'
metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2016-11-08 12:11:59.132892 2016-11-08 12:15:37.226835 218 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo win7 Clone 1 VirtualBox 2016-11-08 12:11:59 2016-11-08 12:15:36

File Details

File name 2de0ede08394f5720647d731484055fc623baa6b.zip
File size 1104 bytes
File type Zip archive data, at least v2.0 to extract
CRC32 37002560
MD5 fe757520d9a2423d3d22e7fd7cdd2d73
SHA1 2de0ede08394f5720647d731484055fc623baa6b
SHA256 debf608b44b7851ad0594e50180b2294513a8ec6ef9b250b3a8f557467ff949e
SHA512 a2d315a6e6737443e4d8cbdacb7075b112d468127cd3240ee7bc7f1c55b5affdd24652847e42fffbd879e4c428e716e30ad6a36ff5e9e391d74f6e7177069a47
Ssdeep 24:9cCaTF6CJ5xB/T90+TKd9GWlWnCPV58jtAi8UF8wX7OMhCN89Nm6I:9cFNnt5TKUgVWKU7OMa8yZ
PEiD None matched
Yara
  • PM_Zip_with_js ()
VirusTotal File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=125, Anomalies=0, PEiD=0, Yara=2, VT[1478607375]=0): Snort Events=1, AV Events=2
Total Score=125

SNORT EVENTS:
ET INFO SUSPICIOUS Dotted Quad Host MZ Response

CLAMAV DETECTED:
Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND
DROPPED FILE - NRV_2I56240B_.js: Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND

Dropped File/Buffer Yara Signatures:
84ecc988ad211b3f734e01b7006a50a98f444793 [BUFFER]: shellcode
7220f1a13ec0865c040fcdef3960162ba58aa34e [BUFFER]: Str_Win32_Http_API

Signatures

antivm_queries_computername details
recon_fingerprint details
antivm_memory_available details
dumped_buffer details
Roaming_Profile_Modified details
creates_doc details
antivm_network_adapters details
dumped_buffer2 details
antivm_vbox_files details
Windows_Proxy_Tinkering details
network_wscript_downloader details
persistence_ads details
antiav_detectfile details
exploit_heapspray details
malicious_document_urls details
network_document_file details
network_downloader_exe details
antivm_vbox_devices details
antivm_vbox_files details
modifies_files details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

