'
metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2016-11-08 21:18:24.119871 2016-11-08 21:21:40.649137 196 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo2 win7 Clone 2 VirtualBox 2016-11-08 21:18:25 2016-11-08 21:21:38

File Details

File name 21555b643861f1a834d4540b7ff486382f528cd5.zip
File size 1107 bytes
File type Zip archive data, at least v2.0 to extract
CRC32 9053617E
MD5 1c58e9441836ff64b95f66d5eb798e01
SHA1 21555b643861f1a834d4540b7ff486382f528cd5
SHA256 55cab6a98e88cfe2fb8f05dcadc3a7e267c38149c299c28b2c1bca29d84c0272
SHA512 e7a0f2fb394ed8738d916a5ce84443f0b5eec5ae39c79e1363df5c8e0a8f82a6890e7e1231aac3e55d9a426b598dc4ca09a7036908d83c6f94401123399ce147
Ssdeep 24:96TzsGJFPgkHcNteoYJELhiuVk24cuOVmmKzO4W3T3:96TzbFL8NMwhd624f6KzzaT3
PEiD None matched
Yara
  • PM_Zip_with_js ()
VirusTotal File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=125, Anomalies=0, PEiD=0, Yara=2, VT[1478640140]=0): Snort Events=2, AV Events=2
Total Score=125

SNORT EVENTS:
ET POLICY PE EXE or DLL Windows file download HTTP
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

CLAMAV DETECTED:
Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND
DROPPED FILE - NRV_5359H4I_.js: Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND

Dropped File/Buffer Yara Signatures:
4793cb553dfaef1d7b9718dd860d5b71a7024856 [BUFFER]: Str_Win32_Http_API
361b0c9df450cb2162f26ceaa3d9e035aa3f7c93 [BUFFER]: shellcode

Signatures

antivm_queries_computername details
recon_fingerprint details
antivm_memory_available details
dumped_buffer details
creates_doc details
antivm_network_adapters details
dumped_buffer2 details
antivm_vbox_files details
Windows_Proxy_Tinkering details
network_wscript_downloader details
persistence_ads details
antiav_detectfile details
exploit_heapspray details
malicious_document_urls details
network_document_file details
network_downloader_exe details
antivm_vbox_devices details
antivm_vbox_files details
modifies_files details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

