'
metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2016-11-08 16:48:53.632388 2016-11-08 16:54:40.095647 346 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo2 win7 Clone 2 VirtualBox 2016-11-08 16:51:45 2016-11-08 16:54:39

File Details

File name 0c800fe35e480b0eb2dd492703ff74dcc1412398.zip
File size 1118 bytes
File type Zip archive data, at least v2.0 to extract
CRC32 A49B3D96
MD5 16a3ad367d1fd99ce9b4c4269beff6a6
SHA1 0c800fe35e480b0eb2dd492703ff74dcc1412398
SHA256 d03f6126575c0c5b29cdc78b9749acf47984fdfdc77e09548d174749676f9dbc
SHA512 daaa3a3cc044574e93eea35a8942bc16198febe8f39bdc1bf35bcd312fce8a11b1b868ec2f59ee8fe256ea77078947a8e6a5a86edb1e1e8d5131b9efff008040
Ssdeep 24:9DYvmiiyPIi9RyntbLljEMInjSNPv3xxqhyBDsgoK+ngYo:9DniiygcU14njWPvah8KK+ngb
PEiD None matched
Yara
  • PM_Zip_with_js ()
VirusTotal Permalink
VirusTotal Scan Date: 2016-11-08 13:36:45
Detection Rate: 8/56 (Expand)

MetaFlows Scores

Metaflows Analysis Results (Signatures=125, Anomalies=0, PEiD=0, Yara=2, VT[1478624119]=100): Snort Events=2, AV Events=2
Total Score=125

SNORT EVENTS:
ET POLICY PE EXE or DLL Windows file download HTTP
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

CLAMAV DETECTED:
Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND
DROPPED FILE - NRV_6NE59609_.js: Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND

Dropped File/Buffer Yara Signatures:
f51f47545f70258e34b0f6a72692072c616b016d [BUFFER]: shellcode
c92a3b7c1463fca97739f9ce600151c58a478f02 [BUFFER]: Str_Win32_Http_API

Signatures

antivm_queries_computername details
recon_fingerprint details
antivm_memory_available details
dumped_buffer details
creates_doc details
antivm_network_adapters details
dumped_buffer2 details
antivm_vbox_files details
Windows_Proxy_Tinkering details
network_wscript_downloader details
persistence_ads details
antiav_detectfile details
exploit_heapspray details
malicious_document_urls details
network_document_file details
network_downloader_exe details
antivm_vbox_devices details
antivm_vbox_files details
modifies_files details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

