'
metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2016-11-08 12:59:50.274788 2016-11-08 13:06:48.990188 418 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo2 win7 Clone 2 VirtualBox 2016-11-08 13:03:12 2016-11-08 13:06:48

File Details

File name 98ead3e5d4f3a16b7ee62f0ff3d41b48950a7c09.zip
File size 1109 bytes
File type Zip archive data, at least v2.0 to extract
CRC32 CA2CEA22
MD5 6a64f7bc487476f6b82427347dc73d9c
SHA1 98ead3e5d4f3a16b7ee62f0ff3d41b48950a7c09
SHA256 39ca9fea30de1b00bab37e68233c559e1d4d4b5756ccca68c9a4bbaabf5fa379
SHA512 cedf92eee911bb74694be62e9ffb3901eddbdcc2ac28af51775610eb4323867939691e7f7e79b13df023f9dbd0ab77b3b783136a8e5e8949da02f6097d9a5d8e
Ssdeep 24:9cT0lJ067uXZOIsTsfaBaClS+b3t8s5BYwukwOCZZ4PXG:9i0lJ03Y94fahI+Z3i/ZZ4e
PEiD None matched
Yara
  • PM_Zip_with_js ()
VirusTotal Permalink
VirusTotal Scan Date: 2016-11-08 12:56:12
Detection Rate: 8/56 (Expand)

MetaFlows Scores

Metaflows Analysis Results (Signatures=125, Anomalies=0, PEiD=0, Yara=2, VT[1478610444]=100): Snort Events=1, AV Events=2
Total Score=125

SNORT EVENTS:
ET POLICY PE EXE or DLL Windows file download HTTP

CLAMAV DETECTED:
Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND
DROPPED FILE - NRV_F9DF5220_.js: Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND

Dropped File/Buffer Yara Signatures:
02a3c39d4987ca98b97d841db6f637441f8e2c8c [BUFFER]: Str_Win32_Http_API
30d93d698bb32f09172d788036c48f3e70d1dee5 [BUFFER]: shellcode

Signatures

antivm_queries_computername details
recon_fingerprint details
antivm_memory_available details
dumped_buffer details
creates_doc details
antivm_network_adapters details
dumped_buffer2 details
antivm_vbox_files details
Windows_Proxy_Tinkering details
network_wscript_downloader details
persistence_ads details
antiav_detectfile details
exploit_heapspray details
malicious_document_urls details
network_document_file details
network_downloader_exe details
antivm_vbox_devices details
antivm_vbox_files details
modifies_files details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