eee7e94d18bf66b0_gizcrygx-7am0-fmm8-39ee-3999dc332db6.thor

e7a438974aa4bdab_gizcrygx-7am0-fmm8-bdd5-1f34264a94d8.thor

5a307453f6448ee4_gizcrygx-7am0-fmm8-6891-ba40bac59f77.thor

0849d1c3d84c5bcc_gizcrygx-7am0-fmm8-fb45-e17c85a907df.thor

858566ee5734d523_gizcrygx-7am0-fmm8-efbf-33ce294f45cb.thor

ff4c5a42b539f825_gizcrygx-7am0-fmm8-13e2-0775517403e8.thor

f9c7d2b83aa212cc_gizcrygx-7am0-fmm8-d593-c54d0cc14d59.thor

e8389b01faef06f8_gizcrygx-7am0-fmm8-3ffe-1bc037db8644.thor

e526cfb1b962b8ca_gizcrygx-7am0-fmm8-6703-efcae40ea145.thor

d79f85ed4ab069d6_gizcrygx-7am0-fmm8-db5c-1394dcbaa964.thor

10c1b172aa87c7dc_gizcrygx-7am0-fmm8-099b-86646ae03ce5.thor

f087bbc8e4127366_gizcrygx-7am0-fmm8-f320-e0d3dc93f882.thor

61df109bc34755d7_gizcrygx-7am0-fmm8-71ac-888ae40f337b.thor

dc0c9fafe8532bc2_gizcrygx-7am0-fmm8-9065-ac3feb90c0be.thor

d6b27f7c164ddd6a_gizcrygx-7am0-fmm8-7518-2bf6dc3bf0e7.thor

7c05593432d4b205_gizcrygx-7am0-fmm8-47ca-63fa9f03c141.thor

c9c110927499bd8d_gizcrygx-7am0-fmm8-af40-132dfe99d790.thor

f891f8ffb826ace2_gizcrygx-7am0-fmm8-cdb9-5bb2105aac05.thor

9390a071f10e6957_gizcrygx-7am0-fmm8-4756-446cd6551af0.thor

afbf0f07e8c2263b_gizcrygx-7am0-fmm8-48f8-95ef54d38243.thor

b3a0fa1f20f1ab7b_gizcrygx-7am0-fmm8-1e9e-e2e3f485fc4e.thor

c4382f68a976b065_gizcrygx-7am0-fmm8-f468-1319fb43a487.thor

deb4c07afbf8917a_gizcrygx-7am0-fmm8-492b-c334bf476570.thor

b53f949396f4ef3d_gizcrygx-7am0-fmm8-91d9-86d64e512683.thor

e935eaf986936381_gizcrygx-7am0-fmm8-43d2-74eb4dcc6056.thor

b08d08d9446f4a1e_gizcrygx-7am0-fmm8-8acc-44640addcb1c.thor

443de8bc12a7a599_gizcrygx-7am0-fmm8-8932-8e63f08d346d.thor

e01eb580a73d3648_gizcrygx-7am0-fmm8-4bd9-17a8d0e103e1.thor

448e61be0507dafc_gizcrygx-7am0-fmm8-b6dc-88971badba12.thor

090077013c9cf1fa_gizcrygx-7am0-fmm8-c021-a6dd05e2ff48.thor

d7632230ddde0159_gizcrygx-7am0-fmm8-3b36-855f01e924af.thor

caa21bef3e5ed7b6_gizcrygx-7am0-fmm8-2ce2-b5006a8ebe2d.thor

9d86a86b043c1085_gizcrygx-7am0-fmm8-9bcd-1e39f87bfdee.thor

2a973910846ef545_gizcrygx-7am0-fmm8-4340-5c738b9a26d2.thor

7cfe752a6c7d4c8d_gizcrygx-7am0-fmm8-d763-f1e4a0b0ef01.thor

7ea6313b53530553_gizcrygx-7am0-fmm8-f798-fc6fc9924491.thor

0adf26a10ab8ca6d_gizcrygx-7am0-fmm8-d707-9da50cac8012.thor

3aeadfeff7cdb777_gizcrygx-7am0-fmm8-4142-f964624773d5.thor

46aed5facdc37517_gizcrygx-7am0-fmm8-6040-b2ffae005cb4.thor

473d050dafa2a76b_gizcrygx-7am0-fmm8-da2f-ef9c57f448c0.thor

91a7aa99df865e9b_gizcrygx-7am0-fmm8-0013-3e18ca750f97.thor

4975f6fea8ea44fc_ctlt8b[1].txt

cdd443f3b336e8e8_gizcrygx-7am0-fmm8-5211-434ee8ddc621.thor

f01d6e0939e41b95_gizcrygx-7am0-fmm8-522b-6ec53a1f950e.thor

83e082e538c8a2cf_gizcrygx-7am0-fmm8-1108-d9fa393d7f55.thor

d5ca6b6e398a61f0_gizcrygx-7am0-fmm8-c5a6-0eff9ebafb5a.thor

7ba6de99485dfd50_gizcrygx-7am0-fmm8-d64d-8bf5e4082970.thor

0fac7216b0deb9c6_gizcrygx-7am0-fmm8-d891-9851497dc487.thor

c908ad62abae0481_gizcrygx-7am0-fmm8-b710-47a7c357d0f2.thor

65da78268082c526_gizcrygx-7am0-fmm8-f1be-804434211ab2.thor

422be6502776dd43_gizcrygx-7am0-fmm8-16bd-c9eb65d5e2e4.thor

f874a4231c063b01_gizcrygx-7am0-fmm8-5cf9-0e9bcc3d4d94.thor

506679b421e7bde1_gizcrygx-7am0-fmm8-4ca1-6387676ef251.thor

337888b7b989306f_gizcrygx-7am0-fmm8-3bd5-bc4306881ce5.thor

97160d84e544ffc2_gizcrygx-7am0-fmm8-a2c0-697e3edfffc0.thor

8ec83eb5f16b2554_gizcrygx-7am0-fmm8-cd18-045ff0acd67c.thor

2783bcaae198b20b_gizcrygx-7am0-fmm8-2363-1712a80b079f.thor

761bcebbc6f51b54_gizcrygx-7am0-fmm8-cfd0-587b5c1bb28c.thor

9e8928de95b9857a_gizcrygx-7am0-fmm8-e35c-0ad5fa560e10.thor

86a4b7181093ced6__3_what_is.html

c9897ecbc441185c_gizcrygx-7am0-fmm8-ea8c-11e88d06f4b8.thor

878b7ccf0664126a_gizcrygx-7am0-fmm8-47b0-4a8830772219.thor

2b83a9cee1fb6cbc_gizcrygx-7am0-fmm8-0adb-3aa3355bb4a1.thor

32cce3cd61fe153e_gizcrygx-7am0-fmm8-267c-32b53abe44a2.thor

40f80f13ebd8023a_gizcrygx-7am0-fmm8-a93b-af44a6f490ef.thor

85a9988a451d169a_gizcrygx-7am0-fmm8-c24c-423ef74e1894.thor

b9be6277bd1a27bf_gizcrygx-7am0-fmm8-d9ab-1488d1af06ea.thor

8cc3562cb0bcc737_gizcrygx-7am0-fmm8-f4dd-ff446bf6b185.thor

77fd9fb5616fbb0b_gizcrygx-7am0-fmm8-035b-6a99daf49a71.thor

139f17005da67e5d_gizcrygx-7am0-fmm8-a748-b0e3f705a3ae.thor

a50bc5985321b960_gizcrygx-7am0-fmm8-9307-060db23d5113.thor

c768e98a5e413dc4_gizcrygx-7am0-fmm8-3b54-8a187c8b163f.thor

1bd608963b869afd_gizcrygx-7am0-fmm8-8678-a9d91670041f.thor

1dca3d32615910d4_gizcrygx-7am0-fmm8-b939-9fc78b95934d.thor

2e50659ae51942ce_gizcrygx-7am0-fmm8-9e53-835fa849b01d.thor

15af6bc845683a6a_gizcrygx-7am0-fmm8-9ead-c955ad9486a0.thor

0071e6d8cdbec6b6_gizcrygx-7am0-fmm8-6f5c-a70d42287224.thor

ebf652473f6349ec_gizcrygx-7am0-fmm8-5a29-f74c6a3af0f6.thor

53241393d9ebcd25_gizcrygx-7am0-fmm8-b9df-71dfa701c634.thor

84e9b60cfbc65cf0_gizcrygx-7am0-fmm8-fb02-e0cce641ee1c.thor

e6fc179120df9a8e_gizcrygx-7am0-fmm8-effc-76dd3bb4ad21.thor

44e77bab0c5fe2d6_gizcrygx-7am0-fmm8-0cc6-3e96c1e791fc.thor

1c69f635b21e2471_gizcrygx-7am0-fmm8-47ea-b5fca6634e88.thor

6b7cbda10ff23d5e_gizcrygx-7am0-fmm8-ee52-27ce6e38143e.thor

0a406f84ae551c6c_gizcrygx-7am0-fmm8-378c-25ddfaf2be1d.thor

5032391119a1bc70_gizcrygx-7am0-fmm8-d1ee-12e228b52347.thor

07bf96a9812e69ac_gizcrygx-7am0-fmm8-bd32-fa79580bf809.thor

ec2f299837df3cd1_gizcrygx-7am0-fmm8-dab3-2483e3f68e4d.thor

682d17f04b1b9b26_gizcrygx-7am0-fmm8-2259-4b3721505021.thor

8922be825fc94095_gizcrygx-7am0-fmm8-0f25-b5a2b157f106.thor

d2c1eb024632c52c_gizcrygx-7am0-fmm8-bc81-2037bcb6d7ed.thor

9686d33d98674264_gizcrygx-7am0-fmm8-66a4-eb30f37e6df3.thor

683e780090cf0fb7_gizcrygx-7am0-fmm8-3f1e-bbe6588f136d.thor

bb0bd0e3eeab8e0c_gizcrygx-7am0-fmm8-62cc-f3c733cbdee2.thor

7e427d91bd29103e_gizcrygx-7am0-fmm8-4174-25deec9c7e70.thor

0409fdbddcc7e62d_gizcrygx-7am0-fmm8-b32a-4ced551a14ee.thor

245bb6698c2a5cb7_gizcrygx-7am0-fmm8-d394-3c78312b40c6.thor

5bcf24cb030e308a_gizcrygx-7am0-fmm8-ad49-3a0fd5aa1bfa.thor

10ac3c8cb8f43a44_gizcrygx-7am0-fmm8-0147-9dabd6d0b54d.thor

a4edb79c87f756fa_gizcrygx-7am0-fmm8-3524-86a0dcfe418c.thor

c6ca29a99b5ef5c1_gizcrygx-7am0-fmm8-59bf-e187cbf15fd3.thor

a7885be2eb153f69_gizcrygx-7am0-fmm8-9a0c-d1130025b960.thor

13f2140662f7ccce_gizcrygx-7am0-fmm8-ab3d-447d88ffbddb.thor

d4bda01539843565_gizcrygx-7am0-fmm8-3de9-d0abadc29d93.thor

cce2055279af52ee_gizcrygx-7am0-fmm8-4739-61fa3e405d02.thor

7cd06af4c84d2db6_gizcrygx-7am0-fmm8-6aaf-0330029d310f.thor

91f0b7db5aac57bb_gizcrygx-7am0-fmm8-d32f-d4efcbe3a766.thor

b0dfe389770f7cfd_gizcrygx-7am0-fmm8-a958-edf1d1655454.thor

92e6db1057469eed_gizcrygx-7am0-fmm8-b8cb-3e8db753525c.thor

3624430f56151c3d_gizcrygx-7am0-fmm8-0ae7-725c3d337a1b.thor

2895a71b2c2a5100_gizcrygx-7am0-fmm8-62c9-47d638eabde0.thor

4e24a258fdbfef81_gizcrygx-7am0-fmm8-0c19-a663bbbd4db2.thor

8f94c53a470188b6_gizcrygx-7am0-fmm8-0612-20b208a90f5b.thor

bda117e9ac33dfa5_gizcrygx-7am0-fmm8-89a1-9bd8fa9c3a10.thor

9a7ffcfeb2f2b74a_gizcrygx-7am0-fmm8-291e-85683f8212b0.thor

8a3fdf0563dbdf34_gizcrygx-7am0-fmm8-db2f-186f6231694e.thor

6efe479b5feaba82_gizcrygx-7am0-fmm8-8812-d8923c425cb2.thor

87dfdecc984a613e_gizcrygx-7am0-fmm8-c633-dac415525f18.thor

232dbc82940ff0a2_gizcrygx-7am0-fmm8-5a07-6d62518675cd.thor

6e82ed8e9ab3f21d_gizcrygx-7am0-fmm8-cf07-9bc7d6d51ffb.thor

24537760d6dabbde_gizcrygx-7am0-fmm8-b5f5-0dc11fd7c842.thor

65bc7e07b43a6cf8_gizcrygx-7am0-fmm8-ee47-c72e453110ab.thor

08fefa83b0ff6bc7_gizcrygx-7am0-fmm8-0824-1dd74ed4e17e.thor

9243167678f2f23b_gizcrygx-7am0-fmm8-c1ab-95b9d830a8b7.thor

6d96a85f44e6a1ac_gizcrygx-7am0-fmm8-8b4b-a6c447d6d0b0.thor

cb03d64b189c9ea7_gizcrygx-7am0-fmm8-d90f-f9e8aeaf2f2c.thor

17d9dbea2c97ada5_gizcrygx-7am0-fmm8-1bfe-19c44dab7d59.thor

133dd04ad8346edb_gizcrygx-7am0-fmm8-3730-4126a9e833d4.thor

99e6cb16ca004a97_gizcrygx-7am0-fmm8-cd18-358d66046618.thor

d1fa1afc1a4b47fc_gizcrygx-7am0-fmm8-b623-30e61bd392a2.thor

40001811b4e4b843_gizcrygx-7am0-fmm8-92ce-74c89d7b4458.thor

44bd53b2575dea35_gizcrygx-7am0-fmm8-79b6-4cb4b2cb01d8.thor

a1a174060a9e398a_gizcrygx-7am0-fmm8-fab5-febef58e7cae.thor

90c4009722d3f4ea_gizcrygx-7am0-fmm8-b8d3-d03ecbc87a99.thor

b25b2e3c975eb08b_gizcrygx-7am0-fmm8-a193-9424e2683c08.thor

8caa3fdeccbb1c17_gizcrygx-7am0-fmm8-ec8e-ce6bb53c4597.thor

0102fb6444be6cff_gizcrygx-7am0-fmm8-1169-8f68d4e71a15.thor

15a7cbe5d2bc74f9_gizcrygx-7am0-fmm8-23a5-19d872b35ade.thor

62dd36f34f4fc8cc_gizcrygx-7am0-fmm8-e665-d39106036bd5.thor

ea0e4d6bed9a53cc_gizcrygx-7am0-fmm8-13d0-059a2faef998.thor

7d2e0f81feb9c773_gizcrygx-7am0-fmm8-b0ec-049ff3f45e07.thor

4c48a8e4a080e462_gizcrygx-7am0-fmm8-5967-99defaf1f626.thor

f49379900339d427_gizcrygx-7am0-fmm8-7aa8-095936da7bc9.thor

6754ec176998525b_gizcrygx-7am0-fmm8-74b6-e3c62f4bd4bc.thor

6a9da9714a18f218_gizcrygx-7am0-fmm8-bf2b-82d1cde886a3.thor

367ceb8bd92fcf78_gizcrygx-7am0-fmm8-6b9e-777aa9d3cc58.thor

bac6a2c8c4b4b964_gizcrygx-7am0-fmm8-3bd3-35bde6cb7a22.thor

3b167d090f56b3b1_gizcrygx-7am0-fmm8-de14-f145c2bf39b6.thor

abf6606a020254f8_gizcrygx-7am0-fmm8-8b26-b8a07d82b38b.thor

04daef267371975c_gizcrygx-7am0-fmm8-3b67-d3fbb92d321b.thor

8e3bed45a3062adb_gizcrygx-7am0-fmm8-9bc9-0bd9fc9cc4d7.thor

NRV_5359H4I_.js

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

Behavior Summary

File-Read
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\include\errcode.h
  • c:\Python27\Lib\test\keycert3.pem
  • c:\Python27\include\ast.h
  • c:\Python27\include\pyexpat.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\tupleobject.h
  • c:\Python27\include\parsetok.h
  • c:\Python27\include\warnings.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • c:\Python27\include\descrobject.h
  • c:\Python27\include\floatobject.h
  • c:\Python27\include\Python-ast.h
  • c:\Python27\include\osdefs.h
  • c:\Python27\Lib\test\empty.vbs
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • c:\Python27\include\pymacconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Python27\include\ceval.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\Python27\include\import.h
  • \\?\PIPE\browser
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\pymem.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\Python27\include\pyarena.h
  • c:\Python27\include\pygetopt.h
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\Python27\include\complexobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\Python27\include\rangeobject.h
  • c:\Python27\include\bufferobject.h
  • c:\Python27\include\pythread.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • c:\Python27\include\patchlevel.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\bCfIQCBODrpmxSwKV.docx
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\include\iterobject.h
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\Python27\include\funcobject.h
  • c:\Python27\include\listobject.h
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • c:\Python27\include\marshal.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\Python27\include\pgenheaders.h
  • c:\Python27\include\frameobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\longintrepr.h
  • c:\cnrgqonuj\bin\cert.p12
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\brZUYpxPew.pptx
  • c:\Python27\include\opcode.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\Python27\Lib\test\badcert.pem
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\include\sliceobject.h
  • c:\Python27\include\pgen.h
  • c:\Python27\include\memoryobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • c:\Python27\include\moduleobject.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • c:\Python27\include\objimpl.h
  • c:\Python27\include\Python.h
  • c:\Python27\include\fileobject.h
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • c:\Python27\include\stringobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\Python27\include\pyerrors.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\Python27\include\token.h
  • c:\Python27\include\bitset.h
  • c:\Python27\include\intobject.h
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\include\dictobject.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\include\abstract.h
  • c:\Python27\include\pystate.h
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\Python27\include\pycapsule.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\include\methodobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\include\object.h
  • c:\Python27\include\grammar.h
  • c:\Python27\include\pyconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • c:\Python27\include\structseq.h
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • \\?\PIPE\wkssvc
  • c:\Python27\include\pymath.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\timefuncs.h
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\Python27\tcl\tclConfig.sh
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\cxAaSctarJ.docx
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\Python27\include\ucnhash.h
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • c:\Python27\Lib\test\keycert2.pem
  • c:\Python27\include\py_curses.h
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\include\pyport.h
  • c:\Python27\include\graminit.h
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\symtable.h
  • c:\Python27\include\node.h
  • c:\Python27\include\boolobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • c:\Python27\Lib\test\pycacert.pem
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\code.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\ypskzbLJJfgtfKwlcM.docm
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\Python27\include\dtoa.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\Python27\include\asdl.h
  • c:\Python27\include\cStringIO.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\include\codecs.h
  • c:\Python27\Lib\idlelib\idle.bat
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\hPSEnBTEGwOpwYW.txt
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\Python27\include\bytearrayobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\Python27\include\setobject.h
  • c:\Python27\Lib\test\badkey.pem
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\KBfeSoXzHuZo.pptx
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • c:\Python27\include\pyctype.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\PkUqHhpaKQKE.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\Python27\Lib\test\nokia.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\Python27\include\intrcheck.h
  • c:\Python27\include\pydebug.h
  • \\?\PIPE\lsarpc
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\uaCOGdPGPAl.docm
  • c:\Python27\include\cobject.h
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\Python27\include\structmember.h
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\Python27\Lib\test\dh1024.pem
  • c:\Python27\Lib\test\185test.db
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • c:\Python27\Lib\test\sha256.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\Lib\test\keycert.passwd.pem
  • c:\Python27\include\modsupport.h
  • c:\Python27\include\enumobject.h
  • c:\Python27\include\classobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\weakrefobject.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • c:\Python27\include\eval.h
  • c:\Python27\include\datetime.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\Python27\include\unicodeobject.h
  • c:\Python27\include\metagrammar.h
  • UNC\KIDSROOM\Users\Default\NTUSER.DAT.LOG
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\kqgerUpGgg.ppt
  • c:\Python27\include\pyfpe.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\BDIeWDAoPzxqui.txt
  • c:\Python27\include\compile.h
  • c:\Python27\include\genobject.h
  • c:\Python27\include\cellobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • C:\Users\Harry Dresden\Desktop\desktop.ini
  • C:\Windows\System32\wshom.ocx
  • C:\Windows\System32\wscript.exe
  • C:\Users\Harry Dresden\AppData\Local\Temp\NRV_5359H4I_.js
  • C:\Windows\System32\msxml3.dll
File-Written
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\include\object.h
