Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

HkObDPju6Z.exe

Status: finished
Submission Time: 2023-06-12 21:16:06 +02:00
Malicious
Ransomware
Spreader
Evader
Spyware
BlackBasta

Comments

Tags

  • exe

Details

  • Analysis ID:
    886219
  • API (Web) ID:
    1253199
  • Original Filename:
    723d1cf3d74fb3ce95a77ed9dff257a78c8af8e67a82963230dd073781074224.exe
  • Analysis Started:
    2023-06-12 21:16:06 +02:00
  • Analysis Finished:
    2023-06-12 21:53:40 +02:00
  • MD5:
    6441d7260944bcedc5958c5c8a05d16d
  • SHA1:
    46257982840493eca90e051ff1749e7040895584
  • SHA256:
    723d1cf3d74fb3ce95a77ed9dff257a78c8af8e67a82963230dd073781074224
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Full Report Management Report IOC Report
malicious
Score: 88
System: Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301

Third Party Analysis Engines

Open Full Report
malicious
Score: 44/69
malicious
Score: 22/37
malicious

URLs

Name Detection
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
https://www.rizonesoft.com
https://www.torproject.org/
Click to see the 3 hidden entries
http://office.micro
https://www.flos-freeware.chopenmailto:florian.balmer
https://www.flos-freeware.ch