56ba531448611d4e_gizcrygj-7am0-fzca-7b5b-df885b44eabe.thor

7af0b9c17dfb1cf5_gizcrygj-7am0-fzca-568c-ae5f021e50d3.thor

0ff7f84ce4cef972_gizcrygj-7am0-fzca-fe9e-55f23bb81826.thor

982e47ae0b031904_gizcrygj-7am0-fzca-9aac-857183d20d2f.thor

7534b1181c495c7b_gizcrygj-7am0-fzca-7a51-59ce5a4a28b5.thor

86b97c0d4ea0e88b_gizcrygj-7am0-fzca-9415-be88976ed310.thor

096067ab740a889d_gizcrygj-7am0-fzca-6de2-81c1acca4345.thor

56c2aa475c39176d_gizcrygj-7am0-fzca-66a6-ab94decf2c23.thor

9e0a273c75cbdd5b_gizcrygj-7am0-fzca-08e0-b2a5cba887a4.thor

58cda07f44a20cc4_gizcrygj-7am0-fzca-ad87-1e8bfaf081bd.thor

7721c788cb5e5c07_gizcrygj-7am0-fzca-bf27-94dfa2e25502.thor

1c518b9f6f75182f_gizcrygj-7am0-fzca-16d2-938b2042c1cd.thor

18a081d5998fd7f0_gizcrygj-7am0-fzca-5f8a-8805e84d4820.thor

c6ff882e13059476_gizcrygj-7am0-fzca-6050-f70531ce0063.thor

2dc825e063848106_gizcrygj-7am0-fzca-de0e-6a72c9720700.thor

434eda0dd6882bac_gizcrygj-7am0-fzca-6525-781137e31a5f.thor

4b458d022b64b6d8_gizcrygj-7am0-fzca-5ba5-af0cad98c6f4.thor

7a88b4d0259bae11_gizcrygj-7am0-fzca-0dbe-b232213277f2.thor

5c6590162e8e5347_gizcrygj-7am0-fzca-bb37-34f84d278133.thor

4b64975aad96a0b9_gizcrygj-7am0-fzca-c7b8-a8cb92874470.thor

6bda243db4bde388_gizcrygj-7am0-fzca-517e-6aeb623a4f6f.thor

00b9ec76ec9f7923_gizcrygj-7am0-fzca-3423-ee528acd8196.thor

fd71cacf1bc374eb_gizcrygj-7am0-fzca-d398-42835bc0f39c.thor

ff956fbbf84a4612_gizcrygj-7am0-fzca-f722-72177bce21f5.thor

d5a6485a0a927f91_gizcrygj-7am0-fzca-5d7f-9573433d02fc.thor

30e87f4d5bdd693d_gizcrygj-7am0-fzca-d9d1-191121534340.thor

6ca8d750a686fbad_gizcrygj-7am0-fzca-2499-40430b58cd54.thor

43a0d84f9326c7b8_gizcrygj-7am0-fzca-1237-1c9d89773da5.thor

8e351abf2ddecf21_gizcrygj-7am0-fzca-4879-10713453be33.thor

cdc6a37675421af9_gizcrygj-7am0-fzca-c538-f1e8bd4fe587.thor

ad8d1cb17332f081_gizcrygj-7am0-fzca-404e-20624bc9e1df.thor

f3fb157efec9ecc7_gizcrygj-7am0-fzca-adc9-e3aeaa08d549.thor

014aaa9b7b38bfff_gizcrygj-7am0-fzca-8911-8ab7aa3930a8.thor

ff4230c2d24bb584_gizcrygj-7am0-fzca-62ad-69514fe4ea27.thor

959956fd38b40a17_gizcrygj-7am0-fzca-dc30-e6ca361befc3.thor

afcf05ff01be2cbb_gizcrygj-7am0-fzca-db50-001c772845ba.thor

b012985022a1ba58_gizcrygj-7am0-fzca-30b4-83f2c48d58c1.thor

aeab6b08dc61cf5d_gizcrygj-7am0-fzca-d478-680f9d734cc2.thor

c52b33101d22f248_gizcrygj-7am0-fzca-4ddd-33d5b6df0361.thor

a00fad475b3493c9_gizcrygj-7am0-fzca-cf98-a490e140e1b1.thor

16294f5283d29183_gizcrygj-7am0-fzca-26ad-7231c791d07d.thor

064c2ee1a602487e_gizcrygj-7am0-fzca-8349-e2a9b9fc11ed.thor

1281ca4eec30dd05_gizcrygj-7am0-fzca-2cab-a1524040e881.thor

1c725f4c9248685c_gizcrygj-7am0-fzca-a0e1-f188acf632d5.thor

cfda61595b1adb94_gizcrygj-7am0-fzca-db7e-63d42bed0b8c.thor

944cf8f187ff9791_gizcrygj-7am0-fzca-3026-ad9d7a154fc7.thor

8b5cea1a81cc39b9_gizcrygj-7am0-fzca-e992-501b35c5e880.thor

6e51be1e2d227a98_gizcrygj-7am0-fzca-44a0-8900d2e0c905.thor

9c5177dc2b9921d4_gizcrygj-7am0-fzca-44d7-dfa99dd1348c.thor

52c4a198030539d3_gizcrygj-7am0-fzca-d7e0-3f3e5e816857.thor

5000eafd3a215541_gizcrygj-7am0-fzca-a5b8-ddc29b2ef7c7.thor

c426833f331ad49e_gizcrygj-7am0-fzca-1aa8-f0dcdca4717e.thor

a86da1575dd7b571_gizcrygj-7am0-fzca-0c49-2bc8afafe5d2.thor

01c3795321a66395_gizcrygj-7am0-fzca-84a0-a3bc10e22ccd.thor

4008566c4d7744a1_gizcrygj-7am0-fzca-c165-ee51f287a62e.thor

e8bde0c2a0cbad4b_gizcrygj-7am0-fzca-3459-75dd6dc17ca1.thor

b1d8f064d751c18f_gizcrygj-7am0-fzca-3764-20919118c542.thor

6e38bebae231bc5c_gizcrygj-7am0-fzca-37b3-6c1633b1a009.thor

6fc617720d5069b0_gizcrygj-7am0-fzca-b03f-c4b9cea2a328.thor

3b7f5e04d24271f5_gizcrygj-7am0-fzca-f6d4-4f2f97e48b7f.thor

f2ae7331b26b3095_gizcrygj-7am0-fzca-4a94-0ae80cf07b99.thor

f7756bbee82f2de4_gizcrygj-7am0-fzca-f56c-8b8b2be17bf8.thor

f532863fe7b1ed31_gizcrygj-7am0-fzca-548a-9fe8f7d84bc7.thor

cc01b4e7b61fac80_gizcrygj-7am0-fzca-4fb9-c68e9e80d40d.thor

02d4ace0cf26650b_gizcrygj-7am0-fzca-c0dd-4c2ce59d8de1.thor

53acb8d90eb640d8_gizcrygj-7am0-fzca-3837-2fee1182ddc3.thor

f7cde355d46e6c79_gizcrygj-7am0-fzca-be55-876d2e54df1d.thor

5fa6c44929395fec_gizcrygj-7am0-fzca-b2e4-e6078256c849.thor

b07fda960f186f93_gizcrygj-7am0-fzca-57fd-efdf85ae04f4.thor

331a6e6c75eb1fbb_gizcrygj-7am0-fzca-8c25-48f0e226074c.thor

5ea9e728d5f6f778_gizcrygj-7am0-fzca-9a5d-7f14f9829033.thor

857b0676a9c48db3_gizcrygj-7am0-fzca-c251-7f8dc8618307.thor

d3bfdf6d3fbbb6bc_gizcrygj-7am0-fzca-3323-71e74cf63f1e.thor

e23922240c494807_gizcrygj-7am0-fzca-be77-a2bed3958ca6.thor

25e3f2ccd566af1f_gizcrygj-7am0-fzca-1fa3-bae63797ff03.thor

10a4088538054ff0_gizcrygj-7am0-fzca-c775-7bb57883ac42.thor

a90c91c256643a01_gizcrygj-7am0-fzca-8f0a-0f13d2df5958.thor

dc856e5ec4c804d4_gizcrygj-7am0-fzca-f270-b84407463ad4.thor

15c3235bcd67a2dc_gizcrygj-7am0-fzca-c982-03d580c88572.thor

28f11594803a45ef_gizcrygj-7am0-fzca-6d71-8fedeca5130b.thor

07872e8e46c0eb0e_gizcrygj-7am0-fzca-8fe4-8a5db59e6dd5.thor

e32b4894af65ab7f_gizcrygj-7am0-fzca-303b-a25baccddde7.thor

4cac043e2cdce0e9_gizcrygj-7am0-fzca-928a-d4beb73ce646.thor

035a8b0417dc1128_gizcrygj-7am0-fzca-cfee-700bfd03a20b.thor

7c473df5122d5a1d_gizcrygj-7am0-fzca-408b-91787d5c8980.thor

7f9003b730f6b7da_gizcrygj-7am0-fzca-93cb-1c59ae40436d.thor

94b0d5df6e4ab756_gizcrygj-7am0-fzca-7909-89e27c0dd4ee.thor

dd0eda69cce3eae9_gizcrygj-7am0-fzca-d51c-9b136b28efdf.thor

e11224d0867475f2_gizcrygj-7am0-fzca-63d4-b8a398f09180.thor

71dae71bb4c7b021_gizcrygj-7am0-fzca-063c-04be2933f6dc.thor

031ff954118815b0_gizcrygj-7am0-fzca-41db-0bb1332294da.thor

385985560068fb48_gizcrygj-7am0-fzca-4e58-b9b1c34f67a5.thor

6c1bf612f3a8ab27_gizcrygj-7am0-fzca-0c0f-9db7c21a6d9f.thor

0931560534f4e1a7_gizcrygj-7am0-fzca-1ff8-49411c13e766.thor

905964185589851b_gizcrygj-7am0-fzca-cc7a-8171b285cb8b.thor

8c4b44729422840b_gizcrygj-7am0-fzca-996a-a45acfa929be.thor

0306966b78776d13_gizcrygj-7am0-fzca-7b9c-6bac150cc797.thor

916f60fbc0aa5860__26_what_is.html

ef492f2852d78204_gizcrygj-7am0-fzca-97ba-3d4d01526a99.thor

de2c2baed764cb46_gizcrygj-7am0-fzca-57d0-a8035f64d5ee.thor

69a2fba496280b06_gizcrygj-7am0-fzca-4bca-ba4c8b72035e.thor

d48857b6a6b100d7_gizcrygj-7am0-fzca-4b3c-d5675780638c.thor

3239e3c2c524c399_gizcrygj-7am0-fzca-60fb-df80d4984397.thor

6eea2d7122c54045_gizcrygj-7am0-fzca-a89e-ec5eb86a639b.thor

6889c7d8789e03c6_gizcrygj-7am0-fzca-e0dc-adf774feb1e7.thor

5b848e9784e31434_gizcrygj-7am0-fzca-cd08-65e919219b2f.thor

b444f940bff7ee6f_gizcrygj-7am0-fzca-f8a4-e14a84ccb20f.thor

de2d6107e59fb969_gizcrygj-7am0-fzca-fe4f-5b44a578bb39.thor

ceea307ba9cf272a_gizcrygj-7am0-fzca-1b18-ff19c5f49ab0.thor

d9fc4c75fe7a5c28_gizcrygj-7am0-fzca-16d6-22af490eb85c.thor

f51f59d8a92e0697_gizcrygj-7am0-fzca-e48d-252c5e9bc51a.thor

211b0e400abc03f8_gizcrygj-7am0-fzca-7753-2c7d4f64b7a5.thor

e8cfeb67dcd5f1ea_gizcrygj-7am0-fzca-7e77-a36c63250401.thor

c7ebafa00eed3780_gizcrygj-7am0-fzca-3b44-97c62c2b2300.thor

ef26b631621cf30b_gizcrygj-7am0-fzca-ad2e-0ac80bec16d3.thor

7c3a4628e5483b90_gizcrygj-7am0-fzca-dcb3-73004bbc6528.thor

e27a54e5951f9a0c_gizcrygj-7am0-fzca-0f4f-1078337d755d.thor

ae51a7bd96e59835_gizcrygj-7am0-fzca-e6a4-8c95de54137c.thor

930b2ab398dd0ed5_gizcrygj-7am0-fzca-0303-d0cff4d7c532.thor

c137537149a59b70_gizcrygj-7am0-fzca-71dd-b62a3170331c.thor

49277f179ee5f612_gizcrygj-7am0-fzca-2dc6-505628def510.thor

b6ce1f8a71262119_gizcrygj-7am0-fzca-7b8d-ffda3a666a4a.thor

7d899e71c5524a64_gizcrygj-7am0-fzca-6279-5562151a6e42.thor

309aab9ea9f34e94_gizcrygj-7am0-fzca-19e5-18ab434f76c0.thor

e55a6efb3136b6fc_gizcrygj-7am0-fzca-366a-68041d78eecc.thor

94882fe31b73410c_gizcrygj-7am0-fzca-f979-80bf204929d1.thor

e2a61af878bdd2df_gizcrygj-7am0-fzca-49f9-da4456a09d7d.thor

c39a9462740e124e_gizcrygj-7am0-fzca-d9cf-839a029a39f2.thor

4e6535e96707a3c0_gizcrygj-7am0-fzca-c1c5-ca68400cb132.thor

8b935c6ba5b68228_gizcrygj-7am0-fzca-dfb1-4eabd7c88ce2.thor

817374a14ad5f732_gizcrygj-7am0-fzca-c454-b5cf87a01293.thor

28fa3918a8ccc3cc_gizcrygj-7am0-fzca-0854-343f005230dc.thor

47149016dc25c006_gizcrygj-7am0-fzca-2234-fd8209eea089.thor

3ad01f16819f817e_gizcrygj-7am0-fzca-7d66-314a18224a8c.thor

eedab5a85f88433d_gizcrygj-7am0-fzca-ef78-7fdd1632c1fd.thor

07d9f32b08223eb6_gizcrygj-7am0-fzca-338e-a7156a9c372b.thor

1c7a847171a17191_gizcrygj-7am0-fzca-aac2-1f05702afe51.thor

765395c221f4ef42_gizcrygj-7am0-fzca-1674-0aebb2c64deb.thor

619893d97ec8390b_kxgqlzdazyfmv.dll

72432502d167da37_gizcrygj-7am0-fzca-fd77-4f989f23e5ef.thor

34761f858f6ec171_gizcrygj-7am0-fzca-5da9-24de07c652ed.thor

2b6cf8f0a6407cf3_gizcrygj-7am0-fzca-78be-f7f075a11176.thor

f92bb1056a07cd44_gizcrygj-7am0-fzca-d454-fe28c101ded7.thor

a82c0f5171c0406a_gizcrygj-7am0-fzca-60c7-0589450c8025.thor

0ee41de2f4e91cef_gizcrygj-7am0-fzca-0726-695978b148fc.thor

0bda30bafb3c7cda_gizcrygj-7am0-fzca-7c02-d2c45efded93.thor

bc294e5c3ea6280f_gizcrygj-7am0-fzca-e6e8-ca36d654874a.thor

ead8dca58d061838_gizcrygj-7am0-fzca-91e3-32c3e0018f28.thor

573cdb1858fe01c1_gizcrygj-7am0-fzca-f602-da3ad702bd33.thor

1095ec7ef446f01d_gizcrygj-7am0-fzca-cebe-689f99574767.thor

748e7a48d0449bce_gizcrygj-7am0-fzca-2235-72943727255f.thor

509a3fa658519982_gizcrygj-7am0-fzca-90cc-bda50f05b6b1.thor

d45100d9a489ca6f_gizcrygj-7am0-fzca-f6b6-1c9728a90575.thor

3b51a586e29a2ca4_gizcrygj-7am0-fzca-0baf-7278c4c4d1f7.thor

11ece4968a3483a3_gizcrygj-7am0-fzca-f79d-9603f8ec7023.thor

55bc87018c7090a6_gizcrygj-7am0-fzca-39f6-d99cda4db7c6.thor

87ef4ad9c519e3c5_gizcrygj-7am0-fzca-e693-248eab344986.thor

c8835d6f19a9b1ce_gizcrygj-7am0-fzca-fd04-3eb377fbb857.thor

NRV_6NE59609_.js

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

Behavior Summary

File-Read
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\qiMqMFqEpbdrWNMGt.docm
  • c:\zjwmukavuf\bin\cert.p12
  • c:\Python27\include\errcode.h
  • c:\Python27\Lib\test\keycert3.pem
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\BPtcODUexIBpzGiKpu.txt
  • c:\Python27\include\pyexpat.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\tupleobject.h
  • c:\Python27\include\parsetok.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\enumobject.h
  • c:\Python27\include\warnings.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • c:\Python27\include\structseq.h
  • c:\Python27\include\floatobject.h
  • c:\Python27\include\Python-ast.h
  • c:\Python27\include\osdefs.h
  • c:\Python27\Lib\test\empty.vbs
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • c:\Python27\include\pymacconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Python27\include\ceval.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\Python27\include\import.h
  • \\?\PIPE\browser
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\pymem.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\Python27\include\pyarena.h
  • c:\Python27\include\pygetopt.h
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\Python27\include\complexobject.h
  • c:\Python27\include\ast.h
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\Python27\include\rangeobject.h
  • c:\Python27\include\pgenheaders.h
  • c:\Python27\include\pythread.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • c:\Python27\include\patchlevel.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\include\iterobject.h
  • c:\Python27\include\memoryobject.h
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\Python27\include\funcobject.h
  • c:\Python27\include\listobject.h
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\Python27\include\marshal.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • c:\Python27\include\frameobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\DikCBBBwxCDVDWy.ppt
  • c:\Python27\include\longintrepr.h
  • c:\Python27\include\opcode.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\Python27\Lib\test\badcert.pem
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • c:\6cdeacda242012e0e5b593e657\1043\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1038\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\include\sliceobject.h
  • c:\Python27\include\pgen.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • c:\Python27\include\moduleobject.h
  • c:\Python27\Lib\test\wrongcert.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • c:\Python27\include\objimpl.h
  • c:\Python27\include\Python.h
  • c:\Python27\include\fileobject.h
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\Python27\include\pyerrors.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\Python27\include\token.h
  • c:\Python27\include\bitset.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\yPpodLVTGVFXib.docm
  • c:\Python27\include\intobject.h
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\include\dictobject.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\Python27\include\abstract.h
  • c:\Python27\include\pystate.h
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\Python27\Lib\test\keycert.passwd.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\include\methodobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\include\object.h
  • c:\Python27\include\descrobject.h
  • c:\Python27\include\pyconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • c:\Python27\include\cobject.h
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • \\?\PIPE\wkssvc
  • c:\Python27\include\pymath.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\timefuncs.h
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\Python27\tcl\tclConfig.sh
  • c:\Python27\include\node.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\Python27\include\ucnhash.h
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\keycert2.pem
  • c:\Python27\include\py_curses.h
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\include\pyport.h
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml
  • c:\Python27\include\graminit.h
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\symtable.h
  • c:\Python27\include\setobject.h
  • c:\Python27\include\boolobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\UZXMILVotRymaGlC.rtf
  • c:\Python27\Lib\test\pycacert.pem
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\code.h
  • c:\Python27\include\dtoa.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\Python27\include\eval.h
  • c:\Python27\include\asdl.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\Lib\idlelib\idle.bat
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\MxXfvHhcbVMSK.docx
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • c:\Python27\include\bytearrayobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\Python27\include\grammar.h
  • c:\Python27\Lib\test\badkey.pem
  • c:\Python27\include\cStringIO.h
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • c:\Python27\include\pyctype.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\Python27\Lib\test\nokia.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\Python27\include\intrcheck.h
  • c:\Python27\include\pydebug.h
  • \\?\PIPE\lsarpc
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • c:\Python27\include\metagrammar.h
  • c:\Python27\include\stringobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\OJGTKVTlyWwuMn.pptx
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\Python27\include\structmember.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • c:\Python27\Lib\test\dh1024.pem
  • c:\Python27\Lib\test\185test.db
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • c:\Python27\Lib\test\sha256.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\include\pycapsule.h
  • c:\Python27\include\modsupport.h
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\include\classobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\weakrefobject.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • c:\Python27\include\bufferobject.h
  • c:\Python27\include\datetime.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\Python27\include\unicodeobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\KIDSROOM\Users\Default\NTUSER.DAT.LOG
  • c:\Python27\include\pyfpe.h
  • c:\Python27\include\compile.h
  • c:\Python27\include\genobject.h
  • c:\Python27\include\cellobject.h
  • c:\Python27\include\codecs.h
