'
metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2016-11-08 21:08:26.484969 2016-11-08 21:11:41.578787 195 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo win7 Clone 1 VirtualBox 2016-11-08 21:08:28 2016-11-08 21:11:41

File Details

File name 76bd36cf0c6d3f3a56d3f94a5cceff4e6ff65ee8.zip
File size 1106 bytes
File type Zip archive data, at least v2.0 to extract
CRC32 00EB0BE1
MD5 546b243118040d5708bc1d7dafada773
SHA1 76bd36cf0c6d3f3a56d3f94a5cceff4e6ff65ee8
SHA256 bd302da2426940a911a3a21a515df74c3260222a98231e5f2f5b82ffdabe4f70
SHA512 46c223e4e51555401506deac42db2466611b25e574ecb34faea3d181b0cdbce517f9c4f5eaef81a3449ef91936a187adc56eb312307eaa0fcf5040e1ce4fc932
Ssdeep 24:9mp1bb4acS7+imZbZZp+yOnbZ+FuD7NqRGpc:9w1guq5UJ7EQc
PEiD None matched
Yara
  • PM_Zip_with_js ()
VirusTotal Permalink
VirusTotal Scan Date: 2016-11-08 15:31:43
Detection Rate: 7/56 (Expand)

MetaFlows Scores

Metaflows Analysis Results (Signatures=125, Anomalies=0, PEiD=0, Yara=2, VT[1478639534]=100): Snort Events=2, AV Events=2
Total Score=125

SNORT EVENTS:
ET POLICY PE EXE or DLL Windows file download HTTP
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

CLAMAV DETECTED:
Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND
DROPPED FILE - NRV_365M1NN_.js: Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND

Dropped File/Buffer Yara Signatures:
02a3c39d4987ca98b97d841db6f637441f8e2c8c [BUFFER]: Str_Win32_Http_API
4a2193322102ea36dc2027d7d45456caa4c664a9 [BUFFER]: shellcode

Signatures

antivm_queries_computername details
recon_fingerprint details
antivm_memory_available details
dumped_buffer details
creates_doc details
antivm_network_adapters details
dumped_buffer2 details
antivm_vbox_files details
Windows_Proxy_Tinkering details
network_wscript_downloader details
persistence_ads details
antiav_detectfile details
exploit_heapspray details
malicious_document_urls details
network_document_file details
network_downloader_exe details
antivm_vbox_devices details
antivm_vbox_files details
modifies_files details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

