Gather the names of all services running on the system. Gather a list of the names of all processes running on the endpoint. Gather the list of all files names listed in the Recent Items folder i.e. Appdata%\Microsoft\Windows\Recent". - Gather all names of files listed in the Desktop folder of the current user. Gather names of all files and programs listed in the Taskbar i.e. AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\Taskbar". - Get the bitness of the Operating System : "x86" or "x64". - Get Username, OS name and version,. NET Framework version. The instrumentor script also enables all macros for Office by setting the VBAWarnings registry value to 0x1 at: HKCU\Software\Microsoft\Office\<OfficeVersionNumber>.0\Word\Security\VBAWarnings = 0x1