3704bd3c4e926f92_076e35c0-5e29-6be8-12fc-58bea7e5d153.thor

0eb5358571868715_076e35c0-5e29-6be8-89da-3f93d48846b8.thor

f32b5e498d8aded7_076e35c0-5e29-6be8-4b53-bbaaa09df0d4.thor

0462acc8fee8bd2f_076e35c0-5e29-6be8-5ed9-7befab175c42.thor

30ef418be5c50870_076e35c0-5e29-6be8-cfb4-7f46f53f94ca.thor

772746a9dd7f6161_076e35c0-5e29-6be8-a5f4-c498602da4d7.thor

9083683060aa8c7c_076e35c0-5e29-6be8-f19a-27250c302e61.thor

86e0f3774095f94b_076e35c0-5e29-6be8-3e98-767a65824aa8.thor

580a781247bcc39b_076e35c0-5e29-6be8-3fac-55f23ab952b1.thor

399d7797362eb363_076e35c0-5e29-6be8-6aff-c57b7cdca4d5.thor

c33291e21247065c_076e35c0-5e29-6be8-d517-96e618682860.thor

f88ef17628a3ae0c_076e35c0-5e29-6be8-2532-7c763aaf6763.thor

251cd1e57e850239_076e35c0-5e29-6be8-cbc3-8e1f4ee28eeb.thor

2b4e6a71a3bf5105_076e35c0-5e29-6be8-0306-fc76f3984855.thor

520f93db9a519458_076e35c0-5e29-6be8-a125-6b110a7811d7.thor

a5ce53ffeb4a3bc9_m1jpgl32.txt

163ad8fffdfa043d_076e35c0-5e29-6be8-0c2d-42385fc8097c.thor

93fd87b24d5b4430_076e35c0-5e29-6be8-2955-de2cce93bea1.thor

8b84a4988371db88_076e35c0-5e29-6be8-724b-7f8101159d51.thor

0a79cefb12c15886_076e35c0-5e29-6be8-6902-515d2789ecad.thor

2dd9e7c63e66b53f_076e35c0-5e29-6be8-0b22-4d424aa69843.thor

77c99cc3bc82749a_076e35c0-5e29-6be8-f0db-f123c82218c0.thor

306068f50876c941_076e35c0-5e29-6be8-5e77-4f1b7876bdc0.thor

caba40235aaacaab_076e35c0-5e29-6be8-abf0-0e5181f6df96.thor

0e5f69023d9fd31a_076e35c0-5e29-6be8-9027-c9a09c8ef4c9.thor

51e9b27738f69aa3_076e35c0-5e29-6be8-cd2e-a2a9ad9bc2ec.thor

37d319b22f7722cc_076e35c0-5e29-6be8-2f52-d31632dd2570.thor

89dbacfd9685004b_076e35c0-5e29-6be8-1fef-f923e39d8c20.thor

c1ffe4455b0dc9f2_076e35c0-5e29-6be8-2a0d-d317caeccd53.thor

c7d8cacf159ff735_076e35c0-5e29-6be8-74b3-6f7da2bacfe7.thor

543a8e1f171fb6e1_076e35c0-5e29-6be8-dfff-cbe48afc11ee.thor

fef4f41dfdc95507_076e35c0-5e29-6be8-56c2-32d867195c98.thor

99d9e9f8baea9714_076e35c0-5e29-6be8-6a6c-1410fd4c5fdd.thor

4b6a498ca2acb834_076e35c0-5e29-6be8-5927-15b468df5c89.thor

f6bd28a1b42f4b32_076e35c0-5e29-6be8-739b-818cfba23d3f.thor

5449de24fcd4e400_076e35c0-5e29-6be8-ff5a-60ab31288475.thor

af39760054e1fa00_076e35c0-5e29-6be8-a053-c43a10b7c0f7.thor

f2bebefbd42aa2f8_076e35c0-5e29-6be8-9a89-8c4820e2ebc6.thor

35695f03ea0333dc_076e35c0-5e29-6be8-a63f-a9918a006329.thor

30c4e3d4ece82172_076e35c0-5e29-6be8-e515-08cff9cfa006.thor

69915ed445dacc8d_076e35c0-5e29-6be8-f4e1-ce31423ff9e3.thor

86cdf9f724e04e82_076e35c0-5e29-6be8-f26e-f7e655217a13.thor

e5dcb11f0fadcc37_076e35c0-5e29-6be8-2ad5-5adf6b91eb39.thor

a98214334220c3cf_076e35c0-5e29-6be8-1d54-bcc0d370c1c2.thor

d35414554df36b69_076e35c0-5e29-6be8-7122-a5a8198f286b.thor

97bb7f8e170d4b27_076e35c0-5e29-6be8-e783-8a5d3f5c8898.thor

eddff0bcfb427c76_076e35c0-5e29-6be8-299a-9b4913bc6639.thor

6661f72605bde69e_076e35c0-5e29-6be8-7669-c8cc82d317af.thor

71bcf0b8b349e749_076e35c0-5e29-6be8-fec0-89538ceb41f8.thor

9878739187e8606a_076e35c0-5e29-6be8-dc23-b221e3c650aa.thor

62451e8d582fa0c6_076e35c0-5e29-6be8-2b36-c96c6ea14624.thor

df0090f14df6b984_076e35c0-5e29-6be8-23fb-a7b6f6f5df2b.thor

f9c824a5f2d9d1dc_076e35c0-5e29-6be8-3b43-c904c8d835e0.thor

7b66988cc8e8a80b_076e35c0-5e29-6be8-f48a-886b8b4d40cf.thor

a823d1dec9e1fa56_076e35c0-5e29-6be8-bad4-86fdda06c1fb.thor

bcfb99eef9852910_076e35c0-5e29-6be8-20df-c1d4b3bc5e07.thor

1794f0a1cc06f285_076e35c0-5e29-6be8-dcf1-e8e2a03b86d7.thor

fc5be4766593c87c_076e35c0-5e29-6be8-a7d9-dda4d851b153.thor

d4de7cc42c7f0116_076e35c0-5e29-6be8-fa7b-bcba32cce2bf.thor

1b19d3c48a39eff1_076e35c0-5e29-6be8-6fa6-fbd274af1506.thor

218ba353ea1c9600_076e35c0-5e29-6be8-d4d9-754f6a5dd7bf.thor

eed9a015ef6a83c6_076e35c0-5e29-6be8-b79f-68cfa643c0ef.thor

33c81813a467547b_076e35c0-5e29-6be8-1b9d-6c0d1c128f1e.thor

b14ffa3bad438216_076e35c0-5e29-6be8-62b2-587916e17552.thor

55f9259a38c4ecae_076e35c0-5e29-6be8-0515-3693aae65094.thor

50bff6051e666bc5_076e35c0-5e29-6be8-50d8-1739e21d1f10.thor

e30190427fb42ef7_076e35c0-5e29-6be8-d704-8d5e30a7d8ab.thor

93f06c990450b538_076e35c0-5e29-6be8-b08b-bff520f0bdbd.thor

918521853461a41f_076e35c0-5e29-6be8-31f1-aea22c4e0a43.thor

5b852c72d49fea4e_076e35c0-5e29-6be8-24aa-4c9cfbbea6ee.thor

15bc5a5996cf1733_076e35c0-5e29-6be8-9aba-473a364a4815.thor

60dbd9a24b142558_076e35c0-5e29-6be8-0e72-6fbc93655f48.thor

d3c621a03e0aec85_076e35c0-5e29-6be8-7529-8bea42671db0.thor

e21cea15a8586730_076e35c0-5e29-6be8-f226-4ee07b4f775d.thor

5e02cd8e0d15c1b3_076e35c0-5e29-6be8-daf3-c9165b6b325e.thor

de185f0bc6be82d4_076e35c0-5e29-6be8-0252-6c9162c7f3e3.thor

1a396f69a76d3877_076e35c0-5e29-6be8-1864-e467cb20a701.thor

4648ca965d006d8f_076e35c0-5e29-6be8-cbe4-025e6e95134c.thor

15d651ab3642296e_076e35c0-5e29-6be8-265c-aa80c03e2a04.thor

288bdce307476b0c_076e35c0-5e29-6be8-275f-f1ee5537d74c.thor

5f5101142703b283_076e35c0-5e29-6be8-9266-c9ac1900a800.thor

1c68eecb4723c812_076e35c0-5e29-6be8-cbac-d15700c3bcaf.thor

4d47c68e472581c6_076e35c0-5e29-6be8-71d0-c45ddd002c2c.thor

aba2392d09b6cdc2_076e35c0-5e29-6be8-b0cc-57e1261b1166.thor

27b5fb9ae5fec79a_076e35c0-5e29-6be8-84a0-fc93a8a6fa38.thor

3e3f38cc313ace0b_076e35c0-5e29-6be8-d9d6-c1e84a814aeb.thor

831db7e658c24226_076e35c0-5e29-6be8-e211-cb64943feac8.thor

763474571aa9ae14_076e35c0-5e29-6be8-a3a5-6b315513f7f1.thor

b69cfbf94e2520d6_076e35c0-5e29-6be8-a6bf-7f63f4caadc7.thor

7ba69242c92b943f_076e35c0-5e29-6be8-0947-4a084728ca9d.thor

5fb058968a054024_076e35c0-5e29-6be8-9971-9ded941dc346.thor

0718cb19abb1f640_076e35c0-5e29-6be8-6dd8-9346f3ecbd62.thor

1d5aa920c1d2ea9a_076e35c0-5e29-6be8-ff7d-b4e075a5649b.thor

a3116f1c06e3e1cc_076e35c0-5e29-6be8-71d0-5f47ef1944a0.thor

08710a14f7a63e79_076e35c0-5e29-6be8-f698-6449a8f6bcad.thor

1969ccb4de8e5a19_076e35c0-5e29-6be8-a055-77b232528b0e.thor

47e407189ea8d2aa_076e35c0-5e29-6be8-c6a4-dd308a78f5c1.thor

da720cbb4574585b_076e35c0-5e29-6be8-35aa-b3f7b23fde71.thor

d53c8151a898fb84_076e35c0-5e29-6be8-7fcb-445ec58d2996.thor

e7d3655ed64437a3_076e35c0-5e29-6be8-c7dc-5a63faac1153.thor

e09582d00206eeae_076e35c0-5e29-6be8-e56c-f689c3902502.thor

8d3b7173cc1d8048_076e35c0-5e29-6be8-b366-b766d26447c7.thor

bfb89736f918794e_076e35c0-5e29-6be8-394f-5aa1fffbe060.thor

86e1278dc1473557_076e35c0-5e29-6be8-0500-2982cfd9498b.thor

11df96047e04752a_076e35c0-5e29-6be8-29e0-0159797b5b32.thor

bf01dda35b14b2dd_076e35c0-5e29-6be8-c74b-5388aa03be88.thor

e0c251334f3c1f63_076e35c0-5e29-6be8-7f7a-511c61762b0a.thor

f8f61dd20306e3be_076e35c0-5e29-6be8-f2b4-855830b3f561.thor

4974eeafbdc02ed6_076e35c0-5e29-6be8-96bc-95d8293ec5c8.thor

f8087134e1b5b747_076e35c0-5e29-6be8-b7b9-54f2c5cbc24c.thor

f6fc21bae8511636_076e35c0-5e29-6be8-f184-9413efbfcb24.thor

e7186570c045e4dc__3_what_is.html

096fd9ed49f70fa7_076e35c0-5e29-6be8-6637-de4b8f013499.thor

3974ad46c2992642_076e35c0-5e29-6be8-7323-d36202519dac.thor

da76ad85d9be4829_076e35c0-5e29-6be8-48eb-14395c2c9159.thor

707cea19448f8b9b_076e35c0-5e29-6be8-64fe-fe9a2937bc9b.thor

dcf2d3f2f005ffd6_076e35c0-5e29-6be8-28c2-1ae7e33979ba.thor

cb6e62618d3aa62f_076e35c0-5e29-6be8-7943-29dac126fdba.thor

062904d7e7c18fd0_076e35c0-5e29-6be8-ec25-48fb2f458d1d.thor

68d4466b9c2d09a1_076e35c0-5e29-6be8-6b71-047217566a84.thor

2f6ac5d0b233adba_076e35c0-5e29-6be8-c3ed-0d5f5751f5ad.thor

5e3249184c9b2597_076e35c0-5e29-6be8-a6ad-78b9e22f503f.thor

aebf5b8b8abe8cb8_076e35c0-5e29-6be8-4ef2-92a89cfcdceb.thor

9753280e3b76ea29_076e35c0-5e29-6be8-a41d-bdb67be31ada.thor

faafb7b8129dc483_076e35c0-5e29-6be8-6b08-ecd2563dd88e.thor

a0f331378b367d2f_076e35c0-5e29-6be8-b4ce-8706f23e961e.thor

173dafc259c535ae_076e35c0-5e29-6be8-66de-744fe87bf88b.thor

bc03ab693cde2cd3_076e35c0-5e29-6be8-fb33-0f9888ac53ed.thor

c96cbd23834926d5_076e35c0-5e29-6be8-48e8-0f0eb0e43526.thor

71b08c453bd98c9f_076e35c0-5e29-6be8-d8d4-a1a7d623a706.thor

92e70d24c3df63ba_076e35c0-5e29-6be8-882f-3eff0252d944.thor

8c68b13d0e8374a7_076e35c0-5e29-6be8-fdad-242c9a32ac24.thor

d91ea07e31662e48_076e35c0-5e29-6be8-fa16-14c035e9c4cf.thor

61e7b6156711c698_076e35c0-5e29-6be8-6aa8-68b2aa4398dd.thor

51a52f4462a53dcb_076e35c0-5e29-6be8-5787-96d5c9bcdfd8.thor

a7537782ac135dff_076e35c0-5e29-6be8-f55d-fae2e4b26355.thor

8352dcf014f0eda3_076e35c0-5e29-6be8-3943-ed2b6e2fd7ad.thor

d49b651f8990c27e_076e35c0-5e29-6be8-b950-1f21bca07ec6.thor

7b2a0f441c38e49e_076e35c0-5e29-6be8-a481-af7f78ac04e2.thor

65de19116651fd15_076e35c0-5e29-6be8-1374-02fe3c53a4a3.thor

ff0174a074d8f146_076e35c0-5e29-6be8-1da4-ced1a93989e5.thor

b9117ed7f4d8394a_076e35c0-5e29-6be8-b0c0-b472db32dc58.thor

97c2569634920bba_076e35c0-5e29-6be8-5c2c-c483139d2b62.thor

6213617a784b3c20_hbdo6[1]

