'
metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2016-11-08 15:59:12.546221 2016-11-08 16:01:50.357079 157 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo2 win7 Clone 2 VirtualBox 2016-11-08 15:59:13 2016-11-08 16:01:49

File Details

File name 9702346720f3ff997902fa3d0bf32633bacb1a5e.zip
File size 1102 bytes
File type Zip archive data, at least v2.0 to extract
CRC32 9BC1C0FD
MD5 91be304290f7f08d69da8070d5de735d
SHA1 9702346720f3ff997902fa3d0bf32633bacb1a5e
SHA256 d6661cde476c9f5e5004fb0bf1c2cc4c453467e5faa8f400a553fc7d054c085f
SHA512 1eb151b71181283ddd86a51c35710a42deb5cb36aeaca5aee81b43cb147632b76e1232ad04d74f31bf42685437341d1376bdf2d1f0c88fcfb24f61f16954d49f
Ssdeep 24:9iMCWHEP3ESm7vvCehYGk4cOfkhIYHjjNcSaYh4BZHY:9iMCWHE/ESmTvDYM8OAvdUHY
PEiD None matched
Yara
  • PM_Zip_with_js ()
VirusTotal Permalink
VirusTotal Scan Date: 2016-11-08 13:42:45
Detection Rate: 7/56 (Expand)

MetaFlows Scores

Metaflows Analysis Results (Signatures=125, Anomalies=0, PEiD=0, Yara=2, VT[1478620954]=100): Snort Events=2, AV Events=2
Total Score=125

SNORT EVENTS:
ET POLICY PE EXE or DLL Windows file download HTTP
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

CLAMAV DETECTED:
Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND
DROPPED FILE - NRV_2INP08_.js: Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND

Dropped File/Buffer Yara Signatures:
df8cb3462947e7b0d62dc9602d792cdb827922c7 [BUFFER]: Str_Win32_Http_API

Signatures

antivm_queries_computername details
recon_fingerprint details
antivm_memory_available details
dumped_buffer details
creates_doc details
antivm_network_adapters details
dumped_buffer2 details
antivm_vbox_files details
Windows_Proxy_Tinkering details
network_wscript_downloader details
persistence_ads details
antiav_detectfile details
exploit_heapspray details
malicious_document_urls details
network_document_file details
network_downloader_exe details
antivm_vbox_devices details
antivm_vbox_files details
modifies_files details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