  • c:\Python27\include\errcode.h
  • c:\Python27\Lib\test\keycert3.pem
  • c:\Python27\include\ast.h
  • c:\Python27\include\pyexpat.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\tupleobject.h
  • c:\Python27\include\parsetok.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\_11_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • c:\Python27\include\descrobject.h
  • c:\Python27\include\floatobject.h
  • c:\Python27\include\Python-ast.h
  • c:\6cdeacda242012e0e5b593e657\1042\_7_WHAT_is.html
  • c:\Python27\Lib\test\empty.vbs
  • c:\ProgramData\WebEx\WebEx\12_1324\_19_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • c:\Python27\include\pymacconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Python27\include\ceval.h
  • c:\6cdeacda242012e0e5b593e657\1028\_20_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\6cdeacda242012e0e5b593e657\1038\_4_WHAT_is.html
  • c:\Python27\include\import.h
  • \\?\PIPE\browser
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\pymem.h
  • c:\6cdeacda242012e0e5b593e657\1037\_28_WHAT_is.html
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\Python27\include\pyarena.h
  • c:\Python27\include\pygetopt.h
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\Python27\Lib\test\nullcert.pem
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos\_10_WHAT_is.html
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\_0_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1044\_9_WHAT_is.html
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\Python27\include\rangeobject.h
  • c:\Python27\include\bufferobject.h
  • c:\Python27\include\warnings.h
  • c:\Python27\include\pythread.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • c:\Python27\Lib\test\_2_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • c:\Python27\include\patchlevel.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\bCfIQCBODrpmxSwKV.docx
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\Python27\include\setobject.h
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\_9_WHAT_is.html
  • c:\Python27\include\iterobject.h
  • c:\Python27\include\memoryobject.h
  • c:\6cdeacda242012e0e5b593e657\1043\_8_WHAT_is.html
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\Python27\include\funcobject.h
  • c:\Python27\include\listobject.h
  • c:\Python27\Lib\test\keycert.pem
  • c:\6cdeacda242012e0e5b593e657\2070\_16_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1029\_21_WHAT_is.html
  • c:\Python27\include\traceback.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\_5_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1055\_14_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • c:\Python27\include\marshal.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1036\_27_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\Python27\include\pgenheaders.h
  • c:\Python27\include\frameobject.h
  • c:\6cdeacda242012e0e5b593e657\1046\_11_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\longintrepr.h
  • c:\cnrgqonuj\bin\cert.p12
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\brZUYpxPew.pptx
  • c:\Python27\include\opcode.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\Python27\Lib\test\badcert.pem
  • c:\Python27\include\complexobject.h
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\_2_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\include\sliceobject.h
  • c:\Python27\include\pgen.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • c:\Python27\include\bytes_methods.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • c:\Python27\include\moduleobject.h
  • c:\6cdeacda242012e0e5b593e657\3082\_17_WHAT_is.html
  • c:\Python27\Lib\test\wrongcert.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • c:\Python27\include\objimpl.h
  • c:\Python27\include\Python.h
  • c:\Python27\include\fileobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts\_13_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • c:\Python27\include\osdefs.h
  • c:\Python27\include\stringobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1032\_24_WHAT_is.html
  • c:\cnrgqonuj\bin\_1_WHAT_is.html
  • c:\Python27\include\pyerrors.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\Python27\include\token.h
  • c:\Python27\include\bitset.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\_6_WHAT_is.html
  • c:\Python27\include\intobject.h
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\include\dictobject.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\6cdeacda242012e0e5b593e657\1040\_5_WHAT_is.html
  • c:\Python27\include\timefuncs.h
  • c:\Python27\include\abstract.h
  • c:\Python27\include\pystate.h
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\Python27\include\pycapsule.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\include\methodobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\_0_WHAT_is.html
  • c:\Python27\include\grammar.h
  • c:\Python27\include\pyconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • c:\Python27\include\structseq.h
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • \\?\PIPE\wkssvc
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\include\pymath.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\_4_WHAT_is.html
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\Python27\tcl\tclConfig.sh
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\cxAaSctarJ.docx
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\Python27\include\ucnhash.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\_3_WHAT_is.html
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • c:\6cdeacda242012e0e5b593e657\1049\_12_WHAT_is.html
  • c:\Python27\Lib\test\keycert2.pem
  • c:\Python27\include\py_curses.h
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\include\pyport.h
  • c:\Python27\include\graminit.h
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1025\_18_WHAT_is.html
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\symtable.h
  • c:\Python27\include\node.h
  • c:\Python27\include\boolobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • c:\Python27\Lib\test\pycacert.pem
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\code.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\ypskzbLJJfgtfKwlcM.docm
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\Python27\include\dtoa.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\Python27\include\asdl.h
  • c:\Python27\include\cStringIO.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\Lib\idlelib\idle.bat
  • UNC\KIDSROOM\Users\Default\_12_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • c:\Python27\include\_3_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\hPSEnBTEGwOpwYW.txt
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • c:\6cdeacda242012e0e5b593e657\1030\_22_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • c:\Python27\include\bytearrayobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • c:\6cdeacda242012e0e5b593e657\1035\_26_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\_8_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1031\_23_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\6cdeacda242012e0e5b593e657\2052\_15_WHAT_is.html
  • c:\Python27\Lib\test\badkey.pem
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\KBfeSoXzHuZo.pptx
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\6cdeacda242012e0e5b593e657\1053\_13_WHAT_is.html
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • c:\Python27\include\pyctype.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • c:\Python27\tcl\tix8.4.3\pref\_29_WHAT_is.html
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\PkUqHhpaKQKE.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\Python27\Lib\test\nokia.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\Python27\include\intrcheck.h
  • c:\Python27\include\pydebug.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\_7_WHAT_is.html
  • \\?\PIPE\lsarpc
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\uaCOGdPGPAl.docm
  • c:\Python27\include\cobject.h
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\Python27\include\structmember.h
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\Python27\Lib\test\dh1024.pem
  • c:\Python27\Lib\test\185test.db
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • c:\Python27\tcl\_30_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • c:\Python27\Lib\test\sha256.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\Lib\test\keycert.passwd.pem
  • c:\Python27\include\modsupport.h
  • c:\Python27\include\enumobject.h
  • c:\Python27\include\classobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\weakrefobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\_1_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • c:\Python27\include\eval.h
  • c:\Python27\include\datetime.h
  • c:\6cdeacda242012e0e5b593e657\1045\_10_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\6cdeacda242012e0e5b593e657\1041\_6_WHAT_is.html
  • c:\Python27\include\unicodeobject.h
  • c:\Python27\include\metagrammar.h
  • UNC\KIDSROOM\Users\Default\NTUSER.DAT.LOG
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\kqgerUpGgg.ppt
  • c:\Python27\include\pyfpe.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\BDIeWDAoPzxqui.txt
  • c:\Python27\include\compile.h
  • c:\Python27\include\genobject.h
  • c:\Python27\include\cellobject.h
  • c:\Python27\include\codecs.h
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YLC2QM2Y\ctlt8b[1].txt
  • C:\Users\Harry Dresden\AppData\Local\Temp\2J0lxVWx8vkjC.dll
File-Opened
  • c:\Python27\include\frameobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\ctypes
  • c:\Users\Default\Links
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages
  • c:\Python27\include\ast.h
  • c:\Python27\include\memoryobject.h
  • c:\Python27\Lib\site-packages\pip\_vendor\colorama
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources
  • c:\Python27\DLLs
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol
  • c:\Python27\include\tupleobject.h
  • c:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode
  • c:\ProgramData\Adobe\Setup
  • UNC\KIDSROOM\Users\Default\Documents
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\en-US
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Users\Harry Dresden\OneDrive
  • c:\Python27\include\grammar.h
  • c:\ProgramData\Microsoft\PlayReady\Cache\S-1-5-21-3416602863-1947377224-293699093-1001
  • c:\Python27\include\import.h
  • c:\Users\Public\Libraries
  • \\?\PIPE\browser
  • c:\Python27\Lib\test\tracedmodules
  • c:\Python27\tcl\tcl8.5\tzdata\Indian
  • c:\Users\Public
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Queue
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource
  • c:\Python27\Lib
  • \??\VBoxMiniRdrDN
  • c:\ProgramData
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}
  • c:\Python27\Lib\site-packages\pip
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A6
  • c:\Python27\Lib\ctypes\macholib
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\Security
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1055
  • c:\Python27\Lib\unittest\test
  • c:\ProgramData\Microsoft\PlayReady
  • c:\Python27\Lib\xml\dom
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\Python27\Lib\site-packages\pip\models
  • c:\Python27\include\marshal.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate
  • c:\Python27\Tools\i18n
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\hPSEnBTEGwOpwYW.txt
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog
  • c:\ProgramData\Microsoft\Crypto\Keys
  • UNC\KIDSROOM\Users\Public\Videos
  • c:\Python27\Lib\test
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos
  • c:\Python27\tcl\tcl8\8.4
  • c:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\brZUYpxPew.pptx
  • c:\Python27\Lib\ctypes\test
  • c:\Users\Harry Dresden\Searches
  • c:\Python27\Lib\test\badcert.pem
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • c:\Python27\Lib\ensurepip
  • c:\Python27\include\pgen.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\Users\Harry Dresden\Downloads
  • c:\Python27\include\objimpl.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\ProgramData\Microsoft\eHome
  • c:\Python27\tcl\tk8.5\demos\images
  • c:\Python27\Lib\test\cjkencodings
  • c:\inetpub\wwwroot\aspnet_client\system_web
  • c:\Python27\tcl\tcl8.5\tzdata\America\Kentucky
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US
  • c:\cnrgqonuj\lib\api
  • c:\Python27\include\abstract.h
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\keycert.passwd.pem
  • c:\Python27\include\object.h
  • c:\Python27\tcl\tix8.4.3
  • c:\Python27\include\complexobject.h
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • c:\cnrgqonuj
  • c:\ProgramData\Microsoft\Network\Downloader
  • c:\Python27\include\Python-ast.h
  • c:\inetpub\history\CFGHISTORY_0000000005
  • c:\inetpub\history\CFGHISTORY_0000000004
  • c:\inetpub\history\CFGHISTORY_0000000001
  • c:\Python27\include\pydebug.h
  • c:\inetpub\history\CFGHISTORY_0000000003
  • c:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204
  • c:\Users\Harry Dresden\Favorites\Links for United States
  • c:\Python27\Lib\lib2to3\tests\data\fixers
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\Python27\tcl\tcl8.5\tzdata\US
  • c:\Python27\tcl\tcl8.5\tzdata
  • c:\Python27\include\pyport.h
  • c:\Python27\Lib\email
  • c:\Python27\tcl\tix8.4.3\demos\samples
  • c:\Python27\Lib\lib-tk\test\test_tkinter
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\Tools\webchecker
  • c:\Python27\tcl\tcl8.5\tzdata\America\North_Dakota
  • c:\Python27\Lib\test\crashers
  • c:\ProgramData\Microsoft\Windows Defender\LocalCopy
  • c:\Python27\include\dtoa.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\Python27\include\asdl.h
  • c:\Python27\Lib\test\empty.vbs
  • c:\Users\Harry Dresden\Contacts
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0
  • c:\PerfLogs
  • c:\
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders
  • c:\Python27\tcl\tcl8\8.5
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • c:\Python27\libs
  • c:\ProgramData\Microsoft\ClickToRun\MachineData
  • c:\Python27\include\pyexpat.h
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • UNC\KIDSROOM\Users\Public
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\KBfeSoXzHuZo.pptx
  • c:\ProgramData\Microsoft\Assistance
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\pyctype.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results
  • c:\Users\Harry Dresden\Videos
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • c:\Python27\Lib\pydoc_data
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • c:\Python27\Lib\test\nokia.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • c:\ProgramData\Microsoft\Crypto\DSS
  • c:\ProgramData\Adobe\Acrobat
  • c:\Python27\tcl\tcl8.5\tzdata\Atlantic
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\uaCOGdPGPAl.docm
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\BDIeWDAoPzxqui.txt
  • c:\ProgramData\Microsoft\Network
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger
  • c:\Users\Default\Downloads
  • c:\Python27\Lib\xml
  • c:\Python27\tcl\tcl8.5\tzdata\Australia
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • c:\Python27\tcl\tk8.5
  • c:\ProgramData\Microsoft\PlayReady\Cache
  • c:\6cdeacda242012e0e5b593e657\3082
  • c:\Python27\Lib\site-packages\pip\compat
  • c:\Python27\Lib\test\leakers
  • c:\Python27\tcl\tcl8\8.4\platform
  • c:\Python27\include\modsupport.h
  • c:\ProgramData\regid.1991-06.com.microsoft
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\filters
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\DD
  • c:\Python27\Tools\pynche\X
  • c:\Python27\tcl\tix8.4.3\pref
  • c:\Python27\include\bufferobject.h
  • c:\Python27\Tools\Scripts
  • c:\Python27\include\cellobject.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\35