c793d39469c36953_gizcryf0-7am0-ficb-3d08-03aae6e12fcd.thor

da75d2619451b521_gizcryf0-7am0-ficb-d0fc-755203f73394.thor

2b0bcdade91a673b_gizcryf0-7am0-ficb-08ba-d67dd493bfc1.thor

b0cc261d158674f7_gizcryf0-7am0-ficb-11ff-9e3e6e7f1ebb.thor

b94237cda3d232f4_gizcryf0-7am0-ficb-f058-e303d36a1452.thor

4ac6e1df6508be20_gizcryf0-7am0-ficb-b879-219aeec5e021.thor

cef946464485f1d4_gizcryf0-7am0-ficb-b8d4-5cff3ed2bc5c.thor

cf21bd9d6e6936a5_gizcryf0-7am0-ficb-ca80-3600daf9f1c2.thor

aba0ed38bd99671e_gizcryf0-7am0-ficb-2032-72ff837763a6.thor

3ec718199024b062_gizcryf0-7am0-ficb-1039-cae8560fda52.thor

d35a7c6c1e6bea77_gizcryf0-7am0-ficb-d17d-8fbe089c4f57.thor

27a8df7def3eec1a_gizcryf0-7am0-ficb-b695-8b5e881fa811.thor

dccc5a2d45d3dd06_gizcryf0-7am0-ficb-ce3f-4a397b94545d.thor

fd23c280308dc527_gizcryf0-7am0-ficb-5a4f-2dc0d81be5ee.thor

28fbe702067641ed_gizcryf0-7am0-ficb-e4f7-c56dfc746383.thor

533649679cbb34b6_gizcryf0-7am0-ficb-5915-35b2a1c7f30a.thor

89e668131054fc75_gizcryf0-7am0-ficb-64ff-f4ace1c235de.thor

8adadfca8cf85472_gizcryf0-7am0-ficb-f24b-3c70d9a0e9e1.thor

8a1e1725be0a2453_gizcryf0-7am0-ficb-13bd-33a728117c5c.thor

c09fc634eca0f1e1_gizcryf0-7am0-ficb-9fa0-de994512574a.thor

109c9691dff8b871_gizcryf0-7am0-ficb-d8a7-a6c040c5cf78.thor

723f10037d685fb8_gizcryf0-7am0-ficb-82e6-fd7c071df6cc.thor

1755a07aaa36e074_gizcryf0-7am0-ficb-8ac7-809a9d73b642.thor

6a471fa05ef1e168_gizcryf0-7am0-ficb-bec5-06806aa0ae4e.thor

393744eb7340ed72_gizcryf0-7am0-ficb-af30-0d55485d147d.thor

8f861d8bd747e3b0_gizcryf0-7am0-ficb-71c0-74d61ff37cce.thor

12adb34a3f381758_gizcryf0-7am0-ficb-c560-0eb4e5448b0e.thor

5f8f75c05f172fc6_gizcryf0-7am0-ficb-8f61-a987f13cabe0.thor

5e6955b3e35f0149_gizcryf0-7am0-ficb-0248-3cfb5f1b5eaa.thor

a25cab8b26dc03e9_gizcryf0-7am0-ficb-8ea0-6dca1a947e1b.thor

9db604417438e75d_gizcryf0-7am0-ficb-6ead-ca0a77db40c9.thor

549651dfe12ed9e8_gizcryf0-7am0-ficb-f851-f77138bfe702.thor

363ca2c017c2b565_gizcryf0-7am0-ficb-1aa8-f9141f69ad2d.thor

6945423d80213bed_gizcryf0-7am0-ficb-39c7-f824323b7b8c.thor

1555d118c7931318_gizcryf0-7am0-ficb-a7a9-ccb624706407.thor

b22c1c0a9993d31b_gizcryf0-7am0-ficb-1617-bdef82e8cd3c.thor

6534b6d109fb9778_gizcryf0-7am0-ficb-f2a6-d98d860a3fae.thor

b6ac75098228fc43_gizcryf0-7am0-ficb-7d85-ac9821aa610a.thor

4795bd293c34209b_gizcryf0-7am0-ficb-ad25-80e1849b3035.thor

e63aaaad7e5f0ce8_gizcryf0-7am0-ficb-8240-8351c85bcc62.thor

ffe7cad2436a7474_gizcryf0-7am0-ficb-2e88-5bc857fecfc8.thor

469501f2c1464739_gizcryf0-7am0-ficb-90b9-a83c61c75c93.thor

53901e78e202c085_gizcryf0-7am0-ficb-0294-e863dc80181e.thor

39d851653117df4a_gizcryf0-7am0-ficb-cb1f-0eb28d1d4042.thor

f607091b9b6d4348_gizcryf0-7am0-ficb-44b2-98241cf9d77e.thor

f089f55f0e51d177_gizcryf0-7am0-ficb-7058-92c54b245911.thor

bb07c282bedd69a3_gizcryf0-7am0-ficb-552d-336fd5316db3.thor

7d798f8e738cfc43_gizcryf0-7am0-ficb-1a28-3f89d824d41f.thor

b803bc167ea9f3ae_gizcryf0-7am0-ficb-7ef3-e945d725fc2e.thor

e6f88e5f8a3f4775_gizcryf0-7am0-ficb-e752-3e4d4f94900c.thor

1ac616271aaba6f1_gizcryf0-7am0-ficb-6668-9935679ba7cc.thor

ed8b9ef71e7c3cf5_gizcryf0-7am0-ficb-eb65-c85f7eb58b31.thor

673fa23424dcbd37_gizcryf0-7am0-ficb-88c5-26361ba66637.thor

2f5f0eb612130739_y5jllxe[1].txt

ac7397841fb0d649_gizcryf0-7am0-ficb-1b04-7051720578c6.thor

54ffb50cc3e96318_gizcryf0-7am0-ficb-9e63-61be85ada31a.thor

6ab06d6cb8bc6e48_gizcryf0-7am0-ficb-f71e-fb4ce31d10ba.thor

b0ed9ea97bdf1f45_gizcryf0-7am0-ficb-93be-f8b6b6da56c5.thor

bffa5560d31ccb5a_gizcryf0-7am0-ficb-eb32-7ec92824f4ec.thor

8673405435044fa4_gizcryf0-7am0-ficb-c6ea-7bb33bf87d0c.thor

a05b0956603efa8c_gizcryf0-7am0-ficb-49c8-0f59b228ecdd.thor

ab0916bd26a54d2c_gizcryf0-7am0-ficb-1aba-2adfe6bea429.thor

f29eeca9e64fa5b8_gizcryf0-7am0-ficb-15fb-04e400e6f40b.thor

d072ecbf3ab964ce_gizcryf0-7am0-ficb-2c06-be0a452da17f.thor

a74b18a274fb7b39_gizcryf0-7am0-ficb-d869-c1d4989002d7.thor

2964ce67609c4f07_gizcryf0-7am0-ficb-42d8-97fde6a9e0a8.thor

aa12e70c00e3b69e_gizcryf0-7am0-ficb-db71-654ffadc94cd.thor

50b1887448efe638_gizcryf0-7am0-ficb-645d-5286ea3dbf03.thor

84cde15799268e72_gizcryf0-7am0-ficb-0a19-b7e37b3573ac.thor

3acb09d710d9aa01_gizcryf0-7am0-ficb-7d3d-c3e6742194a5.thor

3d2512dc6e1304ca_gizcryf0-7am0-ficb-a9bf-9f19ba6753c9.thor

ec5799dc9564830f_gizcryf0-7am0-ficb-9762-f754147583cd.thor

e34baea1a5487f8f_gizcryf0-7am0-ficb-e408-2d3923c4548a.thor

84882ee2c964777c_gizcryf0-7am0-ficb-0fe6-2eda5c0fc334.thor

3bb063514cfa922a_gizcryf0-7am0-ficb-c9c7-a9811094478e.thor

fa2856e0c7b2cb97_gizcryf0-7am0-ficb-8fe2-2a0093ec773a.thor

1813c82ea594083a_gizcryf0-7am0-ficb-f8ba-3d3a367e48ef.thor

ab11250441cc0850_gizcryf0-7am0-ficb-25a1-911e04b8af31.thor

57fa9e4a53775911_gizcryf0-7am0-ficb-0f15-5ae1e06a5780.thor

6bf6386c4b8f8ce0_gizcryf0-7am0-ficb-cece-573464b0c2ea.thor

0eeff8a3c4cb38cc_gizcryf0-7am0-ficb-00ab-832b0781de9d.thor

8792b9f78061e3c9_gizcryf0-7am0-ficb-6d4e-0f3800430fd3.thor

6e1798a01aa57bcd_gizcryf0-7am0-ficb-fd8a-d876cc7e22e0.thor

f5ba6cb9689a445e_gizcryf0-7am0-ficb-720c-91d31195a951.thor

2aad0256498cf576_gizcryf0-7am0-ficb-96bd-dcea16dad2b0.thor

8f410137f1c4569c_gizcryf0-7am0-ficb-c476-5402644dece2.thor

1e0cf6143be1ea4f_gizcryf0-7am0-ficb-96d4-fd5ac223eda9.thor

559d47b2dd0dfb88_gizcryf0-7am0-ficb-70aa-edbc44ad03cb.thor

7cb7fc45cd3442a9_gizcryf0-7am0-ficb-4042-dda1692ccae3.thor

c36cde0cea8f37d5_gizcryf0-7am0-ficb-958a-cdf0fc2d9c85.thor

17ab57c78d41118e_gizcryf0-7am0-ficb-4123-332e378eb8cd.thor

c862adf2c5208bd6_gizcryf0-7am0-ficb-9ebf-e3a7938a80c9.thor

5713e494e9adfa84_gizcryf0-7am0-ficb-16ad-a3007a09c955.thor

c97382f9c853f371_gizcryf0-7am0-ficb-821f-67cfdca61a99.thor

787d11988c57d560_gizcryf0-7am0-ficb-2d24-d9cefd9550ba.thor

14d74c076fdcb9ce_gizcryf0-7am0-ficb-f044-051a74ce0e69.thor

2a1fe60a45596a1f_gizcryf0-7am0-ficb-2ba6-a2e718cd9957.thor

59e7916378fd1208_gizcryf0-7am0-ficb-e484-fc4c3041861d.thor

7411b79e6162f533_gizcryf0-7am0-ficb-315c-c59c4ff1c43b.thor

5421cec2ffa6885d_gizcryf0-7am0-ficb-d3e9-720f7c45a0f2.thor

c3914c237f40cbbd_gizcryf0-7am0-ficb-374a-0ce2896cee59.thor

773e8be3b8375201_gizcryf0-7am0-ficb-c984-50cd76f149c6.thor

3f4d522438997747_gizcryf0-7am0-ficb-adbd-8065cdbe53a2.thor

e6db2e2607615722_gizcryf0-7am0-ficb-8436-b722e1b68dce.thor

81d279787ead9a51__28_what_is.html

222d03d62579cf83_gizcryf0-7am0-ficb-f85f-0cde7a71bce4.thor

de355afe30e6822b_gizcryf0-7am0-ficb-85a2-239a86bced53.thor

25b18f2cd3200968_gizcryf0-7am0-ficb-a348-50bc8cdfbf69.thor

065aebc8588e96e4_gizcryf0-7am0-ficb-69da-123a702686f7.thor

7fc6cf26094cb60a_gizcryf0-7am0-ficb-6d0a-12a8049f9243.thor

331f3eee4d00bb1d_gizcryf0-7am0-ficb-4f03-830581348794.thor

b2e1227bdff6a041_gizcryf0-7am0-ficb-1249-41544b165d92.thor

63ba16f86770a834_gizcryf0-7am0-ficb-aec8-9d11270a0c0a.thor

705fe4fc24a80e5b_gizcryf0-7am0-ficb-7c7e-11e9bcb29dce.thor

7ac2bd7dc3b7ab82_gizcryf0-7am0-ficb-680c-6e669572da30.thor

35959b064f7feb14_gizcryf0-7am0-ficb-64db-d8eab98b6df9.thor

13c8a30d042b33a0_gizcryf0-7am0-ficb-a641-c5947d65fa9d.thor

d842e41fc0f38409_gizcryf0-7am0-ficb-e828-89cd2eb7298f.thor

07d72a423f4a87a7_gizcryf0-7am0-ficb-58d7-016a7150239f.thor

31b2e4ea3b61c16d_gizcryf0-7am0-ficb-8ee2-1ac3984a6f20.thor

e1cafcdd1a03f4cc_gizcryf0-7am0-ficb-2fb6-fedfc62f578e.thor

b87f8fc0d76544b1_gizcryf0-7am0-ficb-f610-15fd0fbffbc7.thor

98ee3c37495a88ee_gizcryf0-7am0-ficb-fe87-728345a41ed2.thor

e7da6b3a77c11b06_gizcryf0-7am0-ficb-2844-3a706fdb891c.thor

1649bf80994845c5_gizcryf0-7am0-ficb-4b45-5d4c7caa853a.thor

87b576353524fa11_gizcryf0-7am0-ficb-21a0-2b8c0672e8b0.thor

4ffdb0a9c0a65363_gizcryf0-7am0-ficb-e254-b2d61e739d51.thor

ff9aa3e8ba3e8ba4_gizcryf0-7am0-ficb-0662-fa908cbfacf0.thor

05c582bc5ac1e9be_gizcryf0-7am0-ficb-37a7-6b3ee6a9b7e5.thor

eefa7d04d3e79c5a_gizcryf0-7am0-ficb-d1aa-059aa4c60b7e.thor

6a0894c3a3ee9314_gizcryf0-7am0-ficb-032f-7ae80de1c09b.thor

a816997743cb8656_gizcryf0-7am0-ficb-800f-1d5d33279e5f.thor

b36d50befeaff127_gizcryf0-7am0-ficb-80ae-5e82bea98fe8.thor

bfc7d9031cbca849_gizcryf0-7am0-ficb-4acf-52bd29819396.thor

86797403e19a29dd_gizcryf0-7am0-ficb-ba1d-cd2373a35920.thor

8ac6d3dca3cdffb8_gizcryf0-7am0-ficb-ed5e-f1c522182641.thor

a3de42278087df96_gizcryf0-7am0-ficb-2cc2-ab5e2f5b4729.thor

942eca584ed9b9e3_gizcryf0-7am0-ficb-4aeb-bd638a2d4e8f.thor

b80318707a0063c6_gizcryf0-7am0-ficb-ecab-6eb5c33ff752.thor

66175792fef50264_gizcryf0-7am0-ficb-3bf1-b64a40020f52.thor

c3c426d2c5ffd471_gizcryf0-7am0-ficb-aab7-63d77a7b33b4.thor

e581a1e838a5868d_gizcryf0-7am0-ficb-ae82-c60d1a3b2101.thor

692afce9d6f44bd5_gizcryf0-7am0-ficb-752e-9bed44990278.thor

31d444176d5bf615_gizcryf0-7am0-ficb-a0d7-5c55fa987648.thor

0e8d6583754fe0b8_gizcryf0-7am0-ficb-23c0-ce6b6ea16750.thor

e911e0b3a7194562_gizcryf0-7am0-ficb-fa11-cae43500c058.thor

ba1a6e80ede55997_gizcryf0-7am0-ficb-2362-a0df981da7ef.thor

5587592162dab207_gizcryf0-7am0-ficb-fc3e-763dbd74e026.thor

32c12f77745bcd0d_gizcryf0-7am0-ficb-e90a-609fae3aa983.thor

391bda9dee4c9129_gizcryf0-7am0-ficb-fab5-b03f29da24b6.thor

5b08d9aec57bd95b_gizcryf0-7am0-ficb-68f1-ccb2435bf125.thor

e8bd675ef73bea98_gizcryf0-7am0-ficb-d3d5-93619f0cb088.thor

NRV_365M1NN_.js

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

Behavior Summary

File-Read
  • C:\Users\Harry Dresden\Desktop\desktop.ini
  • C:\Windows\System32\wshom.ocx
  • C:\Users\Harry Dresden\AppData\Local\Temp\NRV_365M1NN_.js
  • C:\Windows\System32\wscript.exe
  • C:\Windows\System32\msxml3.dll
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\Python27\include\pyexpat.h
  • c:\Python27\include\object.h
  • c:\Python27\include\pygetopt.h
  • c:\Python27\include\errcode.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\Lib\test\keycert3.pem
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\OrekLdXCXe.pptx
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\tupleobject.h
  • c:\Python27\include\pyconfig.h
  • c:\Python27\include\cStringIO.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\include\pyerrors.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\structseq.h
  • c:\Python27\include\floatobject.h
  • c:\Python27\include\Python-ast.h
  • c:\Python27\include\osdefs.h
  • c:\Python27\Lib\test\empty.vbs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • c:\Python27\include\pymacconfig.h
  • c:\Python27\include\boolobject.h
  • c:\Python27\include\rangeobject.h
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Python27\include\ceval.h
  • c:\Python27\include\grammar.h
  • c:\Python27\include\import.h
  • \\?\PIPE\browser
  • c:\Python27\include\pythonrun.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\Python27\include\pyarena.h
  • c:\Python27\include\structmember.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\include\ast.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\Python27\include\pgenheaders.h
  • c:\Python27\include\pythread.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\Python27\include\patchlevel.h
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\include\iterobject.h
  • UNC\SHARDREALM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\Python27\include\listobject.h
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • c:\Python27\include\marshal.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • c:\Python27\include\frameobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • c:\Python27\include\longintrepr.h
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\WqUeqEKRcdYl.docx
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Python27\include\opcode.h
  • c:\Python27\include\parsetok.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • c:\Python27\Lib\test\badcert.pem
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\eAWHfXswLz.docx
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\include\sliceobject.h
  • c:\Python27\include\pgen.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\Python27\include\moduleobject.h
  • c:\Python27\include\memoryobject.h
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • c:\Python27\include\objimpl.h
  • c:\Python27\include\Python.h
  • c:\Python27\include\fileobject.h
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\include\stringobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\Python27\include\token.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\Python27\include\bitset.h
  • c:\Python27\include\intobject.h
  • c:\Python27\include\bytes_methods.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\Python27\include\abstract.h
  • c:\Python27\include\pystate.h
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\Python27\include\pycapsule.h
  • c:\Python27\include\methodobject.h
  • c:\lndausa\bin\cert.p12
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • c:\Python27\include\descrobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • \\?\PIPE\wkssvc
  • c:\Python27\include\intrcheck.h
  • c:\Python27\include\pymath.h
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\include\timefuncs.h
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\Python27\tcl\tclConfig.sh
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • c:\Python27\Lib\test\185test.db
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\Python27\include\ucnhash.h
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\test\keycert2.pem
  • c:\Python27\include\py_curses.h
  • c:\Python27\Lib\test\keycert4.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • c:\Python27\include\pyport.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\symtable.h
  • c:\Python27\include\node.h
  • UNC\SHARDREALM\Users\Default\NTUSER.DAT.LOG
  • c:\Python27\Lib\test\pycacert.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\Python27\include\code.h
  • c:\Python27\include\dtoa.h
  • c:\Python27\include\graminit.h
  • c:\Python27\include\asdl.h
  • c:\Python27\include\funcobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\Python27\include\complexobject.h
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\udoQOITRvWikpAerPQr.docm
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\Python27\include\bufferobject.h
  • c:\Python27\include\bytearrayobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • UNC\SHARDREALM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\Python27\include\setobject.h
  • c:\Python27\Lib\test\badkey.pem
  • c:\Python27\include\warnings.h
  • c:\Python27\include\cobject.h
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\include\dictobject.h
  • c:\Python27\include\pyctype.h
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\Python27\Lib\test\nokia.pem
  • c:\Python27\include\cellobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\emfAsjxtGjM.ppt
  • c:\Python27\include\pydebug.h
  • \\?\PIPE\lsarpc
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\Python27\include\pymem.h
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\Python27\Lib\test\dh1024.pem
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\test\sha256.pem
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • c:\Python27\Lib\test\keycert.passwd.pem
  • c:\Python27\include\modsupport.h
  • c:\Python27\include\enumobject.h
  • c:\Python27\include\classobject.h
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\weakrefobject.h
  • c:\Python27\include\eval.h
  • c:\Python27\include\datetime.h
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\Python27\include\unicodeobject.h
  • c:\Python27\include\metagrammar.h
  • c:\Python27\include\pyfpe.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • c:\Python27\include\compile.h
  • c:\Python27\include\genobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • c:\Python27\include\codecs.h
File-Written
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YLC2QM2Y\y5jllxe[1].txt