a714f0ab80b1f8c5_gizcryf0-7am0-ficb-73d9-7811865325ff.thor

5369aa4262343cb0_gizcryf0-7am0-ficb-a698-697056cb2d20.thor

95992ef29eef5e5b_gizcryf0-7am0-ficb-a364-9b64a7672f0d.thor

a1efa94a0e288416_gizcryf0-7am0-ficb-b3f8-8f024656d76f.thor

6ebf8d84699665ed_gizcryf0-7am0-ficb-4cfc-664b46454afe.thor

b239cd51fffca4d5_gizcryf0-7am0-ficb-e2cb-8b348fcd9c80.thor

cc3fa999cba81fd0_gizcryf0-7am0-ficb-0ab3-74d59145a71e.thor

6381d5f83c9c4aa3_gizcryf0-7am0-ficb-d23b-8e4da56a40c6.thor

a072743e6c951421_gizcryf0-7am0-ficb-a581-d1c63543b7d5.thor

37703efeb8b5e484_gizcryf0-7am0-ficb-1f40-7298775930b2.thor

c8381188aba21d38_gizcryf0-7am0-ficb-df34-827a5a56cdbb.thor

be245a6d553fae21_gizcryf0-7am0-ficb-1959-0aa3f0ad658d.thor

99619a46801dccab_gizcryf0-7am0-ficb-5525-4d6636371178.thor

779db7e6b560b777_gizcryf0-7am0-ficb-2d93-c067a0e2fea4.thor

670a47d850373dea_gizcryf0-7am0-ficb-8b11-22ade023ff93.thor

ccac9eca5a8e7a67_gizcryf0-7am0-ficb-c1b1-ef89418a0248.thor

2ba855511129a40d_gizcryf0-7am0-ficb-d771-99688293a59c.thor

f7f73414c0bb13f6_gizcryf0-7am0-ficb-151a-65f59966d6d3.thor

6f45c47f6a563cc3_gizcryf0-7am0-ficb-30ff-910e92713348.thor

c0c3d419ddef0ee9_gizcryf0-7am0-ficb-5bf4-e4f2724919c2.thor

69bd374f9534a160_gizcryf0-7am0-ficb-73d2-b2488ee0d92a.thor

2c7f3bbbcc045faf_gizcryf0-7am0-ficb-feef-36c98937701f.thor

a23ebf68c14f133d_gizcryf0-7am0-ficb-9f8b-e61ec6232fef.thor

904c64806e800994_gizcryf0-7am0-ficb-c4d9-b87f2b445db7.thor

ceaa37c288919c15_gizcryf0-7am0-ficb-8b19-48ca084055b5.thor

d9ceceedc65a67f4_gizcryf0-7am0-ficb-1a15-5d45d7c6200d.thor

5425fe384131757b_gizcryf0-7am0-ficb-8884-ef23591991f5.thor

5df891617e63f63a_gizcryf0-7am0-ficb-0f3f-dd4c2f1ea578.thor

1b576546ae86a29c_gizcryf0-7am0-ficb-c179-20f99ec5201e.thor

e23f44c1275ce961_gizcryf0-7am0-ficb-04a5-d5aeccd8f66d.thor

8c43bb9d55495c2a_gizcryf0-7am0-ficb-564b-be014a5c5907.thor

fa66b0a29b172814_gizcryf0-7am0-ficb-e2b1-f83c072adb41.thor

66e5257fe82f6f19_gizcryf0-7am0-ficb-3d12-c48350cb1eb0.thor

b3bb73f2ce372d9d_gizcryf0-7am0-ficb-746e-a007e1fbb212.thor

aef45f6070c28202_gizcryf0-7am0-ficb-80a1-49bdd5cb81f1.thor

0853afdff5ca8feb_gizcryf0-7am0-ficb-1b87-752003c4211b.thor

411dc67b64668cc3_gizcryf0-7am0-ficb-d460-6a01e15b1390.thor

4fa12a977c5b58b3_gizcryf0-7am0-ficb-aa6e-2d4bd976ca3f.thor

bf993102a3cd0ce0_gizcryf0-7am0-ficb-acae-24c027f91348.thor

5adf884103fee9b0_gizcryf0-7am0-ficb-395b-29861df78a42.thor

6b98fb2aa7011ed2_gizcryf0-7am0-ficb-bd74-1d2dc79e5ad0.thor

3d09d9abc3ea6efb_gizcryf0-7am0-ficb-29ec-3b979a4c8ce6.thor

b9c7ee88f5f903d1_gizcryf0-7am0-ficb-90b6-d7ff6b646a13.thor

a6fe874388de5465_gizcryf0-7am0-ficb-9926-292c6b5b79c7.thor

f0e39bf49641526a_gizcryf0-7am0-ficb-6c1a-3ed9b1a9871d.thor

45e3fc9263668ec4_uqk1lo11kg6o8b.dll

52c6d8043e2cbbaf_gizcryf0-7am0-ficb-9eb8-5a461ffa94e4.thor

d90b0c53b87faed6_gizcryf0-7am0-ficb-f6eb-95a1945eec48.thor

4b3be1ea8b48ca8c_gizcryf0-7am0-ficb-2645-67c6047db950.thor

21010e2b9377c192_gizcryf0-7am0-ficb-46d8-f9aaaeb2343a.thor

d5c2f673691d7ec7_gizcryf0-7am0-ficb-d212-a950c08a2c0a.thor

44f0830c6049d3fd_gizcryf0-7am0-ficb-bff0-3dba49d172de.thor

d73a9f6bebd0b471_gizcryf0-7am0-ficb-b664-de71e597b5b8.thor

f8231baf4170ce7a_gizcryf0-7am0-ficb-4cef-9983422517b3.thor

14e74bd697b5316f_gizcryf0-7am0-ficb-138f-10f0602a182a.thor

7fe48c9762b62a9a_gizcryf0-7am0-ficb-1f4c-30af0e1839ff.thor

b609fd0f31ce8a6c_gizcryf0-7am0-ficb-f7c6-bbdf34584a80.thor

81d279787ead9a51__10_what_is.html

047b01da895716b3_gizcryf0-7am0-ficb-1f51-db7f58e1793c.thor

6c1160608f32688d_gizcryf0-7am0-ficb-970f-9132e46dbd2b.thor

6bc2c5b11a55691a_gizcryf0-7am0-ficb-65b8-9a3fec874c31.thor

356a671af72500d9_gizcryf0-7am0-ficb-d5b9-29f6fe3ee0ad.thor

bc04cedc6d7840f3_gizcryf0-7am0-ficb-b374-cbf95c8716b8.thor

fe787a94f93c155b_gizcryf0-7am0-ficb-afa4-0f1f8745d2d8.thor

c7531c525dcc2dfa_gizcryf0-7am0-ficb-1f93-12e2045564f5.thor

d9caf5df4f64abdb_gizcryf0-7am0-ficb-e748-3b7c874dddaa.thor

98e601c1fd6b2517_gizcryf0-7am0-ficb-af3e-277c0e3c0b9d.thor

e8d63b98eb304bf4_gizcryf0-7am0-ficb-7f91-f1fdaed82b57.thor

31a21159a3851a1d_gizcryf0-7am0-ficb-60e4-0149b761f0ff.thor

d32ec50d34986754_gizcryf0-7am0-ficb-4fd5-babfedc99048.thor

9647fed25732d051_gizcryf0-7am0-ficb-4bec-088ee66891c7.thor

1dd0419ec975c8a8_gizcryf0-7am0-ficb-8f58-904ae03b798d.thor

44241d3dc6469cd2_gizcryf0-7am0-ficb-c651-167f81ebf945.thor

bc3645c1360b5a9c_gizcryf0-7am0-ficb-2db2-d387d205f945.thor

ec880565970533c3_gizcryf0-7am0-ficb-9333-28389158ab35.thor

efcf6e86630e85de_gizcryf0-7am0-ficb-f330-456f98e23c9e.thor

30fd3046e97d952a_gizcryf0-7am0-ficb-00f6-d62f57976dcb.thor

9db0c0b59fc5a3b7_gizcryf0-7am0-ficb-4ae1-26f3549f21e0.thor

971949ce792e91ee_gizcryf0-7am0-ficb-91c1-5ad8cf6d9c49.thor

d2a11090f4cd6858_gizcryf0-7am0-ficb-a87a-fdb1814675e6.thor

d58d71459a202a2a_gizcryf0-7am0-ficb-a376-cc8952b55eeb.thor

09d178548e9f8b3c_gizcryf0-7am0-ficb-8b33-478888601529.thor

65ad2bf1ceec4721_gizcryf0-7am0-ficb-2068-1aa77c09f582.thor

22fde97b21081cf0_gizcryf0-7am0-ficb-0d3a-1e372384c158.thor

5886d51d198dbbc3_gizcryf0-7am0-ficb-0d60-6a4c3823fe95.thor

fdc1dae01f7084f2_gizcryf0-7am0-ficb-a466-ec5c15a54d3d.thor

be216c065f47cf40_gizcryf0-7am0-ficb-988b-37545bfd5d33.thor

d57a3f75349a1e32_gizcryf0-7am0-ficb-3ec9-63d378341ca5.thor

30c9bc481fb939da_gizcryf0-7am0-ficb-118d-6b00147bd4e8.thor

73b3a578491b2f3e_gizcryf0-7am0-ficb-080a-476118fbe698.thor

ced48989beb50c80_gizcryf0-7am0-ficb-73f6-8fdbbcd09a34.thor

798b4e384a944b20_gizcryf0-7am0-ficb-da35-61e64dd9893c.thor

fffc73833064b3d1_gizcryf0-7am0-ficb-36ab-3b9e5170c05d.thor

d15b4b7a8698c31e_gizcryf0-7am0-ficb-cf9b-0b0fe188a408.thor

e83f9f5d6a5dde66_gizcryf0-7am0-ficb-26c2-7f4fbadae594.thor

033cffd6ff351305_gizcryf0-7am0-ficb-62c6-ae9c4232daa8.thor

aad2f3a5a73c7e86_gizcryf0-7am0-ficb-32b2-a1c28dafb40d.thor

6de1f3d45b5e3b95_gizcryf0-7am0-ficb-888e-eb38f1d104c9.thor

67fdd402d091d809_gizcryf0-7am0-ficb-3212-2fdcb0888453.thor

287c74f19e719e16_gizcryf0-7am0-ficb-ed37-e01cfe043319.thor

21dcc0b1d9e45be6_gizcryf0-7am0-ficb-5c6d-128f7b89eaa1.thor

18d562d850a9e6e1_gizcryf0-7am0-ficb-900f-2dba95c2b32b.thor

ccd76015c20e2eb9_gizcryf0-7am0-ficb-0613-d1ccec1190dc.thor

5bae0ec65da00023_gizcryf0-7am0-ficb-46a3-0fc3ac369198.thor

3a64dd484621e437_gizcryf0-7am0-ficb-4b49-658a59863721.thor

caad08e9a95791f7_gizcryf0-7am0-ficb-fb84-21a369fc6ae8.thor

7d7235616e42aded_gizcryf0-7am0-ficb-3b05-dc80ae3c986f.thor

1494d57391d0d331_gizcryf0-7am0-ficb-9ad4-0e667e2c0f0a.thor

b3db663561894b0e_gizcryf0-7am0-ficb-2553-d8f5efc52e65.thor

79150e0a37b98111_gizcryf0-7am0-ficb-3662-376674760ebc.thor

b4520c075a97bed3_gizcryf0-7am0-ficb-16c0-bc2793c64751.thor

bca4498a4942601c_gizcryf0-7am0-ficb-3e0c-0a47db799e35.thor

ec283f16e6e253db_gizcryf0-7am0-ficb-6cef-7327fd847ca5.thor

3ce89e8922317fb3_gizcryf0-7am0-ficb-5f4e-26fd2b60dc83.thor

ac095b287c109d2a_gizcryf0-7am0-ficb-9c26-dbd7aea21e12.thor

78dc93edae9166b6_gizcryf0-7am0-ficb-1aec-d3e909a2fa70.thor

528c1fda42540445_gizcryf0-7am0-ficb-2b33-6926dab885ae.thor

83afa1a9bab50206_gizcryf0-7am0-ficb-4eb6-9f65d26ab044.thor

84bf744427ea8d77_gizcryf0-7am0-ficb-2017-010ce81aeb31.thor

2dfced122632a216_gizcryf0-7am0-ficb-994d-51612a7a82bc.thor

edf679ab7088a8dc_gizcryf0-7am0-ficb-d735-3ac4aa468623.thor

01c6b2f2e0bf5ed4_gizcryf0-7am0-ficb-bb65-e48bcb614f71.thor

5ee754e9df00029a_gizcryf0-7am0-ficb-425b-bf7f1064cd5e.thor

a1bdca8ebaca3718_gizcryf0-7am0-ficb-89bf-2415e98eda82.thor

70ecd5081e08a0a4_gizcryf0-7am0-ficb-5b66-f0ead2580282.thor

a2c4b87fbded54f7_gizcryf0-7am0-ficb-afaa-d07240ef6645.thor

15166c89d375d390_gizcryf0-7am0-ficb-f235-fe0ebc6d5165.thor

7778dee3bf78b315_gizcryf0-7am0-ficb-3047-1cbd82352cec.thor

e20b0d96070949a0_gizcryf0-7am0-ficb-005f-3fe04cbf99b5.thor

725ff61d0f1dc193_gizcryf0-7am0-ficb-c623-53ccebc54bc3.thor

0b7a3503f24b0f16_gizcryf0-7am0-ficb-bd37-fba94b91f875.thor

4d5c7f870a375619_gizcryf0-7am0-ficb-7347-5259d60143a5.thor

2e9da6ef5f4e09ae_gizcryf0-7am0-ficb-2002-38440c8ca287.thor