  • UNC\KIDSROOM\Users\Default\NTUSER.DAT.LOG
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore
  • c:\Python27\include\pyfpe.h
  • c:\Python27\include\compile.h
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • c:\cnrgqonuj\modules
  • c:\cnrgqonuj\modules\auxiliary
  • C:\Users\Harry Dresden\AppData\Local\Temp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\Python27\tcl\tk8.5\images
  • c:\ProgramData\Microsoft\DRM
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US
  • c:\Python27\Lib\idlelib\idle_test
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\include
  • c:\Python27\Lib\test\nullcert.pem
  • c:\Python27\Lib\site-packages\setuptools
  • c:\Python27\include\cobject.h
  • c:\6cdeacda242012e0e5b593e657\1029
  • c:\6cdeacda242012e0e5b593e657\1028
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}
  • c:\Python27\Lib\site-packages\pip\commands
  • c:\Python27\Lib\lib2to3\tests\data\fixers\myfixes
  • c:\6cdeacda242012e0e5b593e657\1025
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us
  • c:\Python27\tcl\tclConfig.sh
  • c:\Python27\Lib\email\test\data
  • c:\ProgramData\Microsoft\Windows Defender\Support
  • c:\ProgramData\WebEx\WebEx
  • c:\6cdeacda242012e0e5b593e657\2052
  • c:\Python27\tcl\tcl8.5\opt0.4
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases
  • c:\Python27\include\pgenheaders.h
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US
  • c:\Python27\tcl\tcl8.5\encoding
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs
  • c:\Python27\Lib\msilib
  • c:\ProgramData\Microsoft\WwanSvc\Profiles
  • c:\Python27\Lib\encodings
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\_backport
  • c:\ProgramData\Microsoft\Assistance\Client
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\95
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F
  • c:\Python27\Lib\site-packages\_markerlib
  • c:\ProgramData\Microsoft\Diagnosis\LocalTraceStore
  • c:\inetpub\custerr
  • c:\Python27\include\longintrepr.h
  • c:\inetpub\custerr\en-US
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches
  • c:\Python27\Lib\test\185test.db
  • c:\Python27\include\opcode.h
  • c:\ProgramData\Microsoft\Crypto\RSA
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tk8.5\ttk
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\01
  • c:\Users\Default\Favorites
  • c:\inetpub\history
  • UNC\KIDSROOM\Users\Default\Desktop
  • c:\ProgramData\Microsoft\Windows NT
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\chardet
  • c:\ProgramData\Microsoft\Vault
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData
  • c:\Python27\include\fileobject.h
  • UNC\KIDSROOM\Users\ruiner
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • c:\Python27\include\boolobject.h
  • C:\Windows\SysWOW64\en-US\VssTrace.DLL.mui
  • c:\Python27\include\token.h
  • c:\Python27\include\bitset.h
  • c:\Python27\include\warnings.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\Python27\tcl\tk8.5\demos
  • c:\ProgramData\Mozilla\logs
  • c:\Python27\include\pycapsule.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\70
  • c:\Python27\tcl\tcl8.5\tzdata\Mexico
  • c:\Python27\Lib\importlib
  • c:\ProgramData\Microsoft\Crypto
  • UNC\KIDSROOM\Users\Harry Dresden\Searches
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\media
  • c:\Python27\tcl\tcl8.5
  • c:\Python27\tcl\tcl8.5\tzdata\Africa
  • UNC\KIDSROOM\Users\Harry Dresden\Music
  • c:\ProgramData\McAfee
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • c:\Python27\Lib\site-packages\pip\vcs
  • c:\Python27\Lib\bsddb\test
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\Python27\Lib\test\keycert2.pem
  • c:\ProgramData\Microsoft\Search\Data\Applications
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F7
  • c:\Python27\include\ucnhash.h
  • c:\Python27\include\py_curses.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3
  • c:\Python27\Lib\xml\parsers
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\tcl\tcl8.5\msgs
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Inbox
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage
  • c:\Users\Harry Dresden
  • c:\Python27\include\symtable.h
  • c:\Python27\include\node.h
  • c:\ProgramData\McAfee\MCLOGS\Common\jxpiinstall
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads
  • c:\ProgramData\Microsoft\Windows Defender\Quarantine
  • c:\Users\Public\Favorites
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\ypskzbLJJfgtfKwlcM.docm
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\include\codecs.h
  • c:\ProgramData\Microsoft\Office
  • c:\Python27\Lib\site-packages\pip\_vendor\requests
  • c:\Users\Public\Pictures
  • c:\ProgramData\NovaTech Network\NovaBench
  • UNC\KIDSROOM\Users\Harry Dresden\Documents
  • c:\cnrgqonuj\bin
  • c:\Python27\Lib\site-packages\pip\_vendor\_markerlib
  • c:\Python27\tcl\reg1.2
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • UNC\KIDSROOM\Users\Public\Desktop
  • c:\Users\ruiner
  • c:\Python27\Lib\xml\etree
  • c:\Python27\include\pymacconfig.h
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01
  • UNC\KIDSROOM\Users\Harry Dresden\Favorites\Links for United States
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • c:\Python27\include\pythread.h
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform
  • c:\Python27\tcl\tcl8.5\tzdata\Antarctica
  • c:\Python27\Lib\xml\sax
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\trie
  • c:\Users\Harry Dresden\Desktop
  • c:\Users\Public\Recorded TV
  • c:\ProgramData\Microsoft\Office\Heartbeat
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\42
  • c:\Python27\tcl\tcl8.5\tzdata\Etc
  • c:\Python27\Lib\bsddb
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\47
  • c:\Python27\include\moduleobject.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups
  • c:\Python27\Lib\wsgiref
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\contrib
  • c:\ProgramData\Microsoft\User Account Pictures
  • c:\ProgramData\Sun\Java\Java Update
  • c:\Python27\Lib\test\sha256.pem
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9
  • c:\Recovery\015e7760-d44b-11e0-8947-954f09601788
  • c:\Users
  • UNC\KIDSROOM\Users\Public\Foxit Software
  • c:\Users\Default\Saved Games
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources
  • c:\inetpub\history\CFGHISTORY_0000000005\schema
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • c:\Python27\include\datetime.h
  • c:\inetpub
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • UNC\KIDSROOM\Users\Public\Favorites
  • c:\Users\Default
  • c:\Python27\tcl\tcl8.5\tzdata\Pacific
  • c:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog
  • c:\Python27\tcl\tk8.5\msgs
  • c:\Python27\tcl\tcl8.5\tzdata\America
  • c:\ProgramData\Microsoft\Diagnosis\DownloadedSettings
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\{98101498-C465-4F51-8751-D1919E97D29D}
  • c:\Python27\Lib\multiprocessing\dummy
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}
  • c:\ProgramData\Microsoft\MF
  • c:\Python27\include\errcode.h
  • c:\Python27\Lib\test\keycert3.pem
  • UNC\KIDSROOM\Users\Default\Saved Games
  • c:\Users\Public\Downloads
  • c:\Python27\Lib\site-packages
  • c:\ProgramData\Microsoft\Device Stage\Task
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Python27\include\pyerrors.h
  • c:\Python27\Lib\unittest
  • c:\6cdeacda242012e0e5b593e657\Graphics
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}
  • c:\Python27\Lib\test\capath
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default
  • c:\Recovery
  • c:\ProgramData\Microsoft\Device Stage
  • c:\Python27\include\ceval.h
  • c:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18
  • c:\cnrgqonuj\lib
  • c:\ProgramData\Microsoft\Assistance\Client\1.0
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\structmember.h
  • c:\ProgramData\Oracle
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\Python27\include\pygetopt.h
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\Python27\Lib\distutils\tests
  • UNC\KIDSROOM\Users\Harry Dresden\Videos
  • c:\Python27\Lib\logging
  • c:\ProgramData\Microsoft\RAC
  • c:\Python27\Lib\site-packages\pip\req
  • c:\Users\Harry Dresden\Links
  • c:\ProgramData\Microsoft\DeviceSync
  • c:\Python27\Doc
  • c:\cnrgqonuj\lib\common
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • c:\Python27\tcl\tix8.4.3\demos\bitmaps
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\en-us.16
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • c:\Python27\include\patchlevel.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\bCfIQCBODrpmxSwKV.docx
  • UNC\KIDSROOM\Users\Default\Favorites
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\Lib\compiler
  • c:\Python27\Scripts
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\42
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\17
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • c:\Python27\tcl\dde1.3
  • c:\Python27\tcl\tcl8.5\tzdata\SystemV
  • c:\ProgramData\NovaTech Network
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • c:\ProgramData\Sun\Java
  • UNC\KIDSROOM\Users\Public\Recorded TV
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js
  • c:\ProgramData\Microsoft\Diagnosis\AsimovUploader
  • UNC\KIDSROOM\Users\Public\Documents
  • UNC\KIDSROOM\Users\Default\Pictures
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images
  • UNC\KIDSROOM\Users\Public\Libraries
  • c:\Python27\tcl\tcl8.5\tzdata\Chile
  • c:\ProgramData\Microsoft\ClickToRun\UserData
  • c:\Python27\Lib\test\xmltestdata
  • c:\ProgramData\Microsoft\WPD
  • c:\Python27\Lib\site-packages\pip\_vendor
  • c:\ProgramData\Sun
  • c:\Python27\include\Python.h
  • UNC\KIDSROOM\Users\Default\Videos
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\Python27\include\metagrammar.h
  • UNC\KIDSROOM\Users\Public\Music\Sample Music
  • c:\Python27\include\pystate.h
  • c:\Users\Default\Desktop
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • UNC\KIDSROOM\Users\Default\Music
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
  • c:\ProgramData\Microsoft\WwanSvc
  • c:\Python27\include\pyconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • \\?\PIPE\wkssvc
  • c:\ProgramData\Microsoft\Event Viewer\Views
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start
  • c:\Python27\Lib\json\tests
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\serializer
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default
  • c:\Python27\include\osdefs.h
  • c:\Python27\Tools
  • c:\Python27\include\timefuncs.h
  • c:\Users\Public\Videos\Sample Videos
  • UNC\KIDSROOM\Users\Public\Downloads
  • c:\Python27\include\enumobject.h
  • c:\ProgramData\Microsoft\IlsCache
  • c:\Python27\Lib\lib-tk
  • UNC\KIDSROOM\Users\Default
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Store
  • c:\ProgramData\Microsoft\Windows NT\MSFax\SentItems
  • c:\Users\Public\Foxit Software\Foxit Reader
  • c:\Python27\Lib\site-packages\pip\operations
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox
  • c:\Python27\Lib\site-packages\pip\_vendor\lockfile
  • c:\Python27\Lib\curses
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\floatobject.h
  • c:\Python27\Lib\test\pycacert.pem
  • c:\Python27\include\pymactoolbox.h
  • c:\Python27\Lib\test\badkey.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • c:\Python27\include\cStringIO.h
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration
  • c:\Users\Default\Music
  • c:\Python27\Lib\email\mime
  • c:\Users\Harry Dresden\Music
  • c:\6cdeacda242012e0e5b593e657\1053
  • c:\inetpub\history\CFGHISTORY_0000000004\schema
  • UNC\KIDSROOM\Users\Harry Dresden\Links
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3
  • c:\Python27\tcl\tcl8.5\tzdata\Asia
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css
  • c:\Python27\Lib\multiprocessing
  • c:\Users\Default\Documents
  • c:\Python27\Tools\pynche
  • c:\Users\Public\Desktop
  • c:\ProgramData\Microsoft\User Account Pictures\Default Pictures
  • c:\Python27\Lib\lib-tk\test\test_ttk
  • c:\Python27\include\dictobject.h
  • c:\Users\Harry Dresden\Documents
  • c:\Python27\include\sysmodule.h
  • c:\ProgramData\McAfee\MCLOGS\Common
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F\x-none.16
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\ProgramData\Microsoft\IdentityCRL
  • c:\ProgramData\WebEx\WebEx\12_1324
  • c:\Python27\Lib\site-packages\pip\utils
  • c:\Python27\Lib\distutils\command
  • c:\Users\Harry Dresden\Saved Games
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\include\pyarena.h
  • c:\ProgramData\Microsoft\Windows Defender
  • c:\Python27\include\eval.h
  • c:\Python27
  • c:\Python27\Lib\hotshot
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\kqgerUpGgg.ppt
  • UNC\KIDSROOM\Users\Harry Dresden
  • c:\Python27\include\genobject.h
  • c:\inetpub\wwwroot
  • c:\Python27\tcl\tcl8.5\tzdata\Canada
  • c:\Python27\Tools\versioncheck
  • c:\Python27\tcl\tcl8.5\tzdata\Arctic
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F7
  • c:\Users\Public\Music
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3
  • c:\Python27\Lib\test\audiodata
  • UNC\KIDSROOM\Users\Default\Downloads
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters
  • c:\Python27\include\intrcheck.h
  • c:\ProgramData\Microsoft\Network\Connections
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\x-none.16
  • c:\Python27\Lib\sqlite3
  • c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\43
  • \\?\PIPE\lsarpc
  • c:\ProgramData\Microsoft\Diagnosis
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F\en-us.16
  • c:\Python27\Lib\distutils
  • UNC\KIDSROOM\Users\Harry Dresden\Saved Games
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\tests
  • c:\Python27\Lib\idlelib\Icons
  • c:\ProgramData\Microsoft\Device Stage\Device
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib
  • c:\Python27\Lib\test\subprocessdata
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\35
  • c:\Python27\include\pymem.h
  • c:\inetpub\wwwroot\aspnet_client
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\ProgramData\Microsoft\RAC\PublishedData
  • c:\Users\Public\Foxit Software
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Quick
  • c:\ProgramData\Microsoft\Windows NT\MSScan
  • c:\Python27\Lib\lib2to3\tests
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\ProgramData\Microsoft OneDrive\setup
  • c:\ProgramData\Microsoft\Crypto\DSS\MachineKeys
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • UNC\KIDSROOM\Users
  • c:\Python27\Lib\site-packages\pkg_resources
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info
  • c:\Python27\include\rangeobject.h
  • c:\Python27\tcl\tcl8.5\tzdata\Brazil
  • c:\Users\Harry Dresden\Favorites\Links
  • UNC\KIDSROOM\Users\Default\Links
  • c:\Python27\Lib\test\imghdrdata
  • c:\Python27\include\iterobject.h
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement
  • c:\ProgramData\Microsoft\RAC\Outbound
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\inetpub\history\CFGHISTORY_0000000002
  • c:\Python27\include\funcobject.h
  • c:\Python27\include\listobject.h
  • c:\ProgramData\Microsoft\NetFramework
  • c:\Users\Public\Recorded TV\Sample Media
  • c:\ProgramData\Microsoft
  • c:\Users\Public\Pictures\Sample Pictures
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Service
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\Users\Default\Videos
  • c:\ProgramData\Microsoft\Search\Data
  • c:\Python27\tcl
  • c:\cnrgqonuj\modules\packages
  • c:\Python27\Lib\json
  • UNC\KIDSROOM\Users\Public\Pictures
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US
  • c:\cnrgqonuj\bin\cert.p12
  • c:\Python27\Lib\lib2to3\fixes
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\Python27\tcl\tix8.4.3\bitmaps
  • c:\Python27\Lib\site-packages\setuptools\command
  • c:\6cdeacda242012e0e5b593e657