  • C:\Users\Harry Dresden\AppData\Local\Temp\LHuW6Ik1pvd3.dll
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\Python27\include\frameobject.h
  • c:\Python27\include\pyexpat.h
  • c:\Python27\include\object.h
  • c:\Python27\include\pygetopt.h
  • UNC\SHARDREALM\Users\Public\Videos\Sample Videos\_10_WHAT_is.html
  • c:\Python27\include\errcode.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\Lib\test\keycert3.pem
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\emfAsjxtGjM.ppt
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\OrekLdXCXe.pptx
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\tupleobject.h
  • c:\Python27\include\pyconfig.h
  • c:\Python27\include\cStringIO.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\include\pyerrors.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\structseq.h
  • c:\Python27\include\floatobject.h
  • c:\Python27\include\Python-ast.h
  • c:\6cdeacda242012e0e5b593e657\1042\_7_WHAT_is.html
  • c:\Python27\Lib\test\empty.vbs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • c:\Python27\include\pymacconfig.h
  • c:\Python27\include\boolobject.h
  • c:\Python27\include\rangeobject.h
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\_2_WHAT_is.html
  • c:\Python27\include\grammar.h
  • c:\Python27\include\import.h
  • \\?\PIPE\browser
  • c:\Python27\include\pythonrun.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • c:\6cdeacda242012e0e5b593e657\1037\_28_WHAT_is.html
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\Python27\include\pyarena.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\_2_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • c:\Python27\include\structmember.h
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\Python27\Lib\test\nullcert.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\_8_WHAT_is.html
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\include\ast.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\6cdeacda242012e0e5b593e657\1044\_9_WHAT_is.html
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\Python27\include\pgenheaders.h
  • c:\Python27\include\pythread.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\Python27\include\patchlevel.h
  • UNC\SHARDREALM\Users\Default\_11_WHAT_is.html
  • c:\Python27\include\bytearrayobject.h
  • c:\6cdeacda242012e0e5b593e657\2052\_15_WHAT_is.html
  • c:\Python27\include\iterobject.h
  • c:\6cdeacda242012e0e5b593e657\1043\_8_WHAT_is.html
  • UNC\SHARDREALM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • c:\Python27\Lib\test\_1_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\Python27\include\listobject.h
  • c:\Python27\Lib\test\keycert.pem
  • c:\6cdeacda242012e0e5b593e657\2070\_16_WHAT_is.html
  • c:\lndausa\bin\_0_WHAT_is.html
  • c:\Python27\include\traceback.h
  • c:\6cdeacda242012e0e5b593e657\1055\_14_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1053\_13_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • c:\Python27\include\marshal.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\_13_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\_1_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1046\_11_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • c:\Python27\include\longintrepr.h
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\WqUeqEKRcdYl.docx
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\_7_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Python27\include\opcode.h
  • c:\Python27\include\parsetok.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • c:\Python27\Lib\test\badcert.pem
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\_9_WHAT_is.html
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\eAWHfXswLz.docx
  • c:\6cdeacda242012e0e5b593e657\1036\_27_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\include\sliceobject.h
  • c:\Python27\include\pgen.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\include\moduleobject.h
  • c:\6cdeacda242012e0e5b593e657\3082\_17_WHAT_is.html
  • c:\Python27\include\memoryobject.h
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • c:\Python27\include\objimpl.h
  • c:\Python27\include\Python.h
  • c:\Python27\include\fileobject.h
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\_0_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\include\stringobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1032\_24_WHAT_is.html
  • c:\Python27\include\token.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\Python27\include\bitset.h
  • c:\Python27\include\intobject.h
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\6cdeacda242012e0e5b593e657\1040\_5_WHAT_is.html
  • c:\Python27\include\abstract.h
  • c:\Python27\include\pystate.h
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\Python27\Lib\test\keycert.passwd.pem
  • c:\Python27\include\methodobject.h
  • c:\lndausa\bin\cert.p12
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • c:\6cdeacda242012e0e5b593e657\1029\_21_WHAT_is.html
  • c:\Python27\include\descrobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • \\?\PIPE\wkssvc
  • c:\Python27\include\intrcheck.h
  • c:\Python27\include\pymath.h
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\timefuncs.h
  • c:\6cdeacda242012e0e5b593e657\1033\_25_WHAT_is.html
  • c:\Python27\tcl\tclConfig.sh
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1049\_12_WHAT_is.html
  • c:\Python27\Lib\test\185test.db
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\Python27\include\ucnhash.h
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\test\keycert2.pem
  • c:\Python27\include\py_curses.h
  • c:\Python27\Lib\test\keycert4.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • c:\6cdeacda242012e0e5b593e657\1038\_3_WHAT_is.html
  • c:\Python27\include\pyport.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1025\_18_WHAT_is.html
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\symtable.h
  • c:\Python27\include\node.h
  • UNC\SHARDREALM\Users\Default\NTUSER.DAT.LOG
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\_3_WHAT_is.html
  • c:\Python27\Lib\test\pycacert.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\Python27\include\code.h
  • c:\Python27\include\dtoa.h
  • c:\Python27\include\graminit.h
  • c:\Python27\include\asdl.h
  • c:\Python27\include\funcobject.h
  • c:\6cdeacda242012e0e5b593e657\1028\_19_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\Python27\include\complexobject.h
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • UNC\SHARDREALM\Users\Harry Dresden\Contacts\_12_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • c:\Python27\include\ceval.h
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\udoQOITRvWikpAerPQr.docm
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\6cdeacda242012e0e5b593e657\1030\_22_WHAT_is.html
  • c:\Python27\include\bufferobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\_5_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\_6_WHAT_is.html
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • c:\6cdeacda242012e0e5b593e657\1035\_26_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\6cdeacda242012e0e5b593e657\1031\_23_WHAT_is.html
  • c:\Python27\include\setobject.h
  • c:\Python27\Lib\test\badkey.pem
  • c:\Python27\include\warnings.h
  • c:\Python27\include\cobject.h
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\include\dictobject.h
  • c:\Python27\include\pyctype.h
  • c:\Python27\tcl\tix8.4.3\pref\_29_WHAT_is.html
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • c:\Python27\include\osdefs.h
  • c:\Python27\Lib\test\nokia.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\_4_WHAT_is.html
  • c:\Python27\include\cellobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • c:\Python27\include\pydebug.h
  • \\?\PIPE\lsarpc
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\Python27\Lib\test\check_soundcard.vbs
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\ProgramData\WebEx\WebEx\12_1324\_20_WHAT_is.html
  • c:\Python27\include\pymem.h
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\Python27\Lib\test\dh1024.pem
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • c:\Python27\tcl\_30_WHAT_is.html
  • c:\Python27\include\_4_WHAT_is.html
  • c:\Python27\Lib\test\sha256.pem
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • c:\Python27\include\pycapsule.h
  • c:\Python27\include\modsupport.h
  • c:\Python27\include\enumobject.h
  • c:\Python27\include\classobject.h
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\weakrefobject.h
  • c:\Python27\include\eval.h
  • c:\Python27\include\datetime.h
  • c:\6cdeacda242012e0e5b593e657\1045\_10_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\6cdeacda242012e0e5b593e657\1041\_6_WHAT_is.html
  • c:\Python27\include\unicodeobject.h
  • c:\Python27\include\metagrammar.h
  • c:\Python27\include\pyfpe.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • c:\Python27\include\compile.h
  • c:\Python27\include\genobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • c:\Python27\include\codecs.h
File-Deleted
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000000.db
File-Opened
  • C:\Windows\System32\wshqos.dll
  • C:\Users\Harry Dresden\AppData\Local\Temp\NRV_365M1NN_.js
  • C:\Windows\System32\wshom.ocx
  • C:\
  • C:\Windows\Globalization\Sorting\sortdefault.nls
  • C:\Users\
  • C:\Users\Harry Dresden\
  • C:\Users\Harry Dresden\AppData\
  • C:\Users\Harry Dresden\AppData\Local\
  • C:\Windows\SysWOW64\rundll32.exe
  • C:\Windows\System32\en-US\wshqos.dll.mui
  • C:\Users\Harry Dresden\Desktop\desktop.ini
  • C:\Windows\System32\en-US\wshtcpip.dll.mui
  • C:\Windows\System32\rsaenh.dll
  • C:\Windows\System32\msxml3.dll
  • C:\Windows\System32\en-US\wship6.dll.mui
  • C:\Windows\System32\wscript.exe
  • C:\Windows\
  • C:\Windows\SysWOW64\
  • c:\Python27\include\frameobject.h
  • c:\Python27\include\pyexpat.h
  • c:\Python27\Lib\ctypes
  • UNC\SHARDREALM\Users\Harry Dresden\Documents
  • c:\Users\Default\Links
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages
  • c:\Python27\include\pymacconfig.h
  • c:\Python27\include\ast.h
  • c:\Python27\include\memoryobject.h
  • c:\Python27\Lib\site-packages\pip\_vendor\colorama
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources
  • c:\Python27\DLLs
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol
  • c:\Python27\include\tupleobject.h
  • UNC\SHARDREALM\Users\Harry Dresden\Favorites\Links for United States
  • c:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\ProgramData\Adobe\Setup
  • c:\Python27\Lib\test\empty.vbs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\en-US
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages
  • UNC\SHARDREALM\Users\Harry Dresden\OneDrive
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Users\Harry Dresden\OneDrive
  • c:\Python27\include\grammar.h
  • c:\ProgramData\Microsoft\PlayReady\Cache\S-1-5-21-3416602863-1947377224-293699093-1001
  • c:\Python27\include\import.h
  • c:\Users\Public\Libraries
  • \\?\PIPE\browser
  • c:\Python27\Lib\test\tracedmodules
  • c:\ProgramData\Adobe\ARM
  • c:\Python27\tcl\tcl8.5\tzdata\Indian
  • c:\Users\Public
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Queue
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource
  • c:\Python27\Lib
  • \??\VBoxMiniRdrDN
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • c:\ProgramData
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\Python27\Lib\site-packages\pip
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A6
  • c:\Python27\Lib\ctypes\macholib
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\Security
  • c:\Python27\Lib\site-packages
  • c:\lndausa\bin
  • c:\inetpub\history\CFGHISTORY_0000000004\schema
  • c:\Python27\Lib\unittest\test
  • c:\ProgramData\Microsoft\PlayReady
  • c:\Python27\Lib\xml\dom
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00
  • c:\Python27\Lib\site-packages\pip\models
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • c:\Python27\include\marshal.h
  • UNC\SHARDREALM\Users\Public\Foxit Software
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate
  • c:\Python27\Tools\i18n
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\Python27\tcl\tcl8\8.4
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog
  • c:\ProgramData\Microsoft\Crypto\Keys
  • UNC\SHARDREALM\Users\Public\Music\Sample Music
  • c:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319
  • c:\Python27\Lib\ctypes\test
  • c:\Users\Harry Dresden\Searches
  • c:\Python27\Lib\test\badcert.pem
  • c:\ProgramData\Adobe\ARM\S
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • c:\Python27\Lib\ensurepip
  • c:\Python27\include\pgen.h
  • UNC\SHARDREALM\Users
  • c:\Python27\tcl\tcl8.5\tzdata\Canada
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\Users\Harry Dresden\Downloads
  • c:\Python27\include\objimpl.h
  • c:\ProgramData\Microsoft\eHome
  • c:\Python27\tcl\tk8.5\demos\images
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images
  • c:\Python27\Lib\test\cjkencodings
  • c:\inetpub\wwwroot\aspnet_client\system_web
  • UNC\SHARDREALM\Users\Public\Music
  • c:\Python27\tcl\tcl8.5\tzdata\America\Kentucky
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US
  • c:\Python27\include\abstract.h
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\keycert.passwd.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • c:\Python27\include\object.h
  • c:\Python27\tcl\tix8.4.3
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • c:\ProgramData\Microsoft\RAC\PublishedData
  • UNC\SHARDREALM\Users\Harry Dresden\Links
  • c:\lndausa\lib
  • c:\inetpub\history\CFGHISTORY_0000000004
  • c:\inetpub\history\CFGHISTORY_0000000001
  • c:\Python27\include\pydebug.h
  • c:\inetpub\history\CFGHISTORY_0000000003
  • c:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204
  • c:\Users\Harry Dresden\Favorites\Links for United States
  • c:\Python27\Lib\lib2to3\tests\data\fixers
  • c:\Python27\tcl\tcl8.5\tzdata\US
  • c:\Python27\tcl\tcl8.5\tzdata
  • UNC\SHARDREALM\Users\Public\Videos
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\Python27\include\pyport.h
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • UNC\SHARDREALM\Users\Public\Documents
  • c:\Python27\Lib\email
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\tcl\tix8.4.3\demos\samples
  • c:\Python27\Lib\lib-tk\test\test_tkinter
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • UNC\SHARDREALM\Users\Harry Dresden\Music
  • c:\lndausa\modules
  • c:\Python27\tcl\tcl8.5\tzdata\America\North_Dakota
  • c:\Python27\Lib\test\crashers
  • c:\ProgramData\Microsoft\Windows Defender\LocalCopy
  • c:\Python27\include\dtoa.h
  • c:\Python27\include\asdl.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • c:\Users\Harry Dresden\Contacts
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0
  • c:\PerfLogs
  • UNC\SHARDREALM\Users\Public\Libraries
  • c:\
  • c:\Python27\include\complexobject.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders
  • c:\Python27\tcl\tcl8\8.5
  • UNC\SHARDREALM\Users\Default\Desktop
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • c:\Python27\libs
  • c:\ProgramData\Microsoft\ClickToRun\MachineData
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • UNC\SHARDREALM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • c:\ProgramData\Microsoft\Assistance
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\pyctype.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results
  • c:\Users\Harry Dresden\Videos
  • c:\Python27\Lib\pydoc_data
