Sample File: MD5 hash: 868a06468b0eb6d5e9777681a0cb2afe SHA1 hash: 2551e34c72e928f615aeba3b7c2a099b3adcb84e SHA256 hash: e824650b66c5cdd8c71983f4c4fc0e1ac55cd04809d562f3b6b4790a28521486 SSDEEP hash: 384:KS9ASfotpAEi8F1c2OfzHt/PRbeRGNr1aBVJmDm1nTfuUQ:pAtplFDfOdBe4YBZtQ Filename(s): Info_Project_BSV_2019.docm Filetype: Word Document Mutex IOCs: - None - Registry Key IOCs: HKEY_CLASSES_ROOT\Licenses HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7 HKEY_CLASSES_ROOT\TypeLib HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046} HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.2 HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.2\9 HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.2\9\win64 HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7 HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0 HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0\win64 HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\409 HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\9 HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\win64 HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8 HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64 HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BackGroundCompile HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnAllErrors HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnServerErrors HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\CompileOnDemand HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\NotifyUserBeforeStateLoss HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\RequireDeclaration HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\VbaCapability win64 Domain IOCs: hcwyo5rfapkytajg.onion.pet IP IOCs: 198.251.80.48 URL IOCs: http://hcwyo5rfapkytajg.onion.pet/2hq68vxr3f.exe File IOCs: Filenames: C:\ C:\$Recycle.Bin C:\$Recycle.Bin\S-1-5-21-2345716840-1148442690-1481144037-1000 C:\$Recycle.Bin\S-1-5-21-2345716840-1148442690-1481144037-1000\desktop.ini C:\BOOTSECT.BAK C:\Boot C:\Boot\BCD C:\Boot\BCD.LOG C:\Boot\BCD.LOG1 C:\Boot\BCD.LOG2 C:\Boot\BOOTSTAT.DAT C:\Boot\Fonts C:\Boot\Fonts\chs_boot.ttf C:\Boot\Fonts\cht_boot.ttf C:\Boot\Fonts\jpn_boot.ttf C:\Boot\Fonts\kor_boot.ttf C:\Boot\Fonts\wgl4_boot.ttf C:\Boot\cs-CZ C:\Boot\cs-CZ\bootmgr.exe.mui C:\Boot\da-DK C:\Boot\da-DK\bootmgr.exe.mui C:\Boot\de-DE C:\Boot\de-DE\bootmgr.exe.mui C:\Boot\el-GR C:\Boot\el-GR\bootmgr.exe.mui C:\Boot\en-US C:\Boot\en-US\bootmgr.exe.mui C:\Boot\en-US\memtest.exe.mui C:\Boot\es-ES C:\Boot\es-ES\bootmgr.exe.mui C:\Boot\fi-FI C:\Boot\fi-FI\bootmgr.exe.mui C:\Boot\fr-FR C:\Boot\fr-FR\bootmgr.exe.mui C:\Boot\hu-HU C:\Boot\hu-HU\bootmgr.exe.mui C:\Boot\it-IT C:\Boot\it-IT\bootmgr.exe.mui C:\Boot\ja-JP C:\Boot\ja-JP\bootmgr.exe.mui C:\Boot\ko-KR C:\Boot\ko-KR\bootmgr.exe.mui C:\Boot\memtest.exe C:\Boot\nb-NO C:\Boot\nb-NO\bootmgr.exe.mui C:\Boot\nl-NL C:\Boot\nl-NL\bootmgr.exe.mui C:\Boot\pl-PL C:\Boot\pl-PL\bootmgr.exe.mui C:\Boot\pt-BR C:\Boot\pt-BR\bootmgr.exe.mui C:\Boot\pt-PT C:\Boot\pt-PT\bootmgr.exe.mui C:\Boot\ru-RU C:\Boot\ru-RU\bootmgr.exe.mui C:\Boot\sv-SE C:\Boot\sv-SE\bootmgr.exe.mui C:\Boot\tr-TR C:\Boot\tr-TR\bootmgr.exe.mui C:\Boot\zh-CN C:\Boot\zh-CN\bootmgr.exe.mui C:\Boot\zh-HK C:\Boot\zh-HK\bootmgr.exe.mui C:\Boot\zh-TW C:\Boot\zh-TW\bootmgr.exe.mui C:\Documents and Settings C:\PerfLogs C:\Program Files C:\Program Files (x86) C:\ProgramData C:\ProgramData\Adobe C:\ProgramData\Adobe\ARM C:\ProgramData\Adobe\ARM\Reader_10.0.0 C:\ProgramData\Adobe\ARM\Reader_10.0.0\18541 C:\ProgramData\Adobe\ARM\Reader_10.0.0\18541\AcrobatUpdater.exe C:\ProgramData\Adobe\ARM\Reader_10.0.0\18541\AdobeARM.exe C:\ProgramData\Adobe\ARM\Reader_10.0.0\18541\AdobeARMHelper.exe C:\ProgramData\Adobe\ARM\Reader_10.0.0\18541\ReaderUpdater.exe C:\ProgramData\Adobe\ARM\Reader_10.0.0\ARM.msi C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdobeARM.bin C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdobeARM.bin.lcphr C:\ProgramData\Adobe\ARM\Reader_10.0.0\Reader10Manifest.msi C:\ProgramData\Adobe\Acrobat C:\ProgramData\Adobe\Acrobat\10.0 C:\ProgramData\Adobe\Acrobat\10.0\Replicate C:\ProgramData\Adobe\Acrobat\10.0\Replicate\Security