  • C:\Users\Harry Dresden\Desktop\desktop.ini
  • C:\Windows\System32\wshom.ocx
  • C:\Windows\System32\wscript.exe
  • C:\Windows\System32\msxml3.dll
  • C:\Users\Harry Dresden\AppData\Local\Temp\NRV_6NE59609_.js
File-Written
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\Python27\include\object.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\qiMqMFqEpbdrWNMGt.docm
  • c:\zjwmukavuf\bin\cert.p12
  • c:\Python27\include\errcode.h
  • c:\Python27\Lib\test\keycert3.pem
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\BPtcODUexIBpzGiKpu.txt
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml
  • c:\Python27\include\pyexpat.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\tupleobject.h
  • c:\Python27\include\parsetok.h
  • c:\Python27\Lib\idlelib\_30_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\enumobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • c:\Python27\tcl\tix8.4.3\pref\_29_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • c:\Python27\include\warnings.h
  • c:\Python27\include\structseq.h
  • c:\Python27\include\floatobject.h
  • c:\Python27\include\Python-ast.h
  • c:\Python27\include\osdefs.h
  • c:\Python27\Lib\test\empty.vbs
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • c:\Python27\include\pymacconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Python27\include\ceval.h
  • c:\6cdeacda242012e0e5b593e657\1043\_11_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\6cdeacda242012e0e5b593e657\1055\_17_WHAT_is.html
  • c:\Python27\include\import.h
  • \\?\PIPE\browser
  • c:\Python27\include\pythonrun.h
  • c:\6cdeacda242012e0e5b593e657\1045\_13_WHAT_is.html
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\Python27\include\pyarena.h
  • c:\Python27\include\pygetopt.h
  • c:\6cdeacda242012e0e5b593e657\1025\_23_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\Python27\Lib\test\nullcert.pem
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos\_10_WHAT_is.html
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • UNC\KIDSROOM\Users\Default\_13_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\3082\_20_WHAT_is.html
  • c:\Python27\include\complexobject.h
  • c:\6cdeacda242012e0e5b593e657\1038\_7_WHAT_is.html
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\Python27\include\rangeobject.h
  • c:\Python27\include\pgenheaders.h
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts\_11_WHAT_is.html
  • c:\Python27\include\pythread.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • c:\6cdeacda242012e0e5b593e657\1036\_6_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\6cdeacda242012e0e5b593e657\1032\_28_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\_9_WHAT_is.html
  • c:\Python27\include\iterobject.h
  • c:\Python27\include\memoryobject.h
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\Python27\include\ast.h
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Python27\include\funcobject.h
  • c:\6cdeacda242012e0e5b593e657\2052\_18_WHAT_is.html
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\_5_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\Python27\include\marshal.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1041\_9_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • c:\Python27\include\pyfpe.h
  • c:\Python27\include\frameobject.h
  • c:\Python27\Lib\test\_0_WHAT_is.html
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\DikCBBBwxCDVDWy.ppt
  • c:\Python27\include\longintrepr.h
  • c:\Python27\include\opcode.h
  • c:\6cdeacda242012e0e5b593e657\1031\_27_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\_1_WHAT_is.html
  • c:\Python27\Lib\test\badcert.pem
  • c:\zjwmukavuf\bin\_2_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • c:\6cdeacda242012e0e5b593e657\1043\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1038\LocalizedData.xml
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\_2_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1053\_16_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\include\sliceobject.h
  • c:\Python27\include\pgen.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\include\patchlevel.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • c:\Python27\include\moduleobject.h
  • c:\Python27\Lib\test\wrongcert.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • c:\Python27\include\objimpl.h
  • c:\Python27\include\Python.h
  • c:\Python27\include\fileobject.h
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\Python27\include\pyerrors.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\Python27\include\token.h
  • c:\Python27\include\metagrammar.h
  • c:\Python27\include\bitset.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\_6_WHAT_is.html
  • c:\Python27\include\intobject.h
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\include\dictobject.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\Python27\include\timefuncs.h
  • c:\Python27\include\abstract.h
  • c:\Python27\include\pystate.h
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\Python27\Lib\test\keycert.passwd.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\include\methodobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\_0_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1042\_10_WHAT_is.html
  • c:\Python27\include\pyconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • c:\Python27\include\cobject.h
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • \\?\PIPE\wkssvc
  • c:\Python27\include\pymath.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\modsupport.h
  • c:\ProgramData\WebEx\WebEx\12_1324\_22_WHAT_is.html
  • c:\Python27\tcl\tclConfig.sh
  • c:\Python27\include\node.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • c:\6cdeacda242012e0e5b593e657\1037\_21_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\6cdeacda242012e0e5b593e657\1046\_14_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\Python27\include\ucnhash.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\_3_WHAT_is.html
  • c:\Python27\include\structmember.h
  • c:\Python27\Lib\test\keycert2.pem
  • c:\Python27\include\py_curses.h
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\include\pyport.h
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml
  • c:\Python27\include\listobject.h
  • c:\Python27\include\graminit.h
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\symtable.h
  • c:\Python27\include\setobject.h
  • c:\6cdeacda242012e0e5b593e657\1040\_8_WHAT_is.html
  • c:\Python27\include\boolobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\UZXMILVotRymaGlC.rtf
  • c:\Python27\Lib\test\pycacert.pem
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\code.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\_12_WHAT_is.html
  • c:\Python27\include\dtoa.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\Python27\include\eval.h
  • c:\Python27\include\asdl.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\Lib\idlelib\idle.bat
  • c:\6cdeacda242012e0e5b593e657\1028\_24_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • c:\Python27\include\_3_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1029\_25_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\MxXfvHhcbVMSK.docx
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • c:\Python27\include\bytearrayobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\yPpodLVTGVFXib.docm
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\_8_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\Python27\include\grammar.h
  • c:\Python27\Lib\test\badkey.pem
  • c:\Python27\include\cStringIO.h
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • c:\Python27\include\pyctype.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\Python27\Lib\test\nokia.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\Python27\include\intrcheck.h
  • c:\Python27\include\pydebug.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\_7_WHAT_is.html
  • \\?\PIPE\lsarpc
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1044\_12_WHAT_is.html
  • c:\Python27\include\stringobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\OJGTKVTlyWwuMn.pptx
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\6cdeacda242012e0e5b593e657\2070\_19_WHAT_is.html
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\6cdeacda242012e0e5b593e657\1035\_5_WHAT_is.html
  • c:\Python27\include\pymem.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • c:\Python27\Lib\test\dh1024.pem
  • c:\Python27\tcl\_31_WHAT_is.html
  • c:\Python27\Lib\test\185test.db
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • c:\Python27\Lib\test\sha256.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\include\pycapsule.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\_4_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\include\descrobject.h
  • c:\Python27\include\classobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\weakrefobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\_1_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1033\_4_WHAT_is.html
  • c:\Python27\include\bufferobject.h
  • c:\Python27\include\datetime.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • c:\6cdeacda242012e0e5b593e657\1030\_26_WHAT_is.html
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\Python27\include\unicodeobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\KIDSROOM\Users\Default\NTUSER.DAT.LOG
  • c:\6cdeacda242012e0e5b593e657\1049\_15_WHAT_is.html
  • c:\Python27\include\compile.h
  • c:\Python27\include\genobject.h
  • c:\Python27\include\cellobject.h
  • c:\Python27\include\codecs.h
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YLC2QM2Y\766epkuj[1].txt
  • C:\Users\Harry Dresden\AppData\Local\Temp\KXgQLZDAZyFMV.dll
File-Opened
  • c:\Python27\include\frameobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\ctypes
  • c:\Users\Default\Links
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages
  • c:\Python27\include\ast.h
  • c:\Python27\include\memoryobject.h
  • c:\Python27\Lib\site-packages\pip\_vendor\colorama
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources
  • c:\Python27\DLLs
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol
  • c:\Python27\include\tupleobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\DikCBBBwxCDVDWy.ppt
  • c:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\qiMqMFqEpbdrWNMGt.docm
  • UNC\KIDSROOM\Users\Default\Documents
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\en-US
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Users\Harry Dresden\OneDrive
  • c:\Python27\include\grammar.h
  • c:\ProgramData\Microsoft\PlayReady\Cache\S-1-5-21-3416602863-1947377224-293699093-1001
  • c:\Python27\include\import.h
  • c:\Users\Public\Libraries
  • \\?\PIPE\browser
  • c:\Python27\Lib\test\tracedmodules
  • c:\Python27\tcl\tcl8.5\tzdata\Indian
  • c:\Users\Public
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Queue
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource
  • c:\Python27\Lib
  • \??\VBoxMiniRdrDN
  • c:\ProgramData
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}
  • c:\Python27\Lib\site-packages\pip
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A6
  • c:\Python27\Lib\ctypes\macholib
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\Security
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\inetpub\history\CFGHISTORY_0000000004\schema
  • c:\Python27\Lib\unittest\test
  • c:\ProgramData\Microsoft\PlayReady
  • c:\Python27\Lib\xml\dom
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\Python27\Lib\site-packages\pip\models
  • c:\Python27\include\marshal.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate
  • c:\Python27\Tools\i18n
  • c:\Python27\tcl\tcl8\8.4
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog
  • c:\ProgramData\Microsoft\Crypto\Keys
  • UNC\KIDSROOM\Users\Public\Videos
  • c:\Python27\Lib\test
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos
  • c:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319
  • c:\Python27\Lib\ctypes\test
  • c:\Users\Harry Dresden\Searches
  • c:\Python27\Lib\test\badcert.pem
  • c:\Python27\Lib\ensurepip
  • c:\Python27\include\pgen.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\Users\Harry Dresden\Downloads
  • c:\Python27\include\objimpl.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\ProgramData\Microsoft\eHome
  • c:\Python27\tcl\tk8.5\demos\images
  • c:\Python27\Lib\test\cjkencodings
  • c:\inetpub\wwwroot\aspnet_client\system_web
  • c:\Python27\tcl\tcl8.5\tzdata\America\Kentucky
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US
  • c:\Python27\include\moduleobject.h
  • c:\Python27\include\abstract.h
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\keycert.passwd.pem
  • c:\Python27\include\object.h
  • c:\ProgramData\Adobe\Setup
  • c:\Python27\include\complexobject.h
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • c:\ProgramData\Microsoft\Network\Downloader
  • c:\Python27\include\Python-ast.h
  • c:\inetpub\history\CFGHISTORY_0000000005
  • c:\inetpub\history\CFGHISTORY_0000000004
  • c:\inetpub\history\CFGHISTORY_0000000001
  • c:\Python27\include\pydebug.h
  • c:\inetpub\history\CFGHISTORY_0000000003
  • c:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204
  • c:\Users\Harry Dresden\Favorites\Links for United States
  • c:\Python27\Lib\lib2to3\tests\data\fixers
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\Python27\tcl\tcl8.5\tzdata\US
  • c:\Python27\tcl\tcl8.5\tzdata
  • c:\Python27\include\pyport.h
  • c:\Python27\Lib\email
  • c:\Python27\tcl\tix8.4.3\demos\samples
  • c:\Python27\Lib\lib-tk\test\test_tkinter
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\Tools\webchecker
  • c:\Python27\tcl\tcl8.5\tzdata\America\North_Dakota
  • c:\Python27\Lib\test\crashers
  • c:\ProgramData\Microsoft\Windows Defender\LocalCopy
  • c:\Python27\include\dtoa.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\Python27\include\asdl.h
  • c:\Python27\Lib\test\empty.vbs
  • c:\Users\Harry Dresden\Contacts
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0
  • c:\PerfLogs
  • c:\zjwmukavuf\modules\packages
  • C:\Windows\SysWOW64\en-US\VssTrace.DLL.mui
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders
  • c:\Python27\tcl\tcl8\8.5
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • c:\Python27\libs
  • c:\ProgramData\Microsoft\ClickToRun\MachineData
  • c:\Python27\include\pyexpat.h
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • UNC\KIDSROOM\Users\Public
  • c:\ProgramData\Microsoft\Assistance
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\pyctype.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results
  • c:\Users\Harry Dresden\Videos
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • c:\Python27\Lib\pydoc_data
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • c:\Python27\Lib\test\nokia.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • c:\ProgramData\Microsoft\Crypto\DSS
  • c:\ProgramData\Adobe\Acrobat
  • c:\Python27\tcl\tcl8.5\tzdata\Atlantic
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • c:\ProgramData\Microsoft\Network
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger
  • c:\Users\Default\Downloads
  • c:\Python27\Lib\xml
  • c:\Python27\tcl\tcl8.5\tzdata\Australia
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • c:\Python27\tcl\tk8.5
  • c:\ProgramData\Microsoft\PlayReady\Cache
  • c:\6cdeacda242012e0e5b593e657\3082
  • c:\Python27\Lib\site-packages\pip\compat
  • c:\Python27\Lib\test\leakers
  • c:\Python27\tcl\tcl8\8.4\platform
  • c:\Python27\include\modsupport.h
  • c:\ProgramData\regid.1991-06.com.microsoft
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\filters
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\DD
  • c:\Python27\Tools\pynche\X
  • c:\Python27\tcl\tix8.4.3\pref
  • c:\Python27\include\bufferobject.h
  • c:\Python27\Tools\Scripts
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\35
  • UNC\KIDSROOM\Users\Default\NTUSER.DAT.LOG
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore
  • c:\Python27\include\pyfpe.h
  • c:\Python27\include\compile.h
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • c:\zjwmukavuf\lib\api
  • C:\Users\Harry Dresden\AppData\Local\Temp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\Python27\tcl\tk8.5\images
  • c:\ProgramData\Microsoft\DRM
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US
  • c:\Python27\Lib\idlelib\idle_test
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\include
  • c:\zjwmukavuf\lib
  • c:\Python27\Lib\test\nullcert.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • c:\Python27\include\structseq.h
  • c:\6cdeacda242012e0e5b593e657\1029
  • c:\6cdeacda242012e0e5b593e657\1028
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}
  • c:\Python27\Lib\site-packages\pip\commands
  • c:\Python27\Lib\lib2to3\tests\data\fixers\myfixes
  • c:\6cdeacda242012e0e5b593e657\1025
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us
  • c:\Python27\tcl\tclConfig.sh
  • c:\Python27\Lib\email\test\data
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\OJGTKVTlyWwuMn.pptx
  • c:\ProgramData\WebEx\WebEx
  • c:\6cdeacda242012e0e5b593e657\2052
  • c:\Python27\tcl\tcl8.5\opt0.4
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases
  • c:\Python27\include\pgenheaders.h
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US
  • c:\Python27\tcl\tcl8.5\encoding
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs
  • c:\Python27\Lib\msilib
  • c:\ProgramData\Microsoft\WwanSvc\Profiles
  • c:\Python27\Lib\encodings
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\_backport
  • c:\ProgramData\Microsoft\Assistance\Client
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\95
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F
  • c:\Python27\Lib\site-packages\_markerlib
  • c:\ProgramData\Microsoft\Diagnosis\LocalTraceStore
  • c:\inetpub\custerr
  • c:\Python27\include\longintrepr.h
  • c:\inetpub\custerr\en-US
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches
  • c:\Python27\Lib\test\185test.db
  • c:\Python27\include\opcode.h
  • c:\ProgramData\Microsoft\Crypto\RSA
  • c:\6cdeacda242012e0e5b593e657\1038\LocalizedData.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tk8.5\ttk
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\01
  • c:\Users\Default\Favorites
  • c:\inetpub\history
  • UNC\KIDSROOM\Users\Default\Desktop
  • c:\ProgramData\Microsoft\Windows NT
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\chardet
  • c:\ProgramData\Microsoft\Vault
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData
  • c:\Python27\include\fileobject.h
  • UNC\KIDSROOM\Users\ruiner
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • c:\Python27\include\boolobject.h
  • c:\
  • c:\Python27\include\token.h
  • c:\Python27\include\bitset.h
  • c:\Python27\include\warnings.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\Python27\tcl\tk8.5\demos
  • c:\ProgramData\Mozilla\logs
  • c:\Python27\include\pycapsule.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\70
  • c:\zjwmukavuf\lib\common
  • c:\Python27\tcl\tcl8.5\tzdata\Mexico
  • c:\Python27\Lib\importlib
  • c:\ProgramData\Microsoft\Crypto
  • UNC\KIDSROOM\Users\Harry Dresden\Searches
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\media
  • c:\Python27\tcl\tcl8.5
  • c:\Python27\tcl\tcl8.5\tzdata\Africa
  • UNC\KIDSROOM\Users\Harry Dresden\Music
  • c:\ProgramData\McAfee
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • c:\Python27\Lib\site-packages\pip\vcs
  • c:\zjwmukavuf\modules\auxiliary
  • c:\Python27\Lib\bsddb\test
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\Python27\Lib\test\keycert2.pem
  • c:\ProgramData\Microsoft\Search\Data\Applications
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F7
  • c:\Python27\include\ucnhash.h
  • c:\Python27\include\py_curses.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3
  • c:\Python27\Lib\xml\parsers
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\tcl\tcl8.5\msgs
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Inbox
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage
  • c:\Users\Harry Dresden
  • c:\Python27\include\symtable.h
  • c:\Python27\include\node.h
  • c:\ProgramData\McAfee\MCLOGS\Common\jxpiinstall
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads
  • c:\ProgramData\Microsoft\Windows Defender\Quarantine
  • c:\Users\Public\Favorites
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\include\codecs.h
  • c:\ProgramData\Microsoft\Office
  • c:\Python27\Lib\site-packages\pip\_vendor\requests
  • c:\Users\Public\Pictures
  • c:\ProgramData\NovaTech Network\NovaBench
  • UNC\KIDSROOM\Users\Harry Dresden\Documents
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\Python27\Lib\site-packages\pip\_vendor\_markerlib
  • c:\Python27\tcl\reg1.2
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • UNC\KIDSROOM\Users\Public\Desktop
  • c:\Users\ruiner
  • c:\Python27\Lib\xml\etree
  • c:\Python27\include\pymacconfig.h
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\zjwmukavuf\modules
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01
  • UNC\KIDSROOM\Users\Harry Dresden\Favorites\Links for United States
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform
  • c:\Python27\tcl\tcl8.5\tzdata\Antarctica
  • c:\Python27\Lib\xml\sax
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\trie
  • c:\Users\Harry Dresden\Desktop
  • c:\Users\Public\Recorded TV
  • c:\ProgramData\Microsoft\Office\Heartbeat
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\42
  • c:\Python27\tcl\tcl8.5\tzdata\Etc
  • c:\Python27\Lib\bsddb
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\47
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\UZXMILVotRymaGlC.rtf
  • c:\Python27\Lib\wsgiref
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\contrib
  • c:\ProgramData\Microsoft\User Account Pictures
  • c:\ProgramData\Sun\Java\Java Update
  • c:\Python27\Lib\test\sha256.pem
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9
  • c:\Recovery\015e7760-d44b-11e0-8947-954f09601788
  • c:\Users
  • UNC\KIDSROOM\Users\Public\Foxit Software
  • c:\Users\Default\Saved Games
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources
  • c:\inetpub\history\CFGHISTORY_0000000005\schema
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\inetpub
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • UNC\KIDSROOM\Users\Public\Favorites
  • c:\Users\Default
  • c:\Python27\tcl\tcl8.5\tzdata\Pacific
  • c:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog
  • c:\Python27\tcl\tk8.5\msgs
  • c:\Python27\tcl\tcl8.5\tzdata\America
  • c:\ProgramData\Microsoft\Diagnosis\DownloadedSettings
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\{98101498-C465-4F51-8751-D1919E97D29D}
  • c:\Python27\Lib\multiprocessing\dummy
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}
  • c:\ProgramData\Microsoft\MF
  • c:\zjwmukavuf\bin\cert.p12
  • c:\Python27\include\errcode.h
  • c:\Python27\Lib\test\keycert3.pem
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\BPtcODUexIBpzGiKpu.txt
  • UNC\KIDSROOM\Users\Default\Saved Games
  • c:\Users\Public\Downloads
  • c:\Python27\Lib\site-packages
  • c:\ProgramData\Microsoft\Device Stage\Task
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Python27\include\pyerrors.h
  • c:\Python27\Lib\unittest
  • c:\6cdeacda242012e0e5b593e657\Graphics
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}
  • c:\Python27\Lib\test\capath
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default
  • c:\Recovery
  • c:\ProgramData\Microsoft\Device Stage
  • c:\Python27\include\ceval.h
  • c:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18
  • c:\ProgramData\Microsoft\Assistance\Client\1.0
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\structmember.h
  • c:\ProgramData\Oracle
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\Python27\include\pygetopt.h
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\Python27\Lib\distutils\tests
  • UNC\KIDSROOM\Users\Harry Dresden\Videos
  • c:\Python27\Lib\logging
  • c:\ProgramData\Microsoft\RAC
  • c:\Python27\Lib\site-packages\pip\req
  • c:\Users\Harry Dresden\Links
  • c:\ProgramData\Microsoft\DeviceSync
  • c:\Python27\Doc
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • c:\Python27\tcl\tix8.4.3\demos\bitmaps
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\en-us.16
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • c:\Python27\include\patchlevel.h
  • UNC\KIDSROOM\Users\Default\Favorites
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\Lib\compiler
  • c:\Python27\Scripts
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\42
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\17
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • c:\Python27\tcl\dde1.3
  • c:\Python27\tcl\tcl8.5\tzdata\SystemV
  • c:\ProgramData\NovaTech Network
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • c:\ProgramData\Sun\Java
  • UNC\KIDSROOM\Users\Public\Recorded TV
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js
  • c:\ProgramData\Microsoft\Diagnosis\AsimovUploader
  • UNC\KIDSROOM\Users\Public\Documents
  • c:\zjwmukavuf
  • UNC\KIDSROOM\Users\Default\Pictures
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml
  • UNC\KIDSROOM\Users\Public\Libraries
  • c:\Python27\tcl\tcl8.5\tzdata\Chile
  • c:\ProgramData\Microsoft\ClickToRun\UserData
  • c:\Python27\Lib\test\xmltestdata
  • c:\ProgramData\Microsoft\WPD
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml
  • c:\Python27\Lib\site-packages\pip\_vendor
  • c:\ProgramData\Sun
  • c:\Python27\include\Python.h
  • UNC\KIDSROOM\Users\Default\Videos
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger
  • c:\Python27\Lib\site-packages\setuptools
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\Python27\include\metagrammar.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\yPpodLVTGVFXib.docm
  • UNC\KIDSROOM\Users\Public\Music\Sample Music
  • c:\Python27\include\pystate.h
  • c:\Users\Default\Desktop
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • UNC\KIDSROOM\Users\Default\Music
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
  • c:\ProgramData\Microsoft\WwanSvc
  • c:\Python27\include\pyconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • \\?\PIPE\wkssvc
  • c:\ProgramData\Microsoft\Event Viewer\Views
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start
  • c:\Python27\Lib\json\tests
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\serializer
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default
  • c:\Python27\include\osdefs.h
  • c:\Python27\Tools
  • c:\Python27\include\timefuncs.h
  • c:\Users\Public\Videos\Sample Videos
  • UNC\KIDSROOM\Users\Public\Downloads
  • c:\Python27\include\enumobject.h
  • c:\ProgramData\Microsoft\IlsCache
  • c:\Python27\Lib\lib-tk
  • UNC\KIDSROOM\Users\Default
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Store
  • c:\ProgramData\Microsoft\Windows NT\MSFax\SentItems
  • c:\Users\Public\Foxit Software\Foxit Reader
  • c:\Python27\Lib\site-packages\pip\operations
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox
  • c:\Python27\Lib\site-packages\pip\_vendor\lockfile
  • c:\Python27\Lib\curses
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\floatobject.h
  • c:\Python27\Lib\test\pycacert.pem
  • c:\Python27\include\pymactoolbox.h
  • c:\Python27\Lib\test\badkey.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • c:\Python27\include\cStringIO.h
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration
  • c:\Users\Default\Music
  • c:\Python27\Lib\email\mime
  • c:\Users\Harry Dresden\Music
  • c:\6cdeacda242012e0e5b593e657\1053
  • c:\6cdeacda242012e0e5b593e657\1055
  • UNC\KIDSROOM\Users\Harry Dresden\Links
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3
  • c:\Python27\tcl\tcl8.5\tzdata\Asia
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css
  • c:\Python27\Lib\multiprocessing
  • c:\Users\Default\Documents
  • c:\Python27\Tools\pynche
  • c:\Users\Public\Desktop
  • c:\ProgramData\Microsoft\User Account Pictures\Default Pictures
  • c:\Python27\Lib\lib-tk\test\test_ttk
  • c:\Python27\include\dictobject.h
  • c:\Users\Harry Dresden\Documents
  • c:\Python27\include\sysmodule.h
  • c:\ProgramData\McAfee\MCLOGS\Common
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F\x-none.16
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\ProgramData\Microsoft\IdentityCRL
  • c:\ProgramData\WebEx\WebEx\12_1324
  • c:\ProgramData\Microsoft\Windows Defender\Support
  • c:\Python27\Lib\site-packages\pip\utils
  • c:\Python27\Lib\distutils\command
  • c:\Users\Harry Dresden\Saved Games
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\include\pyarena.h
  • c:\ProgramData\Microsoft\Windows Defender
  • c:\Python27\include\eval.h
  • c:\zjwmukavuf\lib\core
  • c:\Python27
  • c:\Python27\Lib\hotshot
  • UNC\KIDSROOM\Users\Harry Dresden
  • c:\Python27\include\genobject.h
  • c:\inetpub\wwwroot
  • c:\Python27\tcl\tcl8.5\tzdata\Canada
  • c:\Python27\Tools\versioncheck
  • c:\Python27\tcl\tcl8.5\tzdata\Arctic
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F7
  • c:\Users\Public\Music
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3
  • c:\Python27\Lib\test\audiodata
  • UNC\KIDSROOM\Users\Default\Downloads
  • c:\Python27\tcl\tix8.4.3
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters
  • c:\Python27\include\intrcheck.h
  • c:\ProgramData\Microsoft\Network\Connections
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\x-none.16
  • c:\Python27\Lib\sqlite3
  • c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\43
  • \\?\PIPE\lsarpc
  • c:\ProgramData\Microsoft\Diagnosis
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F\en-us.16
  • c:\Python27\Lib\distutils
  • UNC\KIDSROOM\Users\Harry Dresden\Saved Games
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\tests
  • c:\Python27\Lib\idlelib\Icons
  • c:\ProgramData\Microsoft\Device Stage\Device
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib
  • c:\Python27\Lib\test\subprocessdata
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\35
  • c:\Python27\include\pymem.h
  • c:\inetpub\wwwroot\aspnet_client
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\ProgramData\Microsoft\RAC\PublishedData
  • c:\Users\Public\Foxit Software
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Quick
  • c:\ProgramData\Microsoft\Windows NT\MSScan
  • c:\Python27\Lib\lib2to3\tests
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\ProgramData\Microsoft OneDrive\setup
  • c:\ProgramData\Microsoft\Crypto\DSS\MachineKeys
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • UNC\KIDSROOM\Users
  • c:\Python27\Lib\site-packages\pkg_resources
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info
  • c:\Python27\include\rangeobject.h
  • c:\Python27\tcl\tcl8.5\tzdata\Brazil
  • c:\Users\Harry Dresden\Favorites\Links
  • UNC\KIDSROOM\Users\Default\Links
  • c:\Python27\Lib\test\imghdrdata
  • c:\Python27\include\iterobject.h
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement
  • c:\ProgramData\Microsoft\RAC\Outbound
  • c:\zjwmukavuf\bin
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\inetpub\history\CFGHISTORY_0000000002
  • c:\Python27\include\funcobject.h
  • c:\Python27\include\listobject.h
  • c:\ProgramData\Microsoft\NetFramework
  • c:\Users\Public\Recorded TV\Sample Media
  • c:\ProgramData\Microsoft
  • c:\Users\Public\Pictures\Sample Pictures
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Service
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\Users\Default\Videos
  • c:\ProgramData\Microsoft\Search\Data
  • c:\Python27\tcl
  • c:\Python27\Lib\json
  • UNC\KIDSROOM\Users\Public\Pictures
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US
  • c:\Python27\include\pythread.h
  • c:\Python27\Lib\lib2to3\fixes
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\Python27\tcl\tix8.4.3\bitmaps
  • c:\Python27\Lib\site-packages\setuptools\command
  • c:\6cdeacda242012e0e5b593e657