cc8ac1b3f8982125_076e35c0-5e29-6be8-b2b8-6839d2a3eaed.thor

d635a04941f611b2_076e35c0-5e29-6be8-b64e-a7290b6e9354.thor

04344d34680059a5_076e35c0-5e29-6be8-7995-9bac1e37edd0.thor

c967e3dec6a04edc_076e35c0-5e29-6be8-c17b-b1e01c23e0de.thor

cf3ec07eb80c04ea_076e35c0-5e29-6be8-b785-997a3879053b.thor

12cdeeeb4e2188a5_076e35c0-5e29-6be8-4775-ef4251e83f7c.thor

12bc0d366d0e8cb7_076e35c0-5e29-6be8-52d3-dfdd7f2fd941.thor

8ec6e1bb326d73e0_076e35c0-5e29-6be8-6f18-9c04aacdb6de.thor

73295ba5613412b3_076e35c0-5e29-6be8-0ee4-8a86003ab17e.thor

d34aaebae4edc0f9_076e35c0-5e29-6be8-d4e0-6e8c4df27d1e.thor

7068370971ae527d_076e35c0-5e29-6be8-471a-59463d587e1a.thor

4eaa045381745f1b_076e35c0-5e29-6be8-d84d-e7846c0c0141.thor

07546f60e419c08a_076e35c0-5e29-6be8-671a-4ce7609c9bcf.thor

NRV_2I56240B_.js

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

ICMP requests

Behavior Summary

File-Read
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\wyvfgdruwx\bin\cert.p12
  • c:\Python27\include\methodobject.h
  • c:\Python27\include\object.h
  • c:\Python27\include\errcode.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\Lib\test\keycert3.pem
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\JNhPcPsiVulVWAT.txt
  • c:\Python27\include\intrcheck.h
  • c:\Python27\include\pyexpat.h
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\tupleobject.h
  • c:\Python27\include\pyconfig.h
  • c:\Python27\include\warnings.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\include\pyerrors.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\cobject.h
  • c:\Python27\include\floatobject.h
  • c:\Python27\include\Python-ast.h
  • c:\Python27\include\osdefs.h
  • c:\Python27\Lib\test\empty.vbs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • c:\Python27\include\pymacconfig.h
  • c:\Python27\include\funcobject.h
  • c:\Python27\include\ceval.h
  • c:\Python27\include\grammar.h
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\IHYcSIwYonDar.doc
  • \\?\PIPE\browser
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\structmember.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\Python27\include\pyarena.h
  • c:\Python27\include\pygetopt.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\include\ast.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\Python27\include\rangeobject.h
  • c:\Python27\include\pgenheaders.h
  • c:\Python27\include\pythread.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\Python27\include\patchlevel.h
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\include\iterobject.h
  • c:\Python27\include\pymem.h
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\Python27\include\structseq.h
  • c:\Python27\include\listobject.h
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\YjIDQLbLej.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • c:\Python27\include\frameobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • c:\Python27\include\longintrepr.h
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\dWrjtnxnSxfv.doc
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Python27\include\opcode.h
  • c:\Python27\include\parsetok.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • c:\Python27\Lib\test\badcert.pem
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1043\LocalizedData.xml
  • c:\Python27\include\pydebug.h
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\include\sliceobject.h
  • c:\Python27\include\pgen.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml
  • c:\Python27\include\moduleobject.h
  • c:\Python27\include\memoryobject.h
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • c:\Python27\include\objimpl.h
  • c:\Python27\include\Python.h
  • c:\Python27\include\fileobject.h
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\include\stringobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\Python27\include\token.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\Python27\include\bitset.h
  • c:\Python27\include\intobject.h
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\include\dictobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\Python27\include\abstract.h
  • c:\Python27\include\pystate.h
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\Python27\Lib\test\keycert.passwd.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • UNC\SHARDREALM\Users\Default\NTUSER.DAT.LOG
  • c:\Python27\include\descrobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • \\?\PIPE\wkssvc
  • c:\Python27\include\pymath.h
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\timefuncs.h
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\Python27\tcl\tclConfig.sh
  • c:\Python27\Lib\test\185test.db
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\Python27\include\ucnhash.h
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\test\keycert2.pem
  • c:\Python27\include\py_curses.h
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\include\pyport.h
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\symtable.h
  • c:\Python27\include\setobject.h
  • c:\Python27\include\boolobject.h
  • c:\Python27\Lib\test\pycacert.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\Python27\include\code.h
  • c:\Python27\include\dtoa.h
  • c:\Python27\include\graminit.h
  • c:\Python27\include\eval.h
  • c:\Python27\include\asdl.h
  • c:\Python27\include\cStringIO.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • c:\Python27\Lib\idlelib\idle.bat
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\Python27\include\complexobject.h
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\Python27\include\bytearrayobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • UNC\SHARDREALM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\Python27\include\node.h
  • c:\Python27\Lib\test\badkey.pem
  • UNC\SHARDREALM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\pyctype.h
  • c:\Python27\include\unicodeobject.h
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\xNDTPxSwKOQrMTxOnVbH.doc
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • c:\Python27\include\marshal.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\Python27\Lib\test\nokia.pem
  • c:\Python27\include\import.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • \\?\PIPE\lsarpc
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Python27\Lib\test\nullbytecert.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\Python27\Lib\test\dh1024.pem
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\aufnxtpFtyjemAde.docx
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\test\sha256.pem
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • c:\Python27\include\pycapsule.h
  • c:\Python27\include\modsupport.h
  • c:\Python27\include\enumobject.h
  • c:\Python27\include\classobject.h
  • c:\Python27\include\weakrefobject.h
  • c:\Python27\include\bufferobject.h
  • c:\Python27\include\datetime.h
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\Python27\include\cellobject.h
  • c:\Python27\include\metagrammar.h
  • c:\Python27\include\pyfpe.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • c:\Python27\include\compile.h
  • c:\Python27\include\genobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • c:\Python27\include\codecs.h
  • C:\Users\Harry Dresden\Desktop\desktop.ini
  • C:\Windows\System32\wshom.ocx
  • C:\Windows\System32\wscript.exe
  • C:\Windows\System32\msxml3.dll
  • C:\Users\Harry Dresden\AppData\Local\Temp\NRV_2I56240B_.js
File-Written
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • UNC\SHARDREALM\Users\Harry Dresden\Contacts\_11_WHAT_is.html
  • c:\wyvfgdruwx\bin\cert.p12
  • c:\Python27\include\methodobject.h
  • c:\Python27\include\object.h
  • UNC\SHARDREALM\Users\Public\Videos\Sample Videos\_10_WHAT_is.html
  • c:\Python27\include\errcode.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\Lib\test\keycert3.pem
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\JNhPcPsiVulVWAT.txt
  • c:\Python27\include\intrcheck.h
  • c:\Python27\include\pyexpat.h
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\tupleobject.h
  • c:\Python27\include\pyconfig.h
  • c:\Python27\Lib\idlelib\_30_WHAT_is.html
  • c:\Python27\include\warnings.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\include\pyerrors.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\cobject.h
  • c:\Python27\include\floatobject.h
  • c:\Python27\include\Python-ast.h
  • c:\Python27\include\osdefs.h
  • c:\Python27\Lib\test\empty.vbs
  • c:\wyvfgdruwx\bin\_2_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • c:\6cdeacda242012e0e5b593e657\1032\_27_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1037\_6_WHAT_is.html
  • c:\Python27\include\pymacconfig.h
  • c:\Python27\include\funcobject.h
  • c:\Python27\include\ceval.h
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\_2_WHAT_is.html
  • c:\Python27\include\grammar.h
  • c:\6cdeacda242012e0e5b593e657\1055\_17_WHAT_is.html
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\IHYcSIwYonDar.doc
  • \\?\PIPE\browser
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\structmember.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\Python27\include\pyarena.h
  • c:\Python27\include\pygetopt.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • UNC\SHARDREALM\Users\Default\_13_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\Python27\Lib\test\nullcert.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\_8_WHAT_is.html
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • c:\6cdeacda242012e0e5b593e657\3082\_20_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\include\ast.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • c:\ProgramData\WebEx\WebEx\12_1324\_21_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\_7_WHAT_is.html
  • c:\Python27\include\pythread.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\Python27\include\patchlevel.h
  • c:\Python27\include\bytearrayobject.h
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • c:\Python27\include\iterobject.h
  • c:\Python27\include\pymem.h
  • c:\Python27\Lib\test\_1_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\Python27\include\structseq.h
  • c:\6cdeacda242012e0e5b593e657\2052\_18_WHAT_is.html
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\YjIDQLbLej.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • c:\Python27\include\rangeobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1041\_9_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1036\_5_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\_1_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • c:\Python27\include\longintrepr.h
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\dWrjtnxnSxfv.doc
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Python27\include\opcode.h
  • c:\Python27\include\parsetok.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • c:\Python27\Lib\test\badcert.pem
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\_9_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1043\LocalizedData.xml
  • c:\Python27\include\frameobject.h
  • c:\Python27\include\pydebug.h
  • c:\6cdeacda242012e0e5b593e657\1053\_16_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\include\sliceobject.h
  • c:\Python27\include\pgen.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\include\moduleobject.h
  • c:\Python27\include\memoryobject.h
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • c:\Python27\include\objimpl.h
  • c:\Python27\include\Python.h
  • c:\Python27\include\fileobject.h
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\_0_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\include\stringobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\Python27\include\token.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\Python27\include\bitset.h
  • c:\Python27\include\intobject.h
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\include\dictobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\Python27\include\abstract.h
  • c:\Python27\include\pystate.h
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\Python27\Lib\test\keycert.passwd.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • c:\6cdeacda242012e0e5b593e657\1025\_22_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\_12_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • UNC\SHARDREALM\Users\Default\NTUSER.DAT.LOG
  • c:\6cdeacda242012e0e5b593e657\1042\_10_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • \\?\PIPE\wkssvc
  • c:\6cdeacda242012e0e5b593e657\1029\_24_WHAT_is.html
  • c:\Python27\include\pymath.h
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • c:\6cdeacda242012e0e5b593e657\1031\_26_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\pgenheaders.h
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\6cdeacda242012e0e5b593e657\1030\_25_WHAT_is.html
  • c:\Python27\tcl\tclConfig.sh
  • c:\6cdeacda242012e0e5b593e657\1046\_14_WHAT_is.html
  • c:\Python27\Lib\test\185test.db
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1035\_4_WHAT_is.html
  • c:\Python27\include\ucnhash.h
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\test\keycert2.pem
  • c:\Python27\include\py_curses.h
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\include\pyport.h
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml
  • c:\Python27\include\listobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\symtable.h
  • c:\Python27\include\setobject.h
  • c:\Python27\tcl\tix8.4.3\pref\_29_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1040\_8_WHAT_is.html
  • c:\Python27\include\boolobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\_3_WHAT_is.html
  • c:\Python27\Lib\test\pycacert.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\Python27\include\code.h
  • c:\Python27\include\dtoa.h
  • c:\Python27\include\graminit.h
  • c:\Python27\include\eval.h
  • c:\Python27\include\asdl.h
  • c:\Python27\include\cStringIO.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • c:\Python27\Lib\idlelib\idle.bat
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\_0_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • c:\Python27\include\_3_WHAT_is.html
  • c:\Python27\include\timefuncs.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • c:\6cdeacda242012e0e5b593e657\1043\_11_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\_5_WHAT_is.html
  • c:\Python27\include\modsupport.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\_6_WHAT_is.html
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • UNC\SHARDREALM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\Python27\include\node.h
  • c:\Python27\Lib\test\badkey.pem
  • UNC\SHARDREALM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\pyctype.h
  • c:\Python27\include\unicodeobject.h
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\xNDTPxSwKOQrMTxOnVbH.doc
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • c:\Python27\include\marshal.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\Python27\Lib\test\nokia.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\_4_WHAT_is.html
  • c:\Python27\include\import.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • \\?\PIPE\lsarpc
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\6cdeacda242012e0e5b593e657\1044\_12_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1045\_13_WHAT_is.html
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Python27\Lib\test\nullbytecert.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\Python27\Lib\test\dh1024.pem
  • c:\Python27\tcl\_31_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\aufnxtpFtyjemAde.docx
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\test\sha256.pem
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • c:\Python27\include\complexobject.h
  • c:\Python27\include\pycapsule.h
  • c:\Python27\include\pyfpe.h
  • c:\Python27\include\enumobject.h
  • c:\Python27\include\descrobject.h
  • c:\Python27\include\classobject.h
  • c:\6cdeacda242012e0e5b593e657\1033\_28_WHAT_is.html
  • c:\Python27\include\weakrefobject.h
  • c:\Python27\include\bufferobject.h
  • c:\Python27\include\datetime.h
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\Python27\include\cellobject.h
  • c:\Python27\include\metagrammar.h
  • c:\6cdeacda242012e0e5b593e657\1049\_15_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • c:\Python27\include\compile.h
  • c:\Python27\include\genobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • c:\Python27\include\codecs.h
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YLC2QM2Y\hbdo6[1]
  • C:\Users\Harry Dresden\AppData\Local\Temp\eU6et0ckLJA.dll
  • C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Windows\Cookies\M1JPGL32.txt
File-Deleted
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000000.db
File-Opened
  • c:\Python27\include\frameobject.h
  • c:\Python27\include\pyexpat.h
  • c:\Python27\Lib\ctypes
  • UNC\SHARDREALM\Users\Harry Dresden\Documents
  • c:\Users\Default\Links
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages
  • c:\Python27\include\pymacconfig.h
  • c:\Python27\include\ast.h
  • c:\Python27\include\memoryobject.h
