'
metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2016-11-08 21:28:25.361366 2016-11-08 21:31:32.193140 186 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo2 win7 Clone 2 VirtualBox 2016-11-08 21:28:25 2016-11-08 21:31:32

File Details

File name 839b2fcd873f786ea9837198c57ee16bc536ea6e.zip
File size 1104 bytes
File type Zip archive data, at least v2.0 to extract
CRC32 16DE97E3
MD5 f779e7449b48adc8549e7ca0344614d1
SHA1 839b2fcd873f786ea9837198c57ee16bc536ea6e
SHA256 e2e2199c765778cfa8eb51aeebc2f8c12a012946999f27cf69dd1a299461a7c8
SHA512 a360f0ad12585f677e373bfac53ca09c449ef142e78280a60c45d09d1884b8c93f8b6cf36a5658d7421981c334433e7d3d156a9152fddf2b790eab698cd1175d
Ssdeep 24:9YitD9X+XhueXdIQSHYbeTySz01jSUAXu1Mo6La:9Yip9XICQYKeml1O1uG3La
PEiD None matched
Yara
  • PM_Zip_with_js ()
VirusTotal Permalink
VirusTotal Scan Date: 2016-11-08 15:44:37
Detection Rate: 7/56 (Expand)

MetaFlows Scores

Metaflows Analysis Results (Signatures=125, Anomalies=0, PEiD=0, Yara=2, VT[1478640733]=100): Snort Events=2, AV Events=2
Total Score=125

SNORT EVENTS:
ET POLICY PE EXE or DLL Windows file download HTTP
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

CLAMAV DETECTED:
Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND
DROPPED FILE - NRV_319MM398_.js: Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND

Dropped File/Buffer Yara Signatures:
5b60c3e53119a60d64f28bc3eea509525e9181c9 [BUFFER]: shellcode
df8cb3462947e7b0d62dc9602d792cdb827922c7 [BUFFER]: Str_Win32_Http_API

Signatures

antivm_queries_computername details
recon_fingerprint details
antivm_memory_available details
dumped_buffer details
creates_doc details
antivm_network_adapters details
dumped_buffer2 details
antivm_vbox_files details
Windows_Proxy_Tinkering details
network_wscript_downloader details
persistence_ads details
antiav_detectfile details
exploit_heapspray details
malicious_document_urls details
network_document_file details
network_downloader_exe details
antivm_vbox_devices details
antivm_vbox_files details
modifies_files details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