693df4e9af428320_gizcryge-7am0-ffx5-f80d-fc952b866579.thor

36fd78b3a416bc50_gizcryge-7am0-ffx5-c500-faad67f832eb.thor

b88f87e6e86221d7_gizcryge-7am0-ffx5-fca2-3622cdd38990.thor

9ecd8618c08cdf30_gizcryge-7am0-ffx5-1bdc-f5f0ff9187ed.thor

1985ffdc4699de3e_gizcryge-7am0-ffx5-1add-fe05996b653e.thor

bf6c817e2fd82457_gizcryge-7am0-ffx5-946b-bd258183fcb6.thor

5a4f087dbef86f60_gizcryge-7am0-ffx5-59cc-dfe8d4737d57.thor

a74429b8edd56d0a_gizcryge-7am0-ffx5-d534-e75dcdb1a592.thor

c2e9152f7b71db2b_gizcryge-7am0-ffx5-accb-750f2b1d8947.thor

faf021b3c06abc41_tasks.xml

0f6ce71f2cb701b1_gizcryge-7am0-ffx5-2921-a04e9d15179f.thor

475acc634bbf2b88_gizcryge-7am0-ffx5-60a4-d99b3fa25fd0.thor

646466b9c906dd24_gizcryge-7am0-ffx5-4a28-a6a9a0dc1b61.thor

e8975c46464e8664_gizcryge-7am0-ffx5-d21e-e3dcc1c2cf9f.thor

1a7b0590baa8ea6b_gizcryge-7am0-ffx5-dbd3-78d5635c9e84.thor

0bc5b43cd68cbf52_gizcryge-7am0-ffx5-9317-40f12eef0acb.thor

b655566dec10f737_gizcryge-7am0-ffx5-c49d-bf8e4e6d6829.thor

460193a788e93c71_gizcryge-7am0-ffx5-c6ff-4c7d16317379.thor

8c7029d5e58df395_gizcryge-7am0-ffx5-4ef9-285b551263c0.thor

130c8dc0c75ad439_gizcryge-7am0-ffx5-484a-7a355bd11427.thor

70a709d4cb6fdb56_gizcryge-7am0-ffx5-b316-671afb1ff5e7.thor

0cc4ab1308982009_gizcryge-7am0-ffx5-b710-5322f7581242.thor

5c002013ae5d07ab_gizcryge-7am0-ffx5-14d4-247cb22a194f.thor

2f0e105b0077a1a7_gizcryge-7am0-ffx5-7ac9-a4ee02f3c3ec.thor

9f6a609753f12e60_gizcryge-7am0-ffx5-9854-bdf6bbfea592.thor

7cbed90907d13228_gizcryge-7am0-ffx5-7ed2-273202046c4a.thor

e2239fb75dab6763_gizcryge-7am0-ffx5-0149-595d536f46da.thor

1bf16d5c233bfb1e_gizcryge-7am0-ffx5-5f89-dcdc12cfc198.thor

95bf4eab75f7fd98_gizcryge-7am0-ffx5-025f-1a8b7ca86293.thor

fde4e3b72eb5b69d_gizcryge-7am0-ffx5-6f09-643a13279cdd.thor

37119d2a9239587a_gizcryge-7am0-ffx5-2ecf-7842fb7c9d9b.thor

fd5f68b59aa2b3e8_resource.xml

298eb70fda430892_gizcryge-7am0-ffx5-a61a-8de1a601be38.thor

0fcaae3f7a4b1cdb_gizcryge-7am0-ffx5-6a74-0eed368c8800.thor

67bace45fdc2e44a_gizcryge-7am0-ffx5-ec12-30c90589394b.thor

4a273dfd4658e5bc_gizcryge-7am0-ffx5-165f-1a379f4df352.thor

3c40075ebf3451a5_gizcryge-7am0-ffx5-8a77-0574ae680be6.thor

01e791807287ae33_gizcryge-7am0-ffx5-90c6-3ad87b957b0f.thor

1f41299aa45c4441_gizcryge-7am0-ffx5-d9b8-4bbf461d8d88.thor

eda267a42c749d70_gizcryge-7am0-ffx5-c421-7a06ad1410ae.thor

83bf3b30d548acc2_gizcryge-7am0-ffx5-a359-7da1d5bd70c2.thor

c1ce7dbae45f3be1_gizcryge-7am0-ffx5-fa6c-7f00cbee52e6.thor

12cd8e115a42043a_gizcryge-7am0-ffx5-76c3-aefe6be934f4.thor

f43e3cd370913b6b_gizcryge-7am0-ffx5-9bbc-bbf7bd6a74bd.thor

c45e25dc5223fbf2_gizcryge-7am0-ffx5-e5b7-ca4bf09d77cb.thor

db1706567aa4c019_gizcryge-7am0-ffx5-2001-5a098ae5ac0d.thor

96db7f0f6f631486_gizcryge-7am0-ffx5-8dfe-1470ca501362.thor

cfe39cf7bf5c1d20_gizcryge-7am0-ffx5-66d6-ea1cdbcac4f8.thor

e59ae3a4c9f0f1ea_gizcryge-7am0-ffx5-cb10-54f7fed613d3.thor

fb0ea32cf581f656_gizcryge-7am0-ffx5-6860-73568b053e7c.thor

e2329b325438f1d0_gizcryge-7am0-ffx5-5c4a-1e3e3c52956d.thor

af7a12135db48bf2_resource.xml

25b65330ef7faf98_gizcryge-7am0-ffx5-f70e-3d577c390938.thor

bc846ce4a7655db0_gizcryge-7am0-ffx5-12f4-14382eed1a3d.thor

2b060c85046f8093_gizcryge-7am0-ffx5-c17f-e8ab53570220.thor

9a41bea8ebcc073f_gizcryge-7am0-ffx5-38bd-3f3d2d1138d0.thor

b72ed0e67b8eef52_gizcryge-7am0-ffx5-6a03-4c57abe8dfb8.thor

c774a383f9a2c644_gizcryge-7am0-ffx5-2f38-eb5d2c05f1de.thor

405f32ca6628cd57_gizcryge-7am0-ffx5-3cb0-22f784da4586.thor

679526cca097d288_gizcryge-7am0-ffx5-83ef-c5bd6058d7d4.thor

abb8c1311b0fe6aa_gizcryge-7am0-ffx5-fdda-e70d410929f1.thor

57efcfbab451fa4b_gizcryge-7am0-ffx5-14dc-c3e0c6a75544.thor

8b20e1c82ca2d3e6_gizcryge-7am0-ffx5-ba8f-0983373a245e.thor

502bdd54a1f29bb5_gizcryge-7am0-ffx5-d1a8-90fe926c6a6d.thor

53abe92844e8324f_gizcryge-7am0-ffx5-3552-da1dc9d9e9ce.thor

fb4eb8dc56d708ca_gizcryge-7am0-ffx5-1afb-2875253f7573.thor

b0b22840be8a7123_gizcryge-7am0-ffx5-16a4-e9f25c778eca.thor

c996587558588b9b_gizcryge-7am0-ffx5-bc3f-dcac3661adf3.thor

2af0cfb06bc4e473_gizcryge-7am0-ffx5-7412-f719b76c1098.thor

371fda4915e543e4_gizcryge-7am0-ffx5-e6a1-14d878a0724d.thor

fbb00c202863cd5b_gizcryge-7am0-ffx5-8b71-e9c753e0cb3b.thor

3cebd3458ee5060c_gizcryge-7am0-ffx5-2e49-755eba67fecc.thor

32bf02284e47ef31_gizcryge-7am0-ffx5-dd91-1d45ef70cebb.thor

4dc41581de3b9a0b_gizcryge-7am0-ffx5-57de-aa7ec120fb28.thor

af61a87ba1fd9515_gizcryge-7am0-ffx5-2746-57c4489f7799.thor

611c87ead84928fd_gizcryge-7am0-ffx5-5e37-fdd6daf7e2ce.thor

f7496630ef627d82_gizcryge-7am0-ffx5-a5e7-b2d5c5473c18.thor

876b8c2c2ee3c7d1_gizcryge-7am0-ffx5-99e8-67a8ce457024.thor

e20efbb89ff8820e_gizcryge-7am0-ffx5-9283-2a42f189c659.thor

86c05252eacc2b5d_tasks.xml