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • UNC\SHARDREALM\Users\Default\Music
  • c:\ProgramData\Microsoft\Crypto\DSS
  • c:\ProgramData\Adobe\Acrobat
  • c:\Python27\tcl\tcl8.5\tzdata\Atlantic
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0
  • c:\ProgramData\Microsoft\Network
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger
  • c:\Users\Default\Downloads
  • c:\Python27\include\structmember.h
  • c:\Python27\Lib\xml
  • c:\Python27\tcl\tcl8.5\tzdata\Australia
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17
  • c:\Python27\include\fileobject.h
  • c:\Python27\tcl\tk8.5
  • c:\ProgramData\Microsoft\PlayReady\Cache
  • c:\6cdeacda242012e0e5b593e657\3082
  • c:\Python27\Lib\site-packages\pip\compat
  • c:\Python27\Lib\test\leakers
  • c:\Python27\tcl\tcl8\8.4\platform
  • c:\Python27\include\modsupport.h
  • c:\ProgramData\regid.1991-06.com.microsoft
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\filters
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\x-none.16
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\DD
  • c:\Python27\Tools\pynche\X
  • c:\Python27\include\bufferobject.h
  • c:\Python27\Tools\Scripts
  • c:\Python27\include\cellobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\35
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore
  • c:\Python27\Lib\test\nokia.pem
  • c:\Python27\include\compile.h
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • c:\lndausa\lib\api
  • C:\Users\Harry Dresden\AppData\Local\Temp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\tcl\tk8.5\images
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\ProgramData\Microsoft\DRM
  • UNC\SHARDREALM\Users\Harry Dresden\Videos
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US
  • c:\Python27\Lib\idlelib\idle_test
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\include
  • c:\Python27\Lib\test\nullcert.pem
  • c:\Python27\Lib\site-packages\setuptools
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\structseq.h
  • c:\6cdeacda242012e0e5b593e657\1029
  • c:\6cdeacda242012e0e5b593e657\1028
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}
  • c:\Python27\Lib\site-packages\pip\commands
  • c:\Python27\Lib\lib2to3\tests\data\fixers\myfixes
  • c:\6cdeacda242012e0e5b593e657\1025
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us
  • c:\ProgramData\Adobe\ARM\S\5521
  • c:\Python27\Lib\email\test\data
  • c:\ProgramData\Microsoft\Windows Defender\Support
  • c:\ProgramData\WebEx\WebEx
  • c:\6cdeacda242012e0e5b593e657\2052
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • UNC\SHARDREALM\Users\Default\Saved Games
  • c:\Python27\tcl\tcl8.5\opt0.4
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases
  • c:\Python27\include\pgenheaders.h
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US
  • c:\Python27\tcl\tcl8.5\encoding
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs
  • c:\Python27\Lib\msilib
  • c:\ProgramData\Microsoft\WwanSvc\Profiles
  • UNC\SHARDREALM\Users\Harry Dresden\Contacts
  • c:\Python27\Lib\encodings
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\_backport
  • c:\ProgramData\Microsoft\Assistance\Client
  • UNC\SHARDREALM\Users\Default\Pictures
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\95
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • c:\Python27\Lib\site-packages\_markerlib
  • c:\ProgramData\Microsoft\Diagnosis\LocalTraceStore
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • c:\inetpub\custerr
  • c:\Python27\include\longintrepr.h
  • c:\inetpub\custerr\en-US
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches
  • c:\Python27\Lib\test\185test.db
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\WqUeqEKRcdYl.docx
  • c:\Python27\include\opcode.h
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\eAWHfXswLz.docx
  • c:\ProgramData\Microsoft\Crypto\RSA
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tk8.5\ttk
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\01
  • c:\Users\Default\Favorites
  • c:\inetpub\history
  • c:\Python27\include\moduleobject.h
  • c:\ProgramData\Microsoft\Windows NT
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\chardet
  • c:\ProgramData\Microsoft\Vault
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData
  • UNC\SHARDREALM\Users\Harry Dresden\Pictures
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\Python27\include\boolobject.h
  • C:\Windows\SysWOW64\en-US\VssTrace.DLL.mui
  • c:\Python27\include\token.h
  • UNC\SHARDREALM\Users\Default\Videos
  • c:\Python27\include\bitset.h
  • c:\Python27\include\warnings.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages
  • UNC\SHARDREALM\Users\Harry Dresden
  • c:\ProgramData\Mozilla\logs
  • UNC\SHARDREALM\Users\Public\Recorded TV
  • c:\Python27\include\pycapsule.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\70
  • c:\Python27\tcl\tcl8.5\tzdata\Mexico
  • c:\Python27\Lib\importlib
  • c:\ProgramData\Microsoft\Crypto
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\media
  • c:\Python27\tcl\tcl8.5
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\Python27\tcl\tcl8.5\tzdata\Africa
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\ProgramData\McAfee
  • c:\Users\Public\Videos
  • c:\Python27\include\enumobject.h
  • c:\Python27\Lib\site-packages\pip\vcs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\bsddb\test
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43
  • c:\Python27\Lib\test\keycert2.pem
  • c:\ProgramData\Microsoft\Search\Data\Applications
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F7
  • c:\Python27\include\ucnhash.h
  • c:\Python27\include\py_curses.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3
  • c:\Python27\Lib\xml\parsers
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\keycert4.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • c:\Python27\tcl\tcl8.5\msgs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Inbox
  • c:\Users\Harry Dresden
  • UNC\SHARDREALM\Users\Public\Recorded TV\Sample Media
  • c:\Python27\include\node.h
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\ProgramData\McAfee\MCLOGS\Common\jxpiinstall
  • c:\ProgramData\Microsoft\Windows Defender\Quarantine
  • c:\Users\Public\Favorites
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\ProgramData\Microsoft\Office
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • UNC\SHARDREALM\Users\Public
  • c:\ProgramData\NovaTech Network\NovaBench
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • c:\Python27\Lib\site-packages\pip\_vendor\_markerlib
  • c:\Python27\tcl\reg1.2
  • c:\lndausa\bin\cert.p12
  • c:\Users\ruiner
  • c:\Python27\Lib\xml\etree
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • c:\ProgramData\Microsoft\Media Player
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl
  • c:\Users\Public\Videos\Sample Videos
  • UNC\SHARDREALM\Users\Harry Dresden\Favorites
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01
  • c:\Python27\include\symtable.h
  • c:\Python27\include\cStringIO.h
  • c:\Python27\include\cobject.h
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • c:\Python27\tcl\tcl8.5\tzdata\Antarctica
  • c:\Python27\Lib\xml\sax
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\trie
  • c:\Users\Harry Dresden\Desktop
  • c:\Users\Public\Recorded TV
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\emfAsjxtGjM.ppt
  • c:\ProgramData\Microsoft\Office\Heartbeat
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\42
  • c:\Python27\tcl\tcl8.5\tzdata\Etc
  • c:\Python27\Lib\bsddb
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\47
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups
  • c:\Python27\Lib\wsgiref
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\contrib
  • c:\Python27\include\pyfpe.h
  • c:\ProgramData\Microsoft\User Account Pictures
  • c:\ProgramData\Sun\Java\Java Update
  • c:\Python27\Lib\test\sha256.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • c:\Users
  • c:\Users\Default\Saved Games
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources
  • c:\inetpub\history\CFGHISTORY_0000000005\schema
  • c:\Python27\include\datetime.h
  • c:\inetpub
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\udoQOITRvWikpAerPQr.docm
  • c:\Users\Default
  • c:\Python27\tcl\tcl8.5\tzdata\Pacific
  • c:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog
  • c:\Python27\tcl\tk8.5\msgs
  • c:\Python27\tcl\tcl8.5\tzdata\America
  • c:\ProgramData\Microsoft\Diagnosis\DownloadedSettings
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\{98101498-C465-4F51-8751-D1919E97D29D}
  • c:\inetpub\wwwroot
  • c:\Python27\Lib\multiprocessing\dummy
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}
  • c:\ProgramData\Microsoft\MF
  • c:\ProgramData\Sun\Java
  • c:\Python27\include\errcode.h
  • c:\Python27\Lib\test
  • c:\Python27\Lib\test\keycert3.pem
  • c:\Users\Public\Downloads
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\OrekLdXCXe.pptx
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage
  • c:\ProgramData\Microsoft\Device Stage\Task
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\include\pyerrors.h
  • c:\Python27\Lib\unittest
  • c:\6cdeacda242012e0e5b593e657\Graphics
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}
  • c:\Python27\Lib\test\capath
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • c:\Recovery
  • c:\ProgramData\Microsoft\Device Stage
  • c:\Python27\tcl\tk8.5\demos
  • c:\Python27\include\ceval.h
  • c:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18
  • UNC\SHARDREALM\Users\Public\Desktop
  • c:\ProgramData\Microsoft\Assistance\Client\1.0
  • c:\Python27\include\pythonrun.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • c:\ProgramData\Oracle
  • c:\Python27\include\pygetopt.h
  • c:\Python27\Lib\distutils\tests
  • c:\Python27\include\codecs.h
  • c:\Python27\Lib\logging
  • c:\ProgramData\Microsoft\RAC
  • c:\Python27\Lib\site-packages\pip\req
  • c:\Users\Harry Dresden\Links
  • c:\ProgramData\Microsoft\DeviceSync
  • c:\Python27\Doc
  • c:\lndausa\lib\core
  • c:\Users\Public\Pictures
  • c:\Python27\tcl\tix8.4.3\demos\bitmaps
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\Python27\Lib\site-packages\pip\_vendor\requests
  • c:\Python27\include\patchlevel.h
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\Lib\compiler
  • c:\Python27\Scripts
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\42
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\17
  • c:\Users\Public\Recorded TV\Sample Media
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • c:\Python27\tcl\dde1.3
  • c:\Python27\tcl\tcl8.5\tzdata\SystemV
  • c:\ProgramData\NovaTech Network
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • \\?\PIPE\lsarpc
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • UNC\SHARDREALM\Users\ruiner
  • c:\lndausa\lib\common
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js
  • c:\ProgramData\Microsoft\Diagnosis\AsimovUploader
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images
  • c:\Python27\tcl\tcl8.5\tzdata\Chile
  • c:\ProgramData\Microsoft\ClickToRun\UserData
  • c:\Python27\Lib\test\xmltestdata
  • c:\ProgramData\Microsoft\WPD
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • c:\Python27\Lib\site-packages\pip\_vendor
  • c:\ProgramData\Sun
  • c:\Python27\include\Python.h
  • UNC\SHARDREALM\Users\Default\Documents
  • c:\Python27\tcl\tclConfig.sh
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\Python27\include\metagrammar.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\pystate.h
  • c:\Users\Default\Desktop
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
  • c:\ProgramData\Microsoft\WwanSvc
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • \\?\PIPE\wkssvc
  • c:\ProgramData\Microsoft\Event Viewer\Views
  • c:\Python27\Lib\json\tests
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\serializer
  • c:\Python27\include\osdefs.h
  • c:\Python27\Tools
  • c:\Python27\include\timefuncs.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css
  • c:\ProgramData\Microsoft\IlsCache
  • c:\Python27\Lib\lib-tk
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Store
  • c:\ProgramData\Microsoft\Windows NT\MSFax\SentItems
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\en-us.16
  • c:\Python27\Lib\site-packages\pip\operations
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox
  • c:\Python27\Lib\site-packages\pip\_vendor\lockfile
  • c:\Python27\Lib\curses
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\floatobject.h
  • UNC\SHARDREALM\Users\Default\NTUSER.DAT.LOG
  • c:\Python27\Lib\test\pycacert.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\Python27\include\pymactoolbox.h
  • c:\Python27\Lib\test\badkey.pem
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • c:\Users\Default\Music
  • c:\Python27\Lib\email\mime
  • c:\Users\Harry Dresden\Music
  • c:\lndausa\modules\auxiliary
  • c:\6cdeacda242012e0e5b593e657\1053
  • c:\6cdeacda242012e0e5b593e657\1055
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • UNC\SHARDREALM\Users\Public\Favorites
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3
  • c:\Python27\tcl\tcl8.5\tzdata\Asia
  • UNC\SHARDREALM\Users\Public\Downloads
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css
  • c:\Python27\Lib\multiprocessing
  • c:\Users\Default\Documents
  • UNC\SHARDREALM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\Python27\Tools\pynche
  • c:\Users\Public\Desktop
  • c:\ProgramData\Microsoft\User Account Pictures\Default Pictures
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • c:\Python27\Lib\lib-tk\test\test_ttk
  • c:\Users\Harry Dresden\Documents
  • c:\Python27\include\sysmodule.h
  • c:\ProgramData\McAfee\MCLOGS\Common
  • UNC\SHARDREALM\Users\Harry Dresden\Favorites\Links
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • c:\ProgramData\Microsoft\IdentityCRL
  • c:\ProgramData\WebEx\WebEx\12_1324
  • c:\Python27\Lib\site-packages\pip\utils
  • c:\Python27\Lib\distutils\command
  • c:\Users\Harry Dresden\Saved Games
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • UNC\SHARDREALM\Users\Default
  • c:\Python27\include\pyarena.h
  • c:\ProgramData\Microsoft\Windows Defender
  • c:\Python27\include\eval.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • c:\Python27
  • c:\Python27\Lib\hotshot
  • c:\Python27\include\genobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\Python27\Tools\versioncheck
  • c:\Python27\tcl\tcl8.5\tzdata\Arctic
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F7
  • c:\Users\Public\Music
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3
  • c:\Python27\Lib\test\audiodata
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters
  • c:\Python27\include\intrcheck.h
  • c:\ProgramData\Microsoft\Network\Connections
  • c:\Python27\Lib\test\dh1024.pem
  • c:\Python27\Lib\sqlite3
  • c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
  • UNC\SHARDREALM\Users\Public\Pictures
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\43
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js
  • UNC\SHARDREALM\Users\Default\Downloads
  • UNC\SHARDREALM\Users\Default\Links
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\ProgramData\Microsoft\Diagnosis
  • c:\Python27\Lib\distutils
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\tests
  • c:\Python27\Lib\idlelib\Icons
  • c:\ProgramData\Microsoft\Device Stage\Device
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib
  • c:\Python27\Lib\test\subprocessdata
  • c:\ProgramData\Microsoft OneDrive\setup
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\35