Dropped files

Name File Type Hashes Detection
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab
 data
 #
Click to see the 397 hidden entries
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab
 data
 #
C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab
 data
 #
C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab
 data
 #
C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab
 data
 #
C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab
 data
 #
C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-002C-0409-0000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab
 data
 #
C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\DCFMUI.cab
 data
 #
C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\DCFMUI.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab
 data
 #
C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab
 data
 #
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\OSMUXMUI.cab
 data
 #
C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\OSMUXMUI.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\OWOW64LR.cab
 data
 #
C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\OWOW64LR.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\LyncMUI.cab
 data
 #
C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\LyncMUI.cab.7878kr5jx (copy)
 data
 #
C:\Program Files (x86)\AutoIt3\Au3Check.exe
 data
 #
C:\Program Files (x86)\AutoIt3\Au3Info.exe
 data
 #
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe
 data
 #
C:\Program Files (x86)\AutoIt3\AutoIt.chm
 data
 #
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe
 data
 #
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
 OpenPGP Secret Key
 #
C:\Program Files (x86)\AutoIt3\Uninstall.exe
 COM executable for DOS
 #
C:\Program Files (x86)\autoit3\AutoIt.chm.7878kr5jx (copy)
 data
 #
C:\Program Files\Google\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\MSBuild\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Microsoft Office\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Reference Assemblies\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Defender Advanced Threat Protection\en-US\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Defender\Offline\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Media Player\en-US\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\internet explorer\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Setup.xml
 OpenPGP Secret Key
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 OpenPGP Secret Key
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\osetup.dll
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.dll
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.dll.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe
 data
 #
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi
 data
 #
C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml
 data
 #
C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\Setup.xml
 data
 #
C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi
 data
 #
C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml
 data
 #
C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\Setup.xml
 data
 #
C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi
 data
 #
C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml
 data
 #
C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\Setup.xml
 data
 #
C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi
 data
 #
C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml
 data
 #
C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\Setup.xml
 data
 #
C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\Setup.xml
 data
 #
C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi
 data
 #
C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml
 data
 #
C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi
 data
 #
C:\MSOCache\All Users\{90160000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml
 OpenPGP Secret Key
 #
C:\MSOCache\All Users\{90160000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml.7878kr5jx (copy)
 OpenPGP Secret Key
 #
C:\MSOCache\All Users\{90160000-002C-0409-0000-0000000FF1CE}-C\Setup.xml
 data
 #
C:\MSOCache\All Users\{90160000-002C-0409-0000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi
 data
 #
C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml
 data
 #
C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\Setup.xml
 data
 #
C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\DCFMUI.msi
 data
 #
C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\DCFMUI.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\DCFMUI.xml
 OpenPGP Public Key
 #
C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\DCFMUI.xml.7878kr5jx (copy)
 OpenPGP Public Key
 #
C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\Setup.xml
 data
 #
C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi
 data
 #
C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml
 data
 #
C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml
 data
 #
C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi
 data
 #
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml
 data
 #
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml
 data
 #
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-00E1-0409-0000-0000000FF1CE}-C\OSMMUI.cab
 data
 #
C:\MSOCache\All Users\{90160000-00E1-0409-0000-0000000FF1CE}-C\OSMMUI.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-00E1-0409-0000-0000000FF1CE}-C\OSMMUI.msi
 data
 #
C:\MSOCache\All Users\{90160000-00E1-0409-0000-0000000FF1CE}-C\OSMMUI.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-00E1-0409-0000-0000000FF1CE}-C\OSMMUI.xml
 data
 #
C:\MSOCache\All Users\{90160000-00E1-0409-0000-0000000FF1CE}-C\OSMMUI.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-00E1-0409-0000-0000000FF1CE}-C\Setup.xml
 data
 #
C:\MSOCache\All Users\{90160000-00E1-0409-0000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-00E1-0409-0000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\OSMUXMUI.msi
 data
 #
C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\OSMUXMUI.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\OSMUXMUI.xml
 data
 #
C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\OSMUXMUI.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\Setup.xml
 data
 #
C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OffSetLR.cab
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OffSetLR.cab.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\Setup.xml
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\branding.xml
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\branding.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\setup.chm
 data
 #
C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\setup.chm.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.msi
 data
 #
C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.xml
 OpenPGP Public Key
 #
C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.xml.7878kr5jx (copy)
 OpenPGP Public Key
 #
C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\Office64MUISet.msi
 data
 #
C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\Office64MUISet.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\Office64MUISet.xml
 data
 #
C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\Office64MUISet.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\Setup.xml