  • c:\Python27\Lib\site-packages\pip\_vendor\colorama
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources
  • c:\Python27\DLLs
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol
  • c:\Python27\include\tupleobject.h
  • UNC\SHARDREALM\Users\Harry Dresden\Favorites\Links for United States
  • c:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\ProgramData\Adobe\Setup
  • c:\wyvfgdruwx\lib\core
  • c:\Python27\Lib\test\empty.vbs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\en-US
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages
  • UNC\SHARDREALM\Users\Harry Dresden\OneDrive
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Users\Harry Dresden\OneDrive
  • c:\Python27\include\grammar.h
  • c:\ProgramData\Microsoft\PlayReady\Cache\S-1-5-21-3416602863-1947377224-293699093-1001
  • c:\Python27\include\import.h
  • c:\Users\Public\Libraries
  • \\?\PIPE\browser
  • c:\Python27\Lib\test\tracedmodules
  • c:\ProgramData\Adobe\ARM
  • c:\Python27\tcl\tcl8.5\tzdata\Indian
  • c:\Users\Public
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Queue
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource
  • c:\Python27\Lib
  • \??\VBoxMiniRdrDN
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • c:\ProgramData
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\Python27\Lib\site-packages\pip
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A6
  • c:\Python27\Lib\ctypes\macholib
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\Security
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\inetpub\history\CFGHISTORY_0000000004\schema
  • c:\Python27\Lib\unittest\test
  • c:\ProgramData\Microsoft\PlayReady
  • c:\Python27\Lib\xml\dom
  • c:\wyvfgdruwx\modules\packages
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00
  • c:\Python27\Lib\site-packages\pip\models
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • c:\Python27\include\marshal.h
  • UNC\SHARDREALM\Users\Public\Foxit Software
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate
  • c:\Python27\Tools\i18n
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\Python27\tcl\tcl8\8.4
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog
  • c:\ProgramData\Microsoft\Crypto\Keys
  • UNC\SHARDREALM\Users\Public\Music\Sample Music
  • c:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319
  • c:\Python27\Lib\ctypes\test
  • c:\Users\Harry Dresden\Searches
  • c:\Python27\Lib\test\badcert.pem
  • c:\ProgramData\Adobe\ARM\S
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • c:\Python27\Lib\ensurepip
  • c:\Python27\include\pgen.h
  • UNC\SHARDREALM\Users
  • c:\Python27\tcl\tcl8.5\tzdata\Canada
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\Users\Harry Dresden\Downloads
  • c:\Python27\include\objimpl.h
  • c:\ProgramData\Microsoft\eHome
  • c:\Python27\tcl\tk8.5\demos\images
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images
  • c:\Python27\Lib\test\cjkencodings
  • c:\inetpub\wwwroot\aspnet_client\system_web
  • UNC\SHARDREALM\Users\Public\Music
  • c:\Python27\tcl\tcl8.5\tzdata\America\Kentucky
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US
  • c:\Python27\include\abstract.h
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\keycert.passwd.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • c:\wyvfgdruwx
  • c:\Python27\include\object.h
  • c:\Python27\tcl\tix8.4.3
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • c:\ProgramData\Microsoft\RAC\PublishedData
  • UNC\SHARDREALM\Users\Harry Dresden\Links
  • c:\inetpub\history\CFGHISTORY_0000000005
  • c:\inetpub\history\CFGHISTORY_0000000004
  • c:\inetpub\history\CFGHISTORY_0000000001
  • c:\Python27\include\pydebug.h
  • c:\inetpub\history\CFGHISTORY_0000000003
  • c:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204
  • c:\Users\Harry Dresden\Favorites\Links for United States
  • c:\Python27\Lib\lib2to3\tests\data\fixers
  • c:\Python27\tcl\tcl8.5\tzdata\US
  • c:\Python27\tcl\tcl8.5\tzdata
  • UNC\SHARDREALM\Users\Public\Videos
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\Python27\include\pyport.h
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • UNC\SHARDREALM\Users\Public\Documents
  • c:\Python27\Lib\email
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\tcl\tix8.4.3\demos\samples
  • c:\Python27\Lib\lib-tk\test\test_tkinter
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • UNC\SHARDREALM\Users\Harry Dresden\Music
  • c:\Python27\Tools\webchecker
  • c:\Python27\tcl\tcl8.5\tzdata\America\North_Dakota
  • c:\Python27\Lib\test\crashers
  • c:\ProgramData\Microsoft\Windows Defender\LocalCopy
  • c:\Python27\include\dtoa.h
  • c:\Python27\include\asdl.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • c:\Users\Harry Dresden\Contacts
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0
  • c:\PerfLogs
  • UNC\SHARDREALM\Users\Public\Libraries
  • c:\
  • c:\Python27\include\complexobject.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders
  • c:\Python27\tcl\tcl8\8.5
  • UNC\SHARDREALM\Users\Default\Desktop
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • c:\Python27\libs
  • c:\ProgramData\Microsoft\ClickToRun\MachineData
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • UNC\SHARDREALM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • c:\ProgramData\Microsoft\Assistance
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\pyctype.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results
  • c:\Users\Harry Dresden\Videos
  • c:\Python27\Lib\pydoc_data
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • UNC\SHARDREALM\Users\Default\Music
  • c:\ProgramData\Microsoft\Crypto\DSS
  • c:\ProgramData\Adobe\Acrobat
  • c:\Python27\tcl\tcl8.5\tzdata\Atlantic
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0
  • c:\ProgramData\Microsoft\Network
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger
  • c:\Users\Default\Downloads
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • c:\Python27\Lib\xml
  • c:\Python27\tcl\tcl8.5\tzdata\Australia
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17
  • c:\Python27\include\fileobject.h
  • c:\Python27\tcl\tk8.5
  • c:\ProgramData\Microsoft\PlayReady\Cache
  • c:\6cdeacda242012e0e5b593e657\3082
  • c:\Python27\Lib\site-packages\pip\compat
  • c:\Python27\Lib\test\leakers
  • c:\Python27\tcl\tcl8\8.4\platform
  • c:\Python27\include\modsupport.h
  • c:\ProgramData\regid.1991-06.com.microsoft
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\filters
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\x-none.16
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\DD
  • c:\Python27\Tools\pynche\X
  • c:\Python27\include\bufferobject.h
  • c:\Python27\Tools\Scripts
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\35
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore
  • c:\Python27\Lib\test\nokia.pem
  • c:\Python27\include\compile.h
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • C:\Users\Harry Dresden\AppData\Local\Temp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\tcl\tk8.5\images
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\ProgramData\Microsoft\DRM
  • UNC\SHARDREALM\Users\Harry Dresden\Videos
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US
  • c:\Python27\Lib\idlelib\idle_test
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\include
  • c:\Python27\Lib\test\nullcert.pem
  • c:\Python27\Lib\site-packages\setuptools
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\cobject.h
  • c:\6cdeacda242012e0e5b593e657\1029
  • c:\6cdeacda242012e0e5b593e657\1028
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}
  • c:\Python27\Lib\site-packages\pip\commands
  • c:\Python27\Lib\lib2to3\tests\data\fixers\myfixes
  • c:\6cdeacda242012e0e5b593e657\1025
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us
  • c:\ProgramData\Adobe\ARM\S\5521
  • c:\Python27\Lib\email\test\data
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\IHYcSIwYonDar.doc
  • c:\ProgramData\Microsoft\Windows Defender\Support
  • c:\ProgramData\WebEx\WebEx
  • c:\6cdeacda242012e0e5b593e657\2052
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • UNC\SHARDREALM\Users\Default\Saved Games
  • c:\Python27\tcl\tcl8.5\opt0.4
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases
  • c:\Python27\include\pgenheaders.h
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US
  • c:\Python27\tcl\tcl8.5\encoding
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs
  • c:\Python27\Lib\msilib
  • c:\ProgramData\Microsoft\WwanSvc\Profiles
  • UNC\SHARDREALM\Users\Harry Dresden\Contacts
  • c:\Python27\Lib\encodings
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\_backport
  • c:\ProgramData\Microsoft\Assistance\Client
  • UNC\SHARDREALM\Users\Default\Pictures
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\95
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • c:\Python27\Lib\site-packages\_markerlib
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\YjIDQLbLej.rtf
  • c:\ProgramData\Microsoft\Diagnosis\LocalTraceStore
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • c:\inetpub\custerr
  • c:\Python27\include\longintrepr.h
  • c:\inetpub\custerr\en-US
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches
  • c:\Python27\Lib\test\185test.db
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\dWrjtnxnSxfv.doc
  • c:\Python27\include\opcode.h
  • c:\ProgramData\Microsoft\Crypto\RSA
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tk8.5\ttk
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\01
  • c:\Users\Default\Favorites
  • c:\inetpub\history
  • c:\Python27\include\moduleobject.h
  • c:\ProgramData\Microsoft\Windows NT
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\chardet
  • c:\ProgramData\Microsoft\Vault
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData
  • UNC\SHARDREALM\Users\Harry Dresden\Pictures
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\Python27\include\boolobject.h
  • C:\Windows\SysWOW64\en-US\VssTrace.DLL.mui
  • c:\Python27\include\token.h
  • UNC\SHARDREALM\Users\Default\Videos
  • c:\Python27\include\bitset.h
  • c:\Python27\include\warnings.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages
  • UNC\SHARDREALM\Users\Harry Dresden
  • c:\ProgramData\Mozilla\logs
  • c:\ProgramData\Microsoft\Search\Data\Applications
  • c:\Python27\include\pycapsule.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\70
  • c:\Python27\tcl\tcl8.5\tzdata\Mexico
  • c:\Python27\Lib\importlib
  • c:\ProgramData\Microsoft\Crypto
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\media
  • c:\Python27\tcl\tcl8.5
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\Python27\tcl\tcl8.5\tzdata\Africa
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\ProgramData\McAfee
  • c:\Python27\include\enumobject.h
  • c:\Python27\Lib\site-packages\pip\vcs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\bsddb\test
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43
  • c:\Python27\Lib\test\keycert2.pem
  • UNC\SHARDREALM\Users\Public\Recorded TV
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F7
  • c:\Python27\include\ucnhash.h
  • c:\Python27\include\py_curses.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3
  • c:\Python27\Lib\xml\parsers
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\keycert4.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • c:\Python27\tcl\tcl8.5\msgs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Inbox
  • c:\Users\Harry Dresden
  • UNC\SHARDREALM\Users\Public\Recorded TV\Sample Media
  • c:\Python27\include\node.h
  • c:\ProgramData\McAfee\MCLOGS\Common\jxpiinstall
  • c:\ProgramData\Microsoft\Windows Defender\Quarantine
  • c:\Users\Public\Favorites
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor
  • c:\wyvfgdruwx\lib\common
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\ProgramData\Microsoft\Office
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • UNC\SHARDREALM\Users\Public
  • c:\ProgramData\NovaTech Network\NovaBench
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • c:\Python27\Lib\site-packages\pip\_vendor\_markerlib
  • c:\Python27\tcl\reg1.2
  • c:\Users\ruiner
  • c:\Python27\Lib\xml\etree
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • c:\ProgramData\Microsoft\Media Player
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl
  • c:\Users\Public\Videos\Sample Videos
  • UNC\SHARDREALM\Users\Harry Dresden\Favorites
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01
  • c:\Python27\include\symtable.h
  • c:\Python27\include\cStringIO.h
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • c:\Python27\tcl\tcl8.5\tzdata\Antarctica
  • c:\Python27\Lib\xml\sax
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\trie
  • c:\Users\Harry Dresden\Desktop
  • c:\Users\Public\Recorded TV
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • c:\ProgramData\Microsoft\Office\Heartbeat
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\42
  • c:\Python27\tcl\tcl8.5\tzdata\Etc
  • c:\Python27\Lib\bsddb
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\47
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups
  • c:\Python27\Lib\wsgiref
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\contrib
  • c:\Python27\include\pyfpe.h
  • c:\ProgramData\Microsoft\User Account Pictures
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • c:\ProgramData\Sun\Java\Java Update
  • c:\Python27\Lib\test\sha256.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • c:\Users
  • c:\Users\Default\Saved Games
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources
  • c:\inetpub\history\CFGHISTORY_0000000005\schema
  • c:\Python27\include\datetime.h
  • c:\inetpub
  • c:\Users\Default
  • c:\Python27\tcl\tcl8.5\tzdata\Pacific
  • c:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog
  • c:\Python27\tcl\tk8.5\msgs
  • c:\Python27\tcl\tcl8.5\tzdata\America
  • c:\ProgramData\Microsoft\Diagnosis\DownloadedSettings
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\{98101498-C465-4F51-8751-D1919E97D29D}
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader
  • c:\Python27\Lib\multiprocessing\dummy
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}
  • c:\ProgramData\Microsoft\MF
  • c:\Python27\include\errcode.h
  • c:\Python27\Lib\test
  • c:\Python27\Lib\test\keycert3.pem
  • c:\Users\Public\Downloads
  • c:\Python27\Lib\site-packages
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage
  • c:\ProgramData\Microsoft\Device Stage\Task
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\include\pyerrors.h
  • c:\Python27\Lib\unittest
  • c:\6cdeacda242012e0e5b593e657\Graphics
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}
  • c:\Python27\Lib\test\capath
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • c:\Recovery
  • c:\ProgramData\Microsoft\Device Stage
  • c:\Python27\tcl\tk8.5\demos
  • c:\Python27\include\ceval.h
  • c:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18
  • UNC\SHARDREALM\Users\Public\Desktop
  • c:\ProgramData\Microsoft\Assistance\Client\1.0
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\structmember.h
  • c:\ProgramData\Oracle
  • c:\Python27\include\pygetopt.h
  • c:\Python27\Lib\distutils\tests
  • c:\Python27\include\codecs.h
  • c:\Python27\Lib\logging
  • c:\ProgramData\Microsoft\RAC
  • c:\Python27\Lib\site-packages\pip\req
  • c:\Users\Harry Dresden\Links
  • c:\ProgramData\Microsoft\DeviceSync
  • c:\Python27\Doc
  • c:\Users\Public\Pictures
  • c:\Python27\tcl\tix8.4.3\demos\bitmaps
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\Python27\Lib\site-packages\pip\_vendor\requests
  • c:\Python27\include\patchlevel.h
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\Lib\compiler
  • c:\Python27\Scripts
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\42
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\17
  • c:\Users\Public\Recorded TV\Sample Media
  • c:\Python27\include\structseq.h
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • c:\Python27\tcl\dde1.3
  • c:\Python27\tcl\tcl8.5\tzdata\SystemV
  • c:\ProgramData\NovaTech Network
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • \\?\PIPE\lsarpc
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • UNC\SHARDREALM\Users\ruiner
  • c:\ProgramData\Sun\Java
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js
  • c:\ProgramData\Microsoft\Diagnosis\AsimovUploader
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml
  • c:\Python27\tcl\tcl8.5\tzdata\Chile
  • c:\ProgramData\Microsoft\ClickToRun\UserData
  • c:\Python27\Lib\test\xmltestdata
  • c:\ProgramData\Microsoft\WPD
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • c:\Python27\Lib\site-packages\pip\_vendor
  • c:\ProgramData\Sun
  • c:\Python27\include\Python.h
  • UNC\SHARDREALM\Users\Default\Documents
  • c:\Python27\tcl\tclConfig.sh
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\Python27\include\metagrammar.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\pystate.h
  • c:\Users\Default\Desktop
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
  • c:\ProgramData\Microsoft\WwanSvc