  • c:\Python27\include\pymem.h
  • c:\inetpub\wwwroot\aspnet_client
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\ProgramData\Microsoft\Network\Downloader
  • c:\Users\Public\Foxit Software
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Quick
  • c:\ProgramData\Microsoft\Windows NT\MSScan
  • c:\Python27\Lib\lib2to3\tests
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\inetpub\history\CFGHISTORY_0000000005
  • c:\ProgramData\Microsoft\Crypto\DSS\MachineKeys
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\Lib\site-packages\pkg_resources
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info
  • c:\Python27\include\Python-ast.h
  • c:\Python27\include\rangeobject.h
  • c:\Python27\tcl\tcl8.5\tzdata\Brazil
  • c:\Users\Harry Dresden\Favorites\Links
  • c:\Python27\Lib\test\imghdrdata
  • c:\Python27\include\iterobject.h
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates
  • UNC\SHARDREALM\Users\Harry Dresden\Saved Games
  • c:\ProgramData\Microsoft\RAC\Outbound
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • c:\inetpub\history\CFGHISTORY_0000000002
  • c:\Python27\include\funcobject.h
  • c:\Python27\include\listobject.h
  • c:\ProgramData\Microsoft\NetFramework
  • c:\ProgramData\Adobe\ARM\Reader_11.0.10
  • c:\ProgramData\Microsoft
  • c:\Users\Public\Pictures\Sample Pictures
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Service
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\Users\Default\Videos
  • c:\ProgramData\Microsoft\Search\Data
  • c:\Python27\tcl
  • c:\Python27\Lib\json
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US
  • c:\Python27\include\pythread.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement
  • c:\Python27\Lib\lib2to3\fixes
  • c:\Python27\tcl\tix8.4.3\bitmaps
  • c:\Python27\Lib\site-packages\setuptools\command
  • c:\6cdeacda242012e0e5b593e657
  • c:\Python27\tcl\tcl8.5\tzdata\America\Indiana
  • c:\6cdeacda242012e0e5b593e657\2070
  • c:\Python27\include\sliceobject.h
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\lndausa\modules\packages
  • c:\Python27\Lib\test\decimaltestdata
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\DD
  • c:\Python27\include\descrobject.h
  • c:\ProgramData\Microsoft\Diagnosis\UIF
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A6
  • c:\Python27\tcl\tcl8.5\tzdata\Europe
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5
  • c:\Python27\include\stringobject.h
  • c:\Python27\Lib\lib2to3
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default
  • c:\Python27\include\intobject.h
  • c:\ProgramData\Microsoft\Event Viewer
  • c:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\ProgramData\Microsoft\ClickToRun
  • c:\Python27\tcl\tix8.4.3\pref
  • c:\Python27\include\methodobject.h
  • c:\Python27\include\pyconfig.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • UNC\SHARDREALM\Users\Default\Favorites
  • c:\Python27\tcl\tcl8.5\http1.0
  • c:\Python27\include\pymath.h
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\parsetok.h
  • c:\ProgramData\Adobe\Acrobat\11.0
  • c:\Python27\Lib\ensurepip\_bundled
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\Python27\include\classobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • c:\Users\Public\Music\Sample Music
  • c:\Python27\tcl\tcl8
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager
  • c:\Python27\Lib\lib2to3\tests\data
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70
  • c:\ProgramData\Microsoft OneDrive
  • UNC\SHARDREALM\Users\Harry Dresden\Searches
  • c:\Python27\tcl\tcl8.5\tzdata\America\Argentina
  • c:\Python27\include\setobject.h
  • c:\Recovery\015e7760-d44b-11e0-8947-954f09601788
  • c:\Python27\Lib\idlelib
  • c:\PerfLogs\Admin
  • c:\Python27\include\graminit.h
  • c:\Python27\Lib\site-packages\pip\_vendor\progress
  • c:\Users\Harry Dresden\Pictures
  • c:\ProgramData\Microsoft\Diagnosis\Sideload
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\ssl_match_hostname
  • c:\Users\Harry Dresden\Favorites
  • c:\ProgramData\Passmark
  • c:\Python27\Lib\lib-tk\test
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • c:\ProgramData\Adobe
  • c:\Users\Public\Foxit Software\Foxit Reader
  • c:\ProgramData\Microsoft\Search
  • c:\ProgramData\Passmark\PerformanceTest
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • UNC\SHARDREALM\Users\Public\Videos\Sample Videos
  • c:\Python27\include\bytearrayobject.h
  • c:\ProgramData\Microsoft\NetFramework\BreadcrumbStore
  • c:\Python27\Lib\email\test
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}
  • c:\ProgramData\WebEx
  • c:\inetpub\wwwroot\msmq
  • c:\Python27\tcl\tix8.4.3\demos
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\include\dictobject.h
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\packaging
  • c:\ProgramData\McAfee\MCLOGS
  • c:\Users\Default\Pictures
  • c:\6cdeacda242012e0e5b593e657\1049
  • c:\Users\Public\Documents
  • c:\6cdeacda242012e0e5b593e657\1046
  • c:\6cdeacda242012e0e5b593e657\1045
  • c:\6cdeacda242012e0e5b593e657\1044
  • c:\6cdeacda242012e0e5b593e657\1043
  • c:\6cdeacda242012e0e5b593e657\1042
  • c:\6cdeacda242012e0e5b593e657\1041
  • c:\6cdeacda242012e0e5b593e657\1040
  • c:\Python27\Lib\site-packages\pip\_vendor\packaging
  • c:\ProgramData\Microsoft\eHome\logs
  • c:\ProgramData\Microsoft\Windows Defender\Scans
  • c:\ProgramData\Microsoft\Windows NT\MSFax
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\Python27\Lib\sqlite3\test
  • c:\lndausa
  • c:\ProgramData\Mozilla
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • c:\Python27\Tools\webchecker
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates
  • c:\Python27\include\weakrefobject.h
  • c:\Python27\Lib\lib2to3\pgen2
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History
  • c:\Python27\include\code.h
  • c:\Python27\include\unicodeobject.h
  • c:\ProgramData\Microsoft\RAC\StateData
  • c:\6cdeacda242012e0e5b593e657\1038
  • c:\ProgramData\Microsoft\DRM\Server
  • c:\6cdeacda242012e0e5b593e657\1032
  • c:\6cdeacda242012e0e5b593e657\1033
  • c:\6cdeacda242012e0e5b593e657\1030
  • c:\6cdeacda242012e0e5b593e657\1031
  • c:\6cdeacda242012e0e5b593e657\1036
  • c:\6cdeacda242012e0e5b593e657\1037
  • c:\6cdeacda242012e0e5b593e657\1035
File-Moved
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1032\GIZCRYF0-7AM0-FICB-8240-8351C85BCC62.thor
  • c:\Python27\Lib\test\check_soundcard.vbs -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-FAB5-B03F29DA24B6.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-78F2-F9705D64B503.thor
  • \\SHARDREALM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3 -> \\SHARDREALM\Users\Public\Music\Sample Music\GIZCRYF0-7AM0-FICB-CA53-9167820C1E38.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\GIZCRYF0-7AM0-FICB-2F6E-D3442E467DC0.thor
  • c:\Python27\include\classobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-1617-BDEF82E8CD3C.thor
  • c:\Python27\Lib\test\nullbytecert.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-C560-0EB4E5448B0E.thor
  • c:\Python27\include\intobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-4AEB-BD638A2D4E8F.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-F78D-8D17BC4151AA.thor
  • c:\Python27\include\opcode.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-8EE2-1AC3984A6F20.thor
  • c:\Python27\include\intrcheck.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-2C06-BE0A452DA17F.thor
  • c:\Python27\include\osdefs.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-71C0-74D61FF37CCE.thor
  • c:\Python27\include\graminit.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-6D0A-12A8049F9243.thor
  • c:\Python27\include\sliceobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-F24B-3C70D9A0E9E1.thor
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1031\GIZCRYF0-7AM0-FICB-25A1-911E04B8AF31.thor
  • c:\Python27\include\code.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-B8D4-5CFF3ED2BC5C.thor
  • c:\Python27\include\pythread.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-4042-DDA1692CCAE3.thor
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYF0-7AM0-FICB-21A0-2B8C0672E8B0.thor
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYF0-7AM0-FICB-8F61-A987F13CABE0.thor
  • \\SHARDREALM\Users\Public\Videos\Sample Videos\Wildlife.wmv -> \\SHARDREALM\Users\Public\Videos\Sample Videos\GIZCRYF0-7AM0-FICB-5EDA-3BF8F6295B0F.thor
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1037\GIZCRYF0-7AM0-FICB-37A7-6B3EE6A9B7E5.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-C5FB-2FEB3444C12A.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\WqUeqEKRcdYl.docx -> \\SHARDREALM\Users\Harry Dresden\Desktop\GIZCRYF0-7AM0-FICB-989F-4AEA3139924A.thor
  • c:\Python27\include\pyerrors.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-EB32-7EC92824F4EC.thor
  • c:\Python27\include\genobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-B695-8B5E881FA811.thor
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1030\GIZCRYF0-7AM0-FICB-FA11-CAE43500C058.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\GIZCRYF0-7AM0-FICB-5956-F661B14358BB.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-A0E8-6A3D95775DFA.thor
  • c:\Python27\include\bytesobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-9762-F754147583CD.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-B758-258B93FE1C16.thor
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1042\GIZCRYF0-7AM0-FICB-5A4F-2DC0D81BE5EE.thor
  • c:\Python27\Lib\test\keycert2.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-DB71-654FFADC94CD.thor
  • c:\Python27\include\memoryobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-032F-7AE80DE1C09B.thor
  • c:\Python27\include\bitset.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-80AE-5E82BEA98FE8.thor
  • c:\Python27\Lib\test\https_svn_python_org_root.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-800F-1D5D33279E5F.thor
  • c:\Python27\Lib\test\nullcert.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-70AA-EDBC44AD03CB.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-6644-38E576455FE9.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-B96B-4FA8A30E892D.thor
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1028\GIZCRYF0-7AM0-FICB-CECE-573464B0C2EA.thor
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf -> c:\6cdeacda242012e0e5b593e657\2052\GIZCRYF0-7AM0-FICB-CA80-3600DAF9F1C2.thor
  • c:\Python27\Lib\test\pycacert.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-AEC8-9D11270A0C0A.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-7CCD-3C7C3B7FD094.thor
  • c:\Python27\include\abstract.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-E254-B2D61E739D51.thor
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1041\GIZCRYF0-7AM0-FICB-64DB-D8EAB98B6DF9.thor
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1035\GIZCRYF0-7AM0-FICB-E4F7-C56DFC746383.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-F758-EF16EB84D521.thor
  • c:\Python27\include\floatobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-680C-6E669572DA30.thor
  • c:\Python27\include\pydebug.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-2362-A0DF981DA7EF.thor
  • \\SHARDREALM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg -> \\SHARDREALM\Users\Harry Dresden\Downloads\GIZCRYF0-7AM0-FICB-C6D5-59AFFFE72DA3.thor
  • c:\Python27\include\pygetopt.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-BA1D-CD2373A35920.thor
  • \\SHARDREALM\Users\Public\Music\Sample Music\Sleep Away.mp3 -> \\SHARDREALM\Users\Public\Music\Sample Music\GIZCRYF0-7AM0-FICB-88CE-0F1708BBCB5D.thor
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1033\GIZCRYF0-7AM0-FICB-1A28-3F89D824D41F.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-C606-6F30C4651B4A.thor
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1040\GIZCRYF0-7AM0-FICB-2D24-D9CEFD9550BA.thor
  • c:\Python27\include\errcode.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-8EA0-6DCA1A947E1B.thor
  • c:\Python27\include\structmember.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-4ACF-52BD29819396.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\GIZCRYF0-7AM0-FICB-5C1A-687F4EC60C69.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-88EE-B7398D0C3DC7.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYF0-7AM0-FICB-1785-735284BD995C.thor
  • c:\Python27\Lib\test\keycert4.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-7C7E-11E9BCB29DCE.thor
  • c:\Python27\include\pyexpat.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-CE3F-4A397B94545D.thor
  • c:\Python27\include\moduleobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-ADBD-8065CDBE53A2.thor
  • \\SHARDREALM\Users\Harry Dresden\Contacts\Harry Dresden.contact -> \\SHARDREALM\Users\Harry Dresden\Contacts\GIZCRYF0-7AM0-FICB-8AD5-1AA10F7D23CE.thor
  • \\SHARDREALM\Users\Default\NTUSER.DAT.LOG -> \\SHARDREALM\Users\Default\GIZCRYF0-7AM0-FICB-E139-C78AAFA4D9A9.thor
  • c:\Python27\include\compile.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-720C-91D31195A951.thor
  • c:\Python27\include\grammar.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-A7A9-CCB624706407.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\GIZCRYF0-7AM0-FICB-9823-D280B18D9F58.thor
  • c:\Python27\include\pyfpe.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-23C0-CE6B6EA16750.thor
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYF0-7AM0-FICB-88C5-26361BA66637.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\GIZCRYF0-7AM0-FICB-6A52-C7C2C7A337B7.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Desert.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\GIZCRYF0-7AM0-FICB-A64B-2FB0CDF44E23.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-73A7-4178014E7804.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\GIZCRYF0-7AM0-FICB-4D39-713F47E161F9.thor
  • c:\Python27\include\traceback.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-6D4E-0F3800430FD3.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\GIZCRYF0-7AM0-FICB-0CAD-26B60E3D7590.thor
  • c:\Python27\include\pyport.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-FC3E-763DBD74E026.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\GIZCRYF0-7AM0-FICB-6FB4-6F46818C8A88.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\GIZCRYF0-7AM0-FICB-40C2-7E6426461EE9.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\GIZCRYF0-7AM0-FICB-D2A8-F0A450692282.thor
  • c:\Python27\include\import.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-1249-41544B165D92.thor
  • c:\Python27\include\boolobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-85A2-239A86BCED53.thor
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYF0-7AM0-FICB-E90A-609FAE3AA983.thor
  • c:\Python27\include\fileobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-D0FC-755203F73394.thor
  • c:\Python27\include\sysmodule.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-EB65-C85F7EB58B31.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-C83F-649437F8CFCB.thor
  • c:\Python27\include\cobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-CB1F-0EB28D1D4042.thor
  • c:\Python27\include\frameobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-39C7-F824323B7B8C.thor
  • \\SHARDREALM\Users\Harry Dresden\Downloads\cleandesktop.py.txt -> \\SHARDREALM\Users\Harry Dresden\Downloads\GIZCRYF0-7AM0-FICB-0DE5-8C1BDCA214FE.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\udoQOITRvWikpAerPQr.docm -> \\SHARDREALM\Users\Harry Dresden\Desktop\GIZCRYF0-7AM0-FICB-B29D-5D7A49475C31.thor