  • c:\Python27\tcl\tcl8.5\tzdata\America\Indiana
  • c:\6cdeacda242012e0e5b593e657\2070
  • c:\cnrgqonuj\lib\core
  • c:\Python27\include\sliceobject.h
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Users\Public\Videos
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • c:\Python27\Lib\test\decimaltestdata
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\DD
  • c:\Python27\include\descrobject.h
  • c:\ProgramData\Microsoft\Diagnosis\UIF
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A6
  • c:\Python27\tcl\tcl8.5\tzdata\Europe
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5
  • c:\Python27\include\stringobject.h
  • c:\Python27\Lib\lib2to3
  • c:\Python27\include\intobject.h
  • c:\ProgramData\Microsoft\Event Viewer
  • c:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\ProgramData\Microsoft\ClickToRun
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures
  • c:\Python27\include\methodobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Favorites
  • c:\Python27\include\structseq.h
  • c:\Python27\tcl\tcl8.5\http1.0
  • c:\Python27\include\pymath.h
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\parsetok.h
  • c:\ProgramData\Adobe\Acrobat\11.0
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\cxAaSctarJ.docx
  • c:\Python27\Lib\ensurepip\_bundled
  • c:\Python27\include\classobject.h
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • c:\Users\Public\Music\Sample Music
  • c:\Python27\tcl\tcl8
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager
  • c:\Python27\Lib\lib2to3\tests\data
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70
  • c:\ProgramData\Microsoft OneDrive
  • c:\ProgramData\Microsoft\Media Player
  • c:\Python27\tcl\tcl8.5\tzdata\America\Argentina
  • c:\Python27\include\setobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Pictures
  • c:\Python27\Lib\idlelib
  • c:\PerfLogs\Admin
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\graminit.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images
  • c:\Python27\Lib\site-packages\pip\_vendor\progress
  • c:\Users\Harry Dresden\Pictures
  • c:\ProgramData\Microsoft\Diagnosis\Sideload
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\ssl_match_hostname
  • c:\Users\Harry Dresden\Favorites
  • c:\ProgramData\Passmark
  • c:\Python27\Lib\lib-tk\test
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • c:\ProgramData\Adobe
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • UNC\KIDSROOM\Users\Harry Dresden\Favorites\Links
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\ProgramData\Microsoft\Search
  • c:\ProgramData\Passmark\PerformanceTest
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • UNC\KIDSROOM\Users\Public\Music
  • c:\Python27\include\bytearrayobject.h
  • c:\ProgramData\Microsoft\NetFramework\BreadcrumbStore
  • c:\Python27\Lib\email\test
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}
  • c:\ProgramData\WebEx
  • c:\inetpub\wwwroot\msmq
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\Python27\tcl\tix8.4.3\demos
  • UNC\KIDSROOM\Users\Public\Recorded TV\Sample Media
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\packaging
  • c:\ProgramData\McAfee\MCLOGS
  • c:\Users\Default\Pictures
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\PkUqHhpaKQKE.txt
  • c:\6cdeacda242012e0e5b593e657\1049
  • c:\Users\Public\Documents
  • c:\6cdeacda242012e0e5b593e657\1046
  • c:\6cdeacda242012e0e5b593e657\1045
  • c:\6cdeacda242012e0e5b593e657\1044
  • c:\6cdeacda242012e0e5b593e657\1043
  • c:\6cdeacda242012e0e5b593e657\1042
  • c:\6cdeacda242012e0e5b593e657\1041
  • c:\6cdeacda242012e0e5b593e657\1040
  • c:\Python27\Lib\site-packages\pip\_vendor\packaging
  • c:\ProgramData\Microsoft\eHome\logs
  • c:\ProgramData\Microsoft\Windows Defender\Scans
  • c:\ProgramData\Microsoft\Windows NT\MSFax
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\Python27\Lib\sqlite3\test
  • c:\Python27\Lib\test\dh1024.pem
  • c:\ProgramData\Mozilla
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates
  • c:\Python27\include\weakrefobject.h
  • c:\Python27\Lib\lib2to3\pgen2
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History
  • c:\Python27\Lib\idlelib\idle.bat
  • c:\Python27\include\code.h
  • c:\Python27\include\unicodeobject.h
  • c:\ProgramData\Microsoft\RAC\StateData
  • c:\6cdeacda242012e0e5b593e657\1038
  • UNC\KIDSROOM\Users\Harry Dresden\OneDrive
  • c:\ProgramData\Microsoft\DRM\Server
  • c:\6cdeacda242012e0e5b593e657\1032
  • c:\6cdeacda242012e0e5b593e657\1033
  • c:\6cdeacda242012e0e5b593e657\1030
  • c:\6cdeacda242012e0e5b593e657\1031
  • c:\6cdeacda242012e0e5b593e657\1036
  • c:\6cdeacda242012e0e5b593e657\1037
  • c:\6cdeacda242012e0e5b593e657\1035
  • C:\Windows\System32\wshqos.dll
  • C:\Windows\System32\wshom.ocx
  • C:\
  • C:\Windows\Globalization\Sorting\sortdefault.nls
  • C:\Users\
  • C:\Users\Harry Dresden\
  • C:\Users\Harry Dresden\AppData\
  • C:\Users\Harry Dresden\AppData\Local\
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000001.db
  • C:\Windows\
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
  • C:\Windows\System32\en-US\wshqos.dll.mui
  • C:\Users\Harry Dresden\Desktop\desktop.ini
  • C:\Users\Harry Dresden\AppData\Local\Temp\NRV_5359H4I_.js
  • C:\Windows\SysWOW64\rundll32.exe
  • C:\Windows\System32\rsaenh.dll
  • C:\Windows\System32\msxml3.dll
  • C:\Windows\System32\en-US\wship6.dll.mui
  • C:\Windows\System32\wscript.exe
  • C:\Windows\System32\en-US\wshtcpip.dll.mui
  • C:\Windows\SysWOW64\
File-Moved
  • c:\Python27\include\pythonrun.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-A2C0-697E3EDFFFC0.thor
  • \\KIDSROOM\Users\Harry Dresden\Downloads\cleandesktop.py.txt -> \\KIDSROOM\Users\Harry Dresden\Downloads\GIZCRYGX-7AM0-FMM8-77B6-93F86B49CBE1.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\hPSEnBTEGwOpwYW.txt -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGX-7AM0-FMM8-313B-D46E0BEF5F1E.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYGX-7AM0-FMM8-26A7-57935BC91D95.thor
  • c:\Python27\include\methodobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-59BF-E187CBF15FD3.thor
  • c:\Python27\include\bytes_methods.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-47B0-4A8830772219.thor
  • c:\Python27\include\pyerrors.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-4BD9-17A8D0E103E1.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYGX-7AM0-FMM8-643B-1AAE82F6EA2B.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-FE90-0A23C5895957.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\PkUqHhpaKQKE.txt -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGX-7AM0-FMM8-86AD-93A922E44405.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-452B-0D2B4BCCB095.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\GIZCRYGX-7AM0-FMM8-C978-7774123F86CD.thor
  • c:\Python27\include\traceback.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-7AA8-095936DA7BC9.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Koala.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYGX-7AM0-FMM8-F13B-FF3C0AE18D39.thor
  • \\KIDSROOM\Users\Public\Music\Sample Music\Sleep Away.mp3 -> \\KIDSROOM\Users\Public\Music\Sample Music\GIZCRYGX-7AM0-FMM8-4E97-BA05AE251C50.thor
  • c:\Python27\include\object.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-6AAF-0330029D310F.thor
  • c:\Python27\include\pgenheaders.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-5A07-6D62518675CD.thor
  • c:\Python27\include\compile.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-EE47-C72E453110AB.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYGX-7AM0-FMM8-522D-53C83F83468E.thor
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php -> c:\ProgramData\WebEx\WebEx\12_1324\GIZCRYGX-7AM0-FMM8-B623-30E61BD392A2.thor
  • c:\Python27\include\cobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-F320-E0D3DC93F882.thor
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYGX-7AM0-FMM8-B5F5-0DC11FD7C842.thor
  • c:\Python27\Lib\test\keycert2.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-1169-8F68D4E71A15.thor
  • c:\Python27\include\codecs.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-CF07-9BC7D6D51FFB.thor
  • c:\Python27\include\complexobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-4340-5C738B9A26D2.thor
  • c:\Python27\include\node.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-AF40-132DFE99D790.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Desert.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYGX-7AM0-FMM8-CD86-D21F4C6AAF9C.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-BB36-584D8B98A4C4.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\GIZCRYGX-7AM0-FMM8-12E3-E84380D96028.thor
  • c:\Python27\include\pystrtod.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-16BD-C9EB65D5E2E4.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-3D5B-751817157169.thor
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1044\GIZCRYGX-7AM0-FMM8-66A4-EB30F37E6DF3.thor
  • c:\Python27\Lib\test\badkey.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-BC81-2037BCB6D7ED.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGX-7AM0-FMM8-DF6C-DBE045B57010.thor
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYGX-7AM0-FMM8-3FFE-1BC037DB8644.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-9A34-F7345AF79900.thor
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem -> c:\Python27\Lib\site-packages\pip\_vendor\requests\GIZCRYGX-7AM0-FMM8-9EAD-C955AD9486A0.thor
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-3524-86A0DCFE418C.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGX-7AM0-FMM8-0AB8-0C06B5ED4FF0.thor
  • c:\Python27\include\ceval.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-3F1E-BBE6588F136D.thor
  • c:\Python27\include\pymem.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-EFBF-33CE294F45CB.thor
  • c:\Python27\Lib\test\ssl_cert.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-9BCD-1E39F87BFDEE.thor
  • c:\Python27\include\stringobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-13D0-059A2FAEF998.thor
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1030\GIZCRYGX-7AM0-FMM8-CDB9-5BB2105AAC05.thor
  • c:\Python27\Lib\test\check_soundcard.vbs -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-267C-32B53ABE44A2.thor
  • c:\Python27\Lib\test\wrongcert.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-47CA-63FA9F03C141.thor
  • c:\Python27\include\longintrepr.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-6891-BA40BAC59F77.thor
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1040\GIZCRYGX-7AM0-FMM8-4739-61FA3E405D02.thor
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1036\GIZCRYGX-7AM0-FMM8-492B-C334BF476570.thor
  • c:\Python27\include\pythread.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-2363-1712A80B079F.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-2D00-4079897112BB.thor
  • c:\Python27\include\py_curses.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-0F25-B5A2B157F106.thor
  • c:\Python27\include\marshal.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-CD18-358D66046618.thor
  • c:\Python27\include\tupleobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-E665-D39106036BD5.thor
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYGX-7AM0-FMM8-39EE-3999DC332DB6.thor
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1033\GIZCRYGX-7AM0-FMM8-4142-F964624773D5.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-5C21-1903FC585495.thor
  • c:\Python27\Lib\test\keycert4.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-A93B-AF44A6F490EF.thor
  • \\KIDSROOM\Users\Default\NTUSER.DAT.LOG -> \\KIDSROOM\Users\Default\GIZCRYGX-7AM0-FMM8-7C07-A14F2DDCED47.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-A803-91FE90C762B2.thor
  • c:\Python27\Lib\test\keycert3.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-5211-434EE8DDC621.thor
  • c:\Python27\include\memoryobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-F468-1319FB43A487.thor
  • c:\Python27\include\structmember.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-3730-4126A9E833D4.thor
  • c:\Python27\include\moduleobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-D64D-8BF5E4082970.thor
  • c:\Python27\include\abstract.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-B0EC-049FF3F45E07.thor
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1046\GIZCRYGX-7AM0-FMM8-CFD0-587B5C1BB28C.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYGX-7AM0-FMM8-8A95-34886868E66A.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGX-7AM0-FMM8-3482-DDA193DB4473.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYGX-7AM0-FMM8-D844-A93BA13FB9AD.thor
  • c:\Python27\include\floatobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-CD18-045FF0ACD67C.thor
  • c:\Python27\include\pystrcmp.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-EFFC-76DD3BB4AD21.thor
  • c:\Python27\include\structseq.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-23A5-19D872B35ADE.thor
  • c:\Python27\Lib\test\badcert.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-71AC-888AE40F337B.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-AAD0-91C4F1627496.thor
  • c:\Python27\Lib\test\185test.db -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-74B6-E3C62F4BD4BC.thor
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf -> c:\6cdeacda242012e0e5b593e657\2052\GIZCRYGX-7AM0-FMM8-FAB5-FEBEF58E7CAE.thor
  • c:\Python27\include\fileobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-A958-EDF1D1655454.thor
  • c:\Python27\include\listobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-D394-3C78312B40C6.thor
  • c:\Python27\Lib\test\dh1024.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-C24C-423EF74E1894.thor
  • c:\Python27\include\bufferobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-9BC9-0BD9FC9CC4D7.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYGX-7AM0-FMM8-F27E-7CC1CDCEADB4.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-AFD8-7A74FC81FFCD.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\GIZCRYGX-7AM0-FMM8-6E28-50A9DD1A6332.thor
  • c:\Python27\include\pycapsule.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-13E2-0775517403E8.thor
  • c:\Python27\include\genobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-5A29-F74C6A3AF0F6.thor
  • c:\Python27\include\cellobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-62C9-47D638EABDE0.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-8F7C-DC8A4EBB5E48.thor
  • c:\Python27\include\intrcheck.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-62CC-F3C733CBDEE2.thor
  • c:\Python27\tcl\tclConfig.sh -> c:\Python27\tcl\GIZCRYGX-7AM0-FMM8-0AE7-725C3D337A1B.thor
  • c:\Python27\include\dtoa.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-B8CB-3E8DB753525C.thor
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1037\GIZCRYGX-7AM0-FMM8-B32A-4CED551A14EE.thor
  • c:\Python27\include\Python.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-D891-9851497DC487.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Tulips.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYGX-7AM0-FMM8-71BB-085A75E6D84A.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-7F46-6854209A790A.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\uaCOGdPGPAl.docm -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGX-7AM0-FMM8-FF9F-AB70C4CB7514.thor
  • c:\Python27\include\pystate.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-6703-EFCAE40EA145.thor
  • c:\Python27\include\bytearrayobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-E35C-0AD5FA560E10.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGX-7AM0-FMM8-3A36-E4E770D11A66.thor
  • c:\Python27\Lib\test\empty.vbs -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-BF2B-82D1CDE886A3.thor
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1032\GIZCRYGX-7AM0-FMM8-0CC6-3E96C1E791FC.thor