  • c:\6cdeacda242012e0e5b593e657\1043\LocalizedData.xml
  • c:\Python27\tcl\tcl8.5\tzdata\America\Indiana
  • c:\6cdeacda242012e0e5b593e657\2070
  • c:\Python27\include\sliceobject.h
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Users\Public\Videos
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • c:\Python27\Lib\test\decimaltestdata
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\DD
  • c:\Python27\include\descrobject.h
  • c:\ProgramData\Microsoft\Diagnosis\UIF
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A6
  • c:\Python27\tcl\tcl8.5\tzdata\Europe
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5
  • c:\Python27\include\stringobject.h
  • c:\Python27\Lib\lib2to3
  • c:\Python27\include\intobject.h
  • c:\ProgramData\Microsoft\Event Viewer
  • c:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\ProgramData\Microsoft\ClickToRun
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures
  • c:\Python27\include\methodobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Favorites
  • c:\Python27\include\cobject.h
  • c:\Python27\tcl\tcl8.5\http1.0
  • c:\Python27\include\pymath.h
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\parsetok.h
  • c:\ProgramData\Adobe\Acrobat\11.0
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • c:\Python27\Lib\ensurepip\_bundled
  • c:\Python27\include\classobject.h
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • c:\Users\Public\Music\Sample Music
  • c:\Python27\tcl\tcl8
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager
  • c:\Python27\Lib\lib2to3\tests\data
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70
  • c:\ProgramData\Microsoft OneDrive
  • c:\ProgramData\Microsoft\Media Player
  • c:\Python27\tcl\tcl8.5\tzdata\America\Argentina
  • c:\Python27\include\setobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Pictures
  • c:\Python27\Lib\idlelib
  • c:\PerfLogs\Admin
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\graminit.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images
  • c:\Python27\Lib\site-packages\pip\_vendor\progress
  • c:\Users\Harry Dresden\Pictures
  • c:\ProgramData\Microsoft\Diagnosis\Sideload
  • c:\Python27\include\datetime.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\ssl_match_hostname
  • c:\Users\Harry Dresden\Favorites
  • c:\ProgramData\Passmark
  • c:\Python27\Lib\lib-tk\test
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • c:\ProgramData\Adobe
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • UNC\KIDSROOM\Users\Harry Dresden\Favorites\Links
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\ProgramData\Microsoft\Search
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\MxXfvHhcbVMSK.docx
  • c:\ProgramData\Passmark\PerformanceTest
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • UNC\KIDSROOM\Users\Public\Music
  • c:\Python27\include\bytearrayobject.h
  • c:\ProgramData\Microsoft\NetFramework\BreadcrumbStore
  • c:\Python27\Lib\email\test
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}
  • c:\ProgramData\WebEx
  • c:\inetpub\wwwroot\msmq
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\Python27\tcl\tix8.4.3\demos
  • UNC\KIDSROOM\Users\Public\Recorded TV\Sample Media
  • c:\Python27\include\unicodeobject.h
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\packaging
  • c:\ProgramData\McAfee\MCLOGS
  • c:\Users\Default\Pictures
  • c:\6cdeacda242012e0e5b593e657\1049
  • c:\Users\Public\Documents
  • c:\6cdeacda242012e0e5b593e657\1046
  • c:\6cdeacda242012e0e5b593e657\1045
  • c:\6cdeacda242012e0e5b593e657\1044
  • c:\6cdeacda242012e0e5b593e657\1043
  • c:\6cdeacda242012e0e5b593e657\1042
  • c:\6cdeacda242012e0e5b593e657\1041
  • c:\6cdeacda242012e0e5b593e657\1040
  • c:\Python27\Lib\site-packages\pip\_vendor\packaging
  • c:\ProgramData\Microsoft\eHome\logs
  • c:\ProgramData\Microsoft\Windows Defender\Scans
  • c:\ProgramData\Microsoft\Windows NT\MSFax
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\Python27\Lib\sqlite3\test
  • c:\Python27\Lib\test\dh1024.pem
  • c:\ProgramData\Mozilla
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates
  • c:\Python27\include\weakrefobject.h
  • c:\Python27\Lib\lib2to3\pgen2
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History
  • c:\Python27\Lib\idlelib\idle.bat
  • c:\Python27\include\code.h
  • c:\Python27\include\cellobject.h
  • c:\ProgramData\Microsoft\RAC\StateData
  • c:\6cdeacda242012e0e5b593e657\1038
  • UNC\KIDSROOM\Users\Harry Dresden\OneDrive
  • c:\ProgramData\Microsoft\DRM\Server
  • c:\6cdeacda242012e0e5b593e657\1032
  • c:\6cdeacda242012e0e5b593e657\1033
  • c:\6cdeacda242012e0e5b593e657\1030
  • c:\6cdeacda242012e0e5b593e657\1031
  • c:\6cdeacda242012e0e5b593e657\1036
  • c:\6cdeacda242012e0e5b593e657\1037
  • c:\6cdeacda242012e0e5b593e657\1035
  • C:\Windows\System32\wshqos.dll
  • C:\Windows\System32\wshom.ocx
  • C:\
  • C:\Windows\Globalization\Sorting\sortdefault.nls
  • C:\Users\
  • C:\Users\Harry Dresden\
  • C:\Users\Harry Dresden\AppData\
  • C:\Users\Harry Dresden\AppData\Local\
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000001.db
  • C:\Windows\
  • C:\Users\Harry Dresden\AppData\Local\Temp\NRV_6NE59609_.js
  • C:\Windows\System32\en-US\wshqos.dll.mui
  • C:\Users\Harry Dresden\Desktop\desktop.ini
  • C:\Windows\System32\en-US\wshtcpip.dll.mui
  • C:\Windows\SysWOW64\rundll32.exe
  • C:\Windows\System32\rsaenh.dll
  • C:\Windows\System32\msxml3.dll
  • C:\Windows\System32\en-US\wship6.dll.mui
  • C:\Windows\System32\wscript.exe
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
  • C:\Windows\SysWOW64\
File-Moved
  • c:\Python27\include\errcode.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-84A0-A3BC10E22CCD.thor
  • c:\Python27\include\compile.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-19E5-18AB434F76C0.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-714C-92CF6C5BCAB9.thor
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf -> c:\6cdeacda242012e0e5b593e657\3082\GIZCRYGJ-7AM0-FZCA-7E77-A36C63250401.thor
  • c:\Python27\Lib\test\keycert3.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-CEBE-689F99574767.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYGJ-7AM0-FZCA-71D0-F0A3181C0C90.thor
  • c:\Python27\include\intobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-44A0-8900D2E0C905.thor
  • c:\Python27\Lib\test\keycert2.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-E6E8-CA36D654874A.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\GIZCRYGJ-7AM0-FZCA-CF01-2415C264958F.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-B635-CBF364D6A969.thor
  • c:\Python27\include\pydebug.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-0BAF-7278C4C4D1F7.thor
  • c:\Python27\include\timefuncs.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-1B18-FF19C5F49AB0.thor
  • c:\Python27\include\iterobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-C538-F1E8BD4FE587.thor
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1041\GIZCRYGJ-7AM0-FZCA-D51C-9B136B28EFDF.thor
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem -> c:\Python27\Lib\site-packages\pip\_vendor\requests\GIZCRYGJ-7AM0-FZCA-41DB-0BB1332294DA.thor
  • c:\Python27\include\object.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-5D7F-9573433D02FC.thor
  • c:\Python27\Lib\test\pycacert.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-E6A4-8C95DE54137C.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\DikCBBBwxCDVDWy.ppt -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGJ-7AM0-FZCA-BB3D-0C16ED583DDA.thor
  • c:\Python27\include\pythonrun.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-F79D-9603F8EC7023.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGJ-7AM0-FZCA-5173-5B9DD6328CFE.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\GIZCRYGJ-7AM0-FZCA-B8C2-0E5FD17183F6.thor
  • c:\Python27\include\pyfpe.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-78BE-F7F075A11176.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-7B6A-9046415215A2.thor
  • c:\Python27\Lib\test\nullbytecert.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-71DD-B62A3170331C.thor
  • c:\Python27\include\node.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-60C7-0589450C8025.thor
  • c:\Python27\include\enumobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-FE4F-5B44A578BB39.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGJ-7AM0-FZCA-4F51-626A834A2964.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Desert.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYGJ-7AM0-FZCA-2055-EDBC37A798CB.thor
  • c:\Python27\include\listobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-66A6-AB94DECF2C23.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-0E2C-2CD9EAD331BB.thor
  • c:\Python27\include\longobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-D454-FE28C101DED7.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-A308-4977590ECFDA.thor
  • c:\Python27\Lib\test\keycert.passwd.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-7753-2C7D4F64B7A5.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\GIZCRYGJ-7AM0-FZCA-9B5B-7AC83A96AB3F.thor
  • c:\Python27\include\cellobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-2235-72943727255F.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-066D-9FD87FCBE9F7.thor
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php -> c:\ProgramData\WebEx\WebEx\12_1324\GIZCRYGJ-7AM0-FZCA-6525-781137E31A5F.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\GIZCRYGJ-7AM0-FZCA-D153-6D1FDEF16602.thor
  • c:\Python27\include\intrcheck.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-7C02-D2C45EFDED93.thor
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf -> c:\6cdeacda242012e0e5b593e657\2070\GIZCRYGJ-7AM0-FZCA-2499-40430B58CD54.thor
  • c:\Python27\include\fileobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-AD2E-0AC80BEC16D3.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-E7BE-994434A483B3.thor
  • c:\Python27\include\memoryobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-BF27-94DFA2E25502.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\GIZCRYGJ-7AM0-FZCA-FDED-D95424ED1731.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYGJ-7AM0-FZCA-AB45-D4558067C061.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYGJ-7AM0-FZCA-DAC0-5C29105476C4.thor
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1042\GIZCRYGJ-7AM0-FZCA-4A94-0AE80CF07B99.thor
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYGJ-7AM0-FZCA-57D0-A8035F64D5EE.thor
  • c:\Python27\include\sysmodule.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-E0DC-ADF774FEB1E7.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYGJ-7AM0-FZCA-E5BA-2AA46C535DCE.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-9CEF-E31CE60FCBFE.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\GIZCRYGJ-7AM0-FZCA-169C-BFA377818D31.thor
  • c:\Python27\include\bytes_methods.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-6D71-8FEDECA5130B.thor
  • \\KIDSROOM\Users\Public\Videos\Sample Videos\Wildlife.wmv -> \\KIDSROOM\Users\Public\Videos\Sample Videos\GIZCRYGJ-7AM0-FZCA-DF23-629293B53380.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYGJ-7AM0-FZCA-E27E-29D59F3FAD64.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\GIZCRYGJ-7AM0-FZCA-80B9-3B33ED2C2B6B.thor
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1046\GIZCRYGJ-7AM0-FZCA-6050-F70531CE0063.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-04C8-23EF6E6A982A.thor
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYGJ-7AM0-FZCA-928A-D4BEB73CE646.thor
  • c:\Python27\include\bytearrayobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-9A5D-7F14F9829033.thor
  • c:\Python27\include\structmember.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-4DDD-33D5B6DF0361.thor
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1055\GIZCRYGJ-7AM0-FZCA-2CAB-A1524040E881.thor
  • c:\Python27\include\setobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-5BA5-AF0CAD98C6F4.thor
  • c:\Python27\include\pygetopt.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-0303-D0CFF4D7C532.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-C03D-FF78A82C67B3.thor
  • c:\Python27\include\marshal.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-08E0-B2A5CBA887A4.thor
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1041\GIZCRYGJ-7AM0-FZCA-F270-B84407463AD4.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\OJGTKVTlyWwuMn.pptx -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGJ-7AM0-FZCA-D3ED-766D220EE63E.thor
  • c:\Python27\include\bytesobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-366A-68041D78EECC.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\GIZCRYGJ-7AM0-FZCA-09FD-172B3F71CC67.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-6AA1-A3D9891F794A.thor
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYGJ-7AM0-FZCA-1674-0AEBB2C64DEB.thor
  • c:\Python27\Lib\test\nullcert.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-AD87-1E8BFAF081BD.thor
  • c:\Python27\include\parsetok.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-5DA9-24DE07C652ED.thor
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1035\GIZCRYGJ-7AM0-FZCA-3837-2FEE1182DDC3.thor
  • c:\Python27\include\token.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-7B8D-FFDA3A666A4A.thor
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYGJ-7AM0-FZCA-0854-343F005230DC.thor
  • c:\Python27\include\patchlevel.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-60FB-DF80D4984397.thor
  • c:\Python27\include\abstract.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-B03F-C4B9CEA2A328.thor
  • c:\Python27\include\pgen.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-C1C5-CA68400CB132.thor
  • c:\Python27\include\tupleobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-3026-AD9D7A154FC7.thor
  • c:\Python27\include\pgenheaders.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-26AD-7231C791D07D.thor
  • c:\Python27\include\pymath.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-FD77-4F989F23E5EF.thor
  • c:\Python27\include\methodobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-FD04-3EB377FBB857.thor
  • \\KIDSROOM\Users\Public\Music\Sample Music\Sleep Away.mp3 -> \\KIDSROOM\Users\Public\Music\Sample Music\GIZCRYGJ-7AM0-FZCA-E9EA-C266425E0636.thor
  • c:\Python27\include\pyconfig.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-C454-B5CF87A01293.thor
  • c:\Python27\include\frameobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-E693-248EAB344986.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-F278-9D3324D8EAC5.thor
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1045\GIZCRYGJ-7AM0-FZCA-49F9-DA4456A09D7D.thor
  • c:\Python27\include\cobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-D478-680F9D734CC2.thor
  • c:\Python27\include\pymacconfig.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-E992-501B35C5E880.thor
  • c:\Python27\include\bufferobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-CF98-A490E140E1B1.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\BPtcODUexIBpzGiKpu.txt -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGJ-7AM0-FZCA-40CD-B29B55082413.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYGJ-7AM0-FZCA-9B58-F46D6A5E3839.thor
  • c:\Python27\include\modsupport.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-3B44-97C62C2B2300.thor
  • c:\Python27\include\warnings.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-996A-A45ACFA929BE.thor
  • c:\Python27\include\codecs.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-4B3C-D5675780638C.thor
  • c:\Python27\Lib\test\keycert4.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-3459-75DD6DC17CA1.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Koala.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYGJ-7AM0-FZCA-B583-083DF5AE1019.thor
  • c:\Python27\include\asdl.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-7909-89E27C0DD4EE.thor