fde7a07901465268_gizcryge-7am0-ffx5-167b-8181b3358f9c.thor

74876be12b8b113a_gizcryge-7am0-ffx5-7da5-113bb999005e.thor

9d812d14127d10e1_gizcryge-7am0-ffx5-9b41-0e7fb04adf94.thor

e0b1217e87f8df17_gizcryge-7am0-ffx5-d5ab-e2cf6b6ad36c.thor

9deb50b81671ee94_gizcryge-7am0-ffx5-8022-2d87e538c5e8.thor

c1306726c4b828e9_gizcryge-7am0-ffx5-458b-68a38f829bc1.thor

bfd9a69d24dc98cb_gizcryge-7am0-ffx5-06bd-b03a55c2941a.thor

b192643a4c83ff1a_gizcryge-7am0-ffx5-f7ec-177505a61ee8.thor

c70f343e72a676c4_gizcryge-7am0-ffx5-ed30-6c09fae96a0a.thor

a68bca6ee3cb357d_gizcryge-7am0-ffx5-8bc8-2e1dc7a5e9c0.thor

70aae3886001877d_gizcryge-7am0-ffx5-96c5-eb3d9a0c8010.thor

895b55872c3355f4_gizcryge-7am0-ffx5-b240-51e099dd833f.thor

685cc58c1d7a6942_gizcryge-7am0-ffx5-ba04-d4afe540b69e.thor

c001134f9f5735d2_gizcryge-7am0-ffx5-9802-8637e82a3f0d.thor

fd5745a347395645_gizcryge-7am0-ffx5-a912-3faa485525e1.thor

65b78db8b8ac1f64_gizcryge-7am0-ffx5-65f8-57edd3bf49f6.thor

7ef3f387947e637f_gizcryge-7am0-ffx5-d073-76f1d9903750.thor

c49befe8a8da31c2_gizcryge-7am0-ffx5-0c4d-478740b6d47f.thor

e2bb8c9aab7344b6_gizcryge-7am0-ffx5-285c-e6469ad8df2a.thor

ecce93577610dcea_gizcryge-7am0-ffx5-2eff-dc86daaa70d1.thor

fc8268b5064db52a_gizcryge-7am0-ffx5-590a-f274c8f9a2eb.thor

c4c127a092210e80_gizcryge-7am0-ffx5-eef8-829fa4baeeeb.thor

afacd326e77233f7_gizcryge-7am0-ffx5-e969-15827e016c86.thor

e8ba7f7aae378168_gizcryge-7am0-ffx5-a0ea-7c9424e928f1.thor

35134f4d1100c357_gizcryge-7am0-ffx5-5d61-ab6fbd1f3914.thor

3a6f01407a7bc45d_gizcryge-7am0-ffx5-d3eb-0a7f838e541c.thor

def7f1a8502afaaf_gizcryge-7am0-ffx5-fc21-65d901cbfda0.thor

4fad51466d29ddc9_gizcryge-7am0-ffx5-07f7-5a62e1a4a3b0.thor

a0e512a70cc20c76_gizcryge-7am0-ffx5-9927-a6ec48372c38.thor

00f00a53c00893c8_gizcryge-7am0-ffx5-b0ef-7ce9a04afa56.thor

b24acbc143970758_gizcryge-7am0-ffx5-f59b-08a94f7016a1.thor

c856141a6b0d8f32_gizcryge-7am0-ffx5-00e7-322bea36eeed.thor

fa0edd02e37b6212_gizcryge-7am0-ffx5-8fa9-702a234c804a.thor

483e4971404d2642_gizcryge-7am0-ffx5-ba09-825d1d8f8b4c.thor

dea082e9b394ba14_gizcryge-7am0-ffx5-49fb-5a65e9a453d5.thor

6d379f65c16cd22b_gizcryge-7am0-ffx5-c863-1667b6df873d.thor

62c39487c13d9665_gizcryge-7am0-ffx5-6eda-bcf890f50f5c.thor

7e425b40bad0a9d6_gizcryge-7am0-ffx5-d5e7-c2f2e62a9e28.thor

607fc8be8ad7166e_gizcryge-7am0-ffx5-a463-20c2454ed0ef.thor

7c50e43db853f62f_gizcryge-7am0-ffx5-a1e5-d6c05e2baca0.thor

e11850b38978c240_gizcryge-7am0-ffx5-65c0-ad6de0c22f4b.thor

4963192abc49fbaf_gizcryge-7am0-ffx5-cdc8-c732ac84dbe9.thor

9449c56c8be97ee0_gizcryge-7am0-ffx5-06ac-ac126e2afaf8.thor

35b874c5b952b3ac_gizcryge-7am0-ffx5-b4c4-731c9d95a242.thor

0b36c97b1b4aa6e6_gizcryge-7am0-ffx5-bd41-628c3dd66cb9.thor

c87bfa4f241cda27_gizcryge-7am0-ffx5-af19-0621c16c6eb9.thor

8a1d4484671c0d42_gizcryge-7am0-ffx5-e917-aa932cd8a563.thor

283aac2f1a389fb3_gizcryge-7am0-ffx5-36b3-1ebf0c366466.thor

92a6676b60316aa5_gizcryge-7am0-ffx5-ddf9-abe9204f302d.thor

44068acddf876bd4_gizcryge-7am0-ffx5-704b-25a138d3761a.thor

b2005f4d833c9cd9_gizcryge-7am0-ffx5-bb3f-c0702ce60c56.thor

d49239ef24b27641_gizcryge-7am0-ffx5-1e38-6fb20b46620b.thor

3707e9909dd5b2cf_gizcryge-7am0-ffx5-8c1a-ecd8eb8ab180.thor

0b493cc30269d950_gizcryge-7am0-ffx5-6773-9027915726c8.thor

5995cc7326d92210_nts0mk[1].txt

7213154255c7cd85_gizcryge-7am0-ffx5-7bb5-6b0d35fc0a66.thor

7f5c545d5704108c_gizcryge-7am0-ffx5-0add-9946bd7fae1d.thor

9f63593c6e0dd432_gizcryge-7am0-ffx5-07dc-fbceba1bd792.thor

7d28d7dbb59a7b38_gizcryge-7am0-ffx5-6351-1b26a904a36f.thor

631548d128375356_gizcryge-7am0-ffx5-9e67-00b4253d86f4.thor

657b1abe8b8f71c1_gizcryge-7am0-ffx5-0ad2-6bba802147ec.thor

fff84dadecff18eb_gizcryge-7am0-ffx5-0a22-dfd8bc6bebb8.thor

8dff8e9318bc2a1a_gizcryge-7am0-ffx5-cd75-bfa550eff1fb.thor

5cf839531586de32_gizcryge-7am0-ffx5-6321-4f83e472580e.thor

584db973b4da380f_gizcryge-7am0-ffx5-5dc9-015af7f900f6.thor

8667632f497ab9f4_gizcryge-7am0-ffx5-0af4-2b0cae267513.thor

aafdf899dcbde7b1_gizcryge-7am0-ffx5-43a6-edfdbe6e156a.thor

3c25353c570e03c5_gizcryge-7am0-ffx5-4b34-522d43bb4e65.thor

933850213a1d5a0a_gizcryge-7am0-ffx5-4fd9-9289c575f48d.thor

7bdd480a8614e590_gizcryge-7am0-ffx5-aff8-47f21202f238.thor

4c2e5fb8846a7731_gizcryge-7am0-ffx5-7add-2a59fa0b2def.thor

984789c15e77279f_gizcryge-7am0-ffx5-7707-124dda03a24f.thor

369eab878f5625c3_gizcryge-7am0-ffx5-5425-a9d9b4df86fe.thor

549f93fda6f6709c_gizcryge-7am0-ffx5-d394-ec251eaac33e.thor

47598b6ed613c729_gizcryge-7am0-ffx5-ae07-1b11afc862be.thor

c80836eaa3e00e69_gizcryge-7am0-ffx5-42d5-fbbaa37ccb81.thor

1ebe3a557c7c0b19_gizcryge-7am0-ffx5-2334-8cfdac346700.thor

12742b8618e9dbeb_gizcryge-7am0-ffx5-8397-c636354a3e74.thor