C:\ProgramData\Adobe\Acrobat\10.0\Replicate\Security\directories.acrodata C:\ProgramData\Application Data C:\ProgramData\Desktop C:\ProgramData\Documents C:\ProgramData\Favorites C:\ProgramData\Microsoft C:\ProgramData\Microsoft\Assistance C:\ProgramData\Microsoft\Assistance\Client C:\ProgramData\Microsoft\Assistance\Client\1.0 C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_BestBet.H1W C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.H1D C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.Lck C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q C:\ProgramData\Microsoft\ClickToRun C:\ProgramData\Microsoft\ClickToRun\23A8C7B1-0195-4D07-B6CF-93A6BF126B2A C:\ProgramData\Microsoft\ClickToRun\23A8C7B1-0195-4D07-B6CF-93A6BF126B2A\en-us.16 C:\ProgramData\Microsoft\ClickToRun\23A8C7B1-0195-4D07-B6CF-93A6BF126B2A\en-us.16\MasterDescriptor.en-us.xml C:\ProgramData\Microsoft\ClickToRun\23A8C7B1-0195-4D07-B6CF-93A6BF126B2A\en-us.16\MasterDescriptor.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\23A8C7B1-0195-4D07-B6CF-93A6BF126B2A\en-us.16\s321033.hash C:\ProgramData\Microsoft\ClickToRun\23A8C7B1-0195-4D07-B6CF-93A6BF126B2A\en-us.16\stream.x86.en-us.man.dat C:\ProgramData\Microsoft\ClickToRun\23A8C7B1-0195-4D07-B6CF-93A6BF126B2A\en-us.16\stream.x86.en-us.man.dat.lcphr C:\ProgramData\Microsoft\ClickToRun\23A8C7B1-0195-4D07-B6CF-93A6BF126B2A\x-none.16 C:\ProgramData\Microsoft\ClickToRun\23A8C7B1-0195-4D07-B6CF-93A6BF126B2A\x-none.16\MasterDescriptor.x-none.xml C:\ProgramData\Microsoft\ClickToRun\23A8C7B1-0195-4D07-B6CF-93A6BF126B2A\x-none.16\MasterDescriptor.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\23A8C7B1-0195-4D07-B6CF-93A6BF126B2A\x-none.16\s320.hash C:\ProgramData\Microsoft\ClickToRun\23A8C7B1-0195-4D07-B6CF-93A6BF126B2A\x-none.16\stream.x86.x-none.man.dat C:\ProgramData\Microsoft\ClickToRun\23A8C7B1-0195-4D07-B6CF-93A6BF126B2A\x-none.16\stream.x86.x-none.man.dat.lcphr C:\ProgramData\Microsoft\ClickToRun\B67F2A9E-0258-4BAE-8ED4-AFE18C0C9A23 C:\ProgramData\Microsoft\ClickToRun\B67F2A9E-0258-4BAE-8ED4-AFE18C0C9A23\en-us.16 C:\ProgramData\Microsoft\ClickToRun\B67F2A9E-0258-4BAE-8ED4-AFE18C0C9A23\en-us.16\MasterDescriptor.en-us.xml C:\ProgramData\Microsoft\ClickToRun\B67F2A9E-0258-4BAE-8ED4-AFE18C0C9A23\en-us.16\MasterDescriptor.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\B67F2A9E-0258-4BAE-8ED4-AFE18C0C9A23\en-us.16\s321033.hash C:\ProgramData\Microsoft\ClickToRun\B67F2A9E-0258-4BAE-8ED4-AFE18C0C9A23\en-us.16\stream.x86.en-us.man.dat C:\ProgramData\Microsoft\ClickToRun\B67F2A9E-0258-4BAE-8ED4-AFE18C0C9A23\en-us.16\stream.x86.en-us.man.dat.lcphr C:\ProgramData\Microsoft\ClickToRun\B67F2A9E-0258-4BAE-8ED4-AFE18C0C9A23\x-none.16 C:\ProgramData\Microsoft\ClickToRun\B67F2A9E-0258-4BAE-8ED4-AFE18C0C9A23\x-none.16\MasterDescriptor.x-none.xml C:\ProgramData\Microsoft\ClickToRun\B67F2A9E-0258-4BAE-8ED4-AFE18C0C9A23\x-none.16\MasterDescriptor.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\B67F2A9E-0258-4BAE-8ED4-AFE18C0C9A23\x-none.16\s320.hash C:\ProgramData\Microsoft\ClickToRun\B67F2A9E-0258-4BAE-8ED4-AFE18C0C9A23\x-none.16\stream.x86.x-none.man.dat C:\ProgramData\Microsoft\ClickToRun\B67F2A9E-0258-4BAE-8ED4-AFE18C0C9A23\x-none.16\stream.x86.x-none.man.dat.lcphr C:\ProgramData\Microsoft\ClickToRun\D3BE4D83-2D47-4B3D-97F1-5483AB9ADC5C C:\ProgramData\Microsoft\ClickToRun\D3BE4D83-2D47-4B3D-97F1-5483AB9ADC5C\en-us.16 C:\ProgramData\Microsoft\ClickToRun\D3BE4D83-2D47-4B3D-97F1-5483AB9ADC5C\en-us.16\MasterDescriptor.en-us.xml C:\ProgramData\Microsoft\ClickToRun\D3BE4D83-2D47-4B3D-97F1-5483AB9ADC5C\en-us.16\MasterDescriptor.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\D3BE4D83-2D47-4B3D-97F1-5483AB9ADC5C\en-us.16\s641033.hash C:\ProgramData\Microsoft\ClickToRun\D3BE4D83-2D47-4B3D-97F1-5483AB9ADC5C\en-us.16\stream.x64.en-us.man.dat C:\ProgramData\Microsoft\ClickToRun\D3BE4D83-2D47-4B3D-97F1-5483AB9ADC5C\en-us.16\stream.x64.en-us.man.dat.lcphr C:\ProgramData\Microsoft\ClickToRun\D3BE4D83-2D47-4B3D-97F1-5483AB9ADC5C\x-none.16 C:\ProgramData\Microsoft\ClickToRun\D3BE4D83-2D47-4B3D-97F1-5483AB9ADC5C\x-none.16\MasterDescriptor.x-none.xml C:\ProgramData\Microsoft\ClickToRun\D3BE4D83-2D47-4B3D-97F1-5483AB9ADC5C\x-none.16\MasterDescriptor.