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYGJ-7AM0-FZCA-57FD-EFDF85AE04F4.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\qiMqMFqEpbdrWNMGt.docm -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGJ-7AM0-FZCA-893E-F502610CD744.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-D61D-32CB2AD65BD7.thor
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1042\GIZCRYGJ-7AM0-FZCA-063C-04BE2933F6DC.thor
  • c:\Python27\include\Python-ast.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-C165-EE51F287A62E.thor
  • c:\Python27\include\weakrefobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-16D6-22AF490EB85C.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-9DFC-9D4AED58E6FA.thor
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1053\GIZCRYGJ-7AM0-FZCA-338E-A7156A9C372B.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-D0BF-1809C996A4EF.thor
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1032\GIZCRYGJ-7AM0-FZCA-9AAC-857183D20D2F.thor
  • c:\Python27\include\dtoa.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-6DE2-81C1ACCA4345.thor
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYGJ-7AM0-FZCA-AAC2-1F05702AFE51.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYGJ-7AM0-FZCA-2C91-D42DD5184C3C.thor
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1043\GIZCRYGJ-7AM0-FZCA-CFEE-700BFD03A20B.thor
  • c:\Python27\include\unicodeobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-A5B8-DDC29B2EF7C7.thor
  • c:\zjwmukavuf\bin\cert.p12 -> c:\zjwmukavuf\bin\GIZCRYGJ-7AM0-FZCA-D398-42835BC0F39C.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGJ-7AM0-FZCA-5618-F13C7AC599B8.thor
  • c:\Python27\include\pystrtod.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-F602-DA3AD702BD33.thor
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1040\GIZCRYGJ-7AM0-FZCA-CD08-65E919219B2F.thor
  • c:\Python27\include\pycapsule.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-568C-AE5F021E50D3.thor
  • c:\Python27\include\stringobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-7D66-314A18224A8C.thor
  • c:\Python27\Lib\test\185test.db -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-DCB3-73004BBC6528.thor
  • c:\Python27\Lib\test\badkey.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-303B-A25BACCDDDE7.thor
  • c:\Python27\include\ceval.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-F56C-8B8B2BE17BF8.thor
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYGJ-7AM0-FZCA-0DBE-B232213277F2.thor
  • c:\Python27\Lib\test\empty.vbs -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-C7B8-A8CB92874470.thor
  • c:\Python27\include\pyerrors.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-404E-20624BC9E1DF.thor
  • c:\Python27\include\opcode.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-2DC6-505628DEF510.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-D63B-73477F114B5A.thor
  • c:\Python27\include\complexobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-C775-7BB57883AC42.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGJ-7AM0-FZCA-486F-C54C47BD4675.thor
  • c:\Python27\Lib\test\ssl_key.passwd.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-408B-91787D5C8980.thor
  • c:\Python27\include\datetime.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-BB37-34F84D278133.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGJ-7AM0-FZCA-B399-1F0A279F4D79.thor
  • c:\Python27\include\objimpl.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-3764-20919118C542.thor
  • c:\Python27\include\osdefs.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-3423-EE528ACD8196.thor
  • \\KIDSROOM\Users\Harry Dresden\Downloads\cleandesktop.py.txt -> \\KIDSROOM\Users\Harry Dresden\Downloads\GIZCRYGJ-7AM0-FZCA-BE00-6283D7323DFC.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Tulips.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYGJ-7AM0-FZCA-0B28-B0E0D61B75AE.thor
  • c:\Python27\include\classobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-C0DD-4C2CE59D8DE1.thor
  • c:\Python27\include\sliceobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-DC30-E6CA361BEFC3.thor
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1038\GIZCRYGJ-7AM0-FZCA-F979-80BF204929D1.thor
  • c:\Python27\include\pystrcmp.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-39F6-D99CDA4DB7C6.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGJ-7AM0-FZCA-4ADA-CBA8964D16ED.thor
  • c:\Python27\include\pymem.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-1FF8-49411C13E766.thor
  • c:\Python27\include\graminit.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-8F0A-0F13D2DF5958.thor
  • \\KIDSROOM\Users\Public\Music\Sample Music\Kalimba.mp3 -> \\KIDSROOM\Users\Public\Music\Sample Music\GIZCRYGJ-7AM0-FZCA-39A4-AD2217DB2BAA.thor
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1049\GIZCRYGJ-7AM0-FZCA-CC7A-8171B285CB8B.thor
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-90CC-BDA50F05B6B1.thor
  • c:\6cdeacda242012e0e5b593e657\1038\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1038\GIZCRYGJ-7AM0-FZCA-0C0F-9DB7C21A6D9F.thor
  • \\KIDSROOM\Users\Harry Dresden\Contacts\Harry Dresden.contact -> \\KIDSROOM\Users\Harry Dresden\Contacts\GIZCRYGJ-7AM0-FZCA-113B-F4CF1D68CF58.thor
  • c:\Python27\include\pyexpat.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-D7E0-3F3E5E816857.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-B9ED-F2CEC5ABB82F.thor
  • c:\Python27\include\bitset.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-D9D1-191121534340.thor
  • c:\Python27\include\pyctype.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-548A-9FE8F7D84BC7.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGJ-7AM0-FZCA-8224-8D1AE1F883BA.thor
  • c:\6cdeacda242012e0e5b593e657\1043\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1043\GIZCRYGJ-7AM0-FZCA-F722-72177BCE21F5.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-45D7-5502EF9D49CB.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGJ-7AM0-FZCA-9C7B-FDE294B9FF49.thor
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1029\GIZCRYGJ-7AM0-FZCA-A0E1-F188ACF632D5.thor
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1025\GIZCRYGJ-7AM0-FZCA-B2E4-E6078256C849.thor
  • c:\Python27\include\pyport.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-0726-695978B148FC.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-786D-E26C4CE65DC9.thor
  • c:\Python27\include\structseq.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-4BCA-BA4C8B72035E.thor
  • \\KIDSROOM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg -> \\KIDSROOM\Users\Harry Dresden\Downloads\GIZCRYGJ-7AM0-FZCA-EB8D-E9593BCCD44A.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Penguins.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYGJ-7AM0-FZCA-74E5-FD85858233C8.thor
  • c:\Python27\Lib\test\keycert.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-4FB9-C68E9E80D40D.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-D6DF-2847CC77816D.thor
  • c:\Python27\include\eval.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-7B5B-DF885B44EABE.thor
  • c:\Python27\Lib\test\sha256.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-E48D-252C5E9BC51A.thor
  • c:\Python27\Lib\test\wrongcert.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-6279-5562151A6E42.thor
  • c:\Python27\include\import.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-8911-8AB7AA3930A8.thor
  • c:\Python27\include\cStringIO.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-BE55-876D2E54DF1D.thor
  • \\KIDSROOM\Users\Default\NTUSER.DAT.LOG -> \\KIDSROOM\Users\Default\GIZCRYGJ-7AM0-FZCA-76D8-DF10A4B29F9A.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\GIZCRYGJ-7AM0-FZCA-44F9-CA0B9B2FD16D.thor
  • c:\Python27\include\pystate.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-9415-BE88976ED310.thor
  • c:\Python27\include\pythread.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-8349-E2A9B9FC11ED.thor
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1030\GIZCRYGJ-7AM0-FZCA-4E58-B9B1C34F67A5.thor
  • c:\Python27\include\moduleobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-1FA3-BAE63797FF03.thor
  • c:\Python27\include\ucnhash.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-A89E-EC5EB86A639B.thor
  • c:\Python27\include\longintrepr.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-44D7-DFA99DD1348C.thor
  • c:\Python27\Lib\test\nokia.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-C251-7F8DC8618307.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\yPpodLVTGVFXib.docm -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGJ-7AM0-FZCA-AC5B-A526C847D7A8.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-116D-39100102E973.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-4A3E-EDE472D6D29E.thor
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1044\GIZCRYGJ-7AM0-FZCA-1AA8-F0DCDCA4717E.thor
  • c:\Python27\include\pymactoolbox.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-DB7E-63D42BED0B8C.thor
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYGJ-7AM0-FZCA-C982-03D580C88572.thor
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1037\GIZCRYGJ-7AM0-FZCA-2234-FD8209EEA089.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-A1CF-CC82FE6AF251.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-5448-7238F87DF041.thor
  • c:\Python27\include\descrobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-16D2-938B2042C1CD.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYGJ-7AM0-FZCA-5731-29F9C9B0C275.thor
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1040\GIZCRYGJ-7AM0-FZCA-0F4F-1078337D755D.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-C9F1-FAE89B4653D4.thor
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1033\GIZCRYGJ-7AM0-FZCA-0C49-2BC8AFAFE5D2.thor
  • c:\Python27\include\metagrammar.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-37B3-6C1633B1A009.thor
  • c:\Python27\Lib\test\ssl_cert.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-91E3-32C3E0018F28.thor
  • c:\Python27\include\funcobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-30B4-83F2C48D58C1.thor
  • c:\Python27\include\traceback.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-8C25-48F0E226074C.thor
  • c:\Python27\Lib\test\badcert.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-5F8A-8805E84D4820.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-F556-DC7A4BB7058A.thor
  • c:\Python27\Lib\test\check_soundcard.vbs -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-62AD-69514FE4EA27.thor
  • c:\Python27\include\boolobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-93CB-1C59AE40436D.thor
  • c:\Python27\include\grammar.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-517E-6AEB623A4F6F.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\GIZCRYGJ-7AM0-FZCA-51D3-786867808E7A.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\MxXfvHhcbVMSK.docx -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGJ-7AM0-FZCA-25C7-1259605CC16D.thor
  • c:\Python27\include\floatobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-FE9E-55F23BB81826.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGJ-7AM0-FZCA-D9DA-00172AA61504.thor
  • c:\Python27\include\ast.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-3323-71E74CF63F1E.thor
  • c:\Python27\include\rangeobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-1237-1C9D89773DA5.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-A000-21D9ED864B30.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGJ-7AM0-FZCA-A054-5F2EB1C31970.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\UZXMILVotRymaGlC.rtf -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGJ-7AM0-FZCA-4FBB-DF7F522BD266.thor
  • c:\Python27\include\genobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-7A51-59CE5A4A28B5.thor
  • \\KIDSROOM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3 -> \\KIDSROOM\Users\Public\Music\Sample Music\GIZCRYGJ-7AM0-FZCA-9723-F026C2400D99.thor
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1028\GIZCRYGJ-7AM0-FZCA-DB50-001C772845BA.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYGJ-7AM0-FZCA-CE5F-28DB49BE02DE.thor
  • c:\Python27\Lib\idlelib\idle.bat -> c:\Python27\Lib\idlelib\GIZCRYGJ-7AM0-FZCA-97BA-3D4D01526A99.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYGJ-7AM0-FZCA-BAEF-AA982CF17A1E.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGJ-7AM0-FZCA-C4EF-3BDDB8479F0D.thor
  • c:\Python27\Lib\test\https_svn_python_org_root.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-DE0E-6A72C9720700.thor
  • c:\Python27\include\code.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-8FE4-8A5DB59E6DD5.thor
  • c:\Python27\include\dictobject.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-F6D4-4F2F97E48B7F.thor
  • c:\Python27\include\py_curses.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-BE77-A2BED3958CA6.thor
  • c:\Python27\tcl\tclConfig.sh -> c:\Python27\tcl\GIZCRYGJ-7AM0-FZCA-EF78-7FDD1632C1FD.thor
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1036\GIZCRYGJ-7AM0-FZCA-F6B6-1C9728A90575.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYGJ-7AM0-FZCA-2DBF-E3E3AB0F8FBF.thor
  • c:\Python27\Lib\test\ssl_key.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-D9CF-839A029A39F2.thor
  • c:\Python27\include\symtable.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-7B9C-6BAC150CC797.thor
  • c:\Python27\Lib\test\dh1024.pem -> c:\Python27\Lib\test\GIZCRYGJ-7AM0-FZCA-63D4-B8A398F09180.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\GIZCRYGJ-7AM0-FZCA-7660-6E75B57D79AB.thor
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1031\GIZCRYGJ-7AM0-FZCA-DFB1-4EABD7C88CE2.thor
  • c:\Python27\include\Python.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-4879-10713453BE33.thor
  • c:\Python27\include\pyarena.h -> c:\Python27\include\GIZCRYGJ-7AM0-FZCA-ADC9-E3AEAA08D549.thor
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf -> c:\6cdeacda242012e0e5b593e657\2052\GIZCRYGJ-7AM0-FZCA-F8A4-E14A84CCB20F.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYGJ-7AM0-FZCA-B53C-929D9E7DA97D.thor
Network-Connects Host
  • geethikabedcollege.com
Directory-Created
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YLC2QM2Y
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Caches
Directory-Enumerated
  • c:\Python27\Lib\site-packages\pip\*
  • c:\Python27\tcl\tcl8\8.5\*
  • c:\ProgramData\Sun\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\*
  • \\KIDSROOM\Users\Default\Saved Games\*
  • c:\Python27\tcl\tk8.5\demos\images\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\*
  • c:\Users\ruiner\*
  • c:\Recovery\015e7760-d44b-11e0-8947-954f09601788\*
  • c:\PerfLogs\*
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\*
  • \\KIDSROOM\Users\Harry Dresden\Links\*
  • c:\ProgramData\Passmark\*
  • \\KIDSROOM\Users\Harry Dresden\Pictures\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\*
  • c:\Python27\Tools\pynche\X\*
  • c:\Users\Public\Music\Sample Music\*
  • c:\Python27\Lib\importlib\*
  • c:\Python27\tcl\tcl8.5\http1.0\*
  • c:\Python27\Lib\bsddb\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\*
  • c:\inetpub\wwwroot\aspnet_client\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog\*
  • c:\Python27\tcl\tk8.5\ttk\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\chardet\*
  • c:\Users\Default\Saved Games\*
  • c:\Python27\tcl\tcl8.5\tzdata\Africa\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\*
  • c:\Python27\Tools\i18n\*
  • c:\ProgramData\Microsoft\ClickToRun\*
  • c:\Python27\Lib\site-packages\pip\_vendor\lockfile\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F\en-us.16\*
  • c:\ProgramData\*
  • c:\6cdeacda242012e0e5b593e657\Graphics\*
  • c:\6cdeacda242012e0e5b593e657\1033\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders\*
  • c:\Python27\Lib\compiler\*
  • \\KIDSROOM\Users\Default\Desktop\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\*