b2e89ae410effb84_gizcryf0-7am0-ficb-2a6f-8e4b10780f50.thor

ad47c61a08d8d554_gizcryf0-7am0-ficb-fcc3-0232742e1a1b.thor

6c231edf002eaa31_gizcryf0-7am0-ficb-317d-f626fc47dafb.thor

d833c8e25600cb1f_gizcryf0-7am0-ficb-46fe-7a6a29e39d36.thor

3672c64fd66b0673_gizcryf0-7am0-ficb-e238-41d3652d0c38.thor

8200ee84e63b3ab6_gizcryf0-7am0-ficb-dd7c-cf989f75c111.thor

4afc3f11173ebe70_gizcryf0-7am0-ficb-3d0d-5cd616f1d996.thor

c4afb24d37a4e628_gizcryf0-7am0-ficb-5308-28865da19a64.thor

59bea4083070cc80_gizcryf0-7am0-ficb-b32e-939e0bbb2087.thor

0551698074e03adc_gizcryf0-7am0-ficb-579b-eb83321b98cd.thor

5f85c06dbff0c16d_gizcryf0-7am0-ficb-9047-fc2aa2a9916f.thor

79be4f353121fec7_gizcryf0-7am0-ficb-5a2a-262f297e1e6f.thor

626ac6f194f5429f_gizcryf0-7am0-ficb-017e-6c51a8f493c8.thor

c2492590365fc518_gizcryf0-7am0-ficb-121e-91f32010488e.thor

93c49761f4873354_gizcryf0-7am0-ficb-a840-84a7d2e35e13.thor

5f64841714f910cf_gizcryf0-7am0-ficb-fd01-9de59bfd0d2a.thor

3956d921cf14c2d3_gizcryf0-7am0-ficb-1373-e20ff60d97a4.thor

a79a7999472941fe_gizcryf0-7am0-ficb-10e1-f3c397758250.thor

0d7c51b3b41901d8_gizcryf0-7am0-ficb-386f-db02fd169c0a.thor

2774635675a83afe_gizcryf0-7am0-ficb-2d18-25e7c3f74f50.thor

810be5ad701ba33c_gizcryf0-7am0-ficb-cc1f-578434af770d.thor

NRV_F9DF5220_.js

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

Behavior Summary

File-Read
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\include\errcode.h
  • c:\utskt\bin\cert.p12
  • c:\Python27\Lib\test\keycert3.pem
  • c:\Python27\include\ast.h
  • c:\Python27\include\pyexpat.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\tupleobject.h
  • c:\Python27\include\parsetok.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\nPdhIeLMnBYElZYVU.docm
  • c:\Python27\include\enumobject.h
  • c:\Python27\include\warnings.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\BuHwupzpMAmbiNHl.ppt
  • c:\Python27\include\cobject.h
  • c:\Python27\include\Python-ast.h
  • c:\Python27\include\osdefs.h
  • c:\Python27\Lib\test\empty.vbs
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\xuhoFeErWKhqN.pptx
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\EhJTJkTGnkBxwNb.rtf
  • c:\Python27\include\pymacconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Python27\include\ceval.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\Python27\include\import.h
  • \\?\PIPE\browser
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\structmember.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\Python27\include\pyarena.h
  • c:\Python27\include\pygetopt.h
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\Python27\include\complexobject.h
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\Python27\include\rangeobject.h
  • c:\Python27\include\pgenheaders.h
  • c:\Python27\include\pythread.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • c:\Python27\include\patchlevel.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\include\iterobject.h
  • c:\Python27\include\memoryobject.h
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\Python27\include\funcobject.h
  • c:\Python27\include\listobject.h
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\Python27\include\marshal.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • c:\Python27\include\frameobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\XokzyeXpaoqs.doc
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\longintrepr.h
  • c:\Python27\Lib\test\pycacert.pem
  • c:\Python27\include\opcode.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\Python27\Lib\test\badcert.pem
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\include\sliceobject.h
  • c:\Python27\include\pgen.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\oInXbyTRavgT.doc
  • c:\Python27\Lib\test\wrongcert.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • c:\Python27\include\objimpl.h
  • c:\Python27\include\Python.h
  • c:\Python27\include\fileobject.h
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • c:\Python27\include\stringobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\vZsxMkvyIdOYhmjR.ppt
  • c:\Python27\include\pyerrors.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\Python27\include\token.h
  • c:\Python27\include\bitset.h
  • c:\Python27\include\intobject.h
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\include\dictobject.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\Python27\include\moduleobject.h
  • c:\Python27\include\abstract.h
  • c:\Python27\include\pystate.h
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\Python27\Lib\test\keycert.passwd.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\include\methodobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\include\object.h
  • c:\Python27\include\descrobject.h
  • c:\Python27\include\grammar.h
  • c:\Python27\include\pyconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • c:\Python27\include\structseq.h
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • \\?\PIPE\wkssvc
  • c:\Python27\include\pymath.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\timefuncs.h
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\Python27\tcl\tclConfig.sh
  • c:\Python27\include\node.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\Python27\include\ucnhash.h
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • c:\Python27\Lib\test\keycert2.pem
  • c:\Python27\include\py_curses.h
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\include\pyport.h
  • c:\Python27\include\graminit.h
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • c:\Python27\include\symtable.h
  • c:\Python27\include\pystrcmp.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\Python27\include\setobject.h
  • c:\Python27\include\boolobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\oZDWVpfJrSk.pptx
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • c:\6cdeacda242012e0e5b593e657\1053\LocalizedData.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\code.h
  • c:\Python27\include\dtoa.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\Python27\include\asdl.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\Lib\idlelib\idle.bat
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • c:\Python27\include\bytearrayobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\Python27\include\floatobject.h
  • c:\Python27\Lib\test\badkey.pem
  • c:\Python27\include\cStringIO.h
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • c:\Python27\include\pyctype.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\Python27\Lib\test\nokia.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\Python27\include\intrcheck.h
  • c:\Python27\include\pydebug.h
  • \\?\PIPE\lsarpc
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • c:\Python27\include\metagrammar.h
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\Python27\include\pymem.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • c:\Python27\Lib\test\dh1024.pem
  • c:\Python27\Lib\test\185test.db
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • c:\Python27\Lib\test\sha256.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • c:\Python27\include\pycapsule.h
  • c:\Python27\include\modsupport.h
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\include\classobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\weakrefobject.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • c:\Python27\include\eval.h
  • c:\Python27\include\datetime.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • c:\Python27\include\bufferobject.h
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\Python27\include\unicodeobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\KIDSROOM\Users\Default\NTUSER.DAT.LOG
  • c:\Python27\include\pyfpe.h
  • c:\Python27\include\compile.h
  • c:\Python27\include\genobject.h
  • c:\Python27\include\cellobject.h
  • c:\Python27\include\codecs.h
  • C:\Users\Harry Dresden\Desktop\desktop.ini
  • C:\Windows\System32\wshom.ocx