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • \\?\PIPE\wkssvc
  • c:\ProgramData\Microsoft\Event Viewer\Views
  • c:\Python27\Lib\json\tests
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\serializer
  • c:\Python27\include\osdefs.h
  • c:\Python27\Tools
  • c:\Python27\include\timefuncs.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css
  • c:\ProgramData\Microsoft\IlsCache
  • c:\Python27\Lib\lib-tk
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Store
  • c:\ProgramData\Microsoft\Windows NT\MSFax\SentItems
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • c:\wyvfgdruwx\modules
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\en-us.16
  • c:\Python27\Lib\site-packages\pip\operations
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox
  • c:\Python27\Lib\site-packages\pip\_vendor\lockfile
  • c:\Python27\Lib\curses
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\floatobject.h
  • UNC\SHARDREALM\Users\Default\NTUSER.DAT.LOG
  • c:\Python27\Lib\test\pycacert.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\Python27\include\pymactoolbox.h
  • c:\Python27\Lib\test\badkey.pem
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • c:\Users\Default\Music
  • c:\Python27\Lib\email\mime
  • c:\Users\Harry Dresden\Music
  • c:\wyvfgdruwx\bin
  • c:\6cdeacda242012e0e5b593e657\1053
  • c:\6cdeacda242012e0e5b593e657\1055
  • UNC\SHARDREALM\Users\Public\Favorites
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3
  • c:\Python27\tcl\tcl8.5\tzdata\Asia
  • UNC\SHARDREALM\Users\Public\Downloads
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css
  • c:\Python27\Lib\multiprocessing
  • c:\Users\Default\Documents
  • UNC\SHARDREALM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\Python27\Tools\pynche
  • c:\Users\Public\Desktop
  • c:\ProgramData\Microsoft\User Account Pictures\Default Pictures
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • c:\Python27\Lib\lib-tk\test\test_ttk
  • c:\Users\Harry Dresden\Documents
  • c:\Python27\include\sysmodule.h
  • c:\ProgramData\McAfee\MCLOGS\Common
  • UNC\SHARDREALM\Users\Harry Dresden\Favorites\Links
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • c:\ProgramData\Microsoft\IdentityCRL
  • c:\ProgramData\WebEx\WebEx\12_1324
  • c:\Python27\Lib\site-packages\pip\utils
  • c:\Python27\Lib\distutils\command
  • c:\Users\Harry Dresden\Saved Games
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • UNC\SHARDREALM\Users\Default
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml
  • c:\Python27\include\pyarena.h
  • c:\ProgramData\Microsoft\Windows Defender
  • c:\Python27\include\eval.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • c:\Python27
  • c:\Python27\Lib\hotshot
  • c:\wyvfgdruwx\modules\auxiliary
  • c:\Python27\include\genobject.h
  • c:\inetpub\wwwroot
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\Python27\Tools\versioncheck
  • c:\wyvfgdruwx\bin\cert.p12
  • c:\Python27\tcl\tcl8.5\tzdata\Arctic
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F7
  • c:\Users\Public\Music
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3
  • c:\Python27\Lib\test\audiodata
  • c:\wyvfgdruwx\lib
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\JNhPcPsiVulVWAT.txt
  • c:\Python27\include\intrcheck.h
  • c:\ProgramData\Microsoft\Network\Connections
  • c:\Python27\Lib\sqlite3
  • c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
  • UNC\SHARDREALM\Users\Public\Pictures
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\43
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js
  • UNC\SHARDREALM\Users\Default\Downloads
  • UNC\SHARDREALM\Users\Default\Links
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\ProgramData\Microsoft\Diagnosis
  • c:\Python27\Lib\distutils
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\tests
  • c:\Python27\Lib\idlelib\Icons
  • c:\ProgramData\Microsoft\Device Stage\Device
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib
  • c:\Python27\Lib\test\subprocessdata
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\35
  • c:\Python27\include\pymem.h
  • c:\inetpub\wwwroot\aspnet_client
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\ProgramData\Microsoft\Network\Downloader
  • c:\Users\Public\Foxit Software
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Quick
  • c:\ProgramData\Microsoft\Windows NT\MSScan
  • c:\Python27\Lib\lib2to3\tests
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\ProgramData\Microsoft OneDrive\setup
  • c:\ProgramData\Microsoft\Crypto\DSS\MachineKeys
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\Lib\site-packages\pkg_resources
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info
  • c:\Python27\include\Python-ast.h
  • c:\Python27\include\rangeobject.h
  • c:\Python27\tcl\tcl8.5\tzdata\Brazil
  • c:\Users\Harry Dresden\Favorites\Links
  • c:\Python27\Lib\test\imghdrdata
  • c:\wyvfgdruwx\lib\api
  • c:\Python27\include\iterobject.h
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates
  • UNC\SHARDREALM\Users\Harry Dresden\Saved Games
  • c:\ProgramData\Microsoft\RAC\Outbound
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • c:\inetpub\history\CFGHISTORY_0000000002
  • c:\Python27\include\funcobject.h
  • c:\Python27\include\listobject.h
  • c:\ProgramData\Microsoft\NetFramework
  • c:\ProgramData\Adobe\ARM\Reader_11.0.10
  • c:\ProgramData\Microsoft
  • c:\Users\Public\Pictures\Sample Pictures
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Service
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\xNDTPxSwKOQrMTxOnVbH.doc
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\Users\Default\Videos
  • c:\ProgramData\Microsoft\Search\Data
  • c:\Python27\tcl
  • c:\Python27\Lib\json
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US
  • c:\Python27\include\pythread.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement
  • c:\Python27\Lib\lib2to3\fixes
  • c:\Python27\tcl\tix8.4.3\bitmaps
  • c:\Python27\Lib\site-packages\setuptools\command
  • c:\6cdeacda242012e0e5b593e657
  • c:\6cdeacda242012e0e5b593e657\1043\LocalizedData.xml
  • c:\Python27\tcl\tcl8.5\tzdata\America\Indiana
  • c:\6cdeacda242012e0e5b593e657\2070
  • c:\Python27\include\sliceobject.h
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Users\Public\Videos
  • c:\Python27\Lib\test\decimaltestdata
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\DD
  • c:\Python27\include\descrobject.h
  • c:\ProgramData\Microsoft\Diagnosis\UIF
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A6
  • c:\Python27\tcl\tcl8.5\tzdata\Europe
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5
  • c:\Python27\include\stringobject.h
  • c:\Python27\Lib\lib2to3
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default
  • c:\Python27\include\intobject.h
  • c:\ProgramData\Microsoft\Event Viewer
  • c:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\ProgramData\Microsoft\ClickToRun
  • c:\Python27\tcl\tix8.4.3\pref
  • c:\Python27\include\methodobject.h
  • c:\Python27\include\pyconfig.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • UNC\SHARDREALM\Users\Default\Favorites
  • c:\Python27\tcl\tcl8.5\http1.0
  • c:\Python27\include\pymath.h
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\parsetok.h
  • c:\ProgramData\Adobe\Acrobat\11.0
  • c:\Python27\Lib\ensurepip\_bundled
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\Python27\include\classobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • c:\Users\Public\Music\Sample Music
  • c:\Python27\tcl\tcl8
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager
  • c:\Python27\Lib\lib2to3\tests\data
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70
  • c:\ProgramData\Microsoft OneDrive
  • UNC\SHARDREALM\Users\Harry Dresden\Searches
  • c:\Python27\tcl\tcl8.5\tzdata\America\Argentina
  • c:\Python27\include\setobject.h
  • c:\Recovery\015e7760-d44b-11e0-8947-954f09601788
  • c:\Python27\Lib\idlelib
  • c:\PerfLogs\Admin
  • c:\Python27\include\graminit.h
  • c:\Python27\Lib\site-packages\pip\_vendor\progress
  • c:\Users\Harry Dresden\Pictures
  • c:\ProgramData\Microsoft\Diagnosis\Sideload
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\ssl_match_hostname
  • c:\Users\Harry Dresden\Favorites
  • c:\ProgramData\Passmark
  • c:\Python27\Lib\lib-tk\test
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • c:\ProgramData\Adobe
  • c:\Users\Public\Foxit Software\Foxit Reader
  • c:\ProgramData\Microsoft\Search
  • c:\ProgramData\Passmark\PerformanceTest
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • UNC\SHARDREALM\Users\Public\Videos\Sample Videos
  • c:\Python27\include\bytearrayobject.h
  • c:\ProgramData\Microsoft\NetFramework\BreadcrumbStore
  • c:\Python27\Lib\email\test
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}
  • c:\ProgramData\WebEx
  • c:\inetpub\wwwroot\msmq
  • c:\Python27\tcl\tix8.4.3\demos
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\include\dictobject.h
  • c:\Python27\include\unicodeobject.h
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\packaging
  • c:\ProgramData\McAfee\MCLOGS
  • c:\Users\Default\Pictures
  • c:\6cdeacda242012e0e5b593e657\1049
  • c:\Users\Public\Documents
  • c:\6cdeacda242012e0e5b593e657\1046
  • c:\6cdeacda242012e0e5b593e657\1045
  • c:\6cdeacda242012e0e5b593e657\1044
  • c:\6cdeacda242012e0e5b593e657\1043
  • c:\6cdeacda242012e0e5b593e657\1042
  • c:\6cdeacda242012e0e5b593e657\1041
  • c:\6cdeacda242012e0e5b593e657\1040
  • c:\Python27\Lib\site-packages\pip\_vendor\packaging
  • c:\ProgramData\Microsoft\eHome\logs
  • c:\ProgramData\Microsoft\Windows Defender\Scans
  • c:\ProgramData\Microsoft\Windows NT\MSFax
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\Python27\Lib\sqlite3\test
  • c:\Python27\Lib\test\dh1024.pem
  • c:\ProgramData\Mozilla
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\aufnxtpFtyjemAde.docx
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates
  • c:\Python27\include\weakrefobject.h
  • c:\Python27\Lib\lib2to3\pgen2
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History
  • c:\Python27\Lib\idlelib\idle.bat
  • c:\Python27\include\code.h
  • c:\Python27\include\cellobject.h
  • c:\ProgramData\Microsoft\RAC\StateData
  • c:\6cdeacda242012e0e5b593e657\1038
  • c:\ProgramData\Microsoft\DRM\Server
  • c:\6cdeacda242012e0e5b593e657\1032
  • c:\6cdeacda242012e0e5b593e657\1033
  • c:\6cdeacda242012e0e5b593e657\1030
  • c:\6cdeacda242012e0e5b593e657\1031
  • c:\6cdeacda242012e0e5b593e657\1036
  • c:\6cdeacda242012e0e5b593e657\1037
  • c:\6cdeacda242012e0e5b593e657\1035
  • C:\Windows\System32\wshqos.dll
  • C:\Windows\System32\wshom.ocx
  • C:\
  • C:\Windows\Globalization\Sorting\sortdefault.nls
  • C:\Users\
  • C:\Users\Harry Dresden\
  • C:\Users\Harry Dresden\AppData\
  • C:\Users\Harry Dresden\AppData\Local\
  • C:\Windows\
  • C:\Windows\System32\en-US\wshqos.dll.mui
  • C:\Users\Harry Dresden\Desktop\desktop.ini
  • C:\Windows\System32\en-US\wshtcpip.dll.mui
  • C:\Windows\SysWOW64\rundll32.exe
  • C:\Windows\System32\rsaenh.dll
  • C:\Windows\System32\msxml3.dll
  • C:\Windows\System32\en-US\wship6.dll.mui
  • C:\Windows\System32\wscript.exe
  • C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Windows\Cookies\M1JPGL32.txt
  • C:\Windows\SysWOW64\
  • C:\Users\Harry Dresden\AppData\Local\Temp\NRV_2I56240B_.js
File-Moved
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1040\076E35C0-5E29-6BE8-1D54-BCC0D370C1C2.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-F143-644E10487709.thor
  • c:\Python27\Lib\test\dh1024.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-24AA-4C9CFBBEA6EE.thor
  • c:\Python27\include\symtable.h -> c:\Python27\include\076E35C0-5E29-6BE8-0C2D-42385FC8097C.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-5283-1ECE7EED45F4.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-0D15-9029BCF15EFF.thor
  • c:\Python27\include\complexobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-DC23-B221E3C650AA.thor
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1046\076E35C0-5E29-6BE8-6902-515D2789ECAD.thor
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1049\076E35C0-5E29-6BE8-5ED9-7BEFAB175C42.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\076E35C0-5E29-6BE8-D649-93A606341848.thor
  • c:\Python27\include\pymacconfig.h -> c:\Python27\include\076E35C0-5E29-6BE8-1864-E467CB20A701.thor
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1031\076E35C0-5E29-6BE8-C7DC-5A63FAAC1153.thor
  • c:\Python27\include\pyfpe.h -> c:\Python27\include\076E35C0-5E29-6BE8-6A6C-1410FD4C5FDD.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-A4B1-3E68FCDC9BF0.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\076E35C0-5E29-6BE8-5C6D-E9BB89B55B2A.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-A358-6EAD1E49E6D9.thor
  • c:\Python27\Lib\idlelib\idle.bat -> c:\Python27\Lib\idlelib\076E35C0-5E29-6BE8-5C2C-C483139D2B62.thor
  • c:\Python27\include\structmember.h -> c:\Python27\include\076E35C0-5E29-6BE8-4B53-BBAAA09DF0D4.thor
  • c:\Python27\include\opcode.h -> c:\Python27\include\076E35C0-5E29-6BE8-CFB4-7F46F53F94CA.thor
  • c:\Python27\include\sliceobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-B64E-A7290B6E9354.thor
  • c:\Python27\include\enumobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-A055-77B232528B0E.thor
  • c:\Python27\include\setobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-4EF2-92A89CFCDCEB.thor
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs -> c:\Python27\tcl\tix8.4.3\pref\076E35C0-5E29-6BE8-31F1-AEA22C4E0A43.thor
  • c:\Python27\include\pystate.h -> c:\Python27\include\076E35C0-5E29-6BE8-28C2-1AE7E33979BA.thor
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1045\076E35C0-5E29-6BE8-FA7B-BCBA32CCE2BF.thor
  • c:\Python27\include\fileobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-4775-EF4251E83F7C.thor
  • c:\Python27\include\structseq.h -> c:\Python27\include\076E35C0-5E29-6BE8-6DD8-9346F3ECBD62.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-6EF1-ED8AE144A6A7.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-88D7-AD4D06796014.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\076E35C0-5E29-6BE8-1496-BFD8CBC09470.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-CB28-E715D403C205.thor
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf -> c:\6cdeacda242012e0e5b593e657\3082\076E35C0-5E29-6BE8-FDAD-242C9A32AC24.thor
  • \\SHARDREALM\Users\Harry Dresden\Contacts\Harry Dresden.contact -> \\SHARDREALM\Users\Harry Dresden\Contacts\076E35C0-5E29-6BE8-7A5A-C93A76807C36.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\076E35C0-5E29-6BE8-8EC9-3646AF8D1AAD.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-62BE-6AA3B3446105.thor
  • c:\Python27\Lib\test\empty.vbs -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-FB33-0F9888AC53ED.thor
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf -> c:\6cdeacda242012e0e5b593e657\2052\076E35C0-5E29-6BE8-0EE4-8A86003AB17E.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\076E35C0-5E29-6BE8-EDEC-30461AE625C7.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\076E35C0-5E29-6BE8-5112-5C1D4BB35526.thor
  • c:\Python27\Lib\test\185test.db -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-C6A4-DD308A78F5C1.thor
  • c:\Python27\include\bytes_methods.h -> c:\Python27\include\076E35C0-5E29-6BE8-E211-CB64943FEAC8.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\076E35C0-5E29-6BE8-6174-F21E3FB9663F.thor
  • c:\Python27\include\pyctype.h -> c:\Python27\include\076E35C0-5E29-6BE8-5787-96D5C9BCDFD8.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-ECCD-019DDB2A4FF1.thor
  • c:\Python27\include\errcode.h -> c:\Python27\include\076E35C0-5E29-6BE8-F55D-FAE2E4B26355.thor
  • c:\Python27\include\ucnhash.h -> c:\Python27\include\076E35C0-5E29-6BE8-6B71-047217566A84.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\076E35C0-5E29-6BE8-C866-44566FEBDDEC.thor
  • c:\Python27\include\modsupport.h -> c:\Python27\include\076E35C0-5E29-6BE8-2532-7C763AAF6763.thor
  • c:\Python27\Lib\test\keycert3.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-A3A5-6B315513F7F1.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-2DF1-1ED0E7DC37DD.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-4016-4526B2444C8B.thor
  • c:\Python27\include\eval.h -> c:\Python27\include\076E35C0-5E29-6BE8-D8D4-A1A7D623A706.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\076E35C0-5E29-6BE8-4AD8-DD7CC1F67A42.thor
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1041\076E35C0-5E29-6BE8-B950-1F21BCA07EC6.thor
  • c:\Python27\include\sysmodule.h -> c:\Python27\include\076E35C0-5E29-6BE8-7995-9BAC1E37EDD0.thor
  • c:\Python27\include\moduleobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-DAF3-C9165B6B325E.thor
  • c:\Python27\include\pythread.h -> c:\Python27\include\076E35C0-5E29-6BE8-6AA8-68B2AA4398DD.thor
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1030\076E35C0-5E29-6BE8-B79F-68CFA643C0EF.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-4EED-4651AD28DC4B.thor
