c6963656e73696e674e6f74696669636174696f6e735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c6963656e73696e6744796e616d696343616e7661735369676e496e5c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c22456e666f7263655369676e496e466c6f774669727374506167655c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c22456e666f7263655369676e496e466c6f775365636f6e64506167655c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c22456e666f7263655369676e496e5175616c69666965645c22203a207b205c224576656e74466c61675c22203a203439343038207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4d6f786965222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74466c61675c22203a203438383936207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4e61747572616c4c616e6775616765222c20225622203a20227374643a3a77737472696e677c7b205c224c6f636b65645c22203a2066616c73652c205c225375624e616d657370616365735c22203a207b205c2250726f6f66696e675c22203a207b205c224c6f636b65645c22203a2066616c73652c205c225375624e616d657370616365735c22203a207b205c225265736f75726365456e756d657261746f725c22203a207b205c224c6f636b65645c22203a2066616c73652c205c224576656e74735c22203a207b205c2250726f63657373436174616c6f67526573706f6e73655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2250726f636573735265736f75726365526573706f6e73655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4f6666696365222c20225622203a20227374643a3a77737472696e677c7b205c224c6f636b65645c22203a2066616c73652c205c225375624e616d657370616365735c22203a207b205c224e61747572616c4c616e67756167655c22203a207b205c224c6f636b65645c22203a2066616c73652c205c225375624e616d657370616365735c22203a207b205c224372697469717565735c22203a207b205c224c6f636b65645c22203a2066616c73652c205c224576656e74735c22203a207b205c2250726f636573734175676c6f6f704372697469717565735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250726f636573734175676c6f6f7041646443726974697175655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4f75746c6f6f6b222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224465736b746f705c22203a207b205c225375624e616d657370616365735c22203a207b205c2250726f7669646572735c22203a207b205c224576656e74735c22203a207b205c224c6f616450726f76696465724c6962726172795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253796e635c22203a207b205c224576656e74735c22203a207b205c2253796e6350757267654f66666c696e654974656d735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2256696577735c22203a207b205c224576656e74735c22203a207b205c224872566965774c6f6164436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22566965774d6f64655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e506572666f726d616e6365222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22506572665363656e6172696f5c22203a207b205c224576656e74735c22203a207b205c2253636f70655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e506572736f6e616c697a6174696f6e222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c2246696c65496e736967687443616368654d616e616765725c22203a207b205c224576656e74735c22203a207b205c2250757267654578706972656443616368655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225369676e616c50726f636573736f725c22203a207b205c224576656e74735c22203a207b205c2253656e645369676e616c5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e50726f6772616d6d6162696c697479222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c2254656c656d657472795c22203a207b205c224576656e74735c22203a207b205c22446e61416464496e4c6f6164586c6c46696c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446e61416464496e4c6f616445787465726e616c446c6c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446e61416464496e4c6f6164446e6146696c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464696e43726173685c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22416464696e735c22203a207b205c224576656e74735c22203a207b205c22417070416464496e4c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22417070416464496e55736167655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464696e446f634c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7465726e616c536574436f6e6e6563745c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e50726f6772616d6d61626c655375726661636573222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c2242616e6e65725c22203a207b205c224576656e74735c22203a207b205c22506172736543726561746976655c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c22496d7072657373696f6e5c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c224578656375746542616e6e6572416374696f6e5c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c224578656375746542616e6e65724469736d6973735c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c2248616e646c65457870616e64436f6c6c617073655c22203a207b205c224576656e74466c61675c22203a203439343038207d2c205c2248616e646c655461624368616e67655c22203a207b205c224576656e74466c61675c22203a203439343038207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e5365637572697479222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22506f6c696379546970735c22203a207b205c224576656e74735c22203a207b205c224d616e61676572436f6e74696e7565436c617373696669636174696f6e436c6173736966794368616e67655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c617373696669636174696f6e436c6173736966794368616e67655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436c705c22203a207b205c224576656e74735c22203a207b205c224c6162656c55736167655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f7574636f6d6555736167655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f66666963654a534765744c6162656c44657461696c735c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22436c70506f6c696379466574636843616c6c4261636b537563636573735c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224d616e6461746f72794c6162656c6c696e674469616c6f675c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f626a6563744d6f64656c4765744c6162656c5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f626a6563744d6f64656c5365744c6162656c5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f626a6563744d6f64656c506f6c696379436f6d706c657465496e697469616c697a655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2253656c6563744a757374696669636174696f6e4f7074696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2253656e7369746976697479466c796f7574416e63686f72547261636b416e645265766f6b65427574746f6e436c69636b5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225265676973746572446f63756d656e745c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2246657463684c6162656c7346726f6d5365727665725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657444656661756c744c6162656c49445c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744c6162656c735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744f7574636f6d6573466f724c6162656c4368616e67655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250726f6365737341756469744f6e506f6c6963794d617463685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250726f6365737341756469744f6e5265706c79466f72776172645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250726f6365737341756469744f70656e48656c7065725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744175646974496e666f506f6c6963794d617463685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744175646974496e666f4c6162656c416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744175646974496e666f46696c65416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6162656c696e67457870657269656e63655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224164644c6162656c4f627365727665725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656d6f76654c6162656c4f627365727665725c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c22436c705c22203a207b205c224576656e74735c22203a207b205c22446b6550726f746563746564436f6e74656e745c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d2c205c224d6163726f5c22203a207b205c224576656e74735c22203a207b205c22426c6f636b4d6163726f46726f6d496e7465726e6574506f6c69637953657474696e675c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22456e636f756e74657265645c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22456e61626c65645c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2246696c65426c6f636b5c22203a207b205c224576656e74735c22203a207b205c2246696c65426c6f636b496e666f726d6174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c224f43585c22203a207b205c224576656e74735c22203a207b205c2254727573746564456e636f756e7465725c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224e6f6e5472	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1253\{00000000-0000-0000-0000-000000000000}	EXCEL.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\Roman 5cpi = "Courier 5cpi"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1253\{00000000-0000-0000-0000-000000000000}\PendingChanges\Data = 02000000	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\ODBC\ODBC.INI\Excel Files\Driver = "C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\ACEODBC.DLL"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\ZapfDingbats = "Zapf Dingbats"	EXCEL.EXE