  • C:\Windows\System32\wscript.exe
  • C:\Windows\System32\msxml3.dll
  • C:\Users\Harry Dresden\AppData\Local\Temp\NRV_F9DF5220_.js
File-Written
  • c:\6cdeacda242012e0e5b593e657\1033\_28_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\include\object.h
  • c:\Python27\include\errcode.h
  • c:\utskt\bin\cert.p12
  • c:\Python27\Lib\test\keycert3.pem
  • c:\6cdeacda242012e0e5b593e657\1038\_7_WHAT_is.html
  • c:\Python27\include\pyexpat.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\tupleobject.h
  • c:\Python27\include\parsetok.h
  • c:\6cdeacda242012e0e5b593e657\1035\_3_WHAT_is.html
  • c:\Python27\include\enumobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\_11_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\BuHwupzpMAmbiNHl.ppt
  • c:\Python27\include\cobject.h
  • c:\Python27\include\floatobject.h
  • c:\Python27\include\Python-ast.h
  • c:\Python27\include\osdefs.h
  • c:\Python27\Lib\test\empty.vbs
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\xuhoFeErWKhqN.pptx
  • c:\6cdeacda242012e0e5b593e657\1032\_27_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1037\_6_WHAT_is.html
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\EhJTJkTGnkBxwNb.rtf
  • c:\Python27\include\pymacconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Python27\include\ceval.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\6cdeacda242012e0e5b593e657\1055\_17_WHAT_is.html
  • c:\Python27\include\import.h
  • \\?\PIPE\browser
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\structmember.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\Python27\include\pyarena.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\_2_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\Python27\Lib\test\nullcert.pem
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos\_10_WHAT_is.html
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\6cdeacda242012e0e5b593e657\3082\_20_WHAT_is.html
  • c:\Python27\include\complexobject.h
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\Python27\include\rangeobject.h
  • c:\Python27\include\pgenheaders.h
  • c:\Python27\include\warnings.h
  • c:\Python27\include\pythread.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • c:\Python27\include\patchlevel.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\_9_WHAT_is.html
  • c:\Python27\include\iterobject.h
  • c:\Python27\include\memoryobject.h
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\Python27\include\ast.h
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Python27\include\funcobject.h
  • c:\6cdeacda242012e0e5b593e657\2052\_18_WHAT_is.html
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\asdl.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\_5_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\Python27\include\marshal.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1041\_9_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1036\_5_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • c:\Python27\include\pyfpe.h
  • c:\Python27\include\frameobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\XokzyeXpaoqs.doc
  • c:\Python27\Lib\test\_0_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\longintrepr.h
  • c:\Python27\include\opcode.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\Python27\Lib\test\badcert.pem
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\nPdhIeLMnBYElZYVU.docm
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\_2_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1053\_16_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\include\sliceobject.h
  • c:\Python27\include\pgen.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\oInXbyTRavgT.doc
  • c:\Python27\include\timefuncs.h
  • c:\Python27\Lib\test\wrongcert.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • c:\Python27\include\objimpl.h
  • c:\Python27\include\Python.h
  • c:\Python27\include\_4_WHAT_is.html
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts\_13_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • c:\Python27\include\fileobject.h
  • c:\Python27\include\stringobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\vZsxMkvyIdOYhmjR.ppt
  • c:\Python27\include\pyerrors.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\6cdeacda242012e0e5b593e657\1025\_21_WHAT_is.html
  • c:\Python27\include\metagrammar.h
  • c:\Python27\include\bitset.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\_6_WHAT_is.html
  • c:\Python27\include\intobject.h
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\include\dictobject.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\Python27\include\moduleobject.h
  • c:\Python27\include\abstract.h
  • c:\Python27\include\pystate.h
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\Python27\Lib\test\keycert.passwd.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\include\methodobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\_0_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1042\_10_WHAT_is.html
  • c:\Python27\include\grammar.h
  • c:\Python27\include\pyconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • c:\Python27\include\structseq.h
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • \\?\PIPE\wkssvc
  • c:\6cdeacda242012e0e5b593e657\1029\_24_WHAT_is.html
  • c:\Python27\include\pymath.h
  • c:\6cdeacda242012e0e5b593e657\1031\_26_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\modsupport.h
  • c:\ProgramData\WebEx\WebEx\12_1324\_22_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1030\_25_WHAT_is.html
  • c:\Python27\tcl\tclConfig.sh
  • c:\Python27\include\node.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\6cdeacda242012e0e5b593e657\1046\_14_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\Python27\include\ucnhash.h
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • c:\Python27\Lib\test\keycert2.pem
  • c:\Python27\include\py_curses.h
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\include\pyport.h
  • c:\6cdeacda242012e0e5b593e657\1028\_23_WHAT_is.html
  • c:\Python27\include\listobject.h
  • c:\Python27\include\graminit.h
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • c:\Python27\include\symtable.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • c:\Python27\include\pystrcmp.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\Python27\include\setobject.h
  • c:\6cdeacda242012e0e5b593e657\1040\_8_WHAT_is.html
  • c:\Python27\include\boolobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\oZDWVpfJrSk.pptx
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • c:\6cdeacda242012e0e5b593e657\1053\LocalizedData.xml
  • c:\Python27\Lib\test\pycacert.pem
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\code.h
  • c:\Python27\include\dtoa.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\utskt\bin\_1_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\Lib\idlelib\idle.bat
  • UNC\KIDSROOM\Users\Default\_12_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\Python27\include\token.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • c:\Python27\include\traceback.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • c:\Python27\include\bytearrayobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\include\pystrtod.h
  • c:\Python27\Lib\idlelib\_31_WHAT_is.html
  • c:\Python27\include\longobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\_8_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\_3_WHAT_is.html
  • c:\Python27\Lib\test\badkey.pem
  • c:\Python27\include\cStringIO.h
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • c:\Python27\include\pyctype.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • c:\Python27\tcl\tix8.4.3\pref\_29_WHAT_is.html
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • c:\Python27\include\weakrefobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\Python27\Lib\test\nokia.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\Python27\include\intrcheck.h