  • c:\Python27\include\pyarena.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-C021-A6DD05E2FF48.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\ypskzbLJJfgtfKwlcM.docm -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGX-7AM0-FMM8-9ECE-F6217B04AC38.thor
  • c:\Python27\Lib\test\nullbytecert.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-0013-3E18CA750F97.thor
  • c:\Python27\include\pgen.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-BD32-FA79580BF809.thor
  • c:\Python27\include\pymath.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-6040-B2FFAE005CB4.thor
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1045\GIZCRYGX-7AM0-FMM8-8678-A9D91670041F.thor
  • c:\Python27\Lib\test\sha256.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-A748-B0E3F705A3AE.thor
  • c:\Python27\include\asdl.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-3B67-D3FBB92D321B.thor
  • \\KIDSROOM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3 -> \\KIDSROOM\Users\Public\Music\Sample Music\GIZCRYGX-7AM0-FMM8-85F4-FE365E9CFDE1.thor
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1029\GIZCRYGX-7AM0-FMM8-8932-8E63F08D346D.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-22B1-F5AE5ACA3795.thor
  • c:\Python27\include\osdefs.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-5CF9-0E9BCC3D4D94.thor
  • c:\Python27\include\dictobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-2CE2-B5006A8EBE2D.thor
  • c:\Python27\include\bytesobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-0147-9DABD6D0B54D.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\GIZCRYGX-7AM0-FMM8-3462-37D0DADEA887.thor
  • c:\Python27\include\objimpl.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-F1BE-804434211AB2.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-E8E1-FD06D00D3DBC.thor
  • c:\Python27\include\classobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-DB2F-186F6231694E.thor
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYGX-7AM0-FMM8-91D9-86D64E512683.thor
  • c:\cnrgqonuj\bin\cert.p12 -> c:\cnrgqonuj\bin\GIZCRYGX-7AM0-FMM8-43D2-74EB4DCC6056.thor
  • c:\Python27\include\ast.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-3BD5-BC4306881CE5.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYGX-7AM0-FMM8-7666-2761BA0EAE11.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGX-7AM0-FMM8-7947-F6F44E8EA6E6.thor
  • c:\Python27\include\datetime.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-D593-C54D0CC14D59.thor
  • c:\Python27\include\sliceobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-D90F-F9E8AEAF2F2C.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGX-7AM0-FMM8-74DA-03D99DF8BD62.thor
  • c:\Python27\include\unicodeobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-DAB3-2483E3F68E4D.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-A05F-CAE0DFF0D778.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-03BB-4A71A336C6C1.thor
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1038\GIZCRYGX-7AM0-FMM8-B939-9FC78B95934D.thor
  • c:\Python27\include\sysmodule.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-2E5A-DEFA04BB407F.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-55A8-B64494E195FB.thor
  • c:\Python27\include\metagrammar.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-FB02-E0CCE641EE1C.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYGX-7AM0-FMM8-BFBF-9D15E804A0FD.thor
  • c:\Python27\include\graminit.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-A193-9424E2683C08.thor
  • c:\Python27\Lib\test\https_svn_python_org_root.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-8ACC-44640ADDCB1C.thor
  • c:\Python27\include\parsetok.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-D32F-D4EFCBE3A766.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-0976-19737D74A428.thor
  • c:\Python27\include\import.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-4756-446CD6551AF0.thor
  • c:\Python27\include\pyexpat.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-3DE9-D0ABADC29D93.thor
  • c:\Python27\include\frameobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-C1AB-95B9D830A8B7.thor
  • c:\Python27\include\timefuncs.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-4174-25DEEC9C7E70.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\KBfeSoXzHuZo.pptx -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGX-7AM0-FMM8-B263-F4926372280F.thor
  • c:\Python27\include\grammar.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-1BFE-19C44DAB7D59.thor
  • c:\Python27\include\descrobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-AD49-3A0FD5AA1BFA.thor
  • c:\Python27\Lib\idlelib\idle.bat -> c:\Python27\Lib\idlelib\GIZCRYGX-7AM0-FMM8-1108-D9FA393D7F55.thor
  • c:\Python27\Lib\test\nullcert.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-0824-1DD74ED4E17E.thor
  • c:\Python27\Lib\test\keycert.passwd.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-9A0C-D1130025B960.thor
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1043\GIZCRYGX-7AM0-FMM8-7518-2BF6DC3BF0E7.thor
  • c:\Python27\Lib\test\pycacert.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-89A1-9BD8FA9C3A10.thor
  • \\KIDSROOM\Users\Public\Videos\Sample Videos\Wildlife.wmv -> \\KIDSROOM\Users\Public\Videos\Sample Videos\GIZCRYGX-7AM0-FMM8-98D2-CE80AC40617A.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\GIZCRYGX-7AM0-FMM8-B682-BE18565D2C47.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYGX-7AM0-FMM8-5C20-93325ACA6D0D.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-7811-9CB5D14713AB.thor
  • c:\Python27\include\Python-ast.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-DA2F-EF9C57F448C0.thor
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1055\GIZCRYGX-7AM0-FMM8-48F8-95EF54D38243.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGX-7AM0-FMM8-20D6-9318DE1D2E1F.thor
  • c:\Python27\Lib\test\keycert.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-035B-6A99DAF49A71.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-61E9-CCF4FE2CE3EE.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\cxAaSctarJ.docx -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGX-7AM0-FMM8-1EB0-1B249A31B493.thor
  • c:\Python27\include\warnings.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-DB5C-1394DCBAA964.thor
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1025\GIZCRYGX-7AM0-FMM8-522B-6EC53A1F950E.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-C620-6E94B5E0C0E0.thor
  • c:\Python27\include\enumobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-3BD3-35BDE6CB7A22.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGX-7AM0-FMM8-9F94-CA952F68F4F3.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\GIZCRYGX-7AM0-FMM8-4047-B47C1646F202.thor
  • c:\Python27\include\token.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-EC8E-CE6BB53C4597.thor
  • c:\Python27\include\weakrefobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-3B54-8A187C8B163F.thor
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYGX-7AM0-FMM8-8B26-B8A07D82B38B.thor
  • c:\Python27\include\funcobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-B710-47A7C357D0F2.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\kqgerUpGgg.ppt -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGX-7AM0-FMM8-97E8-BECDD1E23B38.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-C402-47B8E50435D5.thor
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYGX-7AM0-FMM8-C5A6-0EFF9EBAFB5A.thor
  • c:\Python27\Lib\test\ssl_key.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-8812-D8923C425CB2.thor
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYGX-7AM0-FMM8-D9AB-1488D1AF06EA.thor
  • c:\Python27\include\pydebug.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-DE14-F145C2BF39B6.thor
  • c:\Python27\include\pygetopt.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-D1EE-12E228B52347.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\GIZCRYGX-7AM0-FMM8-227F-530D7CB93E9B.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGX-7AM0-FMM8-A82A-5D7A210E2160.thor
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1041\GIZCRYGX-7AM0-FMM8-378C-25DDFAF2BE1D.thor
  • c:\Python27\include\cStringIO.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-0ADB-3AA3355BB4A1.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYGX-7AM0-FMM8-EE2F-1EF64482D835.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYGX-7AM0-FMM8-DC1A-D398350659DB.thor
  • c:\Python27\include\pyconfig.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-9E53-835FA849B01D.thor
  • c:\Python27\include\patchlevel.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-EE52-27CE6E38143E.thor
  • \\KIDSROOM\Users\Public\Music\Sample Music\Kalimba.mp3 -> \\KIDSROOM\Users\Public\Music\Sample Music\GIZCRYGX-7AM0-FMM8-4FEF-B55AC27062C1.thor
  • c:\Python27\include\intobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-8B4B-A6C447D6D0B0.thor
  • c:\Python27\Lib\test\nokia.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-92CE-74C89D7B4458.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\GIZCRYGX-7AM0-FMM8-769D-6F535042EEC6.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-20A0-0BA25239D87A.thor
  • c:\Python27\include\setobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-AB3D-447D88FFBDDB.thor
  • c:\Python27\include\iterobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-D707-9DA50CAC8012.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYGX-7AM0-FMM8-05B3-BB7EA56B092B.thor
  • c:\Python27\include\ucnhash.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-47EA-B5FCA6634E88.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\GIZCRYGX-7AM0-FMM8-CA09-084241C4FD3E.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-36C8-65E669A202AF.thor
  • c:\Python27\include\longobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-F798-FC6FC9924491.thor
  • c:\Python27\include\pymactoolbox.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-6F5C-A70D42287224.thor
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1028\GIZCRYGX-7AM0-FMM8-B9DF-71DFA701C634.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\GIZCRYGX-7AM0-FMM8-7BAE-C9762B81F730.thor
  • c:\Python27\include\pyport.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-EA8C-11E88D06F4B8.thor
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYGX-7AM0-FMM8-FB45-E17C85A907DF.thor
  • c:\Python27\include\errcode.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-291E-85683F8212B0.thor
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1049\GIZCRYGX-7AM0-FMM8-099B-86646AE03CE5.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\brZUYpxPew.pptx -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGX-7AM0-FMM8-E269-08531030D68D.thor
  • c:\Python27\include\boolobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-2259-4B3721505021.thor
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1031\GIZCRYGX-7AM0-FMM8-79B6-4CB4B2CB01D8.thor
  • \\KIDSROOM\Users\Harry Dresden\Contacts\Harry Dresden.contact -> \\KIDSROOM\Users\Harry Dresden\Contacts\GIZCRYGX-7AM0-FMM8-40F3-7BBA581E91E8.thor
  • c:\Python27\include\modsupport.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-3B36-855F01E924AF.thor
  • c:\Python27\include\bitset.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-B6DC-88971BADBA12.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYGX-7AM0-FMM8-6EA5-D0609DB051BB.thor
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1053\GIZCRYGX-7AM0-FMM8-1E9E-E2E3F485FC4E.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\BDIeWDAoPzxqui.txt -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGX-7AM0-FMM8-F0C1-48A8ED3B0B8B.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-943D-57DB474629DE.thor
  • c:\Python27\include\eval.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-0C19-A663BBBD4DB2.thor
  • c:\Python27\include\symtable.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-C633-DAC415525F18.thor
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf -> c:\6cdeacda242012e0e5b593e657\3082\GIZCRYGX-7AM0-FMM8-0612-20B208A90F5B.thor
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1042\GIZCRYGX-7AM0-FMM8-E3AF-1C2B268A7DF6.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-37C8-8A967AB77970.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-32B2-83ADDF77745F.thor
  • c:\Python27\include\rangeobject.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-F4DD-FF446BF6B185.thor
  • c:\Python27\include\code.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-B8D3-D03ECBC87A99.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Penguins.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYGX-7AM0-FMM8-D709-F8FABC84175C.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\bCfIQCBODrpmxSwKV.docx -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYGX-7AM0-FMM8-5513-1544BC391076.thor
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1035\GIZCRYGX-7AM0-FMM8-9065-AC3FEB90C0BE.thor
  • c:\Python27\include\pymacconfig.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-D763-F1E4A0B0EF01.thor
  • \\KIDSROOM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg -> \\KIDSROOM\Users\Harry Dresden\Downloads\GIZCRYGX-7AM0-FMM8-A29B-2FD2682D12E6.thor
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf -> c:\6cdeacda242012e0e5b593e657\2070\GIZCRYGX-7AM0-FMM8-4CA1-6387676EF251.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYGX-7AM0-FMM8-4451-55E75A7AE2E8.thor
  • c:\Python27\include\pyfpe.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-9307-060DB23D5113.thor
  • c:\Python27\Lib\test\ssl_key.passwd.pem -> c:\Python27\Lib\test\GIZCRYGX-7AM0-FMM8-6B9E-777AA9D3CC58.thor
  • c:\Python27\include\opcode.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-BDD5-1F34264A94D8.thor
  • c:\Python27\include\pyctype.h -> c:\Python27\include\GIZCRYGX-7AM0-FMM8-5967-99DEFAF1F626.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\GIZCRYGX-7AM0-FMM8-5F18-453D212645DF.thor
Network-Connects Host
  • corinnenewton.ca
Directory-Created
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YLC2QM2Y
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Caches
Directory-Enumerated
  • c:\Python27\Lib\site-packages\pip\*
  • c:\Python27\tcl\tcl8\8.5\*
  • c:\ProgramData\Sun\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\*
  • \\KIDSROOM\Users\Default\Saved Games\*
  • c:\Python27\tcl\tk8.5\demos\images\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\*
  • c:\Users\ruiner\*
  • c:\Recovery\015e7760-d44b-11e0-8947-954f09601788\*
  • c:\PerfLogs\*
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\*
  • \\KIDSROOM\Users\Harry Dresden\Links\*
  • c:\ProgramData\Passmark\*
  • \\KIDSROOM\Users\Harry Dresden\Pictures\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\*
  • c:\Python27\Tools\pynche\X\*
  • c:\cnrgqonuj\modules\auxiliary\*
  • c:\Users\Public\Music\Sample Music\*
  • c:\Python27\Lib\importlib\*
  • c:\Python27\tcl\tcl8.5\http1.0\*
  • c:\Python27\Lib\bsddb\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\*
  • c:\inetpub\wwwroot\aspnet_client\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog\*
  • c:\Python27\tcl\tk8.5\ttk\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\chardet\*
  • c:\Users\Default\Saved Games\*
  • c:\Python27\tcl\tcl8.5\tzdata\Africa\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\*
  • c:\Python27\Tools\i18n\*
  • c:\ProgramData\Microsoft\ClickToRun\*
  • c:\Python27\Lib\site-packages\pip\_vendor\lockfile\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F\en-us.16\*
  • c:\ProgramData\*
  • c:\6cdeacda242012e0e5b593e657\Graphics\*
  • c:\6cdeacda242012e0e5b593e657\1033\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders\*
  • c:\Python27\Lib\compiler\*
  • \\KIDSROOM\Users\Default\Desktop\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\*