60147921bfded30c_gizcryge-7am0-ffx5-d618-e6665f531356.thor

36233d895debf554_gizcryge-7am0-ffx5-7543-3616fffec667.thor

dd7809bb732526be_gizcryge-7am0-ffx5-1b65-007eaabbc0f2.thor

e7755665c983a046_gizcryge-7am0-ffx5-663a-71589e83a4e4.thor

2ad7165f94eeb436_gizcryge-7am0-ffx5-8672-d90bc9fbd6db.thor

cd9298d60441a4cd_gizcryge-7am0-ffx5-a02d-766ec9c51f63.thor

0c1b6bb5199711a2_gizcryge-7am0-ffx5-204b-d645e398064d.thor

86c975c8c6f589cd_gizcryge-7am0-ffx5-5662-dac6f726c78a.thor

4e8a5f3b4d782a39_gizcryge-7am0-ffx5-08db-0838e7fefa54.thor

faf021b3c06abc41_tasks.xml

b22c0fe9323852c3_gizcryge-7am0-ffx5-4f8b-0a2f86f371af.thor

4df4183ad47491d9_gizcryge-7am0-ffx5-80de-e6bffffd0139.thor

ec75ca052ce1e86a_gizcryge-7am0-ffx5-2ed2-34379b3f405b.thor

c7b77fb35ac09b47_gizcryge-7am0-ffx5-30a8-9d7e83edbeb0.thor

d8b061fdd159463e_gizcryge-7am0-ffx5-6db7-7e41b0bdea9e.thor

1eb6ddd31f2f4b32_gizcryge-7am0-ffx5-965e-7cc297d18c6a.thor

2f820d11ad21f633_gizcryge-7am0-ffx5-ccb4-d8c7b71686b3.thor

060eda0e708562ab_gizcryge-7am0-ffx5-c475-9451a3b66fda.thor

c4c8ba7e0d265daa_gizcryge-7am0-ffx5-6f74-e291ab2bcd18.thor

f972657eebadb8af_gizcryge-7am0-ffx5-4c1c-22ebd4597d2c.thor

a0b09d2a81ea9b3b_gizcryge-7am0-ffx5-592b-36bf77b22fed.thor

054397734af03dd9_gizcryge-7am0-ffx5-9e4f-8984d78367ce.thor

0636f19a06274bf3_gizcryge-7am0-ffx5-aebd-e44f207d0ddd.thor

73093a82e2779c08_gizcryge-7am0-ffx5-1ec3-0d5666a426a8.thor

473af3a08795e481_gizcryge-7am0-ffx5-3faa-e189655c5a26.thor

c5b4fdc4f4541fff_gizcryge-7am0-ffx5-548d-5d616477d3b3.thor

49f78f9a40fab1b4_gizcryge-7am0-ffx5-2a06-83bbd427c14a.thor

fe0201e221b70e5d_gizcryge-7am0-ffx5-7abb-f05803d49856.thor

6940b85cb9c51e36_gizcryge-7am0-ffx5-4b4a-1df165b9e1d9.thor

bdcaf25f234c126b_gizcryge-7am0-ffx5-a5c5-57995f84df6c.thor

fd5f68b59aa2b3e8_resource.xml

69c808f662f78d19_gizcryge-7am0-ffx5-9198-e034d2dfdde3.thor

8f090c30d770ab72_gizcryge-7am0-ffx5-dcc9-c283c5d5e79d.thor

35060c48c0baebb7_gizcryge-7am0-ffx5-997b-913d77350864.thor

d1fca3fa39af6622_gizcryge-7am0-ffx5-89ec-394d6d21780a.thor

9399aeca5ac7a4aa_gizcryge-7am0-ffx5-18d9-8c9e58347780.thor

20801b0ebeba9ab5_gizcryge-7am0-ffx5-de2a-25672d04a228.thor

cf5fa0dcb42fc7a4_gizcryge-7am0-ffx5-cb9c-9c2a1f161262.thor

c5dba13bff25059f_gizcryge-7am0-ffx5-31d4-0ac0d37bd6b7.thor

84663701c5cf5f2d_gizcryge-7am0-ffx5-6750-77050a5219f3.thor

ad06ea6f789686eb_gizcryge-7am0-ffx5-35b4-a68dd7970efc.thor

5c4ec37b24f58a4c_gizcryge-7am0-ffx5-0ebb-f39b36f17cf7.thor

9ae65b4807380ad6_gizcryge-7am0-ffx5-86fa-bdcd7cd9e3e9.thor

9152e5e14ab9d27a_gizcryge-7am0-ffx5-c5e9-ef3210cc7280.thor

8ad038b73a1f0042_gizcryge-7am0-ffx5-ba9f-02335c38aefb.thor

21dc2c77babe7433_gizcryge-7am0-ffx5-4287-7114f3a16387.thor

dac451e066c3c238_gizcryge-7am0-ffx5-fa1f-5e3e38b57599.thor

b58af7ecaa58022e_gizcryge-7am0-ffx5-7473-c7e78b6809e6.thor

db950b6e444aa961_gizcryge-7am0-ffx5-9513-e9aa3ef916db.thor

406e8508d701a81f_gizcryge-7am0-ffx5-5089-13d018eacfa2.thor

94c52255cbabb8d1_gizcryge-7am0-ffx5-ed4e-73f1850b93ba.thor

af7a12135db48bf2_resource.xml

e2b15fa146787a5e_gizcryge-7am0-ffx5-bc31-4429710c8f38.thor

3469a364e721271d_gizcryge-7am0-ffx5-2820-2aa55f88b7ff.thor

5e6e6f5b40d566d7_gizcryge-7am0-ffx5-e9b3-fad9149fbbad.thor

bb811de760eb0c28_gizcryge-7am0-ffx5-11c3-bff0df146065.thor

6b4a35469e65ea44_gizcryge-7am0-ffx5-8623-902a3d86435b.thor

f28467223aa3b949_gizcryge-7am0-ffx5-0279-44bc29beb602.thor

d82dabd6d246046b_gizcryge-7am0-ffx5-fc11-df2ebafe294e.thor

65c2732bb562b748_gizcryge-7am0-ffx5-e089-3d29d7e448ea.thor

1492b005dea65458_gizcryge-7am0-ffx5-9432-b1c396ec281e.thor

e3277870ae321466_gizcryge-7am0-ffx5-2e33-902a79e4cd70.thor

efc01afee25c70b0_gizcryge-7am0-ffx5-40d1-70474f03f3fd.thor

cb8c46ad8a801116_gizcryge-7am0-ffx5-9120-6d97b5c74e04.thor

f6a648b14975421f_gizcryge-7am0-ffx5-646e-e4c7f476e663.thor

c26cca2e539ef8d2_gizcryge-7am0-ffx5-0946-54197daf35bc.thor

f013d127df80ab31_gizcryge-7am0-ffx5-c823-dbf75bc1442c.thor

739fb6808dbc3148_gizcryge-7am0-ffx5-3aac-cc01beb7532e.thor

178cd99c869d37de_gizcryge-7am0-ffx5-905c-96ade4a16db1.thor

664efd002206931b_gizcryge-7am0-ffx5-398a-bf4cfd866790.thor

64e92f95b796ff63_gizcryge-7am0-ffx5-4403-0043d29082bd.thor

1911ac0c4c7e192f_gizcryge-7am0-ffx5-0594-b3466ed0746f.thor

a3bf02562988f683_gizcryge-7am0-ffx5-5ef9-ecaf797e5e55.thor

64aff7e2fbd1eac7_gizcryge-7am0-ffx5-d1a3-5480f390a27b.thor

86c05252eacc2b5d_tasks.xml

9a072b73a538e857_gizcryge-7am0-ffx5-6e9b-9321b2f9dc94.thor

3a42b3f6cc23dae4_gizcryge-7am0-ffx5-3cce-4c264630a891.thor