  • c:\Python27\include\pydebug.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\_7_WHAT_is.html
  • \\?\PIPE\lsarpc
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1044\_12_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1045\_13_WHAT_is.html
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\6cdeacda242012e0e5b593e657\2070\_19_WHAT_is.html
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\Python27\include\pymem.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • c:\Python27\Lib\test\dh1024.pem
  • c:\Python27\Lib\test\185test.db
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • c:\Python27\tcl\_30_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • c:\Python27\Lib\test\sha256.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\include\pycapsule.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\_4_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\include\descrobject.h
  • c:\Python27\include\classobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\pygetopt.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\_1_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • c:\Python27\include\eval.h
  • c:\Python27\include\datetime.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • c:\Python27\include\bufferobject.h
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\Python27\include\unicodeobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\KIDSROOM\Users\Default\NTUSER.DAT.LOG
  • c:\6cdeacda242012e0e5b593e657\1049\_15_WHAT_is.html
  • c:\Python27\include\compile.h
  • c:\Python27\include\genobject.h
  • c:\Python27\include\cellobject.h
  • c:\Python27\include\codecs.h
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YLC2QM2Y\57evyr[1]
  • C:\Users\Harry Dresden\AppData\Local\Temp\Uqk1lO11KG6o8b.dll
File-Opened
  • c:\Python27\include\frameobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\ctypes
  • c:\Users\Default\Links
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages
  • c:\Python27\include\ast.h
  • c:\Python27\include\memoryobject.h
  • c:\Python27\Lib\site-packages\pip\_vendor\colorama
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources
  • c:\Python27\DLLs
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol
  • c:\Python27\include\tupleobject.h
  • c:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode
  • c:\ProgramData\Adobe\Setup
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\xuhoFeErWKhqN.pptx
  • UNC\KIDSROOM\Users\Default\Documents
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\en-US
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Users\Harry Dresden\OneDrive
  • c:\Python27\include\grammar.h
  • c:\ProgramData\Microsoft\PlayReady\Cache\S-1-5-21-3416602863-1947377224-293699093-1001
  • c:\Python27\include\import.h
  • c:\Users\Public\Libraries
  • \\?\PIPE\browser
  • c:\Python27\Lib\test\tracedmodules
  • c:\Python27\tcl\tcl8.5\tzdata\Indian
  • c:\Users\Public
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Queue
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource
  • c:\Python27\Lib
  • \??\VBoxMiniRdrDN
  • c:\ProgramData
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}
  • c:\Python27\Lib\site-packages\pip
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A6
  • c:\Python27\Lib\ctypes\macholib
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\Security
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\inetpub\history\CFGHISTORY_0000000004\schema
  • c:\Python27\Lib\unittest\test
  • c:\ProgramData\Microsoft\PlayReady
  • c:\Python27\Lib\xml\dom
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\Python27\Lib\site-packages\pip\models
  • c:\Python27\include\marshal.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate
  • c:\Python27\Tools\i18n
  • c:\Python27\tcl\tcl8\8.4
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog
  • c:\ProgramData\Microsoft\Crypto\Keys
  • UNC\KIDSROOM\Users\Public\Videos
  • c:\Python27\Lib\test
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos
  • c:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319
  • c:\Python27\Lib\ctypes\test
  • c:\Users\Harry Dresden\Searches
  • c:\Python27\Lib\test\badcert.pem
  • c:\Python27\Lib\ensurepip
  • c:\Python27\include\pgen.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\Users\Harry Dresden\Downloads
  • c:\Python27\include\objimpl.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\ProgramData\Microsoft\eHome
  • c:\Python27\tcl\tk8.5\demos\images
  • c:\Python27\Lib\test\cjkencodings
  • c:\inetpub\wwwroot\aspnet_client\system_web
  • c:\Python27\tcl\tcl8.5\tzdata\America\Kentucky
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US
  • UNC\KIDSROOM\Users\Default\Desktop
  • c:\Python27\include\abstract.h
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\keycert.passwd.pem
  • c:\Python27\include\object.h
  • c:\Python27\tcl\tix8.4.3
  • c:\Python27\include\complexobject.h
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • c:\ProgramData\Microsoft\RAC\PublishedData
  • c:\Python27\include\Python-ast.h
  • c:\inetpub\history\CFGHISTORY_0000000005
  • c:\inetpub\history\CFGHISTORY_0000000004
  • c:\inetpub\history\CFGHISTORY_0000000001
  • c:\Python27\include\pydebug.h
  • c:\inetpub\history\CFGHISTORY_0000000003
  • c:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204
  • c:\Users\Harry Dresden\Favorites\Links for United States
  • c:\Python27\Lib\lib2to3\tests\data\fixers
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\Python27\tcl\tcl8.5\tzdata\US
  • c:\Python27\tcl\tcl8.5\tzdata
  • c:\utskt\lib\core
  • c:\Python27\include\pyport.h
  • c:\Python27\include\pymactoolbox.h
  • c:\Python27\Lib\email
  • c:\Python27\tcl\tix8.4.3\demos\samples
  • c:\Python27\Lib\lib-tk\test\test_tkinter
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\Python27\Tools\pynche
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\Tools\webchecker
  • c:\Python27\tcl\tcl8.5\tzdata\America\North_Dakota
  • c:\Python27\Lib\test\crashers
  • c:\ProgramData\Microsoft\Windows Defender\LocalCopy
  • c:\Python27\include\dtoa.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\Python27\include\asdl.h
  • c:\Python27\Lib\test\empty.vbs
  • c:\Users\Harry Dresden\Contacts
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0
  • c:\PerfLogs
  • c:\
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders
  • c:\Python27\tcl\tcl8\8.5
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\XokzyeXpaoqs.doc
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • c:\Python27\libs
  • c:\ProgramData\Microsoft\ClickToRun\MachineData
  • c:\Python27\include\pyexpat.h
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • UNC\KIDSROOM\Users\Public
  • c:\Python27\include\warnings.h
  • c:\ProgramData\Microsoft\Assistance
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\pyctype.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results
  • c:\Users\Harry Dresden\Videos
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • c:\Python27\Lib\pydoc_data
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • c:\Python27\Lib\test\nokia.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • c:\ProgramData\Microsoft\Crypto\DSS
  • c:\ProgramData\Adobe\Acrobat
  • c:\Python27\tcl\tcl8.5\tzdata\Atlantic
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • c:\ProgramData\Microsoft\Network
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger
  • c:\Users\Default\Downloads
  • c:\Python27\Lib\xml
  • c:\Python27\tcl\tcl8.5\tzdata\Australia
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • c:\Python27\tcl\tk8.5
  • c:\ProgramData\Microsoft\PlayReady\Cache
  • c:\6cdeacda242012e0e5b593e657\3082
  • c:\Python27\Lib\site-packages\pip\compat
  • c:\Python27\Lib\test\leakers
  • c:\Python27\tcl\tcl8\8.4\platform
  • c:\Python27\include\modsupport.h
  • c:\ProgramData\regid.1991-06.com.microsoft
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\filters