  • c:\Python27\Lib\unittest\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\*
  • c:\Python27\Lib\test\capath\*
  • c:\Users\Harry Dresden\Music\*
  • \\KIDSROOM\Users\Default\Downloads\*
  • c:\Users\Harry Dresden\OneDrive\*
  • c:\Python27\tcl\tcl8.5\msgs\*
  • c:\ProgramData\Adobe\Acrobat\11.0\*
  • c:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\*
  • c:\Python27\tcl\tcl8.5\*
  • c:\Python27\Lib\unittest\test\*
  • c:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319\*
  • c:\ProgramData\Microsoft\Network\Connections\*
  • c:\Users\Public\Recorded TV\*
  • c:\Users\Harry Dresden\Contacts\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\42\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F\x-none.16\*
  • c:\Python27\tcl\tk8.5\msgs\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\*
  • c:\Python27\tcl\tcl8.5\tzdata\Atlantic\*
  • c:\Python27\tcl\tcl8.5\tzdata\Europe\*
  • c:\ProgramData\WebEx\WebEx\*
  • \\KIDSROOM\Users\Default\Pictures\*
  • c:\Python27\tcl\tk8.5\demos\*
  • c:\ProgramData\Microsoft\Windows Defender\*
  • c:\ProgramData\Microsoft\PlayReady\Cache\*
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\_backport\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\*
  • c:\ProgramData\NovaTech Network\NovaBench\*
  • c:\Python27\tcl\tix8.4.3\demos\samples\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\SentItems\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers\*
  • c:\ProgramData\Microsoft\PlayReady\Cache\S-1-5-21-3416602863-1947377224-293699093-1001\*
  • c:\6cdeacda242012e0e5b593e657\1037\*
  • c:\Python27\Lib\lib-tk\test\*
  • c:\Users\Default\Pictures\*
  • \\KIDSROOM\Users\Harry Dresden\Searches\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\*
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\tests\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\serializer\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\*
  • c:\inetpub\custerr\*
  • \\KIDSROOM\Users\Harry Dresden\Contacts\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\*
  • c:\Python27\Scripts\*
  • c:\Users\Public\Desktop\*
  • c:\ProgramData\Microsoft\Network\Downloader\*
  • c:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\*
  • c:\Python27\Tools\pynche\*
  • c:\Python27\Lib\email\test\*
  • c:\ProgramData\Mozilla\logs\*
  • \\KIDSROOM\Users\Default\*
  • c:\ProgramData\Microsoft\IdentityCRL\*
  • c:\ProgramData\Microsoft\WPD\*
  • c:\ProgramData\Microsoft\Diagnosis\LocalTraceStore\*
  • c:\ProgramData\Microsoft\Event Viewer\*
  • c:\Users\Harry Dresden\Favorites\Links for United States\*
  • c:\Users\Default\*
  • c:\ProgramData\Sun\Java\Java Update\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\*
  • \\KIDSROOM\Users\Harry Dresden\Favorites\*
  • c:\cnrgqonuj\*
  • c:\Python27\tcl\dde1.3\*
  • c:\Python27\Lib\ensurepip\_bundled\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\x-none.16\*
  • \\KIDSROOM\Users\Harry Dresden\Music\*
  • c:\PerfLogs\Admin\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters\*
  • c:\Python27\Lib\idlelib\*
  • c:\Python27\Lib\site-packages\pip\models\*
  • c:\inetpub\*
  • c:\Users\Harry Dresden\Saved Games\*
  • c:\inetpub\wwwroot\msmq\*
  • c:\ProgramData\Microsoft\DRM\*
  • c:\ProgramData\Microsoft\Crypto\RSA\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\trie\*
  • c:\6cdeacda242012e0e5b593e657\1025\*
  • c:\Python27\Lib\test\crashers\*
  • c:\ProgramData\Microsoft\Search\Data\Applications\*
  • c:\Python27\Lib\ctypes\test\*
  • c:\Users\Public\Libraries\*
  • c:\ProgramData\Microsoft\Device Stage\*
  • c:\ProgramData\Microsoft\Device Stage\Device\*
  • c:\ProgramData\Microsoft\Windows NT\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\*
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\*
  • c:\Python27\Lib\xml\etree\*
  • c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\*
  • c:\Python27\Lib\test\*
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\Security\*
  • c:\Python27\Lib\ctypes\macholib\*
  • c:\Python27\Lib\msilib\*
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\*
  • c:\6cdeacda242012e0e5b593e657\1035\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\DD\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\*
  • c:\Users\Default\Videos\*
  • c:\ProgramData\McAfee\MCLOGS\Common\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\*
  • c:\cnrgqonuj\lib\api\*
  • c:\Users\Default\Documents\*
  • c:\6cdeacda242012e0e5b593e657\1031\*
  • c:\Python27\tcl\tcl8.5\tzdata\Pacific\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\North_Dakota\*
  • \\KIDSROOM\Users\Harry Dresden\Downloads\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\*
  • c:\Python27\tcl\tcl8.5\tzdata\Etc\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\DD\*
  • c:\ProgramData\Adobe\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\*
  • c:\inetpub\history\CFGHISTORY_0000000001\*
  • \\KIDSROOM\Users\Harry Dresden\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A6\*
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\*
  • c:\Python27\Tools\webchecker\*
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\*
  • c:\cnrgqonuj\lib\*
  • c:\inetpub\history\CFGHISTORY_0000000005\*
  • c:\Users\Harry Dresden\Favorites\Links\*
  • c:\ProgramData\Microsoft\Assistance\*
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\*
  • c:\inetpub\wwwroot\*
  • c:\Users\Harry Dresden\*
  • c:\Python27\tcl\tcl8.5\tzdata\Antarctica\*
  • c:\Python27\Lib\site-packages\pip\_vendor\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\*
  • \\KIDSROOM\Users\Public\Downloads\*
  • c:\Users\Public\Downloads\*
  • c:\6cdeacda242012e0e5b593e657\2070\*
  • c:\Python27\Lib\test\cjkencodings\*
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\*
  • \\KIDSROOM\Users\Default\Videos\*
  • c:\ProgramData\Microsoft\Windows Defender\Support\*
  • c:\Python27\Lib\site-packages\pip\operations\*
  • c:\ProgramData\Microsoft\MF\*
  • c:\6cdeacda242012e0e5b593e657\1029\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\*
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\*
  • c:\Python27\Lib\distutils\tests\*
  • c:\ProgramData\Microsoft\Office\*
  • c:\Users\Public\Music\*
  • c:\Python27\tcl\tcl8.5\tzdata\SystemV\*
  • c:\6cdeacda242012e0e5b593e657\1045\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\*
  • c:\Users\Harry Dresden\Desktop\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\*
  • c:\ProgramData\Microsoft\Crypto\*
  • \\KIDSROOM\Users\Public\Foxit Software\*
  • c:\Users\Public\Pictures\*
  • c:\ProgramData\Mozilla\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\*
  • c:\Python27\include\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\*
  • c:\Python27\Lib\lib2to3\tests\data\fixers\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\*
  • c:\Python27\Lib\site-packages\setuptools\*
  • c:\Python27\Lib\test\tracedmodules\*
  • c:\ProgramData\Microsoft\Diagnosis\AsimovUploader\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\*
  • c:\6cdeacda242012e0e5b593e657\1049\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\*
  • \\KIDSROOM\Users\Public\Recorded TV\Sample Media\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\*
  • c:\Python27\tcl\tcl8.5\tzdata\Mexico\*
  • \\KIDSROOM\Users\Harry Dresden\Favorites\Links\*
  • c:\ProgramData\Microsoft\RAC\*
  • \\KIDSROOM\Users\Public\Pictures\*
  • c:\6cdeacda242012e0e5b593e657\2052\*
  • \\KIDSROOM\Users\Public\Music\*
  • c:\Python27\tcl\tcl8.5\tzdata\Arctic\*
  • c:\ProgramData\Oracle\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\35\*
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\media\*
  • c:\ProgramData\Microsoft\Windows Defender\Quarantine\*
  • c:\Python27\tcl\tcl8\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Queue\*
  • c:\ProgramData\Microsoft\RAC\Outbound\*
  • c:\ProgramData\WebEx\*
  • c:\inetpub\history\CFGHISTORY_0000000003\*
  • c:\Python27\Lib\site-packages\setuptools\command\*
  • c:\Python27\tcl\tcl8.5\tzdata\Indian\*
  • c:\ProgramData\Microsoft\Event Viewer\Views\*
  • c:\Users\Default\Favorites\*
  • c:\*
  • c:\Users\Default\Desktop\*
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\*
  • c:\ProgramData\Microsoft\eHome\logs\*
  • c:\ProgramData\Microsoft\Network\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Kentucky\*
  • c:\Python27\Lib\lib-tk\test\test_ttk\*
  • c:\Python27\tcl\tcl8.5\tzdata\US\*
  • c:\ProgramData\Microsoft\ClickToRun\UserData\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\*
  • c:\Users\Public\Pictures\Sample Pictures\*
  • c:\6cdeacda242012e0e5b593e657\1041\*
  • c:\Users\Default\Downloads\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\ssl_match_hostname\*
  • c:\Users\Harry Dresden\Links\*
  • c:\Python27\DLLs\*
  • c:\ProgramData\Microsoft\User Account Pictures\*
  • c:\cnrgqonuj\modules\packages\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\contrib\*
  • \\KIDSROOM\Users\Harry Dresden\OneDrive\*
  • c:\Python27\tcl\tcl8.5\tzdata\Asia\*
  • c:\Users\Harry Dresden\Downloads\*
  • c:\Python27\tcl\tcl8.5\opt0.4\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\42\*
  • c:\Users\Public\Videos\*
  • c:\Python27\tcl\tcl8\8.4\*
  • c:\6cdeacda242012e0e5b593e657\1055\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\*
  • c:\Python27\Tools\versioncheck\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F7\*
  • c:\Python27\Lib\xml\dom\*
  • c:\Python27\Lib\lib2to3\tests\data\*
  • \\KIDSROOM\Users\Harry Dresden\Desktop\*
  • c:\Python27\tcl\tcl8.5\encoding\*
  • c:\ProgramData\McAfee\*
  • c:\ProgramData\Microsoft\DRM\Server\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\*
  • c:\ProgramData\Microsoft\User Account Pictures\Default Pictures\*
  • \\KIDSROOM\Users\Public\Favorites\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\*
  • \\KIDSROOM\Users\Public\Documents\*
  • c:\Python27\Lib\xml\parsers\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\*
  • c:\6cdeacda242012e0e5b593e657\1038\*
  • c:\Python27\tcl\tix8.4.3\*
  • c:\Python27\Lib\encodings\*
  • c:\Python27\tcl\tcl8.5\tzdata\Canada\*
  • c:\ProgramData\NovaTech Network\*
  • c:\ProgramData\Microsoft\WwanSvc\*
  • \\KIDSROOM\Users\*
  • c:\6cdeacda242012e0e5b593e657\1053\*
  • c:\Users\Default\Music\*
  • c:\Python27\Lib\test\decimaltestdata\*
  • c:\Python27\Lib\test\xmltestdata\*
  • c:\cnrgqonuj\bin\*
  • c:\ProgramData\Passmark\PerformanceTest\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\*
  • c:\Python27\tcl\reg1.2\*
  • \\KIDSROOM\Users\Public\*
  • \\KIDSROOM\Users\Harry Dresden\Documents\*
  • \\KIDSROOM\Users\Public\Music\Sample Music\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\*
  • c:\Python27\Lib\logging\*
  • c:\ProgramData\Microsoft\eHome\*
  • c:\Users\Public\*
  • c:\6cdeacda242012e0e5b593e657\1043\*
  • c:\Python27\Lib\site-packages\*
  • c:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\*
  • c:\ProgramData\Microsoft\Diagnosis\UIF\*
  • c:\Users\Harry Dresden\Searches\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\*
  • c:\Python27\tcl\tk8.5\*
  • c:\Python27\Lib\xml\sax\*
  • c:\ProgramData\Microsoft\Vault\*
  • c:\Users\Default\Links\*
  • c:\Python27\Lib\json\tests\*
  • c:\Python27\libs\*
  • c:\6cdeacda242012e0e5b593e657\1028\*
  • c:\Python27\Lib\lib-tk\test\test_tkinter\*
  • c:\Users\Public\Foxit Software\Foxit Reader\*
  • c:\ProgramData\Microsoft OneDrive\*
  • c:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\*
  • c:\Python27\Lib\ctypes\*
  • c:\Users\Public\Recorded TV\Sample Media\*
  • c:\Python27\*
  • c:\ProgramData\Microsoft\Crypto\DSS\*
  • c:\ProgramData\Microsoft\Diagnosis\Sideload\*
  • c:\Python27\Lib\email\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\*
  • c:\ProgramData\Microsoft\Search\Data\*
  • c:\Users\Harry Dresden\Documents\*
  • c:\ProgramData\Adobe\Setup\*
  • c:\Python27\Lib\distutils\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\*
  • c:\ProgramData\Microsoft\Device Stage\Task\*
  • c:\Users\*
  • c:\cnrgqonuj\lib\core\*
  • \\KIDSROOM\Users\Default\Links\*
  • c:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\*
  • c:\Python27\Lib\sqlite3\*
  • c:\ProgramData\Sun\Java\*
  • c:\ProgramData\Microsoft\NetFramework\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\*
  • c:\ProgramData\Microsoft\Crypto\Keys\*
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\*
  • c:\Python27\Lib\bsddb\test\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\{98101498-C465-4F51-8751-D1919E97D29D}\*
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\*
  • c:\Recovery\*
  • c:\Users\Public\Foxit Software\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A6\*
  • c:\inetpub\history\CFGHISTORY_0000000002\*
  • c:\Python27\Lib\site-packages\pip\req\*
  • c:\Users\Harry Dresden\Videos\*
  • \\KIDSROOM\Users\Public\Videos\Sample Videos\*
  • c:\inetpub\wwwroot\aspnet_client\system_web\*
  • c:\Python27\tcl\tcl8.5\tzdata\Australia\*
  • c:\Users\Harry Dresden\Pictures\*
  • c:\ProgramData\Microsoft\DeviceSync\*
  • c:\ProgramData\WebEx\WebEx\12_1324\*
  • c:\ProgramData\Microsoft\Office\Heartbeat\*
  • c:\Python27\Lib\lib2to3\tests\data\fixers\myfixes\*
  • \\KIDSROOM\Users\Public\Libraries\*
  • c:\Python27\Tools\Scripts\*
  • c:\Python27\Lib\hotshot\*
  • c:\ProgramData\Microsoft\*
  • c:\ProgramData\Microsoft\PlayReady\*
  • c:\Python27\Lib\site-packages\pip\utils\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\*
  • \\KIDSROOM\Users\Public\Recorded TV\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\*
  • c:\Python27\tcl\tcl8.5\tzdata\Brazil\*
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\packaging\*
  • \\KIDSROOM\Users\Public\Desktop\*
  • c:\Python27\Lib\lib2to3\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\*
  • c:\cnrgqonuj\modules\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Argentina\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\*
  • c:\ProgramData\Microsoft\WwanSvc\Profiles\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\*
  • c:\Python27\Lib\test\subprocessdata\*
  • \\KIDSROOM\Users\Default\Favorites\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Quick\*
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info\*
  • c:\Python27\Lib\site-packages\pip\_vendor\progress\*
  • \\KIDSROOM\Users\Harry Dresden\Saved Games\*
  • c:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Inbox\*
  • c:\Python27\Lib\xml\*
  • c:\ProgramData\Microsoft\Search\*
  • c:\ProgramData\Microsoft\IlsCache\*
  • c:\Python27\tcl\tk8.5\images\*
  • e:\*
  • c:\Python27\Lib\sqlite3\test\*
  • c:\ProgramData\McAfee\MCLOGS\*
  • c:\Python27\Lib\ensurepip\*
  • c:\Python27\Lib\idlelib\Icons\*
  • c:\Python27\Lib\test\imghdrdata\*
  • c:\ProgramData\Microsoft\Diagnosis\*
  • c:\6cdeacda242012e0e5b593e657\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\*
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\*
  • c:\6cdeacda242012e0e5b593e657\1030\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\*
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\*
  • c:\Python27\tcl\tcl8.5\tzdata\*
  • c:\ProgramData\Microsoft\RAC\PublishedData\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\*
  • \\KIDSROOM\Users\Default\Documents\*
  • c:\Python27\Lib\multiprocessing\dummy\*
  • \\KIDSROOM\Users\ruiner\*
  • c:\Python27\Lib\email\mime\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\*
  • c:\Python27\tcl\tix8.4.3\demos\bitmaps\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\en-us.16\*
  • c:\Users\Public\Documents\*
  • c:\6cdeacda242012e0e5b593e657\3082\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\*
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\*
  • c:\Python27\Lib\lib-tk\*
  • c:\Users\Harry Dresden\Favorites\*
  • c:\Python27\Doc\*
  • c:\Python27\Lib\curses\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F\*
  • c:\Python27\Lib\lib2to3\pgen2\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\*