4c9707014f487f99_gizcryge-7am0-ffx5-9230-14ec1385772d.thor

5cbd62131895bf77_gizcryge-7am0-ffx5-94a5-c5f581bb8f1d.thor

aad0357e9defd108_gizcryge-7am0-ffx5-fe56-698009b47692.thor

c48e20fb227db150_gizcryge-7am0-ffx5-bc5e-7ef280765cf8.thor

45707c777285569e_gizcryge-7am0-ffx5-e9f5-fa842edda988.thor

cdd28466f775a6f5_gizcryge-7am0-ffx5-a729-c51c8ab7470d.thor

bcdcd4a8cbc7281f_gizcryge-7am0-ffx5-5391-69036ee4400a.thor

d0943ecd4d73b598_gizcryge-7am0-ffx5-8a8f-8584e40feb41.thor

f82068f38ffbd1e2_gizcryge-7am0-ffx5-8451-d102ac84b4f6.thor

601cc00e5c82e877_gizcryge-7am0-ffx5-963b-170731707d37.thor

9fd956eddd0710bd_gizcryge-7am0-ffx5-9709-3d97ab5aaa52.thor

aa1e865b3b1bdcef_gizcryge-7am0-ffx5-8ece-cf4729cde93d.thor

87310e0ed901c720_gizcryge-7am0-ffx5-8116-35117f241a6e.thor

096758a5863e6b5b_gizcryge-7am0-ffx5-2285-f40f06887342.thor

21148b646a86d2ba_gizcryge-7am0-ffx5-40c9-741d49e460a5.thor

9be4c05103a15fad_gizcryge-7am0-ffx5-2bfc-cd95d68194c3.thor

9643b4b5d76e8f17_gizcryge-7am0-ffx5-320f-2910e82a83a9.thor

02cd73a6b8746f42_gizcryge-7am0-ffx5-b995-be2692402d67.thor

6fd5fc24c3552ec2_gizcryge-7am0-ffx5-be45-6fbd401d5dcd.thor

9c707bcdd7115b25_gizcryge-7am0-ffx5-3c68-3d049c6305e4.thor

9bf93ccc2de3411c_gizcryge-7am0-ffx5-e1ce-93febaa7dbf9.thor

f5e02906ae7284f3_gizcryge-7am0-ffx5-b646-fb2eeff5961c.thor

86d801536a70e468_gizcryge-7am0-ffx5-d62d-21456333ed73.thor

3e6c059008f8384f_gizcryge-7am0-ffx5-0ca8-2d24d8aa11ad.thor

23febe45a54dc83e_gizcryge-7am0-ffx5-1290-7ed6a2e1dc2f.thor

5531361f277d5a6b_gizcryge-7am0-ffx5-2324-77abdfc79ebc.thor

fd26b7e00ddc5142_gizcryge-7am0-ffx5-35e6-55b16e58cecb.thor

cff8a751a345f58b_gizcryge-7am0-ffx5-3ebe-b0eac86c2ebb.thor

6d76b9b2b2154fa3_gizcryge-7am0-ffx5-42ac-67812bfa5cae.thor

82133ac509ea1af1_gizcryge-7am0-ffx5-fe3b-c054cfedbc05.thor

179181b380ecc441_gizcryge-7am0-ffx5-a38e-cb3ee1103e8c.thor

f33c7e85393f9ab7_gizcryge-7am0-ffx5-9e79-dd95defbc611.thor

50a024f6fd4913f5_gizcryge-7am0-ffx5-044f-a713387a97d8.thor

73730272d4a1a00e_gizcryge-7am0-ffx5-7772-7cdd747e88ad.thor

2b9c1ad7368ee2f8_gizcryge-7am0-ffx5-0ed0-2cdc37c25e1d.thor

1ccb1fbf2a787617_gizcryge-7am0-ffx5-9621-7d2abf444e0e.thor

07a6a347468b6426_gizcryge-7am0-ffx5-49f8-a74251ddf81c.thor

87b933074a5bc5cc_gizcryge-7am0-ffx5-290c-b66b4d05bf22.thor

6b426c89e04dac45_gizcryge-7am0-ffx5-78df-963f75860716.thor

4d6e8a4c6f85fef1_gizcryge-7am0-ffx5-a02d-5a6037b66b11.thor

c43f012b3fce5ea1_gizcryge-7am0-ffx5-f4f1-9b519f3d90af.thor

cf9f1626e0526807_gizcryge-7am0-ffx5-0d6d-d9adf9657ead.thor

3886422da0399d62_gizcryge-7am0-ffx5-a840-db7ebd40d087.thor

205a5e6e775c9d23_gizcryge-7am0-ffx5-aaa5-96911645cf7e.thor

75686f2a53482e05_gizcryge-7am0-ffx5-2d85-c2e4e42a213c.thor

c7510c8d2bfb88f1_gizcryge-7am0-ffx5-7d8f-69ff019065a3.thor

589561de35949085__51_what_is.html

bd677e064308b2fd_gizcryge-7am0-ffx5-f1d5-b217a2c99935.thor

450734143b875c24_gizcryge-7am0-ffx5-1b13-f124b653d948.thor

dcde5c45506274c8_gizcryge-7am0-ffx5-9b1a-51bc337a0b92.thor

8662a9a82412cc72_gizcryge-7am0-ffx5-6033-4543cbb43286.thor

8eb10c5e99791f2c_gizcryge-7am0-ffx5-3ac7-6ecc0f60fe4a.thor

5f2505e94388892d_gizcryge-7am0-ffx5-ac8d-07a84e158bf8.thor

a4f0cdc6b70f4417_gizcryge-7am0-ffx5-a50c-8bf1c8a0dc03.thor

c5118bc3299ff01d_gizcryge-7am0-ffx5-6693-713adae20e89.thor

6784bf4caf6d071c_gizcryge-7am0-ffx5-3b01-8101ced83022.thor

0db0d7b061e29339_gizcryge-7am0-ffx5-9f2b-06f018434bb3.thor

92de886d4c9d4b9c_gizcryge-7am0-ffx5-155e-f3533177d7b6.thor

ff4878303a455064_gizcryge-7am0-ffx5-aad8-06b4e04289cb.thor

071eeada6ef8dfbe_gizcryge-7am0-ffx5-aab9-01e7a847c9a8.thor

534c38cbe2d2e176_gizcryge-7am0-ffx5-2d5d-81edd2dc6476.thor

89499a615ad0d230_gizcryge-7am0-ffx5-6b89-cda3034d8f43.thor

2b6b27dca02613b6_gizcryge-7am0-ffx5-9b54-a0b345d22c7f.thor

4784b239fccdbec1_gizcryge-7am0-ffx5-4c8d-f02afe764910.thor

2ae832a72f302714_gizcryge-7am0-ffx5-40f9-cdae1ec3cf99.thor

fa57822b372cdec6_gizcryge-7am0-ffx5-96df-98074554174d.thor

05c66b7076371e4f_gizcryge-7am0-ffx5-03d8-59265d25d777.thor

4ffd61dd4fb4088a_gizcryge-7am0-ffx5-9eec-4968d084dc7d.thor

b880acb396eaf8f3_gizcryge-7am0-ffx5-b722-0669fda3c07f.thor

7e3f7a18f00bcae2_gizcryge-7am0-ffx5-d641-695fb76ebcac.thor

8e31380345b2a610_gizcryge-7am0-ffx5-bf6c-a0ed830c8579.thor

ad943eb9e2c53298_gizcryge-7am0-ffx5-48e2-d615ce61587f.thor

648e6eb09326dd44_gizcryge-7am0-ffx5-c0f5-00aa582955e6.thor

cf1097b8d46d2cb2_gizcryge-7am0-ffx5-f791-53a3d4168cda.thor

2982cbe858465f33_gizcryge-7am0-ffx5-585c-592eb0df939d.thor