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1038\076E35C0-5E29-6BE8-A7D9-DDA4D851B153.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-9E0F-C835888AEE8A.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\076E35C0-5E29-6BE8-6F1E-60E110A8E6F7.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-C3E3-0C6143AA3319.thor
  • c:\Python27\include\bytearrayobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-2A0D-D317CAECCD53.thor
  • c:\Python27\Lib\test\nullbytecert.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-FF5A-60AB31288475.thor
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1025\076E35C0-5E29-6BE8-471A-59463D587E1A.thor
  • c:\Python27\include\dtoa.h -> c:\Python27\include\076E35C0-5E29-6BE8-56C2-32D867195C98.thor
  • c:\Python27\include\bytesobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-0252-6C9162C7F3E3.thor
  • c:\Python27\include\Python.h -> c:\Python27\include\076E35C0-5E29-6BE8-7529-8BEA42671DB0.thor
  • c:\Python27\include\timefuncs.h -> c:\Python27\include\076E35C0-5E29-6BE8-0E72-6FBC93655F48.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-A032-D0B5008B5159.thor
  • c:\Python27\include\bufferobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-54BA-D5149012B7CA.thor
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs -> c:\Python27\tcl\tix8.4.3\pref\076E35C0-5E29-6BE8-FF7D-B4E075A5649B.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-C204-2D02FEA0347C.thor
  • \\SHARDREALM\Users\Public\Music\Sample Music\Sleep Away.mp3 -> \\SHARDREALM\Users\Public\Music\Sample Music\076E35C0-5E29-6BE8-28C2-B88A82CC20B2.thor
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1032\076E35C0-5E29-6BE8-299A-9B4913BC6639.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-FBA4-8348B1F463E5.thor
  • \\SHARDREALM\Users\Default\NTUSER.DAT.LOG -> \\SHARDREALM\Users\Default\076E35C0-5E29-6BE8-7187-3FF91BFC69D6.thor
  • c:\Python27\include\pyarena.h -> c:\Python27\include\076E35C0-5E29-6BE8-E783-8A5D3F5C8898.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\xNDTPxSwKOQrMTxOnVbH.doc -> \\SHARDREALM\Users\Harry Dresden\Desktop\076E35C0-5E29-6BE8-187A-62361383CAFA.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\IHYcSIwYonDar.doc -> \\SHARDREALM\Users\Harry Dresden\Desktop\076E35C0-5E29-6BE8-A6CF-ED77F9D1AA98.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-DEBD-CCEFFC26FA50.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-F7A9-FF3BE5C2635E.thor
  • \\SHARDREALM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg -> \\SHARDREALM\Users\Harry Dresden\Downloads\076E35C0-5E29-6BE8-7CEA-89AA12729500.thor
  • c:\Python27\include\pyexpat.h -> c:\Python27\include\076E35C0-5E29-6BE8-B2B8-6839D2A3EAED.thor
  • c:\Python27\include\pymath.h -> c:\Python27\include\076E35C0-5E29-6BE8-394F-5AA1FFFBE060.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\076E35C0-5E29-6BE8-8E77-9411601E9980.thor
  • c:\Python27\include\pystrcmp.h -> c:\Python27\include\076E35C0-5E29-6BE8-3943-ED2B6E2FD7AD.thor
  • c:\Python27\include\graminit.h -> c:\Python27\include\076E35C0-5E29-6BE8-9971-9DED941DC346.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\076E35C0-5E29-6BE8-4A98-5D55FB2F9F7A.thor
  • c:\Python27\include\cellobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-FEC0-89538CEB41F8.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-A122-06C64BBA6454.thor
  • c:\Python27\include\pyconfig.h -> c:\Python27\include\076E35C0-5E29-6BE8-1FEF-F923E39D8C20.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-3512-208AC2BB1C68.thor
  • c:\Python27\include\descrobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-6637-DE4B8F013499.thor
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1042\076E35C0-5E29-6BE8-3FAC-55F23AB952B1.thor
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs -> c:\Python27\tcl\tix8.4.3\pref\076E35C0-5E29-6BE8-2955-DE2CCE93BEA1.thor
  • c:\Python27\include\pyerrors.h -> c:\Python27\include\076E35C0-5E29-6BE8-9027-C9A09C8EF4C9.thor
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1035\076E35C0-5E29-6BE8-A5F4-C498602DA4D7.thor
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1041\076E35C0-5E29-6BE8-23FB-A7B6F6F5DF2B.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\076E35C0-5E29-6BE8-B4EE-20720F4285FF.thor
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1037\076E35C0-5E29-6BE8-B785-997A3879053B.thor
  • c:\Python27\include\patchlevel.h -> c:\Python27\include\076E35C0-5E29-6BE8-0947-4A084728CA9D.thor
  • c:\Python27\include\py_curses.h -> c:\Python27\include\076E35C0-5E29-6BE8-D4E0-6E8C4DF27D1E.thor
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs -> c:\Python27\tcl\tix8.4.3\pref\076E35C0-5E29-6BE8-F26E-F7E655217A13.thor
  • c:\Python27\Lib\test\keycert4.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-6AFF-C57B7CDCA4D5.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\JNhPcPsiVulVWAT.txt -> \\SHARDREALM\Users\Harry Dresden\Desktop\076E35C0-5E29-6BE8-AE04-B09D3973255D.thor
  • c:\Python27\include\cStringIO.h -> c:\Python27\include\076E35C0-5E29-6BE8-B7B9-54F2C5CBC24C.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\YjIDQLbLej.rtf -> \\SHARDREALM\Users\Harry Dresden\Desktop\076E35C0-5E29-6BE8-6CE3-9D9E91C80B89.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\076E35C0-5E29-6BE8-285D-01004A0DA445.thor
  • c:\wyvfgdruwx\bin\cert.p12 -> c:\wyvfgdruwx\bin\076E35C0-5E29-6BE8-D517-96E618682860.thor
  • c:\Python27\include\unicodeobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-62B2-587916E17552.thor
  • c:\Python27\include\boolobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-7943-29DAC126FDBA.thor
  • c:\Python27\include\warnings.h -> c:\Python27\include\076E35C0-5E29-6BE8-E56C-F689C3902502.thor
  • c:\Python27\Lib\test\ssl_key.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-74B3-6F7DA2BACFE7.thor
  • c:\Python27\include\cobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-724B-7F8101159D51.thor
  • c:\Python27\include\classobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-D84D-E7846C0C0141.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-F02D-EC24BF73C83F.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\aufnxtpFtyjemAde.docx -> \\SHARDREALM\Users\Harry Dresden\Desktop\076E35C0-5E29-6BE8-8238-8CD4F425819A.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\076E35C0-5E29-6BE8-D350-4FF59946975B.thor
  • c:\Python27\include\ast.h -> c:\Python27\include\076E35C0-5E29-6BE8-FA16-14C035E9C4CF.thor
  • c:\Python27\Lib\test\check_soundcard.vbs -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-0515-3693AAE65094.thor
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1053\076E35C0-5E29-6BE8-CBE4-025E6E95134C.thor
  • c:\Python27\include\intobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-84A0-FC93A8A6FA38.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-B65F-09DA9352315B.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-97B4-11AA7F701975.thor
  • c:\Python27\tcl\tclConfig.sh -> c:\Python27\tcl\076E35C0-5E29-6BE8-A125-6B110A7811D7.thor
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs -> c:\Python27\tcl\tix8.4.3\pref\076E35C0-5E29-6BE8-BAD4-86FDDA06C1FB.thor
  • c:\Python27\include\marshal.h -> c:\Python27\include\076E35C0-5E29-6BE8-48EB-14395C2C9159.thor
  • c:\Python27\include\pyport.h -> c:\Python27\include\076E35C0-5E29-6BE8-0500-2982CFD9498B.thor
  • c:\Python27\include\metagrammar.h -> c:\Python27\include\076E35C0-5E29-6BE8-1374-02FE3C53A4A3.thor
  • c:\Python27\include\ceval.h -> c:\Python27\include\076E35C0-5E29-6BE8-F184-9413EFBFCB24.thor
  • c:\Python27\include\pgenheaders.h -> c:\Python27\include\076E35C0-5E29-6BE8-ABF0-0E5181F6DF96.thor
  • c:\Python27\include\frameobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-CBAC-D15700C3BCAF.thor
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1055\076E35C0-5E29-6BE8-20DF-C1D4B3BC5E07.thor
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem -> c:\Python27\Lib\site-packages\pip\_vendor\requests\076E35C0-5E29-6BE8-7FCB-445EC58D2996.thor
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1043\076E35C0-5E29-6BE8-739B-818CFBA23D3F.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\076E35C0-5E29-6BE8-BE3D-5D7E9083E1F6.thor
  • c:\Python27\include\compile.h -> c:\Python27\include\076E35C0-5E29-6BE8-C3ED-0D5F5751F5AD.thor
  • c:\Python27\include\pymactoolbox.h -> c:\Python27\include\076E35C0-5E29-6BE8-5E77-4F1B7876BDC0.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\076E35C0-5E29-6BE8-33B3-10FFB2E10257.thor
  • c:\Python27\include\floatobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-F698-6449A8F6BCAD.thor
  • c:\Python27\include\codecs.h -> c:\Python27\include\076E35C0-5E29-6BE8-F48A-886B8B4D40CF.thor
  • c:\Python27\include\code.h -> c:\Python27\include\076E35C0-5E29-6BE8-71D0-5F47EF1944A0.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-8322-1BAB9F492067.thor
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1028\076E35C0-5E29-6BE8-1B9D-6C0D1C128F1E.thor
  • c:\Python27\Lib\test\keycert.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-9ABA-473A364A4815.thor
  • c:\Python27\Lib\test\nullcert.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-5927-15B468DF5C89.thor
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1029\076E35C0-5E29-6BE8-7669-C8CC82D317AF.thor
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1033\076E35C0-5E29-6BE8-35AA-B3F7B23FDE71.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Koala.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\076E35C0-5E29-6BE8-3B94-99F21E6FEA81.thor
  • c:\Python27\include\osdefs.h -> c:\Python27\include\076E35C0-5E29-6BE8-DCF1-E8E2A03B86D7.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-A746-7A6183BCE345.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-672F-7AAF5EEA279C.thor
  • c:\Python27\include\pydebug.h -> c:\Python27\include\076E35C0-5E29-6BE8-0306-FC76F3984855.thor
  • c:\Python27\include\bitset.h -> c:\Python27\include\076E35C0-5E29-6BE8-882F-3EFF0252D944.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-4981-5EF1DB83641C.thor
  • c:\Python27\include\import.h -> c:\Python27\include\076E35C0-5E29-6BE8-6F18-9C04AACDB6DE.thor
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs -> c:\Python27\tcl\tix8.4.3\pref\076E35C0-5E29-6BE8-265C-AA80C03E2A04.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-7465-E3BC0293F68B.thor
  • c:\Python27\Lib\test\ssl_key.passwd.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-E515-08CFF9CFA006.thor
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1036\076E35C0-5E29-6BE8-C17B-B1E01C23E0DE.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\076E35C0-5E29-6BE8-C5EA-AB7F65594565.thor
  • c:\Python27\include\iterobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-A63F-A9918A006329.thor
  • \\SHARDREALM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3 -> \\SHARDREALM\Users\Public\Music\Sample Music\076E35C0-5E29-6BE8-8D9A-E3FD83B7A231.thor
  • c:\Python27\include\pgen.h -> c:\Python27\include\076E35C0-5E29-6BE8-CD2E-A2A9AD9BC2EC.thor
  • c:\Python27\Lib\test\keycert2.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-D9D6-C1E84A814AEB.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-DD30-CE4278186A0A.thor
  • c:\Python27\include\pythonrun.h -> c:\Python27\include\076E35C0-5E29-6BE8-F0DB-F123C82218C0.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-A682-489936D29891.thor
  • c:\Python27\include\listobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-12FC-58BEA7E5D153.thor
  • c:\Python27\include\pycapsule.h -> c:\Python27\include\076E35C0-5E29-6BE8-C74B-5388AA03BE88.thor
  • c:\6cdeacda242012e0e5b593e657\1043\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1043\076E35C0-5E29-6BE8-52D3-DFDD7F2FD941.thor
  • c:\Python27\include\pygetopt.h -> c:\Python27\include\076E35C0-5E29-6BE8-2F52-D31632DD2570.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-2B3A-6C048358DF5E.thor
  • c:\Python27\include\longintrepr.h -> c:\Python27\include\076E35C0-5E29-6BE8-6FA6-FBD274AF1506.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\076E35C0-5E29-6BE8-9091-8B8945D059EE.thor
  • c:\Python27\include\genobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-3B43-C904C8D835E0.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-0C0A-CF5D302569FA.thor
  • c:\Python27\include\weakrefobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-CBC3-8E1F4EE28EEB.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\076E35C0-5E29-6BE8-CCA2-BEE3969937F9.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Desert.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\076E35C0-5E29-6BE8-BC0C-51E60CE288ED.thor
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php -> c:\ProgramData\WebEx\WebEx\12_1324\076E35C0-5E29-6BE8-9266-C9AC1900A800.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-A558-B55D276664FB.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-6CCD-7A73F484ED2B.thor
  • c:\Python27\include\object.h -> c:\Python27\include\076E35C0-5E29-6BE8-29E0-0159797B5B32.thor
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1042\076E35C0-5E29-6BE8-A6AD-78B9E22F503F.thor
  • c:\Python27\include\parsetok.h -> c:\Python27\include\076E35C0-5E29-6BE8-A41D-BDB67BE31ADA.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\076E35C0-5E29-6BE8-0C07-3B32CC54D87A.thor
  • \\SHARDREALM\Users\Harry Dresden\Downloads\cleandesktop.py.txt -> \\SHARDREALM\Users\Harry Dresden\Downloads\076E35C0-5E29-6BE8-A0CD-DCC92D2A1425.thor
  • c:\Python27\include\longobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-B366-B766D26447C7.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\076E35C0-5E29-6BE8-9CB4-3A9A2883AF61.thor
  • c:\Python27\include\stringobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-671A-4CE7609C9BCF.thor
  • c:\Python27\include\token.h -> c:\Python27\include\076E35C0-5E29-6BE8-7323-D36202519DAC.thor
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs -> c:\Python27\tcl\tix8.4.3\pref\076E35C0-5E29-6BE8-B0CC-57E1261B1166.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\dWrjtnxnSxfv.doc -> \\SHARDREALM\Users\Harry Dresden\Desktop\076E35C0-5E29-6BE8-ADA5-6596CC64B136.thor
  • c:\Python27\Lib\test\ssl_cert.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-B0C0-B472DB32DC58.thor
  • c:\Python27\include\intrcheck.h -> c:\Python27\include\076E35C0-5E29-6BE8-F2B4-855830B3F561.thor
  • c:\Python27\include\methodobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-A6BF-7F63F4CAADC7.thor
  • c:\Python27\include\rangeobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-EC25-48FB2F458D1D.thor
  • c:\Python27\include\datetime.h -> c:\Python27\include\076E35C0-5E29-6BE8-275F-F1EE5537D74C.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Tulips.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\076E35C0-5E29-6BE8-64E8-9CCCF35D27E6.thor
  • c:\Python27\include\abstract.h -> c:\Python27\include\076E35C0-5E29-6BE8-0B22-4D424AA69843.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\076E35C0-5E29-6BE8-7592-7D4427C39139.thor
  • \\SHARDREALM\Users\Public\Music\Sample Music\Kalimba.mp3 -> \\SHARDREALM\Users\Public\Music\Sample Music\076E35C0-5E29-6BE8-82B8-2EA70D5C7A73.thor
  • c:\Python27\include\node.h -> c:\Python27\include\076E35C0-5E29-6BE8-B08B-BFF520F0BDBD.thor
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs -> c:\Python27\tcl\tix8.4.3\pref\076E35C0-5E29-6BE8-3E98-767A65824AA8.thor
  • c:\Python27\include\grammar.h -> c:\Python27\include\076E35C0-5E29-6BE8-6B08-ECD2563DD88E.thor
  • c:\Python27\Lib\test\badkey.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-D704-8D5E30A7D8AB.thor
  • c:\Python27\Lib\test\keycert.passwd.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-48E8-0F0EB0E43526.thor
  • c:\Python27\Lib\test\badcert.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-2B36-C96C6EA14624.thor
  • c:\Python27\Lib\test\https_svn_python_org_root.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-9A89-8C4820E2EBC6.thor
  • c:\Python27\include\pystrtod.h -> c:\Python27\include\076E35C0-5E29-6BE8-7F7A-511C61762B0A.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-1353-78FD1695F9A1.thor
  • c:\Python27\include\tupleobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-F226-4EE07B4F775D.thor
  • c:\Python27\include\asdl.h -> c:\Python27\include\076E35C0-5E29-6BE8-B4CE-8706F23E961E.thor
  • c:\Python27\include\dictobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-F19A-27250C302E61.thor
  • c:\Python27\Lib\test\nokia.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-D4D9-754F6A5DD7BF.thor
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1044\076E35C0-5E29-6BE8-7122-A5A8198F286B.thor
  • c:\Python27\include\funcobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-2AD5-5ADF6B91EB39.thor
  • \\SHARDREALM\Users\Public\Videos\Sample Videos\Wildlife.wmv -> \\SHARDREALM\Users\Public\Videos\Sample Videos\076E35C0-5E29-6BE8-426C-AE13E64D72F5.thor
  • c:\Python27\Lib\test\pycacert.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-89DA-3F93D48846B8.thor
  • c:\Python27\include\memoryobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-66DE-744FE87BF88B.thor
  • c:\Python27\Lib\test\wrongcert.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-71D0-C45DDD002C2C.thor