fbee7bf5bedcaf45_gizcryge-7am0-ffx5-8158-b83f1dc36cff.thor

845b99fd5d568010_gizcryge-7am0-ffx5-e702-8f5275afa93c.thor

300b9326218ff369_gizcryge-7am0-ffx5-7d61-813de250603a.thor

af05b5414e7d2501_gizcryge-7am0-ffx5-aa04-3dd7253c158d.thor

b79c870de68547d6_gizcryge-7am0-ffx5-a32e-f694ab445a1e.thor

52e7a07ea3efec6a_gizcryge-7am0-ffx5-e3f9-2c46d288682e.thor

37759787f364594f_gizcryge-7am0-ffx5-8daf-9acd79e89933.thor

2e35b9596158f9ea_gizcryge-7am0-ffx5-f9eb-33beb27b3852.thor

aa57744ce23df19f_gizcryge-7am0-ffx5-0193-fec28dec8fb1.thor

971b2f0f899567fa_gizcryge-7am0-ffx5-3c29-5c525f634fca.thor

2913320a7c06435e_gizcryge-7am0-ffx5-fd09-ee7a41ca58ba.thor

b967a1c20976628d_gizcryge-7am0-ffx5-8b0e-958fbe6bd977.thor

a67be59584ceb521_gizcryge-7am0-ffx5-379a-cc985aee56b6.thor

53f09eacf564c33b_gizcryge-7am0-ffx5-fad2-e0909468fc4d.thor

e03124ddb12d74e6_gizcryge-7am0-ffx5-ca1d-4b134a039f03.thor

07f90e32c2a4f245_gizcryge-7am0-ffx5-cb86-4b61236392ef.thor

f3a619a1b1fb1e7b_gizcryge-7am0-ffx5-17a4-15653d295066.thor

145786f1585adeca_gizcryge-7am0-ffx5-f462-c6c774b1e4c4.thor

fcfb21d7a2cd0d1c_gizcryge-7am0-ffx5-a6ae-27cd17abf6c7.thor

72534a8c4827be94_gizcryge-7am0-ffx5-fe4a-0a704d113c73.thor

f1bbbb3fa6a56cc5_gizcryge-7am0-ffx5-9ece-168ee8d8186a.thor

a37845cb5e56126c_gizcryge-7am0-ffx5-791d-cf91e76106a2.thor

cc7160b8be70b644_gizcryge-7am0-ffx5-028a-d8715c6ca169.thor

902845fb7d448715_gizcryge-7am0-ffx5-f9f3-a89fd42de130.thor

71a17e62a3f3428f_gizcryge-7am0-ffx5-0963-1b1b0ef08b30.thor

2fa6fba3787edd47_gizcryge-7am0-ffx5-a154-6d7d4bbab79f.thor

a2a826a6a744ad8e_gizcryge-7am0-ffx5-6c90-ed5ee789d505.thor

d71a344c35b119df_gizcryge-7am0-ffx5-b1dc-37d0f169c70e.thor

8451c7ff3ef1e376_gizcryge-7am0-ffx5-f669-6d06f9b436a8.thor

7f28fe17b2872a80_gizcryge-7am0-ffx5-caff-020b5010a042.thor

01617105de0cf58e_gizcryge-7am0-ffx5-c413-3b6ce3edf6f7.thor

8931d34acc2d60b8_behavior.xml

e6ea7adf6f12094a_gizcryge-7am0-ffx5-b546-7a27f90bcd16.thor

fec3b418cf0172e2_gizcryge-7am0-ffx5-6219-8b898f50d79b.thor

9045ca977b87c6ee_gizcryge-7am0-ffx5-3acf-352965f07618.thor

76bc227286a065c5_gizcryge-7am0-ffx5-17c4-5bed9ef7061c.thor

1f41352677abdcec_gizcryge-7am0-ffx5-0c8f-1b8cb9222588.thor

10a54b4d598581f4_gizcryge-7am0-ffx5-cbef-0a3751039c80.thor

fc73681635922a37_gizcryge-7am0-ffx5-9974-ef5810279666.thor

54e45d43865e2989_gizcryge-7am0-ffx5-4052-c897dd88d104.thor

234004b6b93645ba_gizcryge-7am0-ffx5-2cd7-a59b1fca730e.thor

ed93062a8047efe7_gizcryge-7am0-ffx5-5136-048aa17f777c.thor

bf7c4fe9e2e03e22_gizcryge-7am0-ffx5-7dfd-6f4c864954fa.thor

56563479e2ae1aa2_gizcryge-7am0-ffx5-7986-73b6f5003c29.thor

919daba9f8c3cd38_gizcryge-7am0-ffx5-347e-281af299a94c.thor

7a74ed74d330ad32_gizcryge-7am0-ffx5-f19d-15aa0291e980.thor

418ddac1b5152dd6_gizcryge-7am0-ffx5-0be9-669871a1d8f5.thor

3ae8e767f1de8bac_gizcryge-7am0-ffx5-b947-52d53ca45610.thor

74931ccb85d1db2c_gizcryge-7am0-ffx5-c9ce-55c167823365.thor

ea1f52c653dc84e8_gizcryge-7am0-ffx5-5802-3bcb05785bbc.thor

150b896d4d677867_gizcryge-7am0-ffx5-306a-4c04a9f985f6.thor

44c961ffe0c2695d_gizcryge-7am0-ffx5-000c-1848f66c19b2.thor

8bf3b76c94c1eb7d_gizcryge-7am0-ffx5-5604-0872651ce511.thor

d405062e983588aa_gizcryge-7am0-ffx5-61b1-1438ea73be9e.thor

57d5a81b4b4f9026_gizcryge-7am0-ffx5-9720-a0b30df234d9.thor

e390bce55aa4964e_gizcryge-7am0-ffx5-73aa-7fe53576e1b2.thor

44a240ce165f3986_gizcryge-7am0-ffx5-5fe3-31d6c83191ef.thor

43aa309bb2e50904_gizcryge-7am0-ffx5-f97b-9379c40cbc64.thor

6a0d6229321dbc0d_gizcryge-7am0-ffx5-35a1-ebba9db2f370.thor

e9516471b33278ca_gizcryge-7am0-ffx5-9776-a20fc07bf8d6.thor

49e1d6c457fd320f_gizcryge-7am0-ffx5-081b-e2580971d149.thor

25bcc4536bf6addc_gizcryge-7am0-ffx5-1299-4679e93da503.thor

ae91047dbfdc73e8_gizcryge-7am0-ffx5-c0c9-51df62416393.thor

c4d49bc7370a1226_gizcryge-7am0-ffx5-2b48-d6774feb1200.thor

26e3e741e39017d4_gizcryge-7am0-ffx5-7002-8d4fe5683759.thor

8e8df9aac874236c_gizcryge-7am0-ffx5-2a0a-f24447196420.thor

c056412455338584_gizcryge-7am0-ffx5-dd7c-21c1c7575d34.thor

6359edac7d18f883_gizcryge-7am0-ffx5-224c-f019dd010902.thor

c5af78dd7d8f0f32_gizcryge-7am0-ffx5-6050-9c37424e8ba3.thor

f763a8ceab071dc3_gizcryge-7am0-ffx5-7e8d-cb3f9673ad0a.thor

84d39a49eeedacac_gizcryge-7am0-ffx5-f251-f790abaacdfc.thor

50748afeec96654f_gizcryge-7am0-ffx5-7695-b9626b42e889.thor

fcca256114cacfb1_gizcryge-7am0-ffx5-a7e3-12410d86621e.thor

b36c6c32b639983f_gizcryge-7am0-ffx5-4db5-c0c75be6384f.thor

07d0ec7c83c6c4b0_gizcryge-7am0-ffx5-5c87-08ce346ab711.thor

447c53c3e07093f0_gizcryge-7am0-ffx5-79e0-8541c5421313.thor

fd4a89a6fa7c132f_gizcryge-7am0-ffx5-04bc-e0dd149c465a.thor

df713810ec62eaf3_gizcryge-7am0-ffx5-c18a-a15d944523d5.thor