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\D3BE4D83-2D47-4B3D-97F1-5483AB9ADC5C\x-none.16\s640.hash C:\ProgramData\Microsoft\ClickToRun\D3BE4D83-2D47-4B3D-97F1-5483AB9ADC5C\x-none.16\stream.x64.x-none.man.dat C:\ProgramData\Microsoft\ClickToRun\D3BE4D83-2D47-4B3D-97F1-5483AB9ADC5C\x-none.16\stream.x64.x-none.man.dat.lcphr C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.1.xml C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.1.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\FCE80778-F5A2-48B5-BF04-93D6E887CBA7 C:\ProgramData\Microsoft\ClickToRun\FCE80778-F5A2-48B5-BF04-93D6E887CBA7\en-us.16 C:\ProgramData\Microsoft\ClickToRun\FCE80778-F5A2-48B5-BF04-93D6E887CBA7\en-us.16\MasterDescriptor.en-us.xml C:\ProgramData\Microsoft\ClickToRun\FCE80778-F5A2-48B5-BF04-93D6E887CBA7\en-us.16\MasterDescriptor.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\FCE80778-F5A2-48B5-BF04-93D6E887CBA7\en-us.16\s641033.hash C:\ProgramData\Microsoft\ClickToRun\FCE80778-F5A2-48B5-BF04-93D6E887CBA7\en-us.16\stream.x64.en-us.man.dat C:\ProgramData\Microsoft\ClickToRun\FCE80778-F5A2-48B5-BF04-93D6E887CBA7\en-us.16\stream.x64.en-us.man.dat.lcphr C:\ProgramData\Microsoft\ClickToRun\FCE80778-F5A2-48B5-BF04-93D6E887CBA7\x-none.16 C:\ProgramData\Microsoft\ClickToRun\FCE80778-F5A2-48B5-BF04-93D6E887CBA7\x-none.16\MasterDescriptor.x-none.xml C:\ProgramData\Microsoft\ClickToRun\FCE80778-F5A2-48B5-BF04-93D6E887CBA7\x-none.16\MasterDescriptor.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\FCE80778-F5A2-48B5-BF04-93D6E887CBA7\x-none.16\s640.hash C:\ProgramData\Microsoft\ClickToRun\FCE80778-F5A2-48B5-BF04-93D6E887CBA7\x-none.16\stream.x64.x-none.man.dat C:\ProgramData\Microsoft\ClickToRun\FCE80778-F5A2-48B5-BF04-93D6E887CBA7\x-none.16\stream.x64.x-none.man.dat.lcphr C:\ProgramData\Microsoft\ClickToRun\MachineData C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA} C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8} C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserManifest.xml C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserManifest.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\MachineData\Integration C:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups C:\ProgramData\Microsoft\ClickToRun\ProductReleases C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3EE704C9-9D8D-408A-8094-3FFBD3100627 C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3EE704C9-9D8D-408A-8094-3FFBD3100627\x-none.16 C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394 C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\en-us.16 C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\en-us.16\MasterDescriptor.en-us.xml C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\en-us.16\MasterDescriptor.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\en-us.16\s641033.hash C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\en-us.16\stream.Platform.Culture.man.xml C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\en-us.16\stream.Platform.Culture.man.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\en-us.16\stream.x64.en-us.hash C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\en-us.16\stream.x64.en-us.man.dat C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\en-us.16\stream.x64.en-us.man.dat.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\x-none.16 C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\x-none.16\MasterDescriptor.x-none.xml C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\x-none.16\MasterDescriptor.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\x-none.16\s640.hash C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\x-none.16\stream.Platform.x-none.man.xml C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\x-none.16\stream.Platform.x-none.man.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\x-none.16\stream.x64.x-none.hash C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\x-none.16\stream.x64.x-none.man.dat C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7D4151FA-0263-42FB-99EC-A401902FE394\x-none.16\stream.x64.x-none.man.dat.