  • c:\Python27\include\bytes_methods.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-1ABA-2ADFE6BEA429.thor
  • c:\Python27\include\pyarena.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-8FE2-2A0093EC773A.thor
  • c:\Python27\include\objimpl.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-D1AA-059AA4C60B7E.thor
  • c:\Python27\include\pystrcmp.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-F851-F77138BFE702.thor
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1038\GIZCRYF0-7AM0-FICB-AF30-0D55485D147D.thor
  • c:\Python27\Lib\test\ssl_key.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-D8A7-A6C040C5CF78.thor
  • c:\Python27\include\tupleobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-958A-CDF0FC2D9C85.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-CD5D-498BB4C12B80.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-C92F-5A93B3A507D8.thor
  • c:\Python27\include\dtoa.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-F8BA-3D3A367E48EF.thor
  • c:\Python27\Lib\test\keycert.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-AD25-80E1849B3035.thor
  • c:\Python27\Lib\test\185test.db -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-C984-50CD76F149C6.thor
  • c:\Python27\include\pystrtod.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-8436-B722E1B68DCE.thor
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYF0-7AM0-FICB-44B2-98241CF9D77E.thor
  • c:\Python27\include\metagrammar.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-8AC7-809A9D73B642.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-4346-8D625B2F931C.thor
  • c:\Python27\include\symtable.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-D3D5-93619F0CB088.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-0F8D-BA4B742FFE70.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-95A8-607A3984603A.thor
  • c:\Python27\Lib\test\ssl_key.passwd.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-2CC2-AB5E2F5B4729.thor
  • c:\Python27\include\marshal.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-4B45-5D4C7CAA853A.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-D195-7348D024EC02.thor
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1036\GIZCRYF0-7AM0-FICB-2032-72FF837763A6.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-B341-4622867D3799.thor
  • c:\Python27\include\enumobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-6668-9935679BA7CC.thor
  • c:\Python27\include\longintrepr.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-0248-3CFB5F1B5EAA.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-D3EC-5949EEAC87F9.thor
  • c:\Python27\include\pycapsule.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-7D3D-C3E6742194A5.thor
  • c:\Python27\include\Python.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-ECAB-6EB5C33FF752.thor
  • c:\Python27\include\token.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-2844-3A706FDB891C.thor
  • c:\Python27\Lib\test\ssl_cert.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-AE82-C60D1A3B2101.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-A8BE-F51623E1B443.thor
  • c:\Python27\include\ceval.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-0F15-5AE1E06A5780.thor
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1043\GIZCRYF0-7AM0-FICB-96D4-FD5AC223EDA9.thor
  • c:\Python27\include\methodobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-58D7-016A7150239F.thor
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1044\GIZCRYF0-7AM0-FICB-93BE-F8B6B6DA56C5.thor
  • c:\Python27\include\setobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-2BA6-A2E718CD9957.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYF0-7AM0-FICB-8901-A150BFEBCBD8.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-04C3-475557B4A0DD.thor
  • c:\Python27\Lib\test\badcert.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-315C-C59C4FF1C43B.thor
  • c:\Python27\include\eval.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-D3E9-720F7C45A0F2.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\GIZCRYF0-7AM0-FICB-8DFE-81571CBFDB47.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Penguins.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\GIZCRYF0-7AM0-FICB-0465-D8D0A254012C.thor
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1025\GIZCRYF0-7AM0-FICB-E408-2D3923C4548A.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-38A4-28A358D613B9.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-5462-6884E5E27DCA.thor
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYF0-7AM0-FICB-FE87-728345A41ED2.thor
  • c:\Python27\Lib\test\wrongcert.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-9EBF-E3A7938A80C9.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-5DA8-4EB97BFBC14E.thor
  • c:\Python27\include\rangeobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-E484-FC4C3041861D.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-5195-F79FDE59813F.thor
  • c:\Python27\include\pymath.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-D17D-8FBE089C4F57.thor
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf -> c:\6cdeacda242012e0e5b593e657\2070\GIZCRYF0-7AM0-FICB-1AA8-F9141F69AD2D.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Tulips.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\GIZCRYF0-7AM0-FICB-AE6B-0E26A9513D08.thor
  • c:\Python27\include\iterobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-C6EA-7BB33BF87D0C.thor
  • c:\lndausa\bin\cert.p12 -> c:\lndausa\bin\GIZCRYF0-7AM0-FICB-AAB7-63D77A7B33B4.thor
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php -> c:\ProgramData\WebEx\WebEx\12_1324\GIZCRYF0-7AM0-FICB-4123-332E378EB8CD.thor
  • c:\Python27\include\pymactoolbox.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-5915-35B2A1C7F30A.thor
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-D869-C1D4989002D7.thor
  • c:\Python27\include\pythonrun.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-9FA0-DE994512574A.thor
  • c:\Python27\include\pyconfig.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-E752-3E4D4F94900C.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\OrekLdXCXe.pptx -> \\SHARDREALM\Users\Harry Dresden\Desktop\GIZCRYF0-7AM0-FICB-F55C-D7DDCA5CA970.thor
  • c:\Python27\Lib\test\empty.vbs -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-BEC5-06806AA0AE4E.thor
  • c:\Python27\include\cellobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-2FB6-FEDFC62F578E.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYF0-7AM0-FICB-22F3-6747249C3A2D.thor
  • c:\Python27\include\complexobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-F71E-FB4CE31D10BA.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-943F-D2D3A1899889.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Koala.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\GIZCRYF0-7AM0-FICB-86B1-8634DD2969FB.thor
  • c:\Python27\include\ast.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-08BA-D67DD493BFC1.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYF0-7AM0-FICB-88A1-2D130479ADA0.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\GIZCRYF0-7AM0-FICB-53B4-F36FED83EADF.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-DB3B-AEBCB470EF08.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-F586-0EF14B2BFC17.thor
  • c:\Python27\include\longobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-68F1-CCB2435BF125.thor
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1029\GIZCRYF0-7AM0-FICB-1039-CAE8560FDA52.thor
  • c:\Python27\include\pymacconfig.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-F058-E303D36A1452.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-F41B-6BFE5C6E2A8B.thor
  • c:\Python27\include\bufferobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-9E63-61BE85ADA31A.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYF0-7AM0-FICB-D6FD-3FD44A4ADE3D.thor
  • c:\Python27\include\unicodeobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-821F-67CFDCA61A99.thor
  • c:\Python27\include\Python-ast.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-374A-0CE2896CEE59.thor
  • c:\Python27\include\descrobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-2E88-5BC857FECFC8.thor
  • c:\Python27\Lib\test\sha256.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-645D-5286EA3DBF03.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYF0-7AM0-FICB-7003-4198A816C1B4.thor
  • c:\Python27\include\parsetok.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-42D8-97FDE6A9E0A8.thor
  • \\SHARDREALM\Users\Public\Music\Sample Music\Kalimba.mp3 -> \\SHARDREALM\Users\Public\Music\Sample Music\GIZCRYF0-7AM0-FICB-BF6F-AC328AE9DF36.thor
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1053\GIZCRYF0-7AM0-FICB-A0D7-5C55FA987648.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\emfAsjxtGjM.ppt -> \\SHARDREALM\Users\Harry Dresden\Desktop\GIZCRYF0-7AM0-FICB-CABE-5D5FB6F0CB8E.thor
  • c:\Python27\include\ucnhash.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-7058-92C54B245911.thor
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYF0-7AM0-FICB-82E6-FD7C071DF6CC.thor
  • c:\Python27\include\codecs.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-F85F-0CDE7A71BCE4.thor
  • c:\Python27\include\pgen.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-96BD-DCEA16DAD2B0.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-6ABE-F7A03341CA93.thor
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1046\GIZCRYF0-7AM0-FICB-16AD-A3007A09C955.thor
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYF0-7AM0-FICB-7EF3-E945D725FC2E.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-D07F-6158BA3035B3.thor
  • c:\Python27\include\pyctype.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-0FE6-2EDA5C0FC334.thor
  • c:\Python27\include\dictobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-7D85-AC9821AA610A.thor
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf -> c:\6cdeacda242012e0e5b593e657\3082\GIZCRYF0-7AM0-FICB-3D08-03AAE6E12FCD.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\GIZCRYF0-7AM0-FICB-A0DA-650A522F01CA.thor
  • c:\Python27\Lib\test\dh1024.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-FD8A-D876CC7E22E0.thor
  • c:\Python27\Lib\test\keycert3.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-0662-FA908CBFACF0.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-30DB-556855C570BE.thor
  • c:\Python27\include\weakrefobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-A641-C5947D65FA9D.thor
  • c:\Python27\include\modsupport.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-0294-E863DC80181E.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-442F-11FAAA3CDC76.thor
  • c:\Python27\include\structseq.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-0A19-B7E37B3573AC.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-C390-9358A00A5F37.thor
  • c:\Python27\include\patchlevel.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-11FF-9E3E6E7F1EBB.thor
  • c:\Python27\include\pgenheaders.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-49C8-0F59B228ECDD.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\GIZCRYF0-7AM0-FICB-C791-3B277381633E.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYF0-7AM0-FICB-194E-701D60532CC3.thor
  • c:\Python27\include\object.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-F2A6-D98D860A3FAE.thor
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1045\GIZCRYF0-7AM0-FICB-4F03-830581348794.thor
  • c:\Python27\include\bytearrayobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-90B9-A83C61C75C93.thor
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem -> c:\Python27\Lib\site-packages\pip\_vendor\requests\GIZCRYF0-7AM0-FICB-F610-15FD0FBFFBC7.thor
  • c:\Python27\include\funcobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-C476-5402644DECE2.thor
  • c:\Python27\include\pystate.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-64FF-F4ACE1C235DE.thor
  • c:\Python27\include\pymem.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-A348-50BC8CDFBF69.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\eAWHfXswLz.docx -> \\SHARDREALM\Users\Harry Dresden\Desktop\GIZCRYF0-7AM0-FICB-9CFE-B2A6E8D3DA9B.thor
  • c:\Python27\include\stringobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-13BD-33A728117C5C.thor
  • c:\Python27\include\listobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-1B04-7051720578C6.thor
  • c:\Python27\tcl\tclConfig.sh -> c:\Python27\tcl\GIZCRYF0-7AM0-FICB-00AB-832B0781DE9D.thor
  • c:\Python27\include\py_curses.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-69DA-123A702686F7.thor
  • c:\Python27\include\warnings.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-A9BF-9F19BA6753C9.thor
  • c:\Python27\Lib\test\badkey.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-B879-219AEEC5E021.thor
  • c:\Python27\Lib\test\nokia.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-752E-9BED44990278.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-BD5C-79118F6CD99F.thor
  • c:\Python27\include\asdl.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-552D-336FD5316DB3.thor
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1049\GIZCRYF0-7AM0-FICB-15FB-04E400E6F40B.thor
  • c:\Python27\include\datetime.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-3BF1-B64A40020F52.thor
  • c:\Python27\include\cStringIO.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-C9C7-A9811094478E.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\GIZCRYF0-7AM0-FICB-40C6-823BA75FB706.thor
  • c:\Python27\include\timefuncs.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-E828-89CD2EB7298F.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-E361-95349066C3DB.thor
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1055\GIZCRYF0-7AM0-FICB-ED5E-F1C522182641.thor
  • c:\Python27\Lib\test\keycert.passwd.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-F044-051A74CE0E69.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYF0-7AM0-FICB-674F-6E0BDC69BEC3.thor
  • c:\Python27\include\node.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-6EAD-CA0A77DB40C9.thor
Network-Connects Host
  • drkitchen.ca
Directory-Created
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YLC2QM2Y
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Caches
Directory-Enumerated
  • c:\Python27\Lib\site-packages\pip\*
  • c:\Python27\tcl\tcl8\8.5\*
  • c:\ProgramData\Sun\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\*
  • c:\Python27\tcl\tk8.5\demos\images\*
  • c:\Users\ruiner\*
  • c:\Recovery\015e7760-d44b-11e0-8947-954f09601788\*
  • c:\PerfLogs\*
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\*
  • c:\ProgramData\Passmark\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\*
  • c:\Python27\Tools\pynche\X\*
  • c:\Users\Public\Music\Sample Music\*
  • c:\Python27\Lib\importlib\*
  • c:\Python27\tcl\tcl8.5\http1.0\*
  • c:\Python27\Lib\bsddb\*
  • \\SHARDREALM\Users\Harry Dresden\Pictures\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\*
  • c:\inetpub\wwwroot\aspnet_client\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog\*
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\tests\*
  • c:\Python27\tcl\tk8.5\ttk\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\*
  • c:\Users\Default\Saved Games\*
  • c:\Python27\tcl\tcl8.5\tzdata\Africa\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\*
  • c:\Python27\Tools\i18n\*
  • c:\ProgramData\Microsoft\ClickToRun\*
  • c:\Python27\Lib\site-packages\pip\_vendor\lockfile\*
  • c:\ProgramData\*