d6c90e42bd49e5bf_gizcryge-7am0-ffx5-07c3-e79304709d14.thor

2a63a27804437dff_gizcryge-7am0-ffx5-8c42-3a453aaa1c6d.thor

e21dd0bf7501a499_gizcryge-7am0-ffx5-246c-e4d315817795.thor

bd32b37f7e614c91_gizcryge-7am0-ffx5-a193-8330fb731968.thor

1848d6382196ac0a_gizcryge-7am0-ffx5-a3e1-d84941485dea.thor

5670d2654a256c45_gizcryge-7am0-ffx5-630b-453f307e08af.thor

e899213f1b07c9d1_gizcryge-7am0-ffx5-8bd0-df76aab29848.thor

20c8772d3dc8eff5_gizcryge-7am0-ffx5-d9c3-a3af12d82826.thor

231426d2682ca3f4_gizcryge-7am0-ffx5-f00b-b76840a4743d.thor

fbd3899e5106bde2_gizcryge-7am0-ffx5-355e-ebfa74d85ab3.thor

3a3aac60eac8697c_gizcryge-7am0-ffx5-44b4-89f298f81a7d.thor

dd2b0060107b8d46_gizcryge-7am0-ffx5-ee49-f56976824a3a.thor

f0572b5708c83015_behavior.xml

2791604dd8cf1da9_gizcryge-7am0-ffx5-7470-bca65b678e9d.thor

4dddaaa7ea30c2c2_gizcryge-7am0-ffx5-f7cf-ba1539d19805.thor

f70a3cff1b6184a4_gizcryge-7am0-ffx5-9ed4-60fc4ee8f602.thor

0d4ce50a49af59b7_gizcryge-7am0-ffx5-9811-014ae2420618.thor

c0cdf81922e89d3b_gizcryge-7am0-ffx5-19d3-a0b9f4aab2b2.thor

57daf813cdfc3da7_gizcryge-7am0-ffx5-4d8d-88ef9790f29d.thor

78560a07be29d560_gizcryge-7am0-ffx5-e18c-693e6a9a3f22.thor

4c79a8b85e70ed77_gizcryge-7am0-ffx5-4806-4f0fc58c9063.thor

193d04c59d72ff2c_gizcryge-7am0-ffx5-3d4e-fb9a06cb11bd.thor

52b1f85301ee5b74_gizcryge-7am0-ffx5-336c-a09e6f343470.thor

9378269d2ac0f7e6_gizcryge-7am0-ffx5-657d-d099eb4958e8.thor

3894fec859dd108e_gizcryge-7am0-ffx5-d454-a579e41f7f3a.thor

1f9e57ef91fb9dd5_gizcryge-7am0-ffx5-d67b-119d326bf04c.thor

3503c75f9748a7b3_gizcryge-7am0-ffx5-1782-324d03892eab.thor

832b0a5a3cab8997_gizcryge-7am0-ffx5-7f3a-794090152394.thor

fb57ee29cad2ba53_gizcryge-7am0-ffx5-d800-ddad99010b7f.thor

8f998b6dede73968_gizcryge-7am0-ffx5-fa1a-c4e7c4c96022.thor

dea43098fa219743_gizcryge-7am0-ffx5-dfd0-590f49680f46.thor

25224f8dfb6383c5_gizcryge-7am0-ffx5-c096-0f2e3cad9ea3.thor

7f7e45c60634532e_gizcryge-7am0-ffx5-c4f1-29a8eb91e784.thor

0ca996089738ddec_gizcryge-7am0-ffx5-be7a-d234418b8a80.thor

0174d1f0bb499eee_gizcryge-7am0-ffx5-c84c-e222b8fa9156.thor

8eddc871e61f4879_gizcryge-7am0-ffx5-9d82-d92fa6e0eefd.thor

961e3eb715cf9bb6_gizcryge-7am0-ffx5-554f-f0fcc45f0def.thor

29647d6e2af4d0e4_gizcryge-7am0-ffx5-80c2-d55618357ea8.thor

e115664f3e317e78_gizcryge-7am0-ffx5-108a-a591cbc05da8.thor

b4ac38d22d344020_gizcryge-7am0-ffx5-e875-e9b4050f2ce6.thor

09dfb365fee019e3_gizcryge-7am0-ffx5-4f30-b1aa3caf5ec1.thor

154d33f453d16679_gizcryge-7am0-ffx5-3e1d-72edee34f4f5.thor

bf34124caee7322c_gizcryge-7am0-ffx5-bfc1-134a8fedd3f3.thor

413a25996712c961_gizcryge-7am0-ffx5-939f-1618c1998e3d.thor

ff2a56ea2809acaa_gizcryge-7am0-ffx5-499c-21c7469ad356.thor

e3871b4e5364b1f4_gizcryge-7am0-ffx5-0f70-dabbfadcad7a.thor

fb6ebf33d4c356fd_gizcryge-7am0-ffx5-8f94-a32d6d5a890c.thor

47ce30388e20a810_gizcryge-7am0-ffx5-41ec-46134328448b.thor

8ec73978eac63f23_gizcryge-7am0-ffx5-d100-0ad7930375ee.thor

1a3e8e3b73f846b3_gizcryge-7am0-ffx5-efa6-38481331b5d4.thor

290aa90b02a49d9b_gizcryge-7am0-ffx5-c7cd-fdd981c8dcb1.thor

60acd7bf93cb8327_gizcryge-7am0-ffx5-cb3f-96943c73ba98.thor

f098975551de2ff0_gizcryge-7am0-ffx5-b888-4a6d5315cf4e.thor

7f244f1fa7d85fcb_gizcryge-7am0-ffx5-bbb3-876cd79687f1.thor

6c83c3fdf6145a43_gizcryge-7am0-ffx5-74e6-1da20866a805.thor

e747409110821755_gizcryge-7am0-ffx5-391e-e00d9cfff80b.thor

b1b98345506db9cb_gizcryge-7am0-ffx5-a368-077a52d2b0e9.thor

4716d2291c4fedd7_gizcryge-7am0-ffx5-94eb-963d6456d049.thor

ceccabebc1fb2ef1_gizcryge-7am0-ffx5-e524-cc1a5efb05b9.thor

7ded204f560a6912_gizcryge-7am0-ffx5-6ea9-13b62344140c.thor

08b433f1d027d63c_gizcryge-7am0-ffx5-1311-b639c5f100b1.thor

2d12e679fc834683_gizcryge-7am0-ffx5-71c6-bf1110ec0cc3.thor

b1bb7bf4ecc7d916_gizcryge-7am0-ffx5-8243-42906a0ca640.thor

994e12e6d2fe185d_gizcryge-7am0-ffx5-3120-3c8f527e1800.thor

8596a48eb9ca40dd_gizcryge-7am0-ffx5-7b91-7ccf2df0bf0a.thor

e4304eff002c3046_gizcryge-7am0-ffx5-a643-f8305e2ccc65.thor

d48ec05413d1bc14_gizcryge-7am0-ffx5-1b6d-40118c68c4a1.thor

29b1816c07ede9fb_gizcryge-7am0-ffx5-282d-189c35c3a44a.thor

12ca0128bdbfdf41_gizcryge-7am0-ffx5-2951-d6c5093a9995.thor

77bfa5d993885bb9_gizcryge-7am0-ffx5-b948-c267bc4aef59.thor

73ae44dd596bfe53_gizcryge-7am0-ffx5-ae32-e3b3af227b71.thor

02b0088b060b41ca_gizcryge-7am0-ffx5-82ff-c79a13b7e2e0.thor

589561de35949085__41_what_is.html

a9fea685e7d54790_gizcryge-7am0-ffx5-d436-506bfb99337d.thor

5a2503afcf001d89_gizcryge-7am0-ffx5-2281-cbe9609677b3.thor

2a47d302226fc677_gizcryge-7am0-ffx5-bec8-be8eeea57e2d.thor

d6167c2ac75b9004_gizcryge-7am0-ffx5-d4a7-82a748188e36.thor

6f07f36d088202f0_gizcryge-7am0-ffx5-83aa-558d8a46b0d5.thor

72cf562bcf2c9513_gizcryge-7am0-ffx5-12cb-70e900140d1d.thor