  • c:\Python27\Lib\test\sha256.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-64FE-FE9A2937BC9B.thor
  • c:\Python27\include\traceback.h -> c:\Python27\include\076E35C0-5E29-6BE8-F4E1-CE31423FF9E3.thor
  • c:\Python27\include\objimpl.h -> c:\Python27\include\076E35C0-5E29-6BE8-A481-AF7F78AC04E2.thor
  • c:\Python27\include\pymem.h -> c:\Python27\include\076E35C0-5E29-6BE8-1DA4-CED1A93989E5.thor
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf -> c:\6cdeacda242012e0e5b593e657\2070\076E35C0-5E29-6BE8-DFFF-CBE48AFC11EE.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-057E-FD309E166B42.thor
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-96BC-95D8293EC5C8.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Penguins.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\076E35C0-5E29-6BE8-7A20-2C75F0F858AD.thor
  • c:\Python27\include\Python-ast.h -> c:\Python27\include\076E35C0-5E29-6BE8-50D8-1739E21D1F10.thor
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1040\076E35C0-5E29-6BE8-A053-C43A10B7C0F7.thor
Network-Connects Host
  • 185.67.0.102
  • 188.65.211.181
  • 365aiwu.net
Directory-Created
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YLC2QM2Y
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Caches
Directory-Enumerated
  • c:\Python27\Lib\site-packages\pip\*
  • c:\Python27\tcl\tcl8\8.5\*
  • c:\ProgramData\Sun\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\*
  • c:\Python27\tcl\tk8.5\demos\images\*
  • c:\Users\ruiner\*
  • c:\Recovery\015e7760-d44b-11e0-8947-954f09601788\*
  • c:\PerfLogs\*
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\*
  • c:\ProgramData\Passmark\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\*
  • c:\Python27\Tools\pynche\X\*
  • c:\Users\Public\Music\Sample Music\*
  • c:\Python27\Lib\importlib\*
  • c:\Python27\tcl\tcl8.5\http1.0\*
  • c:\Python27\Lib\bsddb\*
  • \\SHARDREALM\Users\Harry Dresden\Pictures\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\*
  • c:\inetpub\wwwroot\aspnet_client\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog\*
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\tests\*
  • c:\Python27\tcl\tk8.5\ttk\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\*
  • c:\Users\Default\Saved Games\*
  • c:\Python27\tcl\tcl8.5\tzdata\Africa\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\*
  • c:\Python27\Tools\i18n\*
  • c:\ProgramData\Microsoft\ClickToRun\*
  • c:\Python27\Lib\site-packages\pip\_vendor\lockfile\*
  • c:\ProgramData\*
  • c:\6cdeacda242012e0e5b593e657\Graphics\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders\*
  • c:\Python27\Lib\compiler\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\*
  • c:\Python27\Lib\unittest\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\35\*
  • c:\Python27\Lib\test\capath\*
  • c:\Users\Harry Dresden\OneDrive\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\*
  • c:\ProgramData\Adobe\Acrobat\11.0\*
  • c:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\*
  • c:\wyvfgdruwx\modules\auxiliary\*
  • c:\Python27\tcl\tcl8.5\*
  • c:\Python27\Lib\unittest\test\*
  • c:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319\*
  • c:\Users\Public\Videos\Sample Videos\*
  • c:\ProgramData\Microsoft\Network\Connections\*
  • c:\Users\Public\Recorded TV\*
  • c:\Users\Harry Dresden\Contacts\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\42\*
  • c:\Python27\tcl\tk8.5\msgs\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\*
  • c:\Python27\tcl\tcl8.5\tzdata\Atlantic\*
  • c:\Python27\tcl\tcl8.5\tzdata\Europe\*
  • c:\ProgramData\WebEx\WebEx\*
  • c:\Python27\tcl\tk8.5\demos\*
  • c:\ProgramData\Microsoft\Windows Defender\*
  • c:\ProgramData\Microsoft\PlayReady\Cache\*
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\_backport\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\*
  • c:\inetpub\history\CFGHISTORY_0000000005\*
  • c:\Python27\tcl\tix8.4.3\demos\samples\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\SentItems\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers\*
  • \\SHARDREALM\Users\Harry Dresden\Favorites\*
  • c:\ProgramData\Microsoft\PlayReady\Cache\S-1-5-21-3416602863-1947377224-293699093-1001\*
  • c:\6cdeacda242012e0e5b593e657\1037\*
  • c:\Python27\Lib\pydoc_data\*
  • c:\Users\Default\Pictures\*
  • \\SHARDREALM\Users\Default\Links\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\*
  • \\SHARDREALM\Users\Public\Music\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\serializer\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\*
  • c:\inetpub\custerr\*
  • c:\6cdeacda242012e0e5b593e657\1033\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\*
  • \\SHARDREALM\Users\Harry Dresden\Links\*
  • c:\Python27\Scripts\*
  • c:\Users\Public\Desktop\*
  • \\SHARDREALM\Users\Harry Dresden\Videos\*
  • c:\ProgramData\Microsoft\Network\Downloader\*
  • c:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\*
  • c:\Python27\Tools\pynche\*
  • c:\Python27\Lib\email\test\*
  • c:\ProgramData\Mozilla\logs\*
  • c:\ProgramData\Microsoft\IdentityCRL\*
  • c:\ProgramData\Microsoft\WPD\*
  • c:\ProgramData\Microsoft\Diagnosis\LocalTraceStore\*
  • c:\ProgramData\Microsoft\Event Viewer\*
  • c:\Users\Harry Dresden\Favorites\Links for United States\*
  • c:\Users\Default\*
  • c:\ProgramData\Sun\Java\Java Update\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\*
  • c:\Python27\tcl\dde1.3\*
  • c:\Python27\Lib\ensurepip\_bundled\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\*
  • c:\PerfLogs\Admin\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters\*
  • c:\Python27\Lib\idlelib\*
  • c:\Python27\Lib\site-packages\pip\models\*
  • c:\inetpub\*
  • \\SHARDREALM\Users\Harry Dresden\Music\*
  • c:\Users\Harry Dresden\Saved Games\*
  • c:\inetpub\wwwroot\msmq\*
  • c:\ProgramData\Microsoft\DRM\*
  • c:\ProgramData\Microsoft\Crypto\RSA\*
  • c:\6cdeacda242012e0e5b593e657\1025\*
  • c:\Python27\Lib\test\crashers\*
  • c:\ProgramData\Microsoft\Search\Data\Applications\*
  • c:\Python27\Lib\ctypes\test\*
  • c:\Users\Public\Libraries\*
  • c:\ProgramData\Microsoft\Device Stage\*
  • \\SHARDREALM\Users\Harry Dresden\Searches\*
  • c:\ProgramData\Microsoft\Windows NT\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\*
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\*
  • \\SHARDREALM\Users\Public\Videos\Sample Videos\*
  • c:\Python27\Lib\xml\etree\*
  • c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\*
  • c:\Python27\Lib\test\*
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\Security\*
  • \\SHARDREALM\Users\Public\Libraries\*
  • c:\Python27\Lib\ctypes\macholib\*
  • c:\Python27\Lib\msilib\*
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\*
  • \\SHARDREALM\Users\Harry Dresden\Desktop\*
  • c:\6cdeacda242012e0e5b593e657\1035\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\DD\*
  • \\SHARDREALM\Users\Harry Dresden\Contacts\*
  • c:\ProgramData\Adobe\ARM\S\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\*
  • c:\Users\Default\Videos\*
  • c:\ProgramData\McAfee\MCLOGS\Common\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\*
  • c:\Users\Default\Documents\*
  • c:\6cdeacda242012e0e5b593e657\1031\*
  • c:\Python27\tcl\tcl8.5\tzdata\Pacific\*
  • \\SHARDREALM\Users\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\North_Dakota\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\*
  • c:\Python27\tcl\tcl8.5\tzdata\Etc\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\*
  • c:\ProgramData\Adobe\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\*
  • c:\inetpub\history\CFGHISTORY_0000000001\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\chardet\*
  • \\SHARDREALM\Users\Default\Music\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A6\*
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\*
  • \\SHARDREALM\Users\Default\Favorites\*
  • c:\Python27\Tools\webchecker\*
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\*
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\*
  • c:\wyvfgdruwx\modules\*
  • c:\ProgramData\NovaTech Network\NovaBench\*
  • \\SHARDREALM\Users\Public\Music\Sample Music\*
  • c:\Users\Harry Dresden\Favorites\Links\*
  • c:\ProgramData\Microsoft\Assistance\*
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\*
  • c:\inetpub\wwwroot\*
  • c:\Users\Harry Dresden\*
  • c:\Python27\tcl\tcl8.5\tzdata\Antarctica\*
  • c:\Python27\Lib\site-packages\pip\_vendor\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\*
  • c:\ProgramData\Adobe\ARM\S\5521\*
  • \\SHARDREALM\Users\Public\Foxit Software\*
  • c:\Users\Public\Downloads\*
  • c:\6cdeacda242012e0e5b593e657\2070\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\x-none.16\*
  • c:\Python27\Lib\test\cjkencodings\*
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\*
  • c:\ProgramData\Microsoft\Windows Defender\Support\*
  • c:\Python27\Lib\site-packages\pip\operations\*
  • \\SHARDREALM\Users\Harry Dresden\*
  • c:\ProgramData\Microsoft\MF\*
  • c:\6cdeacda242012e0e5b593e657\1029\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\*
  • c:\wyvfgdruwx\lib\*
  • c:\Python27\Lib\distutils\tests\*
  • c:\ProgramData\Microsoft\Office\*
  • c:\Users\Public\Music\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\*
  • c:\6cdeacda242012e0e5b593e657\1045\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\*
  • c:\Users\Harry Dresden\Desktop\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\*
  • c:\ProgramData\Microsoft\Crypto\*
  • \\SHARDREALM\Users\Public\Recorded TV\Sample Media\*
  • c:\Users\Public\Pictures\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\42\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\*
  • c:\Python27\include\*
  • c:\Python27\Lib\lib2to3\tests\data\fixers\*
  • c:\Python27\Lib\encodings\*
  • c:\Python27\Lib\site-packages\setuptools\*
  • c:\Python27\Lib\test\tracedmodules\*
  • c:\ProgramData\Microsoft\DRM\Server\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\*
  • c:\Python27\tcl\tcl8.5\tzdata\SystemV\*
  • c:\6cdeacda242012e0e5b593e657\1049\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\*
  • c:\Users\Harry Dresden\Music\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\*
  • c:\Python27\tcl\tcl8.5\tzdata\Mexico\*
  • c:\ProgramData\Microsoft\RAC\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\*
  • c:\ProgramData\Microsoft\WwanSvc\*
  • c:\Python27\tcl\tcl8.5\tzdata\Arctic\*
  • c:\wyvfgdruwx\lib\core\*
  • c:\ProgramData\Oracle\*
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\media\*
  • c:\ProgramData\Microsoft\Windows Defender\Quarantine\*
  • \\SHARDREALM\Users\Default\Pictures\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Queue\*
  • c:\ProgramData\Microsoft\RAC\Outbound\*
  • c:\ProgramData\WebEx\*
  • c:\inetpub\history\CFGHISTORY_0000000003\*
  • c:\Python27\Lib\site-packages\setuptools\command\*
  • c:\Python27\tcl\tcl8.5\tzdata\Indian\*
  • c:\ProgramData\Microsoft\Event Viewer\Views\*
  • c:\Users\Default\Favorites\*
  • c:\*
  • c:\Users\Default\Desktop\*
  • \\SHARDREALM\Users\Default\Desktop\*
  • c:\ProgramData\Microsoft\eHome\logs\*
  • c:\ProgramData\Microsoft\Network\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Kentucky\*
  • \\SHARDREALM\Users\Harry Dresden\Favorites\Links\*
  • c:\Python27\Lib\lib-tk\test\test_ttk\*
  • c:\Python27\tcl\tcl8.5\tzdata\US\*
  • c:\ProgramData\Microsoft\ClickToRun\UserData\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\*
  • c:\Users\Public\Pictures\Sample Pictures\*
  • c:\Python27\tcl\tcl8.5\msgs\*
  • c:\6cdeacda242012e0e5b593e657\1041\*
  • c:\Users\Default\Downloads\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\ssl_match_hostname\*
  • c:\Users\Harry Dresden\Links\*
  • \\SHARDREALM\Users\Harry Dresden\Favorites\Links for United States\*
  • c:\Python27\DLLs\*
  • \\SHARDREALM\Users\Default\Documents\*
  • c:\ProgramData\Microsoft\User Account Pictures\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\contrib\*
  • c:\Python27\tcl\tcl8.5\tzdata\Asia\*
  • c:\Users\Harry Dresden\Downloads\*
  • c:\Python27\tcl\tcl8.5\opt0.4\*
  • c:\ProgramData\Mozilla\*
  • c:\Users\Public\Videos\*
  • c:\Python27\tcl\tcl8\8.4\*
  • c:\6cdeacda242012e0e5b593e657\1055\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\*
  • c:\Python27\Tools\versioncheck\*
  • c:\Python27\tcl\reg1.2\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F7\*
  • c:\Python27\Lib\xml\dom\*
  • c:\Python27\Lib\lib2to3\tests\data\*
  • c:\wyvfgdruwx\modules\packages\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\*
  • c:\Python27\tcl\tcl8.5\encoding\*
  • c:\ProgramData\McAfee\*
  • c:\ProgramData\Microsoft\Diagnosis\AsimovUploader\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\*
  • c:\ProgramData\Microsoft\User Account Pictures\Default Pictures\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\*
  • \\SHARDREALM\Users\Public\Documents\*
  • c:\Python27\Lib\xml\parsers\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\*
  • c:\6cdeacda242012e0e5b593e657\1038\*
  • c:\Python27\tcl\tix8.4.3\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\trie\*
  • c:\Python27\tcl\tcl8.5\tzdata\Canada\*
  • c:\ProgramData\NovaTech Network\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\*
  • c:\Python27\tcl\tcl8\*
  • c:\6cdeacda242012e0e5b593e657\1053\*
  • c:\Users\Default\Music\*
  • c:\Python27\Lib\test\decimaltestdata\*
  • c:\Python27\Lib\test\xmltestdata\*
  • \\SHARDREALM\Users\Public\Desktop\*
  • c:\ProgramData\Passmark\PerformanceTest\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\*
  • \\SHARDREALM\Users\Harry Dresden\OneDrive\*
  • c:\ProgramData\Adobe\ARM\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\*
  • \\SHARDREALM\Users\Harry Dresden\Documents\*
  • c:\6cdeacda242012e0e5b593e657\2052\*
  • c:\Python27\Lib\logging\*
  • c:\ProgramData\Microsoft\eHome\*
  • c:\Users\Public\*
  • c:\6cdeacda242012e0e5b593e657\1043\*
  • c:\Python27\Lib\site-packages\*
  • c:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\*
  • c:\ProgramData\Microsoft\Diagnosis\UIF\*
  • c:\Users\Harry Dresden\Searches\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\*
  • c:\Python27\tcl\tk8.5\*
  • \\SHARDREALM\Users\Public\*
  • c:\Python27\Lib\xml\sax\*
  • c:\ProgramData\Microsoft\Device Stage\Device\*
  • c:\ProgramData\Microsoft\Vault\*
  • c:\Users\Default\Links\*
  • c:\Python27\Lib\json\tests\*
  • c:\Python27\libs\*
  • c:\6cdeacda242012e0e5b593e657\1028\*
  • c:\Python27\Lib\lib-tk\test\test_tkinter\*
  • c:\ProgramData\Microsoft OneDrive\*
  • c:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\*
  • c:\Python27\Lib\ctypes\*
  • c:\Users\Public\Recorded TV\Sample Media\*
  • \\SHARDREALM\Users\Harry Dresden\Downloads\*
  • c:\Python27\*
  • c:\ProgramData\Microsoft\Crypto\DSS\*
  • c:\ProgramData\Microsoft\Diagnosis\Sideload\*
  • c:\Python27\Lib\email\*
  • c:\ProgramData\Microsoft\Search\Data\*
  • c:\Users\Harry Dresden\Documents\*
  • c:\ProgramData\Adobe\Setup\*
  • c:\Python27\Lib\distutils\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\*
  • c:\ProgramData\Microsoft\Device Stage\Task\*
  • c:\Users\*
  • \\SHARDREALM\Users\Public\Favorites\*
  • c:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\*
  • c:\Python27\Lib\sqlite3\*
  • c:\ProgramData\Sun\Java\*
  • c:\ProgramData\Microsoft\NetFramework\*
  • c:\wyvfgdruwx\lib\common\*
  • c:\ProgramData\Microsoft\Crypto\Keys\*
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\*
  • c:\Python27\Lib\bsddb\test\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\{98101498-C465-4F51-8751-D1919E97D29D}\*
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\*
  • \\SHARDREALM\Users\ruiner\*
  • c:\Recovery\*
  • c:\Users\Public\Foxit Software\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A6\*
  • c:\inetpub\history\CFGHISTORY_0000000002\*
  • c:\Python27\Lib\site-packages\pip\req\*
  • c:\Users\Harry Dresden\Videos\*
  • \\SHARDREALM\Users\Default\Downloads\*
  • c:\inetpub\wwwroot\aspnet_client\system_web\*
  • c:\Python27\tcl\tcl8.5\tzdata\Australia\*
  • c:\Users\Harry Dresden\Pictures\*
  • c:\ProgramData\Microsoft\DeviceSync\*
  • c:\ProgramData\WebEx\WebEx\12_1324\*
  • c:\ProgramData\Microsoft\Office\Heartbeat\*
  • c:\Python27\Lib\lib2to3\tests\data\fixers\myfixes\*
  • c:\Python27\Tools\Scripts\*
  • c:\Python27\Lib\hotshot\*
  • \\SHARDREALM\Users\Public\Videos\*
  • c:\ProgramData\Microsoft\*
  • c:\ProgramData\Microsoft\PlayReady\*
  • c:\Python27\Lib\site-packages\pip\utils\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\*
  • c:\Python27\tcl\tcl8.5\tzdata\Brazil\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\*
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\packaging\*
  • c:\Python27\Lib\lib2to3\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Argentina\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\*
  • c:\ProgramData\Microsoft\WwanSvc\Profiles\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\*
  • c:\Python27\Lib\test\subprocessdata\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Quick\*