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1B8F89C05335B614D81A0DECCD6B4C80	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E4570C7056B03E4A9008F23C02798C1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\ProductName = "MaximizeBrokerVigorous"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1B8F89C05335B614D81A0DECCD6B4C80\9E4570C7056B03E4A9008F23C02798C1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E4570C7056B03E4A9008F23C02798C1\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\SourceList\PackageName = "WPS-Office_10469357_401532.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\Version = "117702664"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E4570C7056B03E4A9008F23C02798C1\PackageCode = "7D1EEA3D825181C44AF2AFB73056614B"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3968	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
64	msiexec.exe
64	msiexec.exe
2416	EiAuPIYhFE4.exe
2416	EiAuPIYhFE4.exe
3940	FfXilmfGmXJX.exe
3940	FfXilmfGmXJX.exe
1020	EiAuPIYhFE4.exe
1020	EiAuPIYhFE4.exe
1020	EiAuPIYhFE4.exe
1020	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe
2504	EiAuPIYhFE4.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2804	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2804	msiexec.exe
Token: SeSecurityPrivilege	64	msiexec.exe
Token: SeCreateTokenPrivilege	2804	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2804	msiexec.exe
Token: SeLockMemoryPrivilege	2804	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2804	msiexec.exe
Token: SeMachineAccountPrivilege	2804	msiexec.exe
Token: SeTcbPrivilege	2804	msiexec.exe
Token: SeSecurityPrivilege	2804	msiexec.exe
Token: SeTakeOwnershipPrivilege	2804	msiexec.exe
Token: SeLoadDriverPrivilege	2804	msiexec.exe
Token: SeSystemProfilePrivilege	2804	msiexec.exe
Token: SeSystemtimePrivilege	2804	msiexec.exe
Token: SeProfSingleProcessPrivilege	2804	msiexec.exe
Token: SeIncBasePriorityPrivilege	2804	msiexec.exe
Token: SeCreatePagefilePrivilege	2804	msiexec.exe
Token: SeCreatePermanentPrivilege	2804	msiexec.exe
Token: SeBackupPrivilege	2804	msiexec.exe
Token: SeRestorePrivilege	2804	msiexec.exe
Token: SeShutdownPrivilege	2804	msiexec.exe
Token: SeDebugPrivilege	2804	msiexec.exe
Token: SeAuditPrivilege	2804	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2804	msiexec.exe
Token: SeChangeNotifyPrivilege	2804	msiexec.exe
Token: SeRemoteShutdownPrivilege	2804	msiexec.exe
Token: SeUndockPrivilege	2804	msiexec.exe
Token: SeSyncAgentPrivilege	2804	msiexec.exe
Token: SeEnableDelegationPrivilege	2804	msiexec.exe
Token: SeManageVolumePrivilege	2804	msiexec.exe
Token: SeImpersonatePrivilege	2804	msiexec.exe
Token: SeCreateGlobalPrivilege	2804	msiexec.exe