a937902975241ccb_gizcryge-7am0-ffx5-090a-d0b705cb9382.thor

b9490bfa5a02079a_gizcryge-7am0-ffx5-eeef-e5266a8d6c18.thor

aca69c05bea7e7c5_gizcryge-7am0-ffx5-5163-43865dbb728d.thor

b1d94c26dcc2b2fd_gizcryge-7am0-ffx5-4ebc-59253266c085.thor

bfe2866d7538d26c_gizcryge-7am0-ffx5-8013-1a28de000a8b.thor

97951a8998965554_gizcryge-7am0-ffx5-b0a8-3219c2e0c2c7.thor

f4db532a556a1e60_gizcryge-7am0-ffx5-2878-ea77990eeda0.thor

55ea0bedc8c39101_gizcryge-7am0-ffx5-e601-76f2e75e78ff.thor

78577b60327c10ea_gizcryge-7am0-ffx5-598e-ae52df7f7573.thor

b6e236caa6ecd393_gizcryge-7am0-ffx5-61bd-f0966e99d650.thor

17df00ef8b64a7e5_gizcryge-7am0-ffx5-853c-da253dae4a6b.thor

10ba29c2cf4dc929_gizcryge-7am0-ffx5-91bc-3d0e1af15274.thor

d704ffbe304ef790_gizcryge-7am0-ffx5-cd43-a274dd31b418.thor

70754ea1b374c2b9_gizcryge-7am0-ffx5-0b75-c1eebdd80874.thor

a16546957639b67a_gizcryge-7am0-ffx5-f8de-eb764fe9d7d1.thor

9f786a52851914ad_gizcryge-7am0-ffx5-1a00-3a26ee3ab744.thor

1dfaeb33bd5ed956_gizcryge-7am0-ffx5-9ee9-c312c145c64f.thor

5ae59981d9a4ef52_gizcryge-7am0-ffx5-d76e-4b77be0b4934.thor

96a0b4f7ecaf4d93_gizcryge-7am0-ffx5-ccfd-8b1e99ccd374.thor

21bddd2d6f8fc53d_gizcryge-7am0-ffx5-7d2b-bfbfbfc15c80.thor

ff1753631a14cd1e_gizcryge-7am0-ffx5-e7ab-5ebc62d92c77.thor

71fc856f9b939bc8_gizcryge-7am0-ffx5-295c-d8d1361171ff.thor

5312385198cdbbe7_gizcryge-7am0-ffx5-ef11-602efe63bec0.thor

3de0c0050343d9c3_gizcryge-7am0-ffx5-dddf-884da72c6e7b.thor

c53a3e3d6e649f87_gizcryge-7am0-ffx5-3021-56447e4ff481.thor

4353367c71cb9758_gizcryge-7am0-ffx5-7db1-e6e2e849f11c.thor

5cc02195e13e950a_gizcryge-7am0-ffx5-4483-cda0378283c6.thor

8f998bcfa8fb2ea1_gizcryge-7am0-ffx5-63b8-5d2bf3220936.thor

ca11cf292e1f7841_gizcryge-7am0-ffx5-5c8c-0ee29db168fe.thor

43b5c4dbe862dbef_gizcryge-7am0-ffx5-7585-91fbb9216be3.thor

d26f32392e0f5c1d_gizcryge-7am0-ffx5-dc47-536209293344.thor

c242c8b6da991e00_gizcryge-7am0-ffx5-6040-cd7fee471e52.thor

7bef1ea57f929da6_gizcryge-7am0-ffx5-f116-7fdfebb5e654.thor

9a9779398bac8397_gizcryge-7am0-ffx5-9c16-d9297d79a2f9.thor

34883a6e6d758c9f_gizcryge-7am0-ffx5-8362-3007615fc0b6.thor

34a16719c9eb748d_gizcryge-7am0-ffx5-85ee-7a889859a174.thor

1adf1927fb61fde8_gizcryge-7am0-ffx5-0a67-618be60da81a.thor

14574a60c4f31406_gizcryge-7am0-ffx5-5bda-4622ed5c15d7.thor

96f3290e30bcff56_gizcryge-7am0-ffx5-ed81-5ee5e1631bba.thor

06428fde0bd18c71_gizcryge-7am0-ffx5-9b91-05a0bbdda847.thor

0d970b42ca0b71e7_gizcryge-7am0-ffx5-53f2-9866fbd7f7bf.thor

7b0ecb010e865d8e_gizcryge-7am0-ffx5-0337-285484cfc17a.thor

08ce1388f0e05062_gizcryge-7am0-ffx5-ef44-6a5c10965301.thor

1ce6552dbebb0f79_gizcryge-7am0-ffx5-85fd-f86e34632317.thor

7253bb2593725df2_gizcryge-7am0-ffx5-0e4a-d250fb2bee7b.thor

54634e5a03c9f4ea_gizcryge-7am0-ffx5-ac9a-7a8baf037ddd.thor

a32e0084aa16bb63_gizcryge-7am0-ffx5-afb8-4bb2e3d49498.thor

41cc422bad13b580_gizcryge-7am0-ffx5-e7b0-65db9c457f55.thor

43d0b70a89fb7403_gizcryge-7am0-ffx5-5616-440f5b8adf44.thor

f80eddf771af1236_gizcryge-7am0-ffx5-468f-343df703802c.thor

6cd07e17d174c072_gizcryge-7am0-ffx5-dd88-fcb8610dd699.thor

f6200e406c92f76e_gizcryge-7am0-ffx5-51c8-0e432b56e6e1.thor

6de63a79242629bc_gizcryge-7am0-ffx5-a3ac-6459e2ee7eeb.thor

9679183761c6e73f_gizcryge-7am0-ffx5-21cd-c6c4c8a7295d.thor

a6a1ca93e6392eb1_gizcryge-7am0-ffx5-d995-d7d4822e90bc.thor

8931d34acc2d60b8_behavior.xml

bb3f02827c91b064_gizcryge-7am0-ffx5-edac-9227daa34baf.thor

c1aa1ca84008fa99_gizcryge-7am0-ffx5-e62b-30aeb18338e0.thor

458d19fd898df083_gizcryge-7am0-ffx5-760d-852fbd323b51.thor

d4cfbaba685a737b_gizcryge-7am0-ffx5-8fc5-d651320965f5.thor

5c68db5b4fb5809a_gizcryge-7am0-ffx5-7ee6-8253d4efa506.thor

6fa647fbfd6057e0_gizcryge-7am0-ffx5-a74c-23d8aff0ed8f.thor

669a7b68dc45336e_gizcryge-7am0-ffx5-f7b3-88fab9dbf17e.thor

754954e6eb06c1b0_gizcryge-7am0-ffx5-5f9d-203f6f2c23b5.thor

86ec084a1c2fa702_gizcryge-7am0-ffx5-df7e-2e186c699b54.thor

23a1bffa8bd2237d_crivqcxyaq.dll

484fc150021215b0_gizcryge-7am0-ffx5-4cbe-e312217f0269.thor

34ae3a4b8c134f99_gizcryge-7am0-ffx5-3a18-5d2ac3ca6e08.thor

6369b06e200c3f26_gizcryge-7am0-ffx5-8515-86ebb0a5a087.thor

8ca8b375f1f6bf06_gizcryge-7am0-ffx5-6cff-8169c3b4147f.thor

ae4605e2d663da17_gizcryge-7am0-ffx5-d7b5-ffe7d8c60474.thor

0319a4b28dffe520_gizcryge-7am0-ffx5-9212-3017db148046.thor

fdcaad8165844492_gizcryge-7am0-ffx5-edaf-e88d612c705b.thor

23d65e7e3c54da6a_gizcryge-7am0-ffx5-605a-34b84bca668b.thor

2a70d18713454a46_gizcryge-7am0-ffx5-c686-998c8caf8022.thor

ae7afd168823d634_gizcryge-7am0-ffx5-b928-5ec339b1be2a.thor