  • c:\6cdeacda242012e0e5b593e657\Graphics\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders\*
  • c:\Python27\Lib\compiler\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\*
  • c:\Python27\Lib\unittest\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\35\*
  • c:\Python27\Lib\test\capath\*
  • c:\Users\Harry Dresden\OneDrive\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\*
  • c:\ProgramData\Adobe\Acrobat\11.0\*
  • c:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\*
  • c:\Python27\tcl\tcl8.5\*
  • c:\Python27\Lib\unittest\test\*
  • c:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319\*
  • c:\Users\Public\Videos\Sample Videos\*
  • c:\ProgramData\Microsoft\Network\Connections\*
  • c:\Users\Public\Recorded TV\*
  • c:\Users\Harry Dresden\Contacts\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\42\*
  • c:\Python27\tcl\tk8.5\msgs\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\*
  • c:\Python27\tcl\tcl8.5\tzdata\Atlantic\*
  • c:\Python27\tcl\tcl8.5\tzdata\Europe\*
  • c:\ProgramData\WebEx\WebEx\*
  • c:\Python27\tcl\tk8.5\demos\*
  • c:\ProgramData\Microsoft\Windows Defender\*
  • c:\ProgramData\Microsoft\PlayReady\Cache\*
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\_backport\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\*
  • c:\inetpub\history\CFGHISTORY_0000000005\*
  • c:\Python27\tcl\tix8.4.3\demos\samples\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\SentItems\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers\*
  • \\SHARDREALM\Users\Harry Dresden\Favorites\*
  • c:\ProgramData\Microsoft\PlayReady\Cache\S-1-5-21-3416602863-1947377224-293699093-1001\*
  • c:\6cdeacda242012e0e5b593e657\1037\*
  • c:\Python27\Lib\pydoc_data\*
  • c:\Users\Default\Pictures\*
  • \\SHARDREALM\Users\Default\Links\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\*
  • \\SHARDREALM\Users\Public\Music\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\serializer\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\*
  • c:\inetpub\custerr\*
  • c:\6cdeacda242012e0e5b593e657\1033\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\*
  • \\SHARDREALM\Users\Harry Dresden\Links\*
  • c:\lndausa\modules\packages\*
  • c:\Python27\Scripts\*
  • c:\Users\Public\Desktop\*
  • \\SHARDREALM\Users\Harry Dresden\Videos\*
  • c:\ProgramData\Microsoft\Network\Downloader\*
  • c:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\*
  • c:\Python27\Tools\pynche\*
  • c:\Python27\Lib\email\test\*
  • c:\ProgramData\Mozilla\logs\*
  • c:\ProgramData\Microsoft\IdentityCRL\*
  • c:\ProgramData\Microsoft\WPD\*
  • c:\ProgramData\Microsoft\Diagnosis\LocalTraceStore\*
  • c:\ProgramData\Microsoft\Event Viewer\*
  • c:\Users\Harry Dresden\Favorites\Links for United States\*
  • c:\Users\Default\*
  • c:\ProgramData\Sun\Java\Java Update\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\*
  • c:\Python27\tcl\dde1.3\*
  • c:\Python27\Lib\ensurepip\_bundled\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\*
  • c:\PerfLogs\Admin\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters\*
  • c:\Python27\Lib\idlelib\*
  • c:\Python27\Lib\site-packages\pip\models\*
  • c:\inetpub\*
  • \\SHARDREALM\Users\Harry Dresden\Music\*
  • c:\Users\Harry Dresden\Saved Games\*
  • c:\inetpub\wwwroot\msmq\*
  • c:\ProgramData\Microsoft\DRM\*
  • c:\ProgramData\Microsoft\Crypto\RSA\*
  • c:\6cdeacda242012e0e5b593e657\1025\*
  • c:\Python27\Lib\test\crashers\*
  • c:\ProgramData\Microsoft\Search\Data\Applications\*
  • c:\Python27\Lib\ctypes\test\*
  • c:\Users\Public\Libraries\*
  • c:\ProgramData\Microsoft\Device Stage\*
  • \\SHARDREALM\Users\Harry Dresden\Searches\*
  • c:\ProgramData\Microsoft\Windows NT\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\*
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\*
  • \\SHARDREALM\Users\Public\Videos\Sample Videos\*
  • c:\Python27\Lib\xml\etree\*
  • c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\*
  • c:\Python27\Lib\test\*
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\Security\*
  • \\SHARDREALM\Users\Public\Libraries\*
  • c:\Python27\Lib\msilib\*
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\*
  • \\SHARDREALM\Users\Harry Dresden\Desktop\*
  • c:\6cdeacda242012e0e5b593e657\1035\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\DD\*
  • \\SHARDREALM\Users\Harry Dresden\Contacts\*
  • c:\ProgramData\Adobe\ARM\S\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\*
  • c:\Users\Default\Videos\*
  • c:\ProgramData\McAfee\MCLOGS\Common\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\*
  • c:\Users\Default\Documents\*
  • c:\6cdeacda242012e0e5b593e657\1031\*
  • c:\Python27\tcl\tcl8.5\tzdata\Pacific\*
  • \\SHARDREALM\Users\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\North_Dakota\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\*
  • c:\Python27\tcl\tcl8.5\tzdata\Etc\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\*
  • c:\ProgramData\Adobe\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\*
  • c:\lndausa\*
  • c:\inetpub\history\CFGHISTORY_0000000001\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\chardet\*
  • \\SHARDREALM\Users\Default\Music\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A6\*
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\*
  • \\SHARDREALM\Users\Default\Favorites\*
  • c:\Python27\Tools\webchecker\*
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\*
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\*
  • c:\ProgramData\NovaTech Network\NovaBench\*
  • \\SHARDREALM\Users\Public\Music\Sample Music\*
  • c:\Users\Harry Dresden\Favorites\Links\*
  • c:\ProgramData\Microsoft\Assistance\*
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\*
  • c:\inetpub\wwwroot\*
  • c:\Users\Harry Dresden\*
  • c:\Python27\tcl\tcl8.5\tzdata\Antarctica\*
  • c:\Python27\Lib\site-packages\pip\_vendor\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\*
  • c:\lndausa\lib\api\*
  • c:\ProgramData\Adobe\ARM\S\5521\*
  • \\SHARDREALM\Users\Public\Foxit Software\*
  • c:\Users\Public\Downloads\*
  • c:\6cdeacda242012e0e5b593e657\2070\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\x-none.16\*
  • c:\Python27\Lib\test\cjkencodings\*
  • c:\ProgramData\Microsoft\MF\*
  • c:\ProgramData\Microsoft\Windows Defender\Support\*
  • c:\Python27\Lib\site-packages\pip\operations\*
  • \\SHARDREALM\Users\Harry Dresden\*
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\*
  • c:\6cdeacda242012e0e5b593e657\1029\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\*
  • c:\Python27\Lib\distutils\tests\*
  • c:\ProgramData\Microsoft\Office\*
  • c:\Users\Public\Music\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\*
  • c:\6cdeacda242012e0e5b593e657\1045\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\*
  • c:\Users\Harry Dresden\Desktop\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\*
  • c:\ProgramData\Microsoft\Crypto\*
  • \\SHARDREALM\Users\Public\Recorded TV\Sample Media\*
  • c:\Users\Public\Pictures\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\42\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\*
  • c:\Python27\include\*
  • c:\Python27\Lib\lib2to3\tests\data\fixers\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\*
  • c:\Python27\Lib\site-packages\setuptools\*
  • c:\Python27\Lib\test\tracedmodules\*
  • c:\ProgramData\Microsoft\DRM\Server\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\*
  • c:\Python27\tcl\tcl8.5\tzdata\SystemV\*
  • c:\6cdeacda242012e0e5b593e657\1049\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\*
  • c:\Users\Harry Dresden\Music\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\*
  • c:\Python27\tcl\tcl8.5\tzdata\Mexico\*
  • c:\ProgramData\Microsoft\RAC\*
  • c:\6cdeacda242012e0e5b593e657\2052\*
  • c:\ProgramData\Microsoft\WwanSvc\*
  • c:\Python27\tcl\tcl8.5\tzdata\Arctic\*
  • c:\ProgramData\Oracle\*
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\media\*
  • c:\ProgramData\Microsoft\Windows Defender\Quarantine\*
  • \\SHARDREALM\Users\Default\Pictures\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Queue\*
  • c:\ProgramData\Microsoft\RAC\Outbound\*
  • c:\ProgramData\WebEx\*
  • c:\inetpub\history\CFGHISTORY_0000000003\*
  • c:\Python27\Lib\site-packages\setuptools\command\*
  • c:\Python27\tcl\tcl8.5\tzdata\Indian\*
  • c:\ProgramData\Microsoft\Event Viewer\Views\*
  • c:\Users\Default\Favorites\*
  • c:\*
  • c:\Users\Default\Desktop\*
  • \\SHARDREALM\Users\Default\Desktop\*
  • c:\ProgramData\Microsoft\eHome\logs\*
  • c:\ProgramData\Microsoft\Network\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Kentucky\*
  • \\SHARDREALM\Users\Harry Dresden\Favorites\Links\*
  • c:\Python27\Lib\lib-tk\test\test_ttk\*
  • c:\Python27\tcl\tcl8.5\tzdata\US\*
  • c:\ProgramData\Microsoft\ClickToRun\UserData\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\*
  • c:\Users\Public\Pictures\Sample Pictures\*
  • c:\Python27\tcl\tcl8.5\msgs\*
  • c:\lndausa\modules\*
  • c:\Users\Default\Downloads\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\ssl_match_hostname\*
  • c:\Users\Harry Dresden\Links\*
  • \\SHARDREALM\Users\Harry Dresden\Favorites\Links for United States\*
  • c:\Python27\DLLs\*
  • \\SHARDREALM\Users\Default\Documents\*
  • c:\ProgramData\Microsoft\User Account Pictures\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\contrib\*
  • c:\Python27\tcl\tcl8.5\tzdata\Asia\*
  • c:\Users\Harry Dresden\Downloads\*
  • c:\Python27\tcl\tcl8.5\opt0.4\*
  • c:\Python27\Lib\test\xmltestdata\*
  • c:\ProgramData\Mozilla\*
  • c:\Users\Public\Videos\*
  • c:\Python27\tcl\tcl8\8.4\*
  • c:\6cdeacda242012e0e5b593e657\1055\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\*
  • c:\Python27\Tools\versioncheck\*
  • c:\Python27\tcl\reg1.2\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F7\*
  • c:\Python27\Lib\xml\dom\*
  • c:\Python27\Lib\lib2to3\tests\data\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\trie\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\*
  • c:\Python27\tcl\tcl8.5\encoding\*
  • c:\ProgramData\McAfee\*
  • c:\Python27\Lib\ctypes\macholib\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\*
  • c:\ProgramData\Microsoft\User Account Pictures\Default Pictures\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\*
  • \\SHARDREALM\Users\Public\Documents\*
  • c:\Python27\Lib\xml\parsers\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\*
  • c:\6cdeacda242012e0e5b593e657\1038\*
  • c:\Python27\tcl\tix8.4.3\*
  • c:\Python27\Lib\encodings\*
  • c:\lndausa\lib\core\*
  • c:\Python27\tcl\tcl8.5\tzdata\Canada\*
  • c:\ProgramData\NovaTech Network\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\*
  • c:\Python27\tcl\tcl8\*
  • c:\6cdeacda242012e0e5b593e657\1053\*
  • c:\Users\Default\Music\*
  • c:\Python27\Lib\test\decimaltestdata\*
  • c:\lndausa\bin\*
  • \\SHARDREALM\Users\Public\Desktop\*
  • c:\ProgramData\Passmark\PerformanceTest\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\*
  • \\SHARDREALM\Users\Harry Dresden\OneDrive\*
  • c:\ProgramData\Adobe\ARM\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\*
  • \\SHARDREALM\Users\Harry Dresden\Documents\*
  • c:\Python27\Lib\logging\*
  • c:\ProgramData\Microsoft\eHome\*
  • c:\Users\Public\*
  • c:\6cdeacda242012e0e5b593e657\1043\*
  • c:\Python27\Lib\site-packages\*
  • c:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\*
  • c:\ProgramData\Microsoft\Diagnosis\UIF\*
  • c:\Users\Harry Dresden\Searches\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\*
  • c:\Python27\tcl\tk8.5\*
  • \\SHARDREALM\Users\Public\*
  • c:\Python27\Lib\xml\sax\*
  • c:\ProgramData\Microsoft\Device Stage\Device\*
  • c:\ProgramData\Microsoft\Vault\*
  • c:\ProgramData\Microsoft\Diagnosis\AsimovUploader\*
  • c:\Python27\Lib\json\tests\*
  • c:\Python27\libs\*
  • c:\6cdeacda242012e0e5b593e657\1028\*
  • c:\Python27\Lib\lib-tk\test\test_tkinter\*
  • c:\ProgramData\Microsoft OneDrive\*
  • c:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\*
  • c:\Python27\Lib\ctypes\*
  • c:\Users\Public\Recorded TV\Sample Media\*
  • \\SHARDREALM\Users\Harry Dresden\Downloads\*
  • c:\Python27\*
  • c:\ProgramData\Microsoft\Crypto\DSS\*
  • c:\ProgramData\Microsoft\Diagnosis\Sideload\*
  • c:\Python27\Lib\email\*
  • c:\ProgramData\Microsoft\Search\Data\*
  • c:\Users\Harry Dresden\Documents\*
  • c:\ProgramData\Adobe\Setup\*
  • c:\Python27\Lib\distutils\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\*
  • c:\ProgramData\Microsoft\Device Stage\Task\*
  • c:\Users\*
  • \\SHARDREALM\Users\Public\Favorites\*
  • c:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\*
  • c:\Python27\Lib\sqlite3\*
  • c:\ProgramData\Sun\Java\*
  • c:\ProgramData\Microsoft\NetFramework\*
  • c:\ProgramData\Microsoft\Crypto\Keys\*
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\*
  • c:\Python27\Lib\bsddb\test\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\{98101498-C465-4F51-8751-D1919E97D29D}\*
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\*
  • \\SHARDREALM\Users\ruiner\*
  • c:\Recovery\*
  • c:\Users\Public\Foxit Software\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A6\*
  • c:\inetpub\history\CFGHISTORY_0000000002\*
  • c:\Python27\Lib\site-packages\pip\req\*
  • c:\Users\Harry Dresden\Videos\*
  • \\SHARDREALM\Users\Default\Downloads\*
  • c:\inetpub\wwwroot\aspnet_client\system_web\*
  • c:\Python27\tcl\tcl8.5\tzdata\Australia\*
  • c:\Users\Harry Dresden\Pictures\*
  • c:\ProgramData\Microsoft\DeviceSync\*
  • c:\ProgramData\WebEx\WebEx\12_1324\*
  • c:\ProgramData\Microsoft\Office\Heartbeat\*
  • c:\Python27\Lib\lib2to3\tests\data\fixers\myfixes\*
  • c:\Python27\Tools\Scripts\*
  • c:\Python27\Lib\hotshot\*
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\*
  • \\SHARDREALM\Users\Public\Videos\*
  • c:\ProgramData\Microsoft\*
  • c:\ProgramData\Microsoft\PlayReady\*
  • c:\Python27\Lib\site-packages\pip\utils\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\*
  • c:\Python27\tcl\tcl8.5\tzdata\Brazil\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\*
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\packaging\*
  • c:\Python27\Lib\lib2to3\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Argentina\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\*
  • c:\ProgramData\Microsoft\WwanSvc\Profiles\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\*
  • c:\Python27\Lib\test\subprocessdata\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Quick\*
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info\*
  • c:\Python27\Lib\site-packages\pip\_vendor\progress\*
  • c:\Users\Public\Foxit Software\Foxit Reader\*
  • c:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Inbox\*
  • c:\Python27\Lib\xml\*
  • c:\ProgramData\Microsoft\Search\*
  • c:\ProgramData\Microsoft\IlsCache\*
  • c:\Python27\tcl\tk8.5\images\*
  • e:\*
  • c:\Python27\Lib\sqlite3\test\*
  • c:\ProgramData\McAfee\MCLOGS\*
  • c:\Python27\Lib\ensurepip\*
  • c:\Python27\Lib\idlelib\Icons\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\*
  • c:\lndausa\lib\common\*
  • c:\Python27\Lib\test\imghdrdata\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\en-us.16\*
  • c:\ProgramData\Microsoft\Diagnosis\*
  • c:\6cdeacda242012e0e5b593e657\*
  • \\SHARDREALM\Users\Default\Saved Games\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\*
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\*
  • c:\6cdeacda242012e0e5b593e657\1030\*
  • \\SHARDREALM\Users\Default\Videos\*
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\*
  • \\SHARDREALM\Users\Public\Downloads\*