Token: SeBackupPrivilege	4908	vssvc.exe
Token: SeRestorePrivilege	4908	vssvc.exe
Token: SeAuditPrivilege	4908	vssvc.exe
Token: SeBackupPrivilege	64	msiexec.exe
Token: SeRestorePrivilege	64	msiexec.exe
Token: SeRestorePrivilege	64	msiexec.exe
Token: SeTakeOwnershipPrivilege	64	msiexec.exe
Token: SeRestorePrivilege	64	msiexec.exe
Token: SeTakeOwnershipPrivilege	64	msiexec.exe
Token: SeBackupPrivilege	4956	srtasks.exe
Token: SeRestorePrivilege	4956	srtasks.exe
Token: SeSecurityPrivilege	4956	srtasks.exe
Token: SeTakeOwnershipPrivilege	4956	srtasks.exe
Token: SeBackupPrivilege	4956	srtasks.exe
Token: SeRestorePrivilege	4956	srtasks.exe
Token: SeSecurityPrivilege	4956	srtasks.exe
Token: SeTakeOwnershipPrivilege	4956	srtasks.exe
Token: SeRestorePrivilege	64	msiexec.exe
Token: SeTakeOwnershipPrivilege	64	msiexec.exe
Token: SeRestorePrivilege	64	msiexec.exe
Token: SeTakeOwnershipPrivilege	64	msiexec.exe
Token: SeRestorePrivilege	64	msiexec.exe
Token: SeTakeOwnershipPrivilege	64	msiexec.exe
Token: SeRestorePrivilege	64	msiexec.exe
Token: SeTakeOwnershipPrivilege	64	msiexec.exe
Token: SeRestorePrivilege	64	msiexec.exe
Token: SeTakeOwnershipPrivilege	64	msiexec.exe
Token: SeRestorePrivilege	64	msiexec.exe
Token: SeTakeOwnershipPrivilege	64	msiexec.exe
Token: SeRestorePrivilege	64	msiexec.exe
Token: SeTakeOwnershipPrivilege	64	msiexec.exe
Token: SeRestorePrivilege	64	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2804	msiexec.exe
2804	msiexec.exe
3968	EXCEL.EXE
3968	EXCEL.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 4956	64	msiexec.exe	87
PID 64 wrote to memory of 4956	64	msiexec.exe	87
PID 64 wrote to memory of 1056	64	msiexec.exe	89
PID 64 wrote to memory of 1056	64	msiexec.exe	89
PID 64 wrote to memory of 1056	64	msiexec.exe	89
PID 1056 wrote to memory of 3068	1056	MsiExec.exe	92
PID 1056 wrote to memory of 3068	1056	MsiExec.exe	92
PID 1056 wrote to memory of 3068	1056	MsiExec.exe	92
PID 1056 wrote to memory of 2416	1056	MsiExec.exe	96
PID 1056 wrote to memory of 2416	1056	MsiExec.exe	96
PID 1056 wrote to memory of 2416	1056	MsiExec.exe	96
PID 1056 wrote to memory of 3968	1056	MsiExec.exe	97
PID 1056 wrote to memory of 3968	1056	MsiExec.exe	97
PID 1056 wrote to memory of 3968	1056	MsiExec.exe	97
PID 3940 wrote to memory of 1020	3940	FfXilmfGmXJX.exe	104
PID 3940 wrote to memory of 1020	3940	FfXilmfGmXJX.exe	104
PID 3940 wrote to memory of 1020	3940	FfXilmfGmXJX.exe	104
PID 1020 wrote to memory of 2504	1020	EiAuPIYhFE4.exe	105
PID 1020 wrote to memory of 2504	1020	EiAuPIYhFE4.exe	105
PID 1020 wrote to memory of 2504	1020	EiAuPIYhFE4.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\WPS-Office_10469357_401532.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2804