520d08ed1b1928d3_gizcryge-7am0-ffx5-4dfd-682a20072ee6.thor

3f659bf04d7c00ec_gizcryge-7am0-ffx5-4a44-534fa1d767e9.thor

ae20233af8cdb2fa_gizcryge-7am0-ffx5-24f6-1992b1b9d42f.thor

45cdc118847442b1_gizcryge-7am0-ffx5-78ae-c04873631dbe.thor

f2a1e5ac6b2b0faf_gizcryge-7am0-ffx5-bc42-5c2e4292c125.thor

ea8382ce260eeb62_gizcryge-7am0-ffx5-3d87-7faf5594329c.thor

c931a56cdcf4625b_gizcryge-7am0-ffx5-fbe5-3081779092a3.thor

5683233d366271bd_gizcryge-7am0-ffx5-b40e-e82513151d1e.thor

c946e1444ba6eaf5_gizcryge-7am0-ffx5-a018-674fc6036db9.thor

1f94dfaeb7c4e021_gizcryge-7am0-ffx5-c38c-4e0ea65e5b93.thor

072bae498ae23355_gizcryge-7am0-ffx5-2aa9-ec5ad6909183.thor

7e2e691be99faa8b_gizcryge-7am0-ffx5-096c-088d59987d65.thor

d7cf970b489c4750_gizcryge-7am0-ffx5-4c36-a44eec167e8c.thor

0a3f441785521833_gizcryge-7am0-ffx5-c098-1eeec8be53d5.thor

f5cdbcdc846bf06f_gizcryge-7am0-ffx5-00be-899c64dbb942.thor

2f6bb625f617f80a_gizcryge-7am0-ffx5-9609-0375988310a8.thor

b498a5a27e4536e9_gizcryge-7am0-ffx5-1722-f12627b71684.thor

2090f28d64f9668e_gizcryge-7am0-ffx5-ad8f-f6097c855696.thor

ce4f89dde55415da_gizcryge-7am0-ffx5-8f62-a4676ea75778.thor

22991a00dbd27d16_gizcryge-7am0-ffx5-4e2b-4d140e6db98e.thor

e867345ec6778bd4_gizcryge-7am0-ffx5-e10f-2be1e600a975.thor

89b7fd087fc0afcc_gizcryge-7am0-ffx5-a95a-5b0c0d86538b.thor

c999763f3cc18f18_gizcryge-7am0-ffx5-5ff8-582eec27baae.thor

648bc222c7d8d8ce_gizcryge-7am0-ffx5-b6c2-09e533524d17.thor

c56ac161a1663905_gizcryge-7am0-ffx5-6822-9bcd5b8d62ef.thor

7d2d2d4f48c1db76_gizcryge-7am0-ffx5-a954-51fe68586a25.thor

0a0eefe5dccbf465_gizcryge-7am0-ffx5-4766-179d3be1e4a5.thor

4ce4518cdd856060_gizcryge-7am0-ffx5-9805-ad3fcc5743bc.thor

8fad1ff2fa472d0a_gizcryge-7am0-ffx5-57b9-1e442afed2ae.thor

e78525b7de372c48_gizcryge-7am0-ffx5-b1dd-f3a25e4c928d.thor

f0572b5708c83015_behavior.xml

c2b2d39e2d115e64_gizcryge-7am0-ffx5-3f97-1b8587b1cbaf.thor

2076c496141de79f_gizcryge-7am0-ffx5-d3bb-dd1e68e8f131.thor

df9bebd9d56fe2eb_gizcryge-7am0-ffx5-3cea-50c03aca79f9.thor

e161b57da00db39e_gizcryge-7am0-ffx5-a30c-67e27b836439.thor

bf8339c4c48de1ae_gizcryge-7am0-ffx5-4b30-accc369af09d.thor

e0be4007a717d2af_gizcryge-7am0-ffx5-a41b-4769b481b43c.thor

7dc8fd9e42685135_gizcryge-7am0-ffx5-5dfc-e77ae47e1af7.thor

e1e343918497e481_gizcryge-7am0-ffx5-ba5b-de1a20fbdddf.thor

b3ece6484a311365_gizcryge-7am0-ffx5-7495-2370446be7c8.thor

02342d057de1119e_gizcryge-7am0-ffx5-daec-5d43e94b6fd1.thor

588b69d29459a0ca_gizcryge-7am0-ffx5-d1b5-66198695013c.thor

32a63bc98d4b0933_gizcryge-7am0-ffx5-6afe-02bd1cd6c48d.thor

30b8a3ca743f5f12_gizcryge-7am0-ffx5-07bd-6f6ac05c36d3.thor

48be6749575a5d19_gizcryge-7am0-ffx5-6f42-d279c1baa712.thor

5e9c3bb75cb87c1f_gizcryge-7am0-ffx5-7776-f95891cf0dd9.thor

ca3939da4584f8db_gizcryge-7am0-ffx5-834f-9a032bff689a.thor

b81ce870bb172153_gizcryge-7am0-ffx5-0eb2-e0c4507d25ed.thor

0f1584b5c1817baa_gizcryge-7am0-ffx5-51bd-af0a58157d33.thor

811e18044e382ebf_gizcryge-7am0-ffx5-ad17-1a2035e59d60.thor

ebdfb52a53e124b6_gizcryge-7am0-ffx5-3767-f2d45bbf155b.thor

e826e6ed6f1ec1c0_gizcryge-7am0-ffx5-9ff3-fb1b56dee8f2.thor

29e732575bd04488_gizcryge-7am0-ffx5-9b8c-c2852085f246.thor

6e4ed0e6ca894b5e_gizcryge-7am0-ffx5-5813-da26f469829f.thor

9ce4881165a908ef_gizcryge-7am0-ffx5-4f75-a5979c2bfa6f.thor

75bbc45872c48686_gizcryge-7am0-ffx5-610a-ac6590fb5ec2.thor

0643b3fbbc925885_gizcryge-7am0-ffx5-ee20-b0745e9ff95e.thor

eda040a5dd41a7fd_gizcryge-7am0-ffx5-7172-5155d13c5097.thor

9189dccea1ae0e70_gizcryge-7am0-ffx5-c75e-2e90e59cd180.thor

eb1834e545a3a541_gizcryge-7am0-ffx5-f2e6-f670dc597058.thor

6c0df7e50e4b8f83_gizcryge-7am0-ffx5-b939-28ac56f6ce5b.thor

2b016cadfabe8146_gizcryge-7am0-ffx5-9d2c-5812fccecc94.thor

048f3613312979ee_gizcryge-7am0-ffx5-88a7-0c8a9c0c5239.thor

44ea8f0696ebc758_gizcryge-7am0-ffx5-b658-3331f8f7add8.thor

2d533a2e28d0b85e_gizcryge-7am0-ffx5-efd4-34e72c244123.thor

6f31e62a89d93646_gizcryge-7am0-ffx5-d0e1-694fcba02771.thor

689a012f447f7bda_gizcryge-7am0-ffx5-eba4-de43fdccf573.thor

853fc30799b46cbf_gizcryge-7am0-ffx5-ea54-8132b6137675.thor

37b5d149a8afce95_gizcryge-7am0-ffx5-cf43-cab13acb555c.thor

af276091dbf0fce7_gizcryge-7am0-ffx5-e45a-7ab71b408cbd.thor

9b29621db9182a92_gizcryge-7am0-ffx5-f629-9f7f65d74403.thor

2cdc4f10b400d881_gizcryge-7am0-ffx5-ce05-9f6fbb8a779d.thor

c8c0364f613f31f2_gizcryge-7am0-ffx5-c213-75aae77e82df.thor

311364c17a459ab8_gizcryge-7am0-ffx5-52b2-0436323656ff.thor

db256b41a6e2dc30_gizcryge-7am0-ffx5-29c1-65e02e5ce970.thor

b2180f77ac9975f1_gizcryge-7am0-ffx5-3f60-bf4631b110be.thor