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info\*
  • c:\Python27\Lib\site-packages\pip\_vendor\progress\*
  • c:\Users\Public\Foxit Software\Foxit Reader\*
  • c:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Inbox\*
  • c:\Python27\Lib\xml\*
  • c:\ProgramData\Microsoft\Search\*
  • c:\ProgramData\Microsoft\IlsCache\*
  • c:\Python27\tcl\tk8.5\images\*
  • e:\*
  • c:\Python27\Lib\sqlite3\test\*
  • c:\ProgramData\McAfee\MCLOGS\*
  • c:\Python27\Lib\ensurepip\*
  • c:\Python27\Lib\idlelib\Icons\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\*
  • c:\Python27\Lib\test\imghdrdata\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\en-us.16\*
  • c:\ProgramData\Microsoft\Diagnosis\*
  • c:\6cdeacda242012e0e5b593e657\*
  • \\SHARDREALM\Users\Default\Saved Games\*
  • c:\wyvfgdruwx\lib\api\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\*
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\*
  • c:\6cdeacda242012e0e5b593e657\1030\*
  • \\SHARDREALM\Users\Default\Videos\*
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\*
  • \\SHARDREALM\Users\Public\Downloads\*
  • c:\ProgramData\Microsoft\RAC\PublishedData\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\*
  • c:\Python27\Lib\multiprocessing\dummy\*
  • c:\Python27\Lib\email\mime\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\*
  • c:\Python27\tcl\tix8.4.3\demos\bitmaps\*
  • c:\wyvfgdruwx\bin\*
  • c:\Users\Public\Documents\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\35\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\*
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\*
  • c:\Python27\Lib\lib-tk\*
  • c:\Users\Harry Dresden\Favorites\*
  • c:\Python27\Doc\*
  • c:\Python27\Lib\curses\*
  • c:\Python27\Lib\lib2to3\pgen2\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\*
  • c:\ProgramData\Adobe\Acrobat\*
  • c:\Python27\Lib\*
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\*
  • c:\Python27\tcl\tix8.4.3\demos\*
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\*
  • c:\6cdeacda242012e0e5b593e657\1042\*
  • c:\Python27\Lib\test\audiodata\*
  • c:\inetpub\history\CFGHISTORY_0000000004\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\*
  • c:\Python27\tcl\tcl8.5\tzdata\*
  • c:\Python27\Lib\site-packages\pip\_vendor\_markerlib\*
  • c:\Python27\tcl\tcl8\8.4\platform\*
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\*
  • c:\Python27\Lib\site-packages\pip\vcs\*
  • c:\6cdeacda242012e0e5b593e657\1046\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\*
  • c:\Python27\tcl\tix8.4.3\pref\*
  • c:\Python27\Lib\site-packages\pip\compat\*
  • \\SHARDREALM\Users\Public\Pictures\*
  • c:\Python27\Lib\json\*
  • c:\Python27\Lib\lib2to3\fixes\*
  • c:\ProgramData\Microsoft\Windows Defender\LocalCopy\*
  • c:\ProgramData\Microsoft\Assistance\Client\*
  • c:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\*
  • \\SHARDREALM\Users\Default\*
  • c:\Python27\Lib\test\leakers\*
  • \\SHARDREALM\Users\Harry Dresden\Saved Games\*
  • c:\ProgramData\Microsoft\Media Player\*
  • c:\ProgramData\McAfee\MCLOGS\Common\jxpiinstall\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\filters\*
  • c:\Python27\Tools\*
  • c:\6cdeacda242012e0e5b593e657\1044\*
  • c:\6cdeacda242012e0e5b593e657\1036\*
  • c:\inetpub\history\*
  • c:\6cdeacda242012e0e5b593e657\1032\*
  • c:\Python27\tcl\tcl8.5\tzdata\Chile\*
  • c:\Python27\Lib\site-packages\pip\_vendor\packaging\*
  • \\SHARDREALM\Users\Public\Recorded TV\*
  • c:\ProgramData\Microsoft\Windows NT\MSScan\*
  • c:\Python27\Lib\email\test\data\*
  • c:\Python27\tcl\tix8.4.3\bitmaps\*
  • c:\Python27\Lib\site-packages\pip\_vendor\colorama\*
  • c:\Python27\Lib\lib2to3\tests\*
  • c:\ProgramData\regid.1991-06.com.microsoft\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F7\*
  • c:\ProgramData\Microsoft OneDrive\setup\*
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\*
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches\*
  • c:\Python27\Lib\distutils\command\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\*
  • c:\wyvfgdruwx\*
  • c:\Python27\tcl\*
  • c:\Python27\Lib\site-packages\pip\commands\*
  • c:\Python27\Lib\site-packages\pkg_resources\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\*
  • c:\Python27\Lib\multiprocessing\*
  • c:\Python27\Lib\wsgiref\*
  • c:\6cdeacda242012e0e5b593e657\3082\*
  • c:\Users\Public\Favorites\*
  • c:\Python27\Lib\lib-tk\test\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util\*
  • c:\ProgramData\Microsoft\RAC\StateData\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Indiana\*
  • c:\Python27\Lib\site-packages\_markerlib\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\DD\*
  • c:\Python27\Lib\idlelib\idle_test\*
  • c:\ProgramData\Adobe\ARM\Reader_11.0.10\*
  • c:\inetpub\custerr\en-US\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\*
  • c:\6cdeacda242012e0e5b593e657\1040\*
Registry Key-Opened
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\control\NetworkProvider\HwOrder
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPNP\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\VssapiPublisher
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MiniNT
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Safeboot\Option
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\NetworkProvider
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider
  • HKEY_CURRENT_USER\Network\E
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions
  • HKEY_LOCAL_MACHINE\system\CurrentControlSet\Control\NetworkProvider\Notifyees
  • HKEY_CURRENT_USER\Network
  • HKEY_PERFORMANCE_DATA\(Default)
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LDAP
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
  • HKEY_LOCAL_MACHINE\system\CurrentControlSet
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\http\
  • HKEY_CURRENT_USER\Software
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610
  • HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CLASSES_ROOT\.js
  • HKEY_LOCAL_MACHINE\Software\Policies
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\application/octet-stream
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Pre Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\0a-00-27-00-00-00
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_CERT_WARNINGS_ON_POST_FROM_ISTREAM_KB2894776
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001
  • HKEY_LOCAL_MACHINE\Software
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Pre Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\*\
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_URLMON_IQDA_SIZE
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent
  • HKEY_CURRENT_USER\Software\Policies
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\KindMap
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_URLMON_IQDA_SIZE
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00
  • HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_LOCAL_MACHINE\System\Setup
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000
  • HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/octet-stream
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION
  • HKEY_CLASSES_ROOT\JSFile\ScriptEngine
  • HKEY_CURRENT_USER\SOFTWARE\Classes\PROTOCOLS\Filter\application/octet-stream
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\UrlMon Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SHOW_CERT_WARNINGS_ON_POST_FROM_ISTREAM_KB2894776
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Registry Key-Deleted
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDetectedUrl
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDetectedUrl
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
Registry Key-Read
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\MaxRpcSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseHostnameAsAlias
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\LdapClientIntegrity
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\OOBEInProgress
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseOldHostResolutionOrder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder\ProviderOrder
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\ComputerName
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions\ProductType
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ReceiveTimeOut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\InheritConsoleHandles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\wscript.exe
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\NoFileFolderJunction
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cer\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InitFolderHandler
  • HKEY_CURRENT_USER\Directory\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PreCreate
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc2740-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\IgnoreUserSettings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\AdminTabProcs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InfoTip
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DevicePath
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ADODB.Stream\CLSID\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\*
  • HKEY_CURRENT_USER\Directory\NeverShowExt
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\LogFileName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.js\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chm\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2005
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\MapNetDriveVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\Timeout
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivKeyCachePurgeIntervalSeconds
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\TabProcGrowth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDhcp
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParsingName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SendTimeOut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\Environment\PROCESSOR_ARCHITECTURE
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SourcePath
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1806
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273c-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsParseDisplayName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\InprocServer32
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\SessionMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bat\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\application/octet-stream\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\FolderTypeID
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\DisplayLogo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.crt\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\(Default)
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableUTF8
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\COM+Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.com\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2005
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForInfoTip
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FrameTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\*
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Srp\GP\RuleCount
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HasNavigationEnum
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1A10
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Description
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Roamable
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PreCreate
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\PolicyScope
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273d-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\Safety Warning Level
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ade\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation\AllowedReservedCharacters
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\SessionMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORPARSING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\BrowseInPlace
  • HKEY_CURRENT_USER\Directory\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForOverlay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\UseDropHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsAliasedNotifications
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugHeapFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FrameTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\DefaultLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JScript\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSXML2.XMLHTTP\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideOnDesktopPerUser
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SendTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WScript.Shell\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bas\(Default)
  • HKEY_CURRENT_USER\Directory\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Name
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORDISPLAY
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Image Path
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Platform
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\TabProcGrowth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\DelegateExecute
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\PinToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\Levels
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpl\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273d-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\InheritConsoleHandles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\UseWINSAFER
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivKeyCacheMaxItems
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\DocObject
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ReceiveTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Security
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\SaferFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResource
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\AdminTabProcs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\TrustPolicy
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Compatible
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\DA0C75D6
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsUniversalDelegate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.adp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\command
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\NoWorkingDirectory
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\ScriptEngine\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecision
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cmd\(Default)
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1806
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\LogSecuritySuccesses
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc2740-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
  • HKEY_CURRENT_USER\Directory\IsShortcut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivateKeyLifetimeSeconds
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\*
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideInWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FrameMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\DisplayLogo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\Timeout
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Compatible
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win64\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273c-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FrameMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\SetWorkingDirectoryFromTarget
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDns
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionTime
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideFolderVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Flags
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadExpirationDays
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\NeverShowExt
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDetectedUrl
Registry Key-Written
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionReason
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecision
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionTime
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadNetworkName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
Mutex-Accessed
  • Local\ZonesCacheCounterMutex
  • Local\ZonesLockedCacheCounterMutex

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 456, Parent PID: 352

"C:\Windows\System32\wscript.exe" C:\Users\HARRYD~1\AppData\Local\Temp\NRV_2I56240B_.js PID: 2340, Parent PID: 3012

"C:\Windows\SysWOW64\rundll32.exe" C:\Users\HARRYD~1\AppData\Local\Temp\EU6ET0~1.DLL,boobs PID: 3156, Parent PID: 2340

Volatility

Nothing to display.