 data
 #
C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.msi
 data
 #
C:\MSOCache\All Users\{90160000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.msi.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml
 data
 #
C:\MSOCache\All Users\{90160000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0117-0409-0000-0000000FF1CE}-C\Setup.xml
 data
 #
C:\MSOCache\All Users\{90160000-0117-0409-0000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-0117-0409-0000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\LyncMUI.msi
 OpenPGP Secret Key
 #
C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\LyncMUI.msi.7878kr5jx (copy)
 OpenPGP Secret Key
 #
C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\LyncMUI.xml
 data
 #
C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\LyncMUI.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\Setup.xml
 data
 #
C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\Setup.xml.7878kr5jx (copy)
 data
 #
C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\MSOCache\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\PerfLogs\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Adobe\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\AutoIt3\Au3Check.dat
 data
 #
C:\Program Files (x86)\AutoIt3\AutoIt v3 Website.url
 data
 #
C:\Program Files (x86)\AutoIt3\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Common Files\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Google\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Internet Explorer\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Java\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\MSBuild\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Microsoft Analysis Services\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106816.WMF
 data
 #
C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107024.WMF
 data
 #
C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107042.WMF
 data
 #
C:\Program Files (x86)\Microsoft Office\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Microsoft SQL Server\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Microsoft.NET\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Mozilla Firefox\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Reference Assemblies\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Windows Defender\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Windows Mail\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Windows Media Player\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Windows Multimedia Platform\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Windows Photo Viewer\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\Windows Portable Devices\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\WindowsPowerShell\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\ZVGTehONYOFIOHEumRSBVkpDOAdmdwUOdLWTBFlImvuycSXfebOKqkiHgvcAaIkSkY\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\autoit3\Au3Check.dat.7878kr5jx (copy)
 data
 #
C:\Program Files (x86)\autoit3\Au3Check.exe.7878kr5jx (copy)
 data
 #
C:\Program Files (x86)\autoit3\Au3Info.exe.7878kr5jx (copy)
 data
 #
C:\Program Files (x86)\autoit3\Au3Info_x64.exe.7878kr5jx (copy)
 data
 #
C:\Program Files (x86)\autoit3\AutoIt v3 Website.url.7878kr5jx (copy)
 data
 #
C:\Program Files (x86)\autoit3\AutoIt3Help.exe.7878kr5jx (copy)
 data
 #
C:\Program Files (x86)\autoit3\AutoIt3_x64.exe.7878kr5jx (copy)
 OpenPGP Secret Key
 #
C:\Program Files (x86)\autoit3\Uninstall.exe.7878kr5jx (copy)
 COM executable for DOS
 #
C:\Program Files (x86)\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\jDownloader\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\windows nt\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Common Files\Services\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Common Files\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Common Files\microsoft shared\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Common Files\system\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Google\Chrome\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\MSBuild\Microsoft\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Microsoft Office\Office16\AppSharingChromeHook64.dll
 data
 #
C:\Program Files\Microsoft Office\Office16\AppSharingChromeHook64.dll.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\AppSharingHookController64.exe
 data
 #
C:\Program Files\Microsoft Office\Office16\AppSharingHookController64.exe.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\Custom.propdesc
 data
 #
C:\Program Files\Microsoft Office\Office16\Custom.propdesc.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\IEAWSDC.DLL
 data
 #
C:\Program Files\Microsoft Office\Office16\IEAWSDC.DLL.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\MAPISHELL.DLL
 data
 #
C:\Program Files\Microsoft Office\Office16\MAPISHELL.DLL.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\MSOHEV.DLL
 data
 #
C:\Program Files\Microsoft Office\Office16\MSOHEV.DLL.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\MSOHEVI.DLL
 OpenPGP Public Key
 #
C:\Program Files\Microsoft Office\Office16\MSOHEVI.DLL.7878kr5jx (copy)
 OpenPGP Public Key
 #
C:\Program Files\Microsoft Office\Office16\MSOHTMED.EXE
 data
 #
C:\Program Files\Microsoft Office\Office16\MSOHTMED.EXE.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\MeetingJoinAxOC.dll
 data
 #
C:\Program Files\Microsoft Office\Office16\MeetingJoinAxOC.dll.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\Mso Example Setup File A.txt
 data
 #
C:\Program Files\Microsoft Office\Office16\Mso Example Setup File A.txt.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\NAMEEXT.DLL
 data
 #
C:\Program Files\Microsoft Office\Office16\NAMEEXT.DLL.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\OCHelper.dll
 data
 #
C:\Program Files\Microsoft Office\Office16\OCHelper.dll.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\OLKFSTUB.DLL
 data
 #
C:\Program Files\Microsoft Office\Office16\OLKFSTUB.DLL.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\ONBttnIE.dll
 data
 #
C:\Program Files\Microsoft Office\Office16\ONBttnIE.dll.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\ONBttnIELinkedNotes.dll
 data
 #
C:\Program Files\Microsoft Office\Office16\ONBttnIELinkedNotes.dll.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\ONFILTER.DLL
 data
 #
C:\Program Files\Microsoft Office\Office16\ONFILTER.DLL.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\ONLNTCOMLIB.DLL
 data
 #
C:\Program Files\Microsoft Office\Office16\ONLNTCOMLIB.DLL.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\VISSHE.DLL
 data
 #
C:\Program Files\Microsoft Office\Office16\VISSHE.DLL.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\VisioCustom.propdesc
 data
 #
C:\Program Files\Microsoft Office\Office16\VisioCustom.propdesc.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Microsoft Office\Office16\msoia.exe
 data
 #
C:\Program Files\Microsoft Office\Office16\msoia.exe.7878kr5jx (copy)
 data
 #
C:\Program Files\Microsoft Office\Office16\msoianetutil.dll
 data
 #
C:\Program Files\Microsoft Office\Office16\msoianetutil.dll.7878kr5jx (copy)
 data
 #
C:\Program Files\Reference Assemblies\Microsoft\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\UNP\Logs\UpdateNotificationPipeline.001.etl