cfeafd6b44ff1083_gizcryge-7am0-ffx5-19d1-f0eda8ea96e9.thor

344339da48a41272_gizcryge-7am0-ffx5-b4ca-f8c98d8fab3b.thor

ffe0d95c771ef8d0_gizcryge-7am0-ffx5-b84a-faf863aeba92.thor

9139784b17a85a39_gizcryge-7am0-ffx5-a34d-fae28f4f54c9.thor

cbf611f8ff67e2f7_gizcryge-7am0-ffx5-0b8c-e8de2c79f307.thor

cdf0a25c550de913_gizcryge-7am0-ffx5-6cbd-b6301bf85ef0.thor

72471a4e0773f1f7_gizcryge-7am0-ffx5-a3f8-3834962ac669.thor

144b15729736c4e0_gizcryge-7am0-ffx5-d899-40c7eb5a2cac.thor

50be1c5d7c2f18f8_gizcryge-7am0-ffx5-bdb7-8a8b858b7c32.thor

c5e77c12fb137ec3_gizcryge-7am0-ffx5-9126-dc5f267bf837.thor

9a680b84787073d4_gizcryge-7am0-ffx5-72e8-59d40a76425b.thor

f2f6409cdb05d2ed_gizcryge-7am0-ffx5-8b22-28ee9124949c.thor

4e30acfafab1d9bf_gizcryge-7am0-ffx5-b708-5c5462987760.thor

0cf4929e2da5b01d_gizcryge-7am0-ffx5-d1e0-e3cf87a4f14c.thor

36bbe9567e12bd12_gizcryge-7am0-ffx5-b883-83369941aa46.thor

NRV_319MM398_.js

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

Behavior Summary

File-Read
  • C:\Users\Harry Dresden\AppData\Local\Temp\NRV_319MM398_.js
  • C:\Windows\System32\wshom.ocx
  • C:\Users\Harry Dresden\Desktop\desktop.ini
  • C:\Windows\System32\wscript.exe
  • C:\Windows\System32\msxml3.dll
  • c:\Python27\include\pyexpat.h
  • c:\Python27\Lib\email\test\data\msg_45.txt
  • c:\Python27\include\ast.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\ZBuzsxHsaKuDPXFYNPq.rtf
  • c:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\include\tupleobject.h
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml
  • c:\Python27\include\descrobject.h
  • c:\Python27\Lib\test\cjkencodings\iso2022_kr.txt
  • c:\Python27\Lib\test\cjkencodings\gb2312.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Python27\include\grammar.h
  • c:\Python27\include\import.h
  • \\?\PIPE\browser
  • c:\Python27\Lib\email\test\data\msg_30.txt
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1032\LocalizedData.xml
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\Python27\Lib\email\test\data\msg_36.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\Python27\Lib\test\cjkencodings\johab.txt
  • c:\Python27\Lib\idlelib\TODO.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\Python27\include\marshal.h
  • c:\Python27\Lib\email\test\data\msg_23.txt
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\Python27\Lib\email\test\data\msg_19.txt
  • c:\Python27\Lib\idlelib\extend.txt
  • c:\Python27\Lib\test\badcert.pem
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\WIHdmkAAxfWGRoTR.rtf
  • c:\Python27\Lib\test\cjkencodings\euc_kr.txt
  • c:\Python27\include\pgen.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • c:\Python27\Lib\test\floating_points.txt
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\Python27\include\objimpl.h
  • c:\Python27\Lib\test\math_testcases.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx45_IIS_schema_update.xml
  • c:\Python27\Lib\idlelib\idle_test\README.txt
  • c:\Python27\include\abstract.h
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\keycert.passwd.pem
  • c:\Python27\Lib\test\cjkencodings\gb18030-utf8.txt
  • c:\Python27\include\object.h
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\LocalizedData.xml
  • c:\Python27\Lib\test\cjkencodings\shift_jis.txt
  • c:\Python27\Lib\test\cjkencodings\euc_jisx0213.txt
  • c:\Python27\tcl\tclConfig.sh
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\Python27\include\pyport.h
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml
  • c:\Python27\include\code.h
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml
  • c:\Python27\Lib\test\exception_hierarchy.txt
  • c:\Python27\include\dtoa.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\Python27\include\asdl.h
  • c:\Python27\Lib\test\empty.vbs
  • c:\6cdeacda242012e0e5b593e657\1030\LocalizedData.xml
  • c:\ProgramData\Microsoft\IlsCache\ilrcache.xml
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.proofing.msi.16.en-us.xml
  • c:\Python27\include\complexobject.h
  • c:\Python27\Lib\email\test\data\msg_13.txt
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1031\LocalizedData.xml
  • c:\Python27\Lib\lib2to3\Grammar.txt
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • c:\Python27\include\pyctype.h
  • c:\Python27\Lib\email\test\data\msg_02.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • c:\Python27\Lib\test\nokia.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • c:\Python27\include\pydebug.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • c:\Python27\include\structmember.h