  • c:\zjwmukavuf\modules\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\*
  • c:\Python27\Lib\unittest\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\*
  • c:\Python27\Lib\test\capath\*
  • c:\Users\Harry Dresden\Music\*
  • \\KIDSROOM\Users\Default\Downloads\*
  • c:\Users\Harry Dresden\OneDrive\*
  • c:\Python27\tcl\tcl8.5\msgs\*
  • c:\ProgramData\Adobe\Acrobat\11.0\*
  • c:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\*
  • c:\Python27\tcl\tcl8.5\*
  • c:\Python27\Lib\unittest\test\*
  • c:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319\*
  • c:\ProgramData\Microsoft\Network\Connections\*
  • c:\Users\Public\Recorded TV\*
  • c:\Users\Harry Dresden\Contacts\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\42\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F\x-none.16\*
  • c:\Python27\tcl\tk8.5\msgs\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\*
  • c:\Python27\tcl\tcl8.5\tzdata\Atlantic\*
  • c:\Python27\tcl\tcl8.5\tzdata\Europe\*
  • c:\ProgramData\WebEx\WebEx\*
  • \\KIDSROOM\Users\Default\Pictures\*
  • c:\Python27\tcl\tk8.5\demos\*
  • c:\ProgramData\Microsoft\Windows Defender\*
  • c:\ProgramData\Microsoft\PlayReady\Cache\*
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\_backport\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\*
  • c:\ProgramData\NovaTech Network\NovaBench\*
  • c:\Python27\tcl\tix8.4.3\demos\samples\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\SentItems\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers\*
  • c:\ProgramData\Microsoft\PlayReady\Cache\S-1-5-21-3416602863-1947377224-293699093-1001\*
  • c:\6cdeacda242012e0e5b593e657\1037\*
  • c:\Python27\Lib\lib-tk\test\*
  • c:\zjwmukavuf\bin\*
  • c:\Users\Default\Pictures\*
  • \\KIDSROOM\Users\Harry Dresden\Searches\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\*
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\tests\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\serializer\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\*
  • c:\inetpub\custerr\*
  • \\KIDSROOM\Users\Harry Dresden\Contacts\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\*
  • c:\Python27\Scripts\*
  • c:\Users\Public\Desktop\*
  • c:\ProgramData\Microsoft\Network\Downloader\*
  • c:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\*
  • c:\Python27\Tools\pynche\*
  • c:\Python27\Lib\email\test\*
  • c:\ProgramData\Mozilla\logs\*
  • \\KIDSROOM\Users\Default\*
  • c:\ProgramData\Microsoft\IdentityCRL\*
  • c:\ProgramData\Microsoft\WPD\*
  • c:\ProgramData\Microsoft\Diagnosis\LocalTraceStore\*
  • c:\ProgramData\Microsoft\Event Viewer\*
  • c:\Users\Harry Dresden\Favorites\Links for United States\*
  • c:\Users\Default\*
  • c:\ProgramData\Sun\Java\Java Update\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\*
  • \\KIDSROOM\Users\Harry Dresden\Favorites\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\*
  • c:\Python27\tcl\dde1.3\*
  • c:\Python27\Lib\ensurepip\_bundled\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\x-none.16\*
  • \\KIDSROOM\Users\Harry Dresden\Music\*
  • c:\PerfLogs\Admin\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters\*
  • c:\Python27\Lib\idlelib\*
  • c:\Python27\Lib\site-packages\pip\models\*
  • c:\inetpub\*
  • c:\Users\Harry Dresden\Saved Games\*
  • c:\inetpub\wwwroot\msmq\*
  • c:\ProgramData\Microsoft\DRM\*
  • c:\ProgramData\Microsoft\Crypto\RSA\*
  • c:\zjwmukavuf\modules\auxiliary\*
  • c:\6cdeacda242012e0e5b593e657\1025\*
  • c:\Python27\Lib\test\crashers\*
  • c:\ProgramData\Microsoft\Search\Data\Applications\*
  • c:\Python27\Lib\ctypes\test\*
  • c:\Users\Public\Libraries\*
  • c:\ProgramData\Microsoft\Device Stage\*
  • c:\ProgramData\Microsoft\Device Stage\Device\*
  • c:\ProgramData\Microsoft\Windows NT\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\*
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\*
  • c:\Python27\Lib\xml\etree\*
  • c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\*
  • c:\Python27\Lib\test\*
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\Security\*
  • c:\Python27\Lib\ctypes\macholib\*
  • c:\Python27\Lib\msilib\*
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\*
  • c:\6cdeacda242012e0e5b593e657\1035\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\DD\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\*
  • c:\Users\Default\Videos\*
  • c:\ProgramData\McAfee\MCLOGS\Common\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\*
  • c:\Users\Default\Documents\*
  • c:\6cdeacda242012e0e5b593e657\1031\*
  • c:\Python27\tcl\tcl8.5\tzdata\Pacific\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\North_Dakota\*
  • \\KIDSROOM\Users\Harry Dresden\Downloads\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\*
  • c:\Python27\tcl\tcl8.5\tzdata\Etc\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\DD\*
  • c:\ProgramData\Adobe\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\*
  • c:\inetpub\history\CFGHISTORY_0000000001\*
  • \\KIDSROOM\Users\Harry Dresden\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A6\*
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\*
  • c:\Python27\Tools\webchecker\*
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\*
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\*
  • c:\inetpub\history\CFGHISTORY_0000000005\*
  • c:\Users\Harry Dresden\Favorites\Links\*
  • c:\ProgramData\Microsoft\Assistance\*
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\*
  • c:\inetpub\wwwroot\*
  • c:\Users\Harry Dresden\*
  • c:\Python27\tcl\tcl8.5\tzdata\Antarctica\*
  • c:\Python27\Lib\site-packages\pip\_vendor\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\*
  • \\KIDSROOM\Users\Public\Downloads\*
  • c:\Users\Public\Downloads\*
  • c:\6cdeacda242012e0e5b593e657\2070\*
  • c:\Python27\Lib\test\cjkencodings\*
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\*
  • \\KIDSROOM\Users\Default\Videos\*
  • c:\ProgramData\Microsoft\Windows Defender\Support\*
  • c:\Python27\Lib\site-packages\pip\operations\*
  • c:\ProgramData\Microsoft\MF\*
  • c:\6cdeacda242012e0e5b593e657\1029\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\*
  • c:\Python27\Lib\distutils\tests\*
  • c:\ProgramData\Microsoft\Office\*
  • c:\Users\Public\Music\*
  • c:\Python27\tcl\tcl8.5\tzdata\SystemV\*
  • c:\6cdeacda242012e0e5b593e657\1045\*
  • c:\zjwmukavuf\lib\common\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\*
  • c:\Users\Harry Dresden\Desktop\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\*
  • c:\ProgramData\Microsoft\Crypto\*
  • \\KIDSROOM\Users\Public\Foxit Software\*
  • c:\Users\Public\Pictures\*
  • c:\ProgramData\Mozilla\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\*
  • c:\Python27\include\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\*
  • c:\Python27\Lib\lib2to3\tests\data\fixers\*
  • c:\Python27\Lib\encodings\*
  • c:\Python27\Lib\site-packages\setuptools\*
  • c:\Python27\Lib\test\tracedmodules\*
  • c:\ProgramData\Microsoft\Diagnosis\AsimovUploader\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\*
  • c:\6cdeacda242012e0e5b593e657\1049\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\*
  • \\KIDSROOM\Users\Public\Recorded TV\Sample Media\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\*
  • c:\Python27\tcl\tcl8.5\tzdata\Mexico\*
  • \\KIDSROOM\Users\Harry Dresden\Favorites\Links\*
  • c:\ProgramData\Microsoft\RAC\*
  • \\KIDSROOM\Users\Public\Pictures\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\*
  • \\KIDSROOM\Users\Public\Music\*
  • c:\Python27\tcl\tcl8.5\tzdata\Arctic\*
  • c:\ProgramData\Oracle\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\35\*
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\media\*
  • c:\ProgramData\Microsoft\Windows Defender\Quarantine\*
  • c:\Python27\tcl\tcl8\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Queue\*
  • c:\ProgramData\Microsoft\RAC\Outbound\*
  • c:\ProgramData\WebEx\*
  • c:\inetpub\history\CFGHISTORY_0000000003\*
  • c:\Python27\Lib\site-packages\setuptools\command\*
  • c:\Python27\tcl\tcl8.5\tzdata\Indian\*
  • c:\ProgramData\Microsoft\Event Viewer\Views\*
  • c:\Users\Default\Favorites\*
  • c:\*
  • c:\Users\Default\Desktop\*
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\*
  • c:\ProgramData\Microsoft\eHome\logs\*
  • c:\ProgramData\Microsoft\Network\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Kentucky\*
  • c:\Python27\Lib\lib-tk\test\test_ttk\*
  • c:\Python27\tcl\tcl8.5\tzdata\US\*
  • c:\ProgramData\Microsoft\ClickToRun\UserData\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\*
  • c:\Users\Public\Pictures\Sample Pictures\*
  • c:\6cdeacda242012e0e5b593e657\1041\*
  • c:\Users\Default\Downloads\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\ssl_match_hostname\*
  • c:\Users\Harry Dresden\Links\*
  • c:\Python27\DLLs\*
  • c:\ProgramData\Microsoft\User Account Pictures\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\contrib\*
  • \\KIDSROOM\Users\Harry Dresden\OneDrive\*
  • c:\Python27\tcl\tcl8.5\tzdata\Asia\*
  • c:\Users\Harry Dresden\Downloads\*
  • c:\Python27\tcl\tcl8.5\opt0.4\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\42\*
  • c:\Users\Public\Videos\*
  • c:\Python27\tcl\tcl8\8.4\*
  • c:\6cdeacda242012e0e5b593e657\1055\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\*
  • c:\Python27\Tools\versioncheck\*
  • c:\zjwmukavuf\lib\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F7\*
  • c:\Python27\Lib\xml\dom\*
  • c:\Python27\Lib\lib2to3\tests\data\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\*
  • \\KIDSROOM\Users\Harry Dresden\Desktop\*
  • c:\Python27\tcl\tcl8.5\encoding\*
  • c:\ProgramData\McAfee\*
  • c:\ProgramData\Microsoft\DRM\Server\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\*
  • c:\ProgramData\Microsoft\User Account Pictures\Default Pictures\*
  • \\KIDSROOM\Users\Public\Favorites\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\*
  • \\KIDSROOM\Users\Public\Documents\*
  • c:\Python27\Lib\xml\parsers\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\*
  • c:\6cdeacda242012e0e5b593e657\1038\*
  • c:\Python27\tcl\tix8.4.3\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\trie\*
  • c:\Python27\tcl\tcl8.5\tzdata\Canada\*
  • c:\ProgramData\NovaTech Network\*
  • c:\ProgramData\Microsoft\WwanSvc\*
  • \\KIDSROOM\Users\*
  • c:\6cdeacda242012e0e5b593e657\1053\*
  • c:\Users\Default\Music\*
  • c:\Python27\Lib\test\decimaltestdata\*
  • c:\Python27\Lib\test\xmltestdata\*
  • c:\zjwmukavuf\lib\api\*
  • c:\ProgramData\Passmark\PerformanceTest\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\*
  • c:\Python27\tcl\reg1.2\*
  • \\KIDSROOM\Users\Public\*
  • \\KIDSROOM\Users\Harry Dresden\Documents\*
  • \\KIDSROOM\Users\Public\Music\Sample Music\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\*
  • c:\6cdeacda242012e0e5b593e657\2052\*
  • c:\Python27\Lib\logging\*
  • c:\ProgramData\Microsoft\eHome\*
  • c:\Users\Public\*
  • c:\6cdeacda242012e0e5b593e657\1043\*
  • c:\Python27\Lib\site-packages\*
  • c:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\*
  • c:\ProgramData\Microsoft\Diagnosis\UIF\*
  • c:\Users\Harry Dresden\Searches\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\*
  • c:\Python27\tcl\tk8.5\*
  • c:\Python27\Lib\xml\sax\*
  • c:\ProgramData\Microsoft\Vault\*
  • c:\Users\Default\Links\*
  • c:\Python27\Lib\json\tests\*
  • c:\Python27\libs\*
  • c:\6cdeacda242012e0e5b593e657\1028\*
  • c:\Python27\Lib\lib-tk\test\test_tkinter\*
  • c:\Users\Public\Foxit Software\Foxit Reader\*
  • c:\ProgramData\Microsoft OneDrive\*
  • c:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\*
  • c:\Python27\Lib\ctypes\*
  • c:\Users\Public\Recorded TV\Sample Media\*
  • c:\Python27\*
  • c:\ProgramData\Microsoft\Crypto\DSS\*
  • c:\ProgramData\Microsoft\Diagnosis\Sideload\*
  • c:\Python27\Lib\email\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\*
  • c:\ProgramData\Microsoft\Search\Data\*
  • c:\Users\Harry Dresden\Documents\*
  • c:\ProgramData\Adobe\Setup\*
  • c:\Python27\Lib\distutils\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\*
  • c:\ProgramData\Microsoft\Device Stage\Task\*
  • c:\Users\*
  • \\KIDSROOM\Users\Default\Links\*
  • c:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\*
  • c:\Python27\Lib\sqlite3\*
  • c:\ProgramData\Sun\Java\*
  • c:\ProgramData\Microsoft\NetFramework\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\*
  • c:\ProgramData\Microsoft\Crypto\Keys\*
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\*
  • c:\Python27\Lib\bsddb\test\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\{98101498-C465-4F51-8751-D1919E97D29D}\*
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\*
  • c:\Recovery\*
  • c:\Users\Public\Foxit Software\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A6\*
  • c:\inetpub\history\CFGHISTORY_0000000002\*
  • c:\Python27\Lib\site-packages\pip\req\*
  • c:\Users\Harry Dresden\Videos\*
  • \\KIDSROOM\Users\Public\Videos\Sample Videos\*
  • c:\inetpub\wwwroot\aspnet_client\system_web\*
  • c:\Python27\tcl\tcl8.5\tzdata\Australia\*
  • c:\Users\Harry Dresden\Pictures\*
  • c:\ProgramData\Microsoft\DeviceSync\*
  • c:\ProgramData\WebEx\WebEx\12_1324\*
  • c:\ProgramData\Microsoft\Office\Heartbeat\*
  • c:\Python27\Lib\lib2to3\tests\data\fixers\myfixes\*
  • \\KIDSROOM\Users\Public\Libraries\*
  • c:\Python27\Tools\Scripts\*
  • c:\Python27\Lib\hotshot\*
  • c:\ProgramData\Microsoft\*
  • c:\ProgramData\Microsoft\PlayReady\*
  • c:\zjwmukavuf\*
  • c:\Python27\Lib\site-packages\pip\utils\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\*
  • \\KIDSROOM\Users\Public\Recorded TV\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\*
  • c:\Python27\tcl\tcl8.5\tzdata\Brazil\*
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\packaging\*
  • \\KIDSROOM\Users\Public\Desktop\*
  • c:\Python27\Lib\lib2to3\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Argentina\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\*
  • c:\ProgramData\Microsoft\WwanSvc\Profiles\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\*
  • c:\Python27\Lib\test\subprocessdata\*
  • \\KIDSROOM\Users\Default\Favorites\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Quick\*
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info\*
  • c:\Python27\Lib\site-packages\pip\_vendor\progress\*
  • \\KIDSROOM\Users\Harry Dresden\Saved Games\*
  • c:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Inbox\*
  • c:\Python27\Lib\xml\*
  • c:\ProgramData\Microsoft\Search\*
  • c:\ProgramData\Microsoft\IlsCache\*
  • c:\Python27\tcl\tk8.5\images\*
  • e:\*
  • c:\Python27\Lib\sqlite3\test\*
  • c:\ProgramData\McAfee\MCLOGS\*
  • c:\Python27\Lib\ensurepip\*
  • c:\Python27\Lib\idlelib\Icons\*
  • c:\Python27\Lib\test\imghdrdata\*
  • c:\ProgramData\Microsoft\Diagnosis\*
  • c:\6cdeacda242012e0e5b593e657\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\*
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\*
  • c:\Python27\Lib\lib-tk\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\*
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\*
  • c:\Python27\tcl\tcl8.5\tzdata\*
  • c:\ProgramData\Microsoft\RAC\PublishedData\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\*
  • \\KIDSROOM\Users\Default\Documents\*
  • c:\Python27\Lib\multiprocessing\dummy\*
  • \\KIDSROOM\Users\ruiner\*
  • c:\Python27\Lib\email\mime\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\*
  • c:\Python27\tcl\tix8.4.3\demos\bitmaps\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\en-us.16\*
  • c:\Users\Public\Documents\*
  • c:\6cdeacda242012e0e5b593e657\3082\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\*
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\*
  • c:\6cdeacda242012e0e5b593e657\1030\*
  • c:\Users\Harry Dresden\Favorites\*
  • c:\Python27\Doc\*
  • c:\Python27\Lib\curses\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F\*