  • c:\ProgramData\Microsoft\RAC\PublishedData\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\*
  • c:\Users\Default\Links\*
  • c:\Python27\Lib\multiprocessing\dummy\*
  • c:\Python27\Lib\email\mime\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\*
  • c:\Python27\tcl\tix8.4.3\demos\bitmaps\*
  • c:\Users\Public\Documents\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\35\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\*
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\*
  • c:\Python27\Lib\lib-tk\*
  • c:\Users\Harry Dresden\Favorites\*
  • c:\Python27\Doc\*
  • c:\Python27\Lib\curses\*
  • c:\Python27\Lib\lib2to3\pgen2\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\*
  • c:\ProgramData\Adobe\Acrobat\*
  • c:\Python27\Lib\*
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\*
  • c:\Python27\tcl\tix8.4.3\demos\*
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\*
  • c:\6cdeacda242012e0e5b593e657\1042\*
  • c:\Python27\Lib\test\audiodata\*
  • c:\inetpub\history\CFGHISTORY_0000000004\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\*
  • c:\Python27\tcl\tcl8.5\tzdata\*
  • c:\Python27\Lib\site-packages\pip\_vendor\_markerlib\*
  • c:\Python27\tcl\tcl8\8.4\platform\*
  • c:\lndausa\lib\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\*
  • c:\Python27\Lib\site-packages\pip\vcs\*
  • c:\6cdeacda242012e0e5b593e657\1046\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\*
  • c:\Python27\tcl\tix8.4.3\pref\*
  • c:\Python27\Lib\site-packages\pip\compat\*
  • \\SHARDREALM\Users\Public\Pictures\*
  • c:\Python27\Lib\json\*
  • c:\Python27\Lib\lib2to3\fixes\*
  • c:\ProgramData\Microsoft\Windows Defender\LocalCopy\*
  • c:\ProgramData\Microsoft\Assistance\Client\*
  • c:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\*
  • \\SHARDREALM\Users\Default\*
  • c:\Python27\Lib\test\leakers\*
  • c:\lndausa\modules\auxiliary\*
  • \\SHARDREALM\Users\Harry Dresden\Saved Games\*
  • c:\ProgramData\Microsoft\Media Player\*
  • c:\ProgramData\McAfee\MCLOGS\Common\jxpiinstall\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\filters\*
  • c:\Python27\Tools\*
  • c:\6cdeacda242012e0e5b593e657\1044\*
  • c:\6cdeacda242012e0e5b593e657\1036\*
  • c:\6cdeacda242012e0e5b593e657\1041\*
  • c:\inetpub\history\*
  • c:\6cdeacda242012e0e5b593e657\1032\*
  • c:\Python27\tcl\tcl8.5\tzdata\Chile\*
  • c:\Python27\Lib\site-packages\pip\_vendor\packaging\*
  • \\SHARDREALM\Users\Public\Recorded TV\*
  • c:\ProgramData\Microsoft\Windows NT\MSScan\*
  • c:\Python27\Lib\email\test\data\*
  • c:\Python27\tcl\tix8.4.3\bitmaps\*
  • c:\Python27\Lib\site-packages\pip\_vendor\colorama\*
  • c:\Python27\Lib\lib2to3\tests\*
  • c:\ProgramData\regid.1991-06.com.microsoft\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F7\*
  • c:\ProgramData\Microsoft OneDrive\setup\*
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\*
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches\*
  • c:\Python27\Lib\distutils\command\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\*
  • c:\Python27\tcl\*
  • c:\Python27\Lib\site-packages\pip\commands\*
  • c:\Python27\Lib\site-packages\pkg_resources\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\*
  • c:\Python27\Lib\multiprocessing\*
  • c:\Python27\Lib\wsgiref\*
  • c:\6cdeacda242012e0e5b593e657\3082\*
  • c:\Users\Public\Favorites\*
  • c:\Python27\Lib\lib-tk\test\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util\*
  • c:\ProgramData\Microsoft\RAC\StateData\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Indiana\*
  • c:\Python27\Lib\site-packages\_markerlib\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\DD\*
  • c:\Python27\Lib\idlelib\idle_test\*
  • c:\ProgramData\Adobe\ARM\Reader_11.0.10\*
  • c:\inetpub\custerr\en-US\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\*
  • c:\6cdeacda242012e0e5b593e657\1040\*
Registry Key-Opened
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\http\
  • HKEY_CURRENT_USER\Software
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610
  • HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CLASSES_ROOT\.js
  • HKEY_LOCAL_MACHINE\Software\Policies
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Pre Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\0a-00-27-00-00-00
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_CERT_WARNINGS_ON_POST_FROM_ISTREAM_KB2894776
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001
  • HKEY_LOCAL_MACHINE\Software
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Pre Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\*\
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_URLMON_IQDA_SIZE
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent
  • HKEY_CURRENT_USER\Software\Policies
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\KindMap
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_URLMON_IQDA_SIZE
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00
  • HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_LOCAL_MACHINE\System\Setup
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION
  • HKEY_CLASSES_ROOT\JSFile\ScriptEngine
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\UrlMon Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SHOW_CERT_WARNINGS_ON_POST_FROM_ISTREAM_KB2894776
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\control\NetworkProvider\HwOrder
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPNP\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\VssapiPublisher
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MiniNT
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Safeboot\Option
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\NetworkProvider
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider
  • HKEY_CURRENT_USER\Network\E
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions
  • HKEY_LOCAL_MACHINE\system\CurrentControlSet\Control\NetworkProvider\Notifyees
  • HKEY_CURRENT_USER\Network
  • HKEY_PERFORMANCE_DATA\(Default)
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LDAP
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
  • HKEY_LOCAL_MACHINE\system\CurrentControlSet
Registry Key-Deleted
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDetectedUrl
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDetectedUrl
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
Registry Key-Read
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ReceiveTimeOut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\InheritConsoleHandles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\wscript.exe
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\NoFileFolderJunction
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cer\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InitFolderHandler
  • HKEY_CURRENT_USER\Directory\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PreCreate
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc2740-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\IgnoreUserSettings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\AdminTabProcs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InfoTip
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DevicePath
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ADODB.Stream\CLSID\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\*
  • HKEY_CURRENT_USER\Directory\NeverShowExt
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\LogFileName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.js\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chm\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\MapNetDriveVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\Timeout
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivKeyCachePurgeIntervalSeconds
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\TabProcGrowth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDhcp
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParsingName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SendTimeOut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\Environment\PROCESSOR_ARCHITECTURE
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SourcePath
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1806
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273c-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsParseDisplayName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\InprocServer32
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\SessionMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bat\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\FolderTypeID
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\DisplayLogo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.crt\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\(Default)
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableUTF8
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\COM+Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.com\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForInfoTip
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FrameTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\*
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Srp\GP\RuleCount
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HasNavigationEnum
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1A10
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Description
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Roamable
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PreCreate
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\PolicyScope
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273d-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\Safety Warning Level
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ade\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation\AllowedReservedCharacters
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\SessionMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORPARSING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\BrowseInPlace
  • HKEY_CURRENT_USER\Directory\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForOverlay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\UseDropHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsAliasedNotifications
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugHeapFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FrameTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\DefaultLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JScript\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSXML2.XMLHTTP\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideOnDesktopPerUser
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SendTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WScript.Shell\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bas\(Default)
  • HKEY_CURRENT_USER\Directory\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Name
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORDISPLAY
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Image Path
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Platform
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\TabProcGrowth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\DelegateExecute
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\PinToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\Levels
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpl\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273d-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\InheritConsoleHandles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\UseWINSAFER
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivKeyCacheMaxItems
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\DocObject
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ReceiveTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Security
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\SaferFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResource
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\AdminTabProcs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\TrustPolicy
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Compatible
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\DA0C75D6
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsUniversalDelegate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.adp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\command
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\NoWorkingDirectory
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\ScriptEngine\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecision
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cmd\(Default)
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1806
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\LogSecuritySuccesses
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc2740-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
  • HKEY_CURRENT_USER\Directory\IsShortcut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivateKeyLifetimeSeconds
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\*
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideInWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FrameMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\DisplayLogo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\Timeout
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Compatible
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win64\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273c-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FrameMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\SetWorkingDirectoryFromTarget
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDns
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionTime
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideFolderVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Flags
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadExpirationDays
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\NeverShowExt
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDetectedUrl
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\MaxRpcSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseHostnameAsAlias
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\LdapClientIntegrity
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\OOBEInProgress
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseOldHostResolutionOrder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder\ProviderOrder
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\ComputerName
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions\ProductType
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\Class
Registry Key-Written
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionReason
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecision
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionTime
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadNetworkName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
Mutex-Accessed
  • Local\ZonesCacheCounterMutex
  • Local\ZonesLockedCacheCounterMutex

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 456, Parent PID: 352

"C:\Windows\System32\wscript.exe" C:\Users\HARRYD~1\AppData\Local\Temp\NRV_365M1NN_.js PID: 4016, Parent PID: 4488

"C:\Windows\SysWOW64\rundll32.exe" C:\Users\HARRYD~1\AppData\Local\Temp\LHUW6I~1.DLL,boobs PID: 1492, Parent PID: 4016

Volatility

Nothing to display.