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:64
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3EEFCBD60881DB0426F7F2B013D5D3A4 E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Program Files\MaximizeBrokerVigorous\OmndZSkNaeRN.exe
    "C:\Program Files\MaximizeBrokerVigorous\OmndZSkNaeRN.exe" x "C:\Program Files\MaximizeBrokerVigorous\wEbXlSkLLbZQWTFxLvFe" -o"C:\Program Files\MaximizeBrokerVigorous\" -pgdmwOrRKmUZEIRCFdxWT -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3068
- - C:\Program Files\MaximizeBrokerVigorous\EiAuPIYhFE4.exe
    "C:\Program Files\MaximizeBrokerVigorous\EiAuPIYhFE4.exe" -number 102 -file file3 -mode mode3 -flag flag3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2416
- - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Program Files\MaximizeBrokerVigorous\xlsx.xlsx"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3968

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.exe
"C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.exe" install
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:1696

C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.exe
"C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.exe" start
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:2256

C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.exe
"C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Program Files\MaximizeBrokerVigorous\EiAuPIYhFE4.exe
  "C:\Program Files\MaximizeBrokerVigorous\EiAuPIYhFE4.exe" -number 293 -file file3 -mode mode3 -flag flag3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Program Files\MaximizeBrokerVigorous\EiAuPIYhFE4.exe
    "C:\Program Files\MaximizeBrokerVigorous\EiAuPIYhFE4.exe" -number 362 -file file3 -mode mode3 -flag flag3
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57ed30.rbs

Filesize
7KB

MD5
4032f0d6de8188e157716c6b528e476d

SHA1
db5cf5e2b83bf8d166b78c09433a60ae93ca8600

SHA256
1b0d9b8043bd6d23059f4a9e8041986a343f0c21f0af3bc6db8a8f1785f19ce4

SHA512
f9750b02d413c7c71bc24729c1cefca22c9962a897ef4ee100ea90253691cb1ec0f22626fc2e855a0f271b283fa9cccb2296089f434b27750ae2f07452d7673c

Download Submit
C:\Program Files\MaximizeBrokerVigorous\EiAuPIYhFE4.exe

Filesize
3.2MB

MD5
1c3d835b334c146196997f99df3c6f8e

SHA1
0027a83539881abaf1f5cb3a2cc0cd6ba528d000

SHA256
dcd7d379effc6f28e3fc43bdeebc3c39c933a93b09d9dc6691fb64392c432b3f

SHA512
f4da23997640cad08e9c3cc605472bb3b112e01406cc18789bd78d1f735790029cede3cd784d5d66882d571d6d515666a2017463ab5be454df50ddc4498d6042

Download Submit
C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.wrapper.log

Filesize
280B

MD5
72f87b2b59e047bcacf547d02a5e9712

SHA1
d344e1b1da165177fec28cf5ffd81570ac72c44b

SHA256
bb6c14426f0496db1a7cbff9638de706d0f05c47d7103f5d450e91e938fea1d5

SHA512
d83fad347d6f1c1d2e87c1ff3e5c914923f11e10bedf7e7b1b6121122b9ee7a2dfae2f90715092cac91327e5bd875320ebaf8362e307623942bd09da73de94a1

Download Submit
C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.wrapper.log

Filesize
443B

MD5
91b13ca326cfbb5636b9867118ea8bbe

SHA1
e5ab6cf40838bc61c311288336d977632a886a87

SHA256
2ddd2108dfd7083dd26d01107ce1aa644cf0a95fa8e81a198f73b3a6c1e95545

SHA512
fb36fde4f2103d40f58302306825d20349796861ed577119f3a3924d544131c6ac6e925c97937ea0d86ff48d9a78207a502a8e6ed1c6d885bdd5db29a4d807a4

Download Submit
C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.wrapper.log