63e3596531a1c59c_gizcryge-7am0-ffx5-1362-c6246600cbb1.thor

f8854ec4a09f27b1_gizcryge-7am0-ffx5-9600-988faa1cbbb3.thor

e8e5cf27c21dc933_gizcryge-7am0-ffx5-32d6-deef18b3036e.thor

NRV_2INP08_.js

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

Behavior Summary

File-Read
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\email\test\data\msg_45.txt
  • c:\Python27\include\ast.h
  • c:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml
  • c:\Python27\include\pyexpat.h
  • c:\Python27\include\tupleobject.h
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml
  • c:\Python27\include\descrobject.h
  • c:\Python27\Lib\test\cjkencodings\iso2022_kr.txt
  • c:\Python27\Lib\test\cjkencodings\gb2312.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Python27\include\grammar.h
  • c:\Python27\include\import.h
  • \\?\PIPE\browser
  • c:\Python27\Lib\email\test\data\msg_30.txt
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.proofing.msi.16.en-us.xml
  • c:\6cdeacda242012e0e5b593e657\1032\LocalizedData.xml
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\Python27\Lib\email\test\data\msg_36.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\Python27\Lib\test\cjkencodings\johab.txt
  • c:\Python27\Lib\idlelib\TODO.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\Python27\include\marshal.h
  • c:\Python27\Lib\email\test\data\msg_23.txt
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\Python27\Lib\email\test\data\msg_19.txt
  • c:\Python27\Lib\idlelib\extend.txt
  • c:\Python27\Lib\test\badcert.pem
  • c:\Python27\Lib\test\cjkencodings\euc_kr.txt
  • c:\Python27\include\pgen.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • c:\Python27\Lib\test\floating_points.txt
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\Python27\include\objimpl.h
  • c:\Python27\Lib\test\math_testcases.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx45_IIS_schema_update.xml
  • c:\Python27\Lib\idlelib\idle_test\README.txt
  • c:\Python27\include\abstract.h
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\keycert.passwd.pem
  • c:\Python27\Lib\test\cjkencodings\gb18030-utf8.txt
  • c:\Python27\include\object.h
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\LocalizedData.xml
  • c:\Python27\Lib\test\cjkencodings\shift_jis.txt
  • c:\Python27\Lib\test\cjkencodings\euc_jisx0213.txt
  • c:\Python27\tcl\tclConfig.sh
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\Python27\include\pyport.h
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml
  • c:\Python27\include\code.h
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml
  • c:\Python27\Lib\test\exception_hierarchy.txt
  • c:\Python27\include\dtoa.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\Python27\include\asdl.h
  • c:\Python27\Lib\test\empty.vbs
  • c:\6cdeacda242012e0e5b593e657\1030\LocalizedData.xml
  • c:\ProgramData\Microsoft\IlsCache\ilrcache.xml
  • c:\Python27\Lib\email\test\data\msg_12.txt
  • c:\Python27\include\complexobject.h
  • c:\Python27\Lib\email\test\data\msg_13.txt
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1031\LocalizedData.xml
  • c:\Python27\Lib\lib2to3\Grammar.txt
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • c:\Python27\include\pyctype.h
  • c:\Python27\Lib\email\test\data\msg_02.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\gIXBFMOAcFFnYRvvk.doc
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • c:\Python27\Lib\test\nokia.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • c:\Python27\include\pydebug.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • c:\Python27\include\fileobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\LlJvsfOTDdyAS.docx
  • c:\Python27\Lib\email\test\data\msg_11.txt
  • c:\Python27\include\enumobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\KIDSROOM\Users\Default\NTUSER.DAT.LOG
  • c:\Python27\include\pyfpe.h
  • c:\Python27\include\compile.h
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.en-us.xml
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\jLmsAMwLwn.ppt
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml
  • c:\Python27\Lib\test\cjkencodings\shift_jisx0213-utf8.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • c:\Python27\include\cobject.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml
  • c:\Python27\Lib\test\cjkencodings\hz.txt
  • c:\Python27\Lib\email\test\data\msg_22.txt
  • c:\Python27\include\pgenheaders.h
  • c:\Python27\include\pythread.h
  • c:\Python27\Lib\email\test\data\msg_31.txt
  • c:\Python27\Lib\email\test\data\msg_14.txt
  • c:\Python27\Lib\email\test\data\msg_39.txt
  • c:\Python27\Lib\site-packages\setuptools\command\launcher manifest.xml