  • c:\ProgramData\Adobe\Acrobat\*
  • c:\Python27\Lib\*
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\*
  • c:\Python27\tcl\tix8.4.3\demos\*
  • c:\6cdeacda242012e0e5b593e657\1042\*
  • c:\Python27\Lib\test\audiodata\*
  • c:\inetpub\history\CFGHISTORY_0000000004\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\*
  • c:\Python27\Lib\site-packages\pip\_vendor\_markerlib\*
  • \\KIDSROOM\Users\Harry Dresden\Videos\*
  • c:\Python27\tcl\tcl8\8.4\platform\*
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\*
  • c:\Python27\Lib\site-packages\pip\vcs\*
  • c:\6cdeacda242012e0e5b593e657\1046\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\*
  • c:\Python27\tcl\tix8.4.3\pref\*
  • c:\Python27\Lib\site-packages\pip\compat\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\*
  • \\KIDSROOM\Users\Default\Music\*
  • c:\Python27\Lib\json\*
  • c:\Python27\Lib\lib2to3\fixes\*
  • \\KIDSROOM\Users\Harry Dresden\Favorites\Links for United States\*
  • c:\ProgramData\Microsoft\Windows Defender\LocalCopy\*
  • c:\ProgramData\Microsoft\Assistance\Client\*
  • c:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\*
  • c:\cnrgqonuj\lib\common\*
  • c:\Python27\Lib\test\leakers\*
  • c:\Users\Public\Videos\Sample Videos\*
  • c:\ProgramData\Microsoft\Media Player\*
  • c:\ProgramData\McAfee\MCLOGS\Common\jxpiinstall\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\filters\*
  • c:\Python27\Tools\*
  • c:\6cdeacda242012e0e5b593e657\1044\*
  • c:\6cdeacda242012e0e5b593e657\1036\*
  • c:\inetpub\history\*
  • c:\6cdeacda242012e0e5b593e657\1032\*
  • c:\Python27\tcl\tcl8.5\tzdata\Chile\*
  • c:\Python27\Lib\site-packages\pip\_vendor\packaging\*
  • c:\ProgramData\Microsoft\Windows NT\MSScan\*
  • c:\Python27\Lib\email\test\data\*
  • c:\Python27\tcl\tix8.4.3\bitmaps\*
  • c:\Python27\Lib\site-packages\pip\_vendor\colorama\*
  • c:\Python27\Lib\lib2to3\tests\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\*
  • \\KIDSROOM\Users\Public\Videos\*
  • c:\ProgramData\regid.1991-06.com.microsoft\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F7\*
  • c:\ProgramData\Microsoft OneDrive\setup\*
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\*
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches\*
  • c:\Python27\Lib\distutils\command\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\*
  • c:\Python27\tcl\*
  • c:\Python27\Lib\site-packages\pip\commands\*
  • c:\Python27\Lib\site-packages\pkg_resources\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\*
  • c:\Python27\Lib\multiprocessing\*
  • c:\Python27\Lib\wsgiref\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\35\*
  • c:\Users\Public\Favorites\*
  • c:\Python27\Lib\pydoc_data\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util\*
  • c:\ProgramData\Microsoft\RAC\StateData\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Indiana\*
  • c:\Python27\Lib\site-packages\_markerlib\*
  • c:\Python27\Lib\idlelib\idle_test\*
  • c:\inetpub\custerr\en-US\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\*
  • c:\6cdeacda242012e0e5b593e657\1040\*
Registry Key-Opened
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\control\NetworkProvider\HwOrder
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPNP\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\VssapiPublisher
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MiniNT
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Safeboot\Option
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\NetworkProvider
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider
  • HKEY_CURRENT_USER\Network\E
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions
  • HKEY_LOCAL_MACHINE\system\CurrentControlSet\Control\NetworkProvider\Notifyees
  • HKEY_CURRENT_USER\Network
  • HKEY_PERFORMANCE_DATA\(Default)
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LDAP
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
  • HKEY_LOCAL_MACHINE\system\CurrentControlSet
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\http\
  • HKEY_CURRENT_USER\Software
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610
  • HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CLASSES_ROOT\.js
  • HKEY_LOCAL_MACHINE\Software\Policies
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Pre Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\0a-00-27-00-00-00
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_CERT_WARNINGS_ON_POST_FROM_ISTREAM_KB2894776
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001
  • HKEY_LOCAL_MACHINE\Software
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Pre Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\*\
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_URLMON_IQDA_SIZE
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent
  • HKEY_CURRENT_USER\Software\Policies
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\KindMap
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_URLMON_IQDA_SIZE
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00
  • HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_LOCAL_MACHINE\System\Setup
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION
  • HKEY_CLASSES_ROOT\JSFile\ScriptEngine
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\UrlMon Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SHOW_CERT_WARNINGS_ON_POST_FROM_ISTREAM_KB2894776
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Registry Key-Deleted
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDetectedUrl
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDetectedUrl
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
Registry Key-Read
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\MaxRpcSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseHostnameAsAlias
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\LdapClientIntegrity
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\OOBEInProgress
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseOldHostResolutionOrder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder\ProviderOrder
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\ComputerName
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions\ProductType
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ReceiveTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\wscript.exe
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\NoFileFolderJunction
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cer\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectTimeOut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\DisallowRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InitFolderHandler
  • HKEY_CURRENT_USER\Directory\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PreCreate
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc2740-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\IgnoreUserSettings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\AdminTabProcs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InfoTip
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DevicePath
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\RestrictRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ADODB.Stream\CLSID\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\*
  • HKEY_CURRENT_USER\Directory\NeverShowExt
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\LogFileName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.js\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chm\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\MapNetDriveVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\Timeout
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivKeyCachePurgeIntervalSeconds
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\TabProcGrowth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDhcp
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParsingName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SendTimeOut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\Environment\PROCESSOR_ARCHITECTURE
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SourcePath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseOldHostResolutionOrder
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273c-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsParseDisplayName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\DontShowSuperHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\InprocServer32
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\AllowFileCLSIDJunctions
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\SessionMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bat\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoSetFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\FolderTypeID
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\DisplayLogo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\(Default)
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableUTF8
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\COM+Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.com\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForInfoTip
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FrameTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\*
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Srp\GP\RuleCount
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HasNavigationEnum
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1A10
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Description
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\PolicyScope
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoCommonGroups
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273d-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoSimpleStartMenu
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\Safety Warning Level
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ade\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation\AllowedReservedCharacters
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoControlPanel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\SessionMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORPARSING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\BrowseInPlace
  • HKEY_CURRENT_USER\Directory\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForOverlay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\UseDropHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.crt\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsAliasedNotifications
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\ClassicShell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugHeapFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FrameTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\DefaultLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JScript\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSXML2.XMLHTTP\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideOnDesktopPerUser
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SendTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoPropertiesMyComputer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WScript.Shell\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bas\(Default)
  • HKEY_CURRENT_USER\Directory\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Name
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoPropertiesRecycleBin
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORDISPLAY
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Image Path
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Platform
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\TabProcGrowth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\DelegateExecute
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\PinToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\Levels
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpl\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoInternetIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273d-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\InheritConsoleHandles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\UseWINSAFER
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivKeyCacheMaxItems
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1806
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\DocObject
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ReceiveTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Security
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\SaferFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResource
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\AdminTabProcs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\TrustPolicy
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Compatible
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\DA0C75D6
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsUniversalDelegate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.adp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\command
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseHostnameAsAlias
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InitFolderHandler
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\NoWorkingDirectory
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\ScriptEngine\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecision
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cmd\(Default)
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1806
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\LogSecuritySuccesses
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc2740-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
  • HKEY_CURRENT_USER\Directory\IsShortcut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivateKeyLifetimeSeconds
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\*
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\LdapClientIntegrity
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideInWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FrameMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\DisplayLogo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\Timeout
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Compatible
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\InheritConsoleHandles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win64\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\InprocServer32
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273c-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FrameMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\SetWorkingDirectoryFromTarget
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDns
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionTime
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideFolderVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Flags
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadExpirationDays
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\NeverShowExt
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDetectedUrl
Registry Key-Written
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionReason
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecision
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionTime
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadNetworkName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
Mutex-Accessed
  • Local\ZonesCacheCounterMutex
  • Local\ZonesLockedCacheCounterMutex

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 460, Parent PID: 364

"C:\Windows\System32\wscript.exe" C:\Users\HARRYD~1\AppData\Local\Temp\NRV_5359H4I_.js PID: 5788, Parent PID: 2608

"C:\Windows\SysWOW64\rundll32.exe" C:\Users\HARRYD~1\AppData\Local\Temp\2J0LXV~1.DLL,boobs PID: 6344, Parent PID: 5788

Volatility

Nothing to display.