Filesize
616B

MD5
1e482af0179f8cfab5547ef6b8d08384

SHA1
37b11d65be06232ac42b9933d1a655f9d22c4d1d

SHA256
fe8c29bf6e8525091839a4de68112036a2de23f756a4e1a56cb22171d98f97da

SHA512
357a03d5b6d62d233c3e4ab9c9a9241c38cd430ef6fa9d91f0fe734555b51ffb5d792030d2baa9cae708d881c87a48d13968e37bacf1fcdd2546cf5195bf32ba

Download Submit
C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.wrapper.log

Filesize
762B

MD5
fe1ff2eedabbe24290e3c86cb35febe3

SHA1
3cfed9cc2037b8eccd6c4580eb358067a77cef07

SHA256
ab9f45a5815f6c5daa835e1babe53acb56125edeac4c5e6ee6b74e02340e7a1a

SHA512
76019be488ea79fc4efb9e1012bf7b446c3c028e8439ca5be54706537b884e8832ed30ab18435bb9edebbd706db6fd988ec75db335628040d152574f389dbfc0

Download Submit
C:\Program Files\MaximizeBrokerVigorous\FfXilmfGmXJX.xml

Filesize
453B

MD5
9e32c947a56da4d7056bbacf3aa3ba8d

SHA1
8eef07ab99b83b0fc319d87981a624a20fea8748

SHA256
30aad03685b79ee46931d87e2975f225eeebbc4e08021f358dc99b460fb2821e

SHA512
32a2a8b2741ade6339d20627858205f5cf4c7d4dc18f6f8d501559d36c934fc949ec74f234aa80912225b3e5fb6785beabef61623a05e9e04ceb88eb15aed625

Download Submit
C:\Program Files\MaximizeBrokerVigorous\OmndZSkNaeRN.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
C:\Program Files\MaximizeBrokerVigorous\asktao_mini_1.77_360rg.exe

Filesize
33.4MB

MD5
20dd50eb0410ad3306914bf541ff277c

SHA1
4b1722a4545625f7c596d556f17c647b30e3b1e4

SHA256
bf74b4a95cd815afdfca7e52973063248ace2703a4c7d9d37b87462962f0dd9f

SHA512
d54a4f5427bd2480da37ad4e8e5ebea56c882a1179487064f1060092ea1135c55421daa8d8c36d4268f98a3e7fdf27b9258404bc4bae184bafaf317b4c7c4ac3

Download Submit
C:\Program Files\MaximizeBrokerVigorous\wEbXlSkLLbZQWTFxLvFe

Filesize
2.0MB

MD5
98579ac04932f2d1b597812ddf61f40b

SHA1
521383df2f01fae8208a4a9705cc31c950d23c14

SHA256
368387ec1be286c1b4159478d46eb1d90653ce89834cf13de936394c30a43c22

SHA512
2753e8520440cbdf0c667b6afab5ebba6226250b4ca1dd303dd17ccdd72ca5b247ddac33d7834a7137b940e36f279198003f3e5a3b64f04aafc67782f6625191

Download Submit
C:\Program Files\MaximizeBrokerVigorous\xlsx.xlsx

Filesize
8KB

MD5
5001ead50aa6c32c9d7e6c6dfb4033f0

SHA1
c273c9bc2a996bb9ab65f7d30ccbf38bb755ed57

SHA256
a3d37b43693ef32bfcd324bb4f2523c828648e012828504302f3f182c97c4cda

SHA512
28d970204f02d6bc270fae20cf0ba78a8086e6dd2552f10f6c30d72c324fa2ca5ca44b2aca3830064caa57abd7255edb1147ea2bf0d103b22b75094f20f6d0bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\FfXilmfGmXJX.exe.log

Filesize
1KB

MD5
122cf3c4f3452a55a92edee78316e071

SHA1
f2caa36d483076c92d17224cf92e260516b3cbbf

SHA256
42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

SHA512
c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
349B

MD5
41ccb73b10a90e09dda08871fb8c3f26

SHA1
1f9a95ef114ba52fac27ec24fa0b1cf8a0f76297

SHA256
307007e0871b5675fa2512864394a017b60abe0d82325888272ceee9d6ddb38e

SHA512
d8763137513b69d09399a0aa7c0f51e226e20f3e19996e7c728344a57421a5f7c9e2243586024addc81a3d7b01a249d8a9a3b5bf47a086cb7a87f18fa3b4f40c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
24B