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\94A84C64-77C0-403D-9E02-99FBBFE901CB C:\ProgramData\Microsoft\ClickToRun\ProductReleases\94A84C64-77C0-403D-9E02-99FBBFE901CB\en-us.16 C:\ProgramData\Microsoft\ClickToRun\ProductReleases\94A84C64-77C0-403D-9E02-99FBBFE901CB\x-none.16 C:\ProgramData\Microsoft\ClickToRun\ProductReleases\94A84C64-77C0-403D-9E02-99FBBFE901CB\x-none.16\MasterDescriptor.x-none.xml C:\ProgramData\Microsoft\ClickToRun\ProductReleases\94A84C64-77C0-403D-9E02-99FBBFE901CB\x-none.16\MasterDescriptor.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\94A84C64-77C0-403D-9E02-99FBBFE901CB\x-none.16\Stream.Platform.x-none.man.xml C:\ProgramData\Microsoft\ClickToRun\ProductReleases\94A84C64-77C0-403D-9E02-99FBBFE901CB\x-none.16\Stream.Platform.x-none.man.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\94A84C64-77C0-403D-9E02-99FBBFE901CB\x-none.16\s640.hash C:\ProgramData\Microsoft\ClickToRun\ProductReleases\94A84C64-77C0-403D-9E02-99FBBFE901CB\x-none.16\stream.x64.x-none.hash C:\ProgramData\Microsoft\ClickToRun\ProductReleases\94A84C64-77C0-403D-9E02-99FBBFE901CB\x-none.16\stream.x64.x-none.man.dat C:\ProgramData\Microsoft\ClickToRun\ProductReleases\94A84C64-77C0-403D-9E02-99FBBFE901CB\x-none.16\stream.x64.x-none.man.dat.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18 C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\en-us.16 C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\en-us.16\MasterDescriptor.en-us.xml C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\en-us.16\MasterDescriptor.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\en-us.16\Stream.Platform.Culture.man.xml C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\en-us.16\Stream.Platform.Culture.man.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\en-us.16\s641033.hash C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\en-us.16\stream.x64.en-us.hash C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\en-us.16\stream.x64.en-us.man.dat C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\en-us.16\stream.x64.en-us.man.dat.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\x-none.16 C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\x-none.16\MasterDescriptor.x-none.xml C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\x-none.16\MasterDescriptor.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\x-none.16\Stream.Platform.x-none.man.xml C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\x-none.16\Stream.Platform.x-none.man.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\x-none.16\s640.hash C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\x-none.16\stream.x64.x-none.man.dat C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A2D24017-4FB1-4B3A-9228-31FD2D620B18\x-none.16\stream.x64.x-none.man.dat.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\B843911F-CE0B-422E-917E-7E7331D1BFAB\en-us.16\MasterDescriptor.en-us.xml C:\ProgramData\Microsoft\ClickToRun\ProductReleases\B843911F-CE0B-422E-917E-7E7331D1BFAB\en-us.16\MasterDescriptor.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\B843911F-CE0B-422E-917E-7E7331D1BFAB\en-us.16\stream.Platform.Culture.man.xml C:\ProgramData\Microsoft\ClickToRun\ProductReleases\B843911F-CE0B-422E-917E-7E7331D1BFAB\en-us.16\stream.Platform.Culture.man.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\B843911F-CE0B-422E-917E-7E7331D1BFAB\en-us.16\stream.x64.en-us.man.dat C:\ProgramData\Microsoft\ClickToRun\ProductReleases\B843911F-CE0B-422E-917E-7E7331D1BFAB\en-us.16\stream.x64.en-us.man.dat.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\B843911F-CE0B-422E-917E-7E7331D1BFAB\x-none.16\MasterDescriptor.x-none.xml C:\ProgramData\Microsoft\ClickToRun\ProductReleases\B843911F-CE0B-422E-917E-7E7331D1BFAB\x-none.16\MasterDescriptor.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\B843911F-CE0B-422E-917E-7E7331D1BFAB\x-none.16\stream.Platform.x-none.man.xml C:\ProgramData\Microsoft\ClickToRun\ProductReleases\B843911F-CE0B-422E-917E-7E7331D1BFAB\x-none.16\stream.Platform.x-none.man.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\ProductReleases\B843911F-CE0B-422E-917E-7E7331D1BFAB\x-none.16\stream.x64.x-none.man.dat C:\ProgramData\Microsoft\ClickToRun\ProductReleases\B843911F-CE0B-422E-917E-7E7331D1BFAB\x-none.16\stream.x64.x-none.man.dat.