  • c:\Python27\Lib\lib2to3\pgen2\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\*
  • c:\ProgramData\Adobe\Acrobat\*
  • c:\Python27\Lib\*
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\*
  • c:\Python27\tcl\tix8.4.3\demos\*
  • c:\6cdeacda242012e0e5b593e657\1042\*
  • c:\Python27\Lib\test\audiodata\*
  • c:\inetpub\history\CFGHISTORY_0000000004\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\*
  • c:\Python27\Lib\site-packages\pip\_vendor\_markerlib\*
  • \\KIDSROOM\Users\Harry Dresden\Videos\*
  • c:\Python27\tcl\tcl8\8.4\platform\*
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\*
  • c:\Python27\Lib\site-packages\pip\vcs\*
  • c:\6cdeacda242012e0e5b593e657\1046\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\*
  • c:\Python27\tcl\tix8.4.3\pref\*
  • c:\Python27\Lib\site-packages\pip\compat\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\*
  • \\KIDSROOM\Users\Default\Music\*
  • c:\Python27\Lib\json\*
  • c:\Python27\Lib\lib2to3\fixes\*
  • \\KIDSROOM\Users\Harry Dresden\Favorites\Links for United States\*
  • c:\ProgramData\Microsoft\Windows Defender\LocalCopy\*
  • c:\ProgramData\Microsoft\Assistance\Client\*
  • c:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\*
  • c:\Python27\Lib\test\leakers\*
  • c:\Users\Public\Videos\Sample Videos\*
  • c:\ProgramData\Microsoft\Media Player\*
  • c:\ProgramData\McAfee\MCLOGS\Common\jxpiinstall\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\filters\*
  • c:\zjwmukavuf\modules\packages\*
  • c:\Python27\Tools\*
  • c:\6cdeacda242012e0e5b593e657\1044\*
  • c:\6cdeacda242012e0e5b593e657\1036\*
  • c:\inetpub\history\*
  • c:\6cdeacda242012e0e5b593e657\1032\*
  • c:\Python27\tcl\tcl8.5\tzdata\Chile\*
  • c:\Python27\Lib\site-packages\pip\_vendor\packaging\*
  • c:\ProgramData\Microsoft\Windows NT\MSScan\*
  • c:\Python27\Lib\email\test\data\*
  • c:\Python27\tcl\tix8.4.3\bitmaps\*
  • c:\Python27\Lib\site-packages\pip\_vendor\colorama\*
  • c:\Python27\Lib\lib2to3\tests\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\*
  • \\KIDSROOM\Users\Public\Videos\*
  • c:\ProgramData\regid.1991-06.com.microsoft\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F7\*
  • c:\ProgramData\Microsoft OneDrive\setup\*
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\*
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches\*
  • c:\Python27\Lib\distutils\command\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\*
  • c:\zjwmukavuf\lib\core\*
  • c:\Python27\tcl\*
  • c:\Python27\Lib\site-packages\pip\commands\*
  • c:\Python27\Lib\site-packages\pkg_resources\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\*
  • c:\Python27\Lib\multiprocessing\*
  • c:\Python27\Lib\wsgiref\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\35\*
  • c:\Users\Public\Favorites\*
  • c:\Python27\Lib\pydoc_data\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util\*
  • c:\ProgramData\Microsoft\RAC\StateData\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Indiana\*
  • c:\Python27\Lib\site-packages\_markerlib\*
  • c:\Python27\Lib\idlelib\idle_test\*
  • c:\inetpub\custerr\en-US\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\*
  • c:\6cdeacda242012e0e5b593e657\1040\*
Registry Key-Opened
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\control\NetworkProvider\HwOrder
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPNP\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\VssapiPublisher
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MiniNT
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Safeboot\Option
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\NetworkProvider
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider
  • HKEY_CURRENT_USER\Network\E
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions
  • HKEY_LOCAL_MACHINE\system\CurrentControlSet\Control\NetworkProvider\Notifyees
  • HKEY_CURRENT_USER\Network
  • HKEY_PERFORMANCE_DATA\(Default)
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LDAP
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
  • HKEY_LOCAL_MACHINE\system\CurrentControlSet
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\http\
  • HKEY_CURRENT_USER\Software
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610
  • HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CLASSES_ROOT\.js
  • HKEY_LOCAL_MACHINE\Software\Policies
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Pre Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\0a-00-27-00-00-00
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_CERT_WARNINGS_ON_POST_FROM_ISTREAM_KB2894776
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001
  • HKEY_LOCAL_MACHINE\Software
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Pre Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\*\
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_URLMON_IQDA_SIZE
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent
  • HKEY_CURRENT_USER\Software\Policies
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\KindMap
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_URLMON_IQDA_SIZE
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00
  • HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_LOCAL_MACHINE\System\Setup
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION
  • HKEY_CLASSES_ROOT\JSFile\ScriptEngine
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\UrlMon Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SHOW_CERT_WARNINGS_ON_POST_FROM_ISTREAM_KB2894776
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Registry Key-Deleted
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDetectedUrl
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDetectedUrl
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
Registry Key-Read
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\MaxRpcSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseHostnameAsAlias
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\LdapClientIntegrity
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\OOBEInProgress
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseOldHostResolutionOrder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder\ProviderOrder
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\ComputerName
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions\ProductType
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ReceiveTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\wscript.exe
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\NoFileFolderJunction
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cer\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectTimeOut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\DisallowRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InitFolderHandler
  • HKEY_CURRENT_USER\Directory\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PreCreate
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc2740-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\IgnoreUserSettings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\AdminTabProcs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InfoTip
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DevicePath
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\RestrictRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ADODB.Stream\CLSID\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\*
  • HKEY_CURRENT_USER\Directory\NeverShowExt
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\LogFileName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.js\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chm\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\MapNetDriveVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\Timeout
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivKeyCachePurgeIntervalSeconds
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\TabProcGrowth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDhcp
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParsingName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SendTimeOut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\Environment\PROCESSOR_ARCHITECTURE
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SourcePath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseOldHostResolutionOrder
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273c-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsParseDisplayName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\DontShowSuperHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\InprocServer32
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\AllowFileCLSIDJunctions
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\SessionMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bat\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoSetFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\FolderTypeID
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\DisplayLogo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\(Default)
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableUTF8
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\COM+Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.com\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForInfoTip
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FrameTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\*
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Srp\GP\RuleCount
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HasNavigationEnum
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1A10
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Description
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\PolicyScope
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoCommonGroups
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273d-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoSimpleStartMenu
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\Safety Warning Level
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ade\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation\AllowedReservedCharacters
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoControlPanel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\SessionMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORPARSING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\BrowseInPlace
  • HKEY_CURRENT_USER\Directory\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForOverlay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\UseDropHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.crt\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsAliasedNotifications
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\ClassicShell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugHeapFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FrameTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\DefaultLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JScript\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSXML2.XMLHTTP\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideOnDesktopPerUser
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SendTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoPropertiesMyComputer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WScript.Shell\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bas\(Default)
  • HKEY_CURRENT_USER\Directory\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Name
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoPropertiesRecycleBin
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORDISPLAY
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Image Path
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Platform
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\TabProcGrowth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\DelegateExecute
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\PinToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\Levels
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpl\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoInternetIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273d-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\InheritConsoleHandles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\UseWINSAFER
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivKeyCacheMaxItems
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1806
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\DocObject
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ReceiveTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Security
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\SaferFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResource
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\AdminTabProcs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\TrustPolicy
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Compatible
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\DA0C75D6
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsUniversalDelegate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.adp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\command
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseHostnameAsAlias
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InitFolderHandler
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\NoWorkingDirectory
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\ScriptEngine\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecision
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cmd\(Default)
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1806
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\LogSecuritySuccesses
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc2740-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
  • HKEY_CURRENT_USER\Directory\IsShortcut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivateKeyLifetimeSeconds
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\*
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\LdapClientIntegrity
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideInWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FrameMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\DisplayLogo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\Timeout
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Compatible
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\InheritConsoleHandles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win64\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\InprocServer32
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273c-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FrameMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\SetWorkingDirectoryFromTarget
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDns
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionTime
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideFolderVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Flags
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadExpirationDays
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\NeverShowExt
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDetectedUrl
Registry Key-Written
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionReason
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecision
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionTime
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadNetworkName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
Mutex-Accessed
  • Local\ZonesCacheCounterMutex
  • Local\ZonesLockedCacheCounterMutex

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 460, Parent PID: 364

"C:\Windows\System32\wscript.exe" C:\Users\HARRYD~1\AppData\Local\Temp\NRV_6NE59609_.js PID: 4044, Parent PID: 5648

"C:\Windows\SysWOW64\rundll32.exe" C:\Users\HARRYD~1\AppData\Local\Temp\KXGQLZ~1.DLL,boobs PID: 5452, Parent PID: 4044

Volatility

Nothing to display.