MD5
4fcb2a3ee025e4a10d21e1b154873fe2

SHA1
57658e2fa594b7d0b99d02e041d0f3418e58856b

SHA256
90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228

SHA512
4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
890B

MD5
956f14e920a57966a9fdbb5334c0a37a

SHA1
c0a916e5edb6bf4c657bee005a7d206884d6722f

SHA256
b5c0671c9a2fc5cf2537838dfc419f6d4937beaef490c2caffc5be1099f18d19

SHA512
e6ca4b872968d44a45f542e50a54e11f3cebe3623f4b4709e4bb072e1a007df7187cb555dd47e17fcf2ac443f1d98bb7816834d27c37ef293c9d3c1d4399d981

Download Submit
C:\Windows\Installer\e57ed2f.msi

Filesize
34.7MB

MD5
0648eae1b36fb6c8e1b9b5a5b28abe96

SHA1
52a313b76e9ab28b360b406f2886c324cc931c43

SHA256
60ab90f343c109734ee5d53b62397d754152c30e7bc2f9ab3114f45d59e4a252

SHA512
63e30921921920cd4dba054e3d7c8ff1225f5ce2f2bc987f543bb3c5ea290b87acc0b13e86891c76f72a040a0c821c3da9264212294f66118cc49aa6776f8091

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
43458d34e86828895f2aeec1c470885e

SHA1
0a6e07f9b447ed8ba9e5ab1d230f77d7ee3b0980

SHA256
9c2cc27d43b5f9936a097799cbe007454bb6d89d778ecc47f58fe5ae09479136

SHA512
06be4c02f27516bb7e5a122716a81fe14369108c08fd0f20bb2f759a2a7fa35fc07b0f449c3fe0c39f56638b4ce37adebf94d2757e18c4d2a6eec7d162e07c3a

Download Submit
\??\Volume{f1c9ec80-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{242bc098-9897-4f0d-b564-dc34ebb7bd25}_OnDiskSnapshotProp

Filesize
6KB

MD5
bae6888c87f10ae41e30ab7c4f6c2f0c

SHA1
01ecf451cdfed41664d8bdd256082ab310294544

SHA256
f16378538445c34b080618fbf9b5941b630fe3a91d8e84d67b62f888dd0eb690

SHA512
6c888cc047aa7170c7ff3799b82c0f4c20c12082e159861ddb1800c4266b7763319ae89b9e9428e9b3bf1239049eb7e10b4dd6325f72b77b1aa4807014107e75

Download Submit
memory/1696-55-0x0000000000FA0000-0x0000000001076000-memory.dmp

Filesize
856KB

Download
memory/2504-85-0x000000002BD20000-0x000000002BEDB000-memory.dmp

Filesize
1.7MB

Download
memory/2504-84-0x000000002A120000-0x000000002A163000-memory.dmp

Filesize
268KB

Download
memory/2504-87-0x000000002BD20000-0x000000002BEDB000-memory.dmp

Filesize
1.7MB

Download
memory/2504-98-0x000000002BD20000-0x000000002BEDB000-memory.dmp

Filesize
1.7MB

Download
memory/3968-32-0x00007FFA860B0000-0x00007FFA860C0000-memory.dmp

Filesize
64KB

Download
memory/3968-34-0x00007FFA860B0000-0x00007FFA860C0000-memory.dmp

Filesize
64KB

Download
memory/3968-47-0x00007FFA83930000-0x00007FFA83940000-memory.dmp

Filesize
64KB

Download
memory/3968-40-0x00007FFA860B0000-0x00007FFA860C0000-memory.dmp

Filesize
64KB

Download
memory/3968-33-0x00007FFA860B0000-0x00007FFA860C0000-memory.dmp

Filesize
64KB

Download
memory/3968-44-0x00007FFA83930000-0x00007FFA83940000-memory.dmp

Filesize
64KB

Download
memory/3968-41-0x00007FFA860B0000-0x00007FFA860C0000-memory.dmp

Filesize
64KB

Download