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Access.Access.x-none.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Project.Project.x-none.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmui.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmui.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmuiset.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmuiset.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.dcfmui.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.dcfmui.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.groovemui.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.groovemui.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.lyncmui.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.lyncmui.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office32mui.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office32mui.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office32ww.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office32ww.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemuiset.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemuiset.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmmui.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmmui.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmuxmui.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmuxmui.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.projectmui.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.projectmui.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.proofing.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.proofing.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.publishermui.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.publishermui.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.visiomui.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.visiomui.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeBackgroundTaskHandlerLogon.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeBackgroundTaskHandlerLogon.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeBackgroundTaskHandlerRegistration.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeBackgroundTaskHandlerRegistration.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.lcphr C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.lcphr C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.lcphr C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.lcphr C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.lcphr C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.lcphr C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.lcphr C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.lcphr C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.lcphr C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.lcphr C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml.lcphr C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.lcphr C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml.lcphr C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml.lcphr C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml.lcphr C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat.lcphr C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat.lcphr C:\ProgramData\Microsoft\RAC\StateData\RacMetaData.dat C:\ProgramData\Microsoft\RAC\StateData\RacMetaData.dat.lcphr C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.lcphr C:\ProgramData\Microsoft\User Account Pictures\aETAdzjz.dat C:\ProgramData\Microsoft\User Account Pictures\aETAdzjz.dat.lcphr C:\Users\aETAdzjz\Desktop\c2056.ini C:\bootmgr C:\hiberfil.sys C:\pagefile.sys LooCipher.exe MD5 hashes: 0c7e59536a7be4a446bbe8b4f22e5880 f0a40ada59708f155a8700133c54b289 SHA1 hashes: 1d1df205acf0efd78cda6994a1bb9780a5b7b005 2c28fe1417757863a83a41de38b1ace2ebaea652 SHA256 hashes: 43cfb0a439705ab2bd7c46b39a7265ff0a14f7bd710b3e1432a9bdc4c1736c49 c31b61eb49f93a0eae27053e7a00b3a4b5ee3500405853a77040ef4de80cf180 SSDEEP hashes: 6144:2s2dV0PvvRN9ONaFhEZW/9zP+jTG0OTW9qddRj/qTh67xBf821ct7f6scUh7wlV:23kNqKhfPm9qN/qThy11ctj6JUO 98304:+d+KQ0CO444hl1p7xFMe7rbbbbLG6wd57qw:+d+KQ0R44Q1rbbbbLG5