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\DD
  • c:\Python27\Tools\pynche\X
  • c:\Python27\tcl\tix8.4.3\pref
  • c:\Python27\include\bufferobject.h
  • c:\Python27\Tools\Scripts
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\35
  • UNC\KIDSROOM\Users\Default\NTUSER.DAT.LOG
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore
  • c:\Python27\include\pyfpe.h
  • c:\Python27\include\compile.h
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • C:\Users\Harry Dresden\AppData\Local\Temp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\Python27\tcl\tk8.5\images
  • c:\ProgramData\Microsoft\DRM
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US
  • c:\Python27\Lib\idlelib\idle_test
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\include
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\nPdhIeLMnBYElZYVU.docm
  • c:\Python27\Lib\test\nullcert.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • c:\Python27\include\cobject.h
  • c:\6cdeacda242012e0e5b593e657\1029
  • c:\6cdeacda242012e0e5b593e657\1028
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}
  • c:\Python27\Lib\site-packages\pip\commands
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\EhJTJkTGnkBxwNb.rtf
  • c:\Python27\Lib\lib2to3\tests\data\fixers\myfixes
  • c:\6cdeacda242012e0e5b593e657\1025
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us
  • c:\Python27\tcl\tclConfig.sh
  • c:\Python27\Lib\email\test\data
  • c:\ProgramData\Microsoft\Windows Defender\Support
  • c:\utskt\modules\packages
  • c:\ProgramData\WebEx\WebEx
  • c:\6cdeacda242012e0e5b593e657\2052
  • c:\Python27\tcl\tcl8.5\opt0.4
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases
  • c:\Python27\include\pgenheaders.h
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US
  • c:\Python27\tcl\tcl8.5\encoding
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs
  • c:\Python27\Lib\msilib
  • c:\ProgramData\Microsoft\WwanSvc\Profiles
  • c:\Python27\Lib\encodings
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\_backport
  • c:\ProgramData\Microsoft\Assistance\Client
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\95
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F
  • c:\Python27\Lib\site-packages\_markerlib
  • c:\ProgramData\Microsoft\Diagnosis\LocalTraceStore
  • c:\inetpub\custerr
  • c:\Python27\include\longintrepr.h
  • c:\inetpub\custerr\en-US
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches
  • c:\Python27\Lib\test\185test.db
  • c:\Python27\include\opcode.h
  • c:\ProgramData\Microsoft\Crypto\RSA
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tk8.5\ttk
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\01
  • c:\Users\Default\Favorites
  • c:\inetpub\history
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\oInXbyTRavgT.doc
  • c:\ProgramData\Microsoft\Windows NT
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\chardet
  • c:\ProgramData\Microsoft\Vault
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData
  • c:\Python27\include\fileobject.h
  • UNC\KIDSROOM\Users\ruiner
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • c:\Python27\include\boolobject.h
  • C:\Windows\SysWOW64\en-US\VssTrace.DLL.mui
  • c:\Python27\include\token.h
  • c:\Python27\include\bitset.h
  • c:\utskt\lib
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\Python27\tcl\tk8.5\demos
  • c:\ProgramData\Mozilla\logs
  • c:\Python27\include\pycapsule.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\70
  • c:\Python27\tcl\tcl8.5\tzdata\Mexico
  • c:\Python27\Lib\importlib
  • c:\ProgramData\Microsoft\Crypto
  • UNC\KIDSROOM\Users\Harry Dresden\Searches
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\media
  • c:\Python27\tcl\tcl8.5
  • c:\Python27\tcl\tcl8.5\tzdata\Africa
  • UNC\KIDSROOM\Users\Harry Dresden\Music
  • c:\ProgramData\McAfee
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • c:\Python27\Lib\site-packages\pip\vcs
  • c:\Python27\Lib\bsddb\test
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\Python27\Lib\test\keycert2.pem
  • c:\ProgramData\Microsoft\Search\Data\Applications
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F7
  • c:\Python27\include\ucnhash.h
  • c:\Python27\include\py_curses.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3
  • c:\Python27\Lib\xml\parsers
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\tcl\tcl8.5\msgs
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Inbox
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage
  • c:\Users\Harry Dresden
  • c:\Python27\include\symtable.h
  • c:\Python27\include\node.h
  • c:\ProgramData\McAfee\MCLOGS\Common\jxpiinstall
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads
  • c:\ProgramData\Microsoft\Windows Defender\Quarantine
  • c:\Users\Public\Favorites
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\include\codecs.h
  • c:\ProgramData\Microsoft\Office
  • c:\Python27\Lib\site-packages\pip\_vendor\requests
  • c:\Users\Public\Pictures
  • c:\ProgramData\NovaTech Network\NovaBench
  • UNC\KIDSROOM\Users\Harry Dresden\Documents
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\Python27\Lib\site-packages\pip\_vendor\_markerlib
  • c:\Python27\tcl\reg1.2
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • UNC\KIDSROOM\Users\Public\Desktop
  • c:\Users\ruiner
  • c:\Python27\Lib\xml\etree
  • c:\Python27\include\pymacconfig.h
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01
  • UNC\KIDSROOM\Users\Harry Dresden\Favorites\Links for United States
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform
  • c:\Python27\tcl\tcl8.5\tzdata\Antarctica
  • c:\Python27\Lib\xml\sax
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\trie
  • c:\Users\Harry Dresden\Desktop
  • c:\Users\Public\Recorded TV
  • c:\utskt\modules
  • c:\ProgramData\Microsoft\Office\Heartbeat
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\42
  • c:\Python27\tcl\tcl8.5\tzdata\Etc
  • c:\Python27\Lib\bsddb
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\47
  • c:\Python27\include\moduleobject.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups
  • c:\utskt\bin
  • c:\Python27\Lib\wsgiref
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\contrib
  • c:\ProgramData\Microsoft\User Account Pictures
  • c:\ProgramData\Sun\Java\Java Update
  • c:\Python27\Lib\test\sha256.pem
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9
  • c:\Recovery\015e7760-d44b-11e0-8947-954f09601788
  • c:\Users
  • UNC\KIDSROOM\Users\Public\Foxit Software
  • c:\Users\Default\Saved Games
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources
  • c:\inetpub\history\CFGHISTORY_0000000005\schema
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\inetpub
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • UNC\KIDSROOM\Users\Public\Favorites
  • c:\Users\Default
  • c:\Python27\tcl\tcl8.5\tzdata\Pacific
  • c:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog
  • c:\Python27\tcl\tk8.5\msgs
  • c:\Python27\tcl\tcl8.5\tzdata\America
  • c:\ProgramData\Microsoft\Diagnosis\DownloadedSettings
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\{98101498-C465-4F51-8751-D1919E97D29D}
  • c:\Python27\Lib\multiprocessing\dummy
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}
  • c:\ProgramData\Microsoft\MF
  • c:\Python27\include\errcode.h
  • c:\Python27\Lib\test\keycert3.pem
  • UNC\KIDSROOM\Users\Default\Saved Games
  • c:\Users\Public\Downloads
  • c:\Python27\Lib\site-packages
  • c:\ProgramData\Microsoft\Device Stage\Task
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Python27\include\pyerrors.h
  • c:\Python27\Lib\unittest
  • c:\6cdeacda242012e0e5b593e657\Graphics
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}
  • c:\Python27\Lib\test\capath
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default
  • c:\Recovery
  • c:\ProgramData\Microsoft\Device Stage
  • c:\Python27\include\ceval.h
  • c:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18