  • c:\Python27\Lib\email\test\data\msg_40.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml
  • c:\Python27\include\opcode.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • c:\6cdeacda242012e0e5b593e657\1038\LocalizedData.xml
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\en-us.16\MasterDescriptor.en-us.xml
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\include\memoryobject.h
  • c:\Python27\include\moduleobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml
  • c:\Python27\Lib\email\test\data\msg_25.txt
  • c:\Python27\include\boolobject.h
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\dependency_links.txt
  • c:\Python27\include\token.h
  • c:\Python27\include\bitset.h
  • c:\Python27\include\warnings.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\Python27\include\pycapsule.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Access.Access.x-none.msi.16.x-none.xml
  • c:\Python27\Lib\email\test\data\msg_27.txt
  • c:\Python27\Lib\idlelib\NEWS.txt
  • c:\Python27\Lib\email\test\data\msg_42.txt
  • c:\Python27\include\modsupport.h
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • c:\Python27\Lib\idlelib\help.txt
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml
  • c:\Python27\include\ucnhash.h
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\Lib\test\cjkencodings\cp949-utf8.txt
  • c:\Python27\Lib\email\test\data\msg_16.txt
  • c:\Python27\include\symtable.h
  • c:\Python27\include\node.h
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\NetFx40_IIS_schema_update.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\kKmKLincfvkAqMi.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\Lib\idlelib\HISTORY.txt
  • c:\Python27\Lib\test\cjkencodings\iso2022_kr-utf8.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\Python27\Lib\test\cjkencodings\gb2312-utf8.txt
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\Lib\email\test\data\msg_41.txt
  • c:\Python27\include\cStringIO.h
  • c:\Python27\Lib\test\cjkencodings\euc_jp.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml
  • c:\ProgramData\Sun\Java\Java Update\jaureglist.xml
  • c:\Python27\Lib\email\test\data\msg_29.txt
  • c:\Python27\Lib\email\test\data\msg_01.txt
  • \\?\PIPE\lsarpc
  • c:\Python27\include\metagrammar.h
  • c:\Python27\Lib\test\formatfloat_testcases.txt
  • c:\Python27\Lib\test\sha256.pem
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml
  • c:\Python27\include\classobject.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • c:\Python27\include\datetime.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • c:\6cdeacda242012e0e5b593e657\1028\LocalizedData.xml
  • c:\Python27\Lib\test\cjkencodings\hz-utf8.txt
  • c:\Python27\Lib\email\test\data\msg_18.txt
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml
  • c:\Python27\include\errcode.h
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info\top_level.txt
  • c:\Python27\Lib\test\keycert3.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Python27\Lib\email\test\data\msg_09.txt
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\WCFIYQmTCoLPo.doc
  • c:\6cdeacda242012e0e5b593e657\1045\LocalizedData.xml
  • c:\Python27\include\pyerrors.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml
  • c:\Python27\include\Python-ast.h
  • c:\Python27\Lib\email\test\data\msg_21.txt
  • c:\Python27\include\ceval.h
  • c:\Python27\Lib\lib2to3\PatternGrammar.txt
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\hNUdnfzMKy.rtf
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\structmember.h
  • c:\Python27\Lib\idlelib\README.txt
  • c:\Python27\include\pygetopt.h
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\Python27\include\codecs.h
  • c:\Python27\Lib\email\test\data\msg_10.txt
  • c:\Python27\Lib\email\test\data\msg_33.txt
  • c:\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • c:\Python27\include\patchlevel.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\Python27\include\bytes_methods.h
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx40_IIS_schema_update.xml
  • c:\Python27\Lib\test\cjkencodings\cp949.txt
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\longintrepr.h
  • c:\Python27\Lib\email\test\data\msg_17.txt
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml
  • c:\Python27\Lib\test\cjkencodings\shift_jis-utf8.txt
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml
  • c:\Python27\include\Python.h
  • c:\Python27\Lib\email\test\data\msg_34.txt
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\entry_points.txt
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\Python27\Lib\test\cjkencodings\iso2022_jp-utf8.txt