  • c:\Python27\include\fileobject.h
  • c:\Python27\Lib\email\test\data\msg_11.txt
  • c:\Python27\include\enumobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\KIDSROOM\Users\Default\NTUSER.DAT.LOG
  • c:\Python27\include\pyfpe.h
  • c:\Python27\include\compile.h
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.en-us.xml
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml
  • c:\Python27\Lib\test\cjkencodings\shift_jisx0213-utf8.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\KOziPMSPVgDWGU.txt
  • c:\Python27\Lib\test\cjkencodings\hz.txt
  • c:\Python27\Lib\email\test\data\msg_22.txt
  • c:\Python27\include\pgenheaders.h
  • c:\Python27\include\pythread.h
  • c:\Python27\Lib\email\test\data\msg_31.txt
  • c:\Python27\Lib\email\test\data\msg_14.txt
  • c:\Python27\Lib\email\test\data\msg_39.txt
  • c:\Python27\Lib\site-packages\setuptools\command\launcher manifest.xml
  • c:\Python27\Lib\email\test\data\msg_40.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml
  • c:\Python27\include\opcode.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • c:\6cdeacda242012e0e5b593e657\1038\LocalizedData.xml
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\en-us.16\MasterDescriptor.en-us.xml
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\include\memoryobject.h
  • c:\Python27\include\moduleobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml
  • c:\Python27\Lib\email\test\data\msg_25.txt
  • c:\Python27\include\boolobject.h
  • c:\Python27\Lib\email\test\data\msg_12.txt
  • c:\Python27\include\token.h
  • c:\Python27\include\bitset.h
  • c:\Python27\include\warnings.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\Python27\include\pycapsule.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Access.Access.x-none.msi.16.x-none.xml
  • c:\Python27\Lib\email\test\data\msg_27.txt
  • c:\Python27\Lib\idlelib\NEWS.txt
  • c:\Python27\Lib\email\test\data\msg_42.txt
  • c:\Python27\include\modsupport.h
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • c:\Python27\Lib\idlelib\help.txt
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml
  • c:\Python27\include\ucnhash.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\bCPvuhfvGU.txt
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\Lib\test\cjkencodings\cp949-utf8.txt
  • c:\Python27\Lib\email\test\data\msg_16.txt
  • c:\Python27\include\symtable.h
  • c:\Python27\include\node.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\Lib\idlelib\HISTORY.txt
  • c:\Python27\Lib\test\cjkencodings\iso2022_kr-utf8.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\Python27\Lib\test\cjkencodings\gb2312-utf8.txt
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\Lib\email\test\data\msg_41.txt
  • c:\Python27\include\cStringIO.h
  • c:\Python27\Lib\test\cjkencodings\euc_jp.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml
  • c:\ProgramData\Sun\Java\Java Update\jaureglist.xml
  • c:\Python27\Lib\email\test\data\msg_29.txt
  • c:\Python27\Lib\email\test\data\msg_01.txt
  • \\?\PIPE\lsarpc
  • c:\Python27\include\metagrammar.h
  • c:\Python27\Lib\test\formatfloat_testcases.txt
  • c:\Python27\Lib\test\sha256.pem
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml
  • c:\Python27\include\classobject.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • c:\ddcbwzbk\bin\cert.p12
  • c:\Python27\include\datetime.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • c:\6cdeacda242012e0e5b593e657\1028\LocalizedData.xml
  • c:\Python27\Lib\test\cjkencodings\hz-utf8.txt
  • c:\Python27\Lib\email\test\data\msg_18.txt
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml
  • c:\Python27\include\errcode.h
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info\top_level.txt
  • c:\Python27\Lib\test\keycert3.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Python27\Lib\email\test\data\msg_09.txt
  • c:\6cdeacda242012e0e5b593e657\1045\LocalizedData.xml
  • c:\Python27\include\pyerrors.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml
  • c:\Python27\include\Python-ast.h
  • c:\Python27\Lib\email\test\data\msg_21.txt
  • c:\Python27\include\ceval.h
  • c:\Python27\Lib\lib2to3\PatternGrammar.txt
  • c:\Python27\Lib\email\test\data\msg_07.txt
  • c:\Python27\include\pythonrun.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\ShMJrAeWwnVaFXDzXd.docm
  • c:\Python27\Lib\idlelib\README.txt
  • c:\Python27\include\pygetopt.h
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\Python27\include\codecs.h