  • c:\ProgramData\Microsoft\Assistance\Client\1.0
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\structmember.h
  • c:\ProgramData\Oracle
  • c:\utskt\bin\cert.p12
  • c:\Python27\include\pygetopt.h
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\Python27\Lib\distutils\tests
  • UNC\KIDSROOM\Users\Harry Dresden\Videos
  • c:\Python27\Lib\logging
  • c:\ProgramData\Microsoft\RAC
  • c:\Python27\Lib\site-packages\pip\req
  • c:\Users\Harry Dresden\Links
  • c:\ProgramData\Microsoft\DeviceSync
  • c:\Python27\Doc
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • c:\Python27\tcl\tix8.4.3\demos\bitmaps
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\en-us.16
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • c:\Python27\include\patchlevel.h
  • UNC\KIDSROOM\Users\Default\Favorites
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\Lib\compiler
  • c:\Python27\Scripts
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\42
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\17
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • c:\Python27\tcl\dde1.3
  • c:\Python27\tcl\tcl8.5\tzdata\SystemV
  • c:\ProgramData\NovaTech Network
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • c:\ProgramData\Sun\Java
  • UNC\KIDSROOM\Users\Public\Recorded TV
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js
  • c:\ProgramData\Microsoft\Diagnosis\AsimovUploader
  • UNC\KIDSROOM\Users\Public\Documents
  • UNC\KIDSROOM\Users\Default\Pictures
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images
  • UNC\KIDSROOM\Users\Public\Libraries
  • c:\Python27\tcl\tcl8.5\tzdata\Chile
  • c:\ProgramData\Microsoft\ClickToRun\UserData
  • c:\Python27\Lib\test\xmltestdata
  • c:\ProgramData\Microsoft\WPD
  • c:\Python27\Lib\site-packages\pip\_vendor
  • c:\ProgramData\Sun
  • c:\Python27\include\Python.h
  • UNC\KIDSROOM\Users\Default\Videos
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger
  • c:\Python27\Lib\site-packages\setuptools
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\Python27\include\metagrammar.h
  • UNC\KIDSROOM\Users\Public\Music\Sample Music
  • c:\Python27\include\pystate.h
  • c:\Users\Default\Desktop
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • UNC\KIDSROOM\Users\Default\Music
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
  • c:\ProgramData\Microsoft\WwanSvc
  • c:\Python27\include\pyconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • \\?\PIPE\wkssvc
  • c:\ProgramData\Microsoft\Event Viewer\Views
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start
  • c:\Python27\Lib\json\tests
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\serializer
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default
  • c:\Python27\include\osdefs.h
  • c:\Python27\Tools
  • c:\Python27\include\timefuncs.h
  • c:\Users\Public\Videos\Sample Videos
  • UNC\KIDSROOM\Users\Public\Downloads
  • c:\Python27\include\enumobject.h
  • c:\ProgramData\Microsoft\IlsCache
  • c:\Python27\Lib\lib-tk
  • UNC\KIDSROOM\Users\Default
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Store
  • c:\ProgramData\Microsoft\Windows NT\MSFax\SentItems
  • c:\Users\Public\Foxit Software\Foxit Reader
  • c:\Python27\Lib\site-packages\pip\operations
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox
  • c:\Python27\Lib\site-packages\pip\_vendor\lockfile
  • c:\Python27\Lib\curses
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\floatobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\oZDWVpfJrSk.pptx
  • c:\Python27\Lib\test\pycacert.pem
  • c:\utskt\modules\auxiliary
  • c:\Python27\Lib\test\badkey.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • c:\Python27\include\cStringIO.h
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration
  • c:\Users\Default\Music
  • c:\Python27\Lib\email\mime
  • c:\Users\Harry Dresden\Music
  • c:\6cdeacda242012e0e5b593e657\1053
  • c:\6cdeacda242012e0e5b593e657\1055
  • UNC\KIDSROOM\Users\Harry Dresden\Links
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3
  • c:\Python27\tcl\tcl8.5\tzdata\Asia
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css
  • c:\Python27\Lib\multiprocessing
  • c:\Users\Default\Documents
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\Users\Public\Desktop
  • c:\ProgramData\Microsoft\User Account Pictures\Default Pictures
  • c:\Python27\Lib\lib-tk\test\test_ttk
  • c:\Python27\include\dictobject.h
  • c:\Users\Harry Dresden\Documents
  • c:\Python27\include\sysmodule.h
  • c:\ProgramData\McAfee\MCLOGS\Common
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F\x-none.16
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\ProgramData\Microsoft\IdentityCRL
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\BuHwupzpMAmbiNHl.ppt
  • c:\ProgramData\WebEx\WebEx\12_1324
  • c:\Python27\Lib\site-packages\pip\utils
  • c:\Python27\Lib\distutils\command
  • c:\Users\Harry Dresden\Saved Games
  • c:\6cdeacda242012e0e5b593e657\1053\LocalizedData.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\include\pyarena.h
  • c:\ProgramData\Microsoft\Windows Defender
  • c:\Python27\include\eval.h
  • c:\Python27
  • c:\Python27\Lib\hotshot
  • UNC\KIDSROOM\Users\Harry Dresden
  • c:\Python27\include\genobject.h
  • c:\inetpub\wwwroot
  • c:\Python27\tcl\tcl8.5\tzdata\Canada
  • c:\Python27\Tools\versioncheck
  • c:\Python27\tcl\tcl8.5\tzdata\Arctic
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F7
  • c:\Users\Public\Music
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3
  • c:\Python27\Lib\test\audiodata
  • UNC\KIDSROOM\Users\Default\Downloads
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters
  • c:\Python27\include\intrcheck.h
  • c:\ProgramData\Microsoft\Network\Connections
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\x-none.16
  • c:\Python27\Lib\sqlite3
  • c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\43
  • \\?\PIPE\lsarpc
  • c:\ProgramData\Microsoft\Diagnosis
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F\en-us.16
  • c:\Python27\Lib\distutils
  • UNC\KIDSROOM\Users\Harry Dresden\Saved Games
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\tests
  • c:\Python27\Lib\idlelib\Icons
  • c:\ProgramData\Microsoft\Device Stage\Device
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib
  • c:\Python27\Lib\test\subprocessdata
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\35
  • c:\Python27\include\pymem.h
  • c:\inetpub\wwwroot\aspnet_client
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\ProgramData\Microsoft\Network\Downloader
  • c:\Users\Public\Foxit Software
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Quick
  • c:\ProgramData\Microsoft\Windows NT\MSScan
  • c:\Python27\Lib\lib2to3\tests
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\ProgramData\Microsoft OneDrive\setup
  • c:\ProgramData\Microsoft\Crypto\DSS\MachineKeys
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\utskt\lib\common
  • UNC\KIDSROOM\Users
  • c:\Python27\Lib\site-packages\pkg_resources
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info
  • c:\Python27\include\rangeobject.h
  • c:\Python27\tcl\tcl8.5\tzdata\Brazil
  • c:\Users\Harry Dresden\Favorites\Links
  • UNC\KIDSROOM\Users\Default\Links
  • c:\Python27\Lib\test\imghdrdata
  • c:\Python27\include\iterobject.h
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement
  • c:\ProgramData\Microsoft\RAC\Outbound
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\inetpub\history\CFGHISTORY_0000000002
  • c:\Python27\include\funcobject.h
  • c:\Python27\include\listobject.h
  • c:\ProgramData\Microsoft\NetFramework
  • c:\Users\Public\Recorded TV\Sample Media
  • c:\ProgramData\Microsoft
  • c:\Users\Public\Pictures\Sample Pictures
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Service
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\Users\Default\Videos
  • c:\ProgramData\Microsoft\Search\Data
  • c:\Python27\tcl
  • c:\Python27\Lib\json