  • c:\Python27\include\pystate.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\Lib\test\ieee754.txt
  • c:\Python27\Lib\test\cjkencodings\shift_jisx0213.txt
  • c:\Python27\include\pyconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • c:\Python27\include\pymacconfig.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml
  • c:\Python27\include\bufferobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\WiCsdamoeY.pptx
  • c:\Python27\include\timefuncs.h
  • c:\Python27\Lib\email\test\data\msg_37.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\floatobject.h
  • c:\Python27\Lib\email\test\data\msg_26.txt
  • c:\Python27\Lib\test\pycacert.pem
  • c:\Python27\Lib\test\badkey.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • c:\Python27\Lib\test\cjkencodings\big5.txt
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\top_level.txt
  • c:\6cdeacda242012e0e5b593e657\1036\LocalizedData.xml
  • c:\Python27\Lib\test\cjkencodings\euc_jp-utf8.txt
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.publishermui.msi.16.en-us.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • c:\Python27\Lib\email\test\data\msg_35.txt
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmui.msi.16.en-us.xml
  • c:\6cdeacda242012e0e5b593e657\1033\LocalizedData.xml
  • c:\alctkbeg\bin\cert.p12
  • c:\Python27\Lib\test\185test.db
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\Lib\email\test\data\msg_08.txt
  • c:\Python27\include\eval.h
  • c:\Python27\Lib\email\test\data\msg_15.txt
  • c:\Python27\Lib\site-packages\README.txt
  • c:\Python27\include\genobject.h
  • c:\6cdeacda242012e0e5b593e657\1029\LocalizedData.xml
  • c:\Python27\Lib\test\cjkencodings\big5hkscs.txt
  • c:\Python27\Lib\email\test\data\msg_28.txt
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\parsetok.h
  • c:\Python27\include\osdefs.h
  • c:\6cdeacda242012e0e5b593e657\1025\LocalizedData.xml
  • \\?\PIPE\wkssvc
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\Python27\Lib\test\leakers\README.txt
  • c:\Python27\include\pymem.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\Python27\include\pyarena.h
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\Python27\Lib\email\test\data\msg_46.txt
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\Python27\include\rangeobject.h
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\include\iterobject.h
  • c:\Python27\include\funcobject.h
  • c:\Python27\include\listobject.h
  • c:\Python27\Lib\email\test\data\msg_44.txt
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\Python27\include\frameobject.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64ww.msi.16.x-none.xml
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\6cdeacda242012e0e5b593e657\1043\LocalizedData.xml
  • c:\Python27\include\sliceobject.h
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\Lib\email\test\data\msg_43.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml
  • c:\Python27\include\stringobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\Python27\include\intobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\ATgbQFEagK.ppt
  • c:\Python27\Lib\email\test\data\msg_20.txt
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\Python27\Lib\test\cjkencodings\johab-utf8.txt
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemuiset.msi.16.en-us.xml
  • c:\Python27\include\methodobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\include\structseq.h
  • c:\Python27\Lib\test\cmath_testcases.txt
  • c:\Python27\Lib\test\cjkencodings\gb18030.txt
  • c:\Python27\include\pymath.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\Lib\email\test\data\msg_32.txt
  • c:\Python27\Lib\email\test\data\msg_24.txt
  • c:\6cdeacda242012e0e5b593e657\1037\LocalizedData.xml
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • c:\Python27\Lib\test\keycert2.pem
  • c:\Python27\include\py_curses.h
  • c:\ProgramData\WebEx\WebEx\atsdk.xml
  • c:\Python27\Lib\test\cjkencodings\gbk-utf8.txt
  • c:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml
  • c:\Python27\include\setobject.h
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml
  • c:\Python27\Lib\test\cjkencodings\big5-utf8.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\Lib\test\cjkencodings\gbk.txt
  • c:\Python27\include\graminit.h
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • c:\6cdeacda242012e0e5b593e657\1035\LocalizedData.xml
  • c:\Python27\include\bytearrayobject.h
  • c:\Python27\Lib\email\test\data\msg_12a.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\Python27\Lib\idlelib\CREDITS.txt
  • c:\Python27\include\dictobject.h
  • c:\Python27\Lib\test\cjkencodi