  • c:\Python27\Lib\email\test\data\msg_10.txt
  • c:\Python27\Lib\email\test\data\msg_33.txt
  • c:\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • c:\Python27\include\patchlevel.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\Python27\include\bytes_methods.h
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx40_IIS_schema_update.xml
  • c:\Python27\Lib\test\cjkencodings\cp949.txt
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\QIGZFpurwNp.pptx
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\longintrepr.h
  • c:\Python27\Lib\email\test\data\msg_17.txt
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml
  • c:\Python27\Lib\test\cjkencodings\shift_jis-utf8.txt
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml
  • c:\Python27\Lib\email\test\data\msg_34.txt
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\entry_points.txt
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\Python27\Lib\test\cjkencodings\iso2022_jp-utf8.txt
  • c:\Python27\include\pystate.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\Lib\test\ieee754.txt
  • c:\Python27\Lib\test\cjkencodings\shift_jisx0213.txt
  • c:\Python27\include\pyconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • c:\Python27\include\pymacconfig.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml
  • c:\Python27\include\bufferobject.h
  • c:\Python27\include\timefuncs.h
  • c:\Python27\Lib\email\test\data\msg_37.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\floatobject.h
  • c:\Python27\Lib\email\test\data\msg_26.txt
  • c:\Python27\Lib\test\pycacert.pem
  • c:\Python27\Lib\test\badkey.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • c:\Python27\Lib\test\cjkencodings\big5.txt
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\top_level.txt
  • c:\6cdeacda242012e0e5b593e657\1036\LocalizedData.xml
  • c:\Python27\Lib\test\cjkencodings\euc_jp-utf8.txt
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.publishermui.msi.16.en-us.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • c:\Python27\Lib\email\test\data\msg_35.txt
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmui.msi.16.en-us.xml
  • c:\6cdeacda242012e0e5b593e657\1033\LocalizedData.xml
  • c:\Python27\Lib\test\185test.db
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\Lib\email\test\data\msg_08.txt
  • c:\Python27\include\eval.h
  • c:\Python27\Lib\email\test\data\msg_15.txt
  • c:\Python27\Lib\site-packages\README.txt
  • c:\Python27\include\genobject.h
  • c:\6cdeacda242012e0e5b593e657\1029\LocalizedData.xml
  • c:\Python27\Lib\test\cjkencodings\big5hkscs.txt
  • c:\Python27\Lib\email\test\data\msg_28.txt
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\parsetok.h
  • c:\Python27\include\osdefs.h
  • c:\6cdeacda242012e0e5b593e657\1025\LocalizedData.xml
  • \\?\PIPE\wkssvc
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\Python27\Lib\test\leakers\README.txt
  • c:\Python27\include\pymem.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\Python27\include\pyarena.h
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\Python27\Lib\email\test\data\msg_46.txt
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\Python27\include\rangeobject.h
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\include\iterobject.h
  • c:\Python27\include\funcobject.h
  • c:\Python27\include\listobject.h
  • c:\Python27\Lib\email\test\data\msg_44.txt
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\Python27\include\frameobject.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64ww.msi.16.x-none.xml
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\6cdeacda242012e0e5b593e657\1043\LocalizedData.xml
  • c:\Python27\include\sliceobject.h
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\Lib\email\test\data\msg_43.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml
  • c:\Python27\include\stringobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\Python27\include\intobject.h
  • c:\Python27\Lib\email\test\data\msg_20.txt
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\Python27\Lib\test\cjkencodings\johab-utf8.txt
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemuiset.msi.16.en-us.xml
  • c:\Python27\include\methodobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\include\cobject.h
  • c:\Python27\Lib\test\cmath_testcases.txt
  • c:\Python27\Lib\test\cjkencodings\gb18030.txt
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\imyLMftHczmAzDfe.txt
  • c:\Python27\i