 data
 #
C:\Program Files\UNP\Logs\UpdateNotificationPipeline.001.etl.7878kr5jx (copy)
 data
 #
C:\Program Files\UNP\Logs\UpdateNotificationPipeline.002.etl
 data
 #
C:\Program Files\UNP\Logs\UpdateNotificationPipeline.002.etl.7878kr5jx (copy)
 data
 #
C:\Program Files\UNP\Logs\UpdateNotificationPipeline.003.etl
 data
 #
C:\Program Files\UNP\Logs\UpdateNotificationPipeline.003.etl.7878kr5jx (copy)
 data
 #
C:\Program Files\UNP\Logs\UpdateNotificationPipeline.004.etl
 data
 #
C:\Program Files\UNP\Logs\UpdateNotificationPipeline.004.etl.7878kr5jx (copy)
 data
 #
C:\Program Files\UNP\Logs\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\UNP\UpdateNotificationMgr\.UpdateNotificationMgr_LockFile
 data
 #
C:\Program Files\UNP\UpdateNotificationMgr\.UpdateNotificationMgr_LockFile.7878kr5jx (copy)
 data
 #
C:\Program Files\UNP\UpdateNotificationMgr\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\UNP\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Uninstall Information\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Defender Advanced Threat Protection\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Defender\en-US\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Defender\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Mail\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Media Player\Media Renderer\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Media Player\Network Sharing\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Media Player\Skins\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Media Player\Visualizations\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Media Player\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Multimedia Platform\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Photo Viewer\en-US\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Photo Viewer\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Portable Devices\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Security\BrowserCore\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Windows Security\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\WindowsPowerShell\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\internet explorer\SIGNUP\install.ins
 COM executable for DOS
 #
C:\Program Files\internet explorer\SIGNUP\install.ins.7878kr5jx (copy)
 COM executable for DOS
 #
C:\Program Files\internet explorer\SIGNUP\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\internet explorer\en-US\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\internet explorer\images\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\windows nt\accessories\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\windows nt\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Program Files\windows nt\tabletextservice\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\ProgramData\Adobe\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\ProgramData\Microsoft Help\MS.DATABASECOMPARE.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.DATABASECOMPARE.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.EXCEL.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.EXCEL.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.GRAPH.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.GRAPH.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.GROOVE.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.GROOVE.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.LYNC.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.LYNC.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.LYNC_BASIC.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.LYNC_BASIC.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.LYNC_ONLINE.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.LYNC_ONLINE.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.MSACCESS.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.MSACCESS.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.MSOUC.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.MSOUC.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.MSPUB.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.MSPUB.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.ONENOTE.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.ONENOTE.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.OUTLOOK.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.OUTLOOK.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.POWERPNT.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.POWERPNT.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.SETLANG.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.SETLANG.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.SKYPEFB.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.SKYPEFB.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.SKYPEFB_BASIC.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.SKYPEFB_BASIC.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.SKYPEFB_ONLINE.16.1033.hxn
 OpenPGP Public Key
 #
C:\ProgramData\Microsoft Help\MS.SKYPEFB_ONLINE.16.1033.hxn.7878kr5jx (copy)
 OpenPGP Public Key
 #
C:\ProgramData\Microsoft Help\MS.SKYPEFB_ONLINEG.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.SKYPEFB_ONLINEG.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.SPREADSHEETCOMPARE.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.SPREADSHEETCOMPARE.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\MS.WINWORD.16.1033.hxn
 data
 #
C:\ProgramData\Microsoft Help\MS.WINWORD.16.1033.hxn.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft Help\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\ProgramData\Microsoft Help\nslist.hxl
 data
 #
C:\ProgramData\Microsoft Help\nslist.hxl.7878kr5jx (copy)
 data
 #
C:\ProgramData\Microsoft OneDrive\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\ProgramData\Oracle\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\ProgramData\Package Cache\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\ProgramData\SoftwareDistribution\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\ProgramData\USOPrivate\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\ProgramData\USOShared\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\ProgramData\WindowsHolographicDevices\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\ProgramData\dbg\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\ProgramData\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\ProgramData\regid.1991-06.com.microsoft\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Microsoft Office Professional Plus 2016.swidtag
 data
 #
C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Microsoft Office Professional Plus 2016.swidtag.7878kr5jx (copy)
 data
 #
C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag
 data
 #
C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.7878kr5jx (copy)
 data
 #
C:\Users\Default\NTUSER.DAT
 data
 #
C:\Users\Default\NTUSER.DAT.7878kr5jx (copy)
 data
 #
C:\Users\Default\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Users\Public\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\fkdjsadasd.ico
 MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel
 #
C:\Users\user\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\Users\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #
C:\instructions_read_me.txt
 ASCII text, with CRLF line terminators
 #