  • UNC\KIDSROOM\Users\Public\Pictures
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US
  • c:\Python27\include\pythread.h
  • c:\Python27\Lib\lib2to3\fixes
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\Python27\tcl\tix8.4.3\bitmaps
  • c:\Python27\Lib\site-packages\setuptools\command
  • c:\6cdeacda242012e0e5b593e657
  • c:\Python27\tcl\tcl8.5\tzdata\America\Indiana
  • c:\6cdeacda242012e0e5b593e657\2070
  • c:\Python27\include\sliceobject.h
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Users\Public\Videos
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • c:\Python27\Lib\test\decimaltestdata
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\DD
  • c:\Python27\include\descrobject.h
  • c:\ProgramData\Microsoft\Diagnosis\UIF
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A6
  • c:\Python27\tcl\tcl8.5\tzdata\Europe
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5
  • c:\Python27\include\stringobject.h
  • c:\Python27\Lib\lib2to3
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\vZsxMkvyIdOYhmjR.ppt
  • c:\Python27\include\intobject.h
  • c:\ProgramData\Microsoft\Event Viewer
  • c:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\ProgramData\Microsoft\ClickToRun
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures
  • c:\Python27\include\methodobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Favorites
  • c:\Python27\include\structseq.h
  • c:\Python27\tcl\tcl8.5\http1.0
  • c:\Python27\include\pymath.h
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\parsetok.h
  • c:\ProgramData\Adobe\Acrobat\11.0
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • c:\Python27\Lib\ensurepip\_bundled
  • c:\Python27\include\classobject.h
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • c:\Users\Public\Music\Sample Music
  • c:\Python27\tcl\tcl8
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager
  • c:\Python27\Lib\lib2to3\tests\data
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70
  • c:\ProgramData\Microsoft OneDrive
  • c:\ProgramData\Microsoft\Media Player
  • c:\Python27\tcl\tcl8.5\tzdata\America\Argentina
  • c:\Python27\include\setobject.h
  • UNC\KIDSROOM\Users\Harry Dresden\Pictures
  • c:\Python27\Lib\idlelib
  • c:\PerfLogs\Admin
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\graminit.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images
  • c:\Python27\Lib\site-packages\pip\_vendor\progress
  • c:\Users\Harry Dresden\Pictures
  • c:\ProgramData\Microsoft\Diagnosis\Sideload
  • c:\Python27\include\datetime.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\ssl_match_hostname
  • c:\Users\Harry Dresden\Favorites
  • c:\ProgramData\Passmark
  • c:\Python27\Lib\lib-tk\test
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • c:\ProgramData\Adobe
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • UNC\KIDSROOM\Users\Harry Dresden\Favorites\Links
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\ProgramData\Microsoft\Search
  • c:\ProgramData\Passmark\PerformanceTest
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • UNC\KIDSROOM\Users\Public\Music
  • c:\Python27\include\bytearrayobject.h
  • c:\ProgramData\Microsoft\NetFramework\BreadcrumbStore
  • c:\Python27\Lib\email\test
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}
  • c:\ProgramData\WebEx
  • c:\inetpub\wwwroot\msmq
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\Python27\tcl\tix8.4.3\demos
  • c:\utskt\lib\api
  • UNC\KIDSROOM\Users\Public\Recorded TV\Sample Media
  • c:\Python27\include\unicodeobject.h
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\packaging
  • c:\ProgramData\McAfee\MCLOGS
  • c:\Users\Default\Pictures
  • c:\6cdeacda242012e0e5b593e657\1049
  • c:\Users\Public\Documents
  • c:\6cdeacda242012e0e5b593e657\1046
  • c:\6cdeacda242012e0e5b593e657\1045
  • c:\6cdeacda242012e0e5b593e657\1044
  • c:\6cdeacda242012e0e5b593e657\1043
  • c:\6cdeacda242012e0e5b593e657\1042
  • c:\6cdeacda242012e0e5b593e657\1041
  • c:\6cdeacda242012e0e5b593e657\1040
  • c:\Python27\Lib\site-packages\pip\_vendor\packaging
  • c:\ProgramData\Microsoft\eHome\logs
  • c:\ProgramData\Microsoft\Windows Defender\Scans
  • c:\ProgramData\Microsoft\Windows NT\MSFax
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\Python27\Lib\sqlite3\test
  • c:\Python27\Lib\test\dh1024.pem
  • c:\ProgramData\Mozilla
  • c:\utskt
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates
  • c:\Python27\include\weakrefobject.h
  • c:\Python27\Lib\lib2to3\pgen2
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History
  • c:\Python27\Lib\idlelib\idle.bat
  • c:\Python27\include\code.h
  • c:\Python27\include\cellobject.h
  • c:\ProgramData\Microsoft\RAC\StateData
  • c:\6cdeacda242012e0e5b593e657\1038
  • UNC\KIDSROOM\Users\Harry Dresden\OneDrive
  • c:\ProgramData\Microsoft\DRM\Server
  • c:\6cdeacda242012e0e5b593e657\1032
  • c:\6cdeacda242012e0e5b593e657\1033
  • c:\6cdeacda242012e0e5b593e657\1030
  • c:\6cdeacda242012e0e5b593e657\1031
  • c:\6cdeacda242012e0e5b593e657\1036
  • c:\6cdeacda242012e0e5b593e657\1037
  • c:\6cdeacda242012e0e5b593e657\1035
  • C:\Windows\System32\wshqos.dll
  • C:\Windows\System32\wshom.ocx
  • C:\
  • C:\Windows\Globalization\Sorting\sortdefault.nls
  • C:\Users\
  • C:\Users\Harry Dresden\
  • C:\Users\Harry Dresden\AppData\
  • C:\Users\Harry Dresden\AppData\Local\
  • C:\Windows\
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
  • C:\Windows\System32\en-US\wshqos.dll.mui
  • C:\Users\Harry Dresden\Desktop\desktop.ini
  • C:\Windows\System32\en-US\wshtcpip.dll.mui
  • C:\Windows\SysWOW64\rundll32.exe
  • C:\Windows\System32\rsaenh.dll
  • C:\Windows\System32\msxml3.dll
  • C:\Users\Harry Dresden\AppData\Local\Temp\NRV_F9DF5220_.js
  • C:\Windows\System32\en-US\wship6.dll.mui
  • C:\Windows\System32\wscript.exe
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000001.db
  • C:\Windows\SysWOW64\
File-Moved
  • \\KIDSROOM\Users\Harry Dresden\Desktop\oInXbyTRavgT.doc -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYF0-7AM0-FICB-B28C-3BE01A257857.thor
  • c:\Python27\include\sysmodule.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-1F93-12E2045564F5.thor
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem -> c:\Python27\Lib\site-packages\pip\_vendor\requests\GIZCRYF0-7AM0-FICB-0F3F-DD4C2F1EA578.thor
  • c:\Python27\include\bitset.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-4CEF-9983422517B3.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-32C2-5832E37E783A.thor
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYF0-7AM0-FICB-A376-CC8952B55EEB.thor
  • c:\Python27\Lib\test\185test.db -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-A364-9B64A7672F0D.thor
  • c:\Python27\include\errcode.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-2A6F-8E4B10780F50.thor
  • c:\Python27\Lib\test\check_soundcard.vbs -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-1B87-752003C4211B.thor
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1045\GIZCRYF0-7AM0-FICB-0613-D1CCEC1190DC.thor
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1038\GIZCRYF0-7AM0-FICB-AA6E-2D4BD976CA3F.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-318C-43F9605F8C70.thor
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1028\GIZCRYF0-7AM0-FICB-5F4E-26FD2B60DC83.thor
  • \\KIDSROOM\Users\Public\Music\Sample Music\Kalimba.mp3 -> \\KIDSROOM\Users\Public\Music\Sample Music\GIZCRYF0-7AM0-FICB-EB1C-F3F3EE81F68E.thor
  • c:\Python27\include\osdefs.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-2017-010CE81AEB31.thor
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYF0-7AM0-FICB-B374-CBF95C8716B8.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-92BE-04AF103A1743.thor
  • c:\Python27\include\ast.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-1F51-DB7F58E1793C.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-1594-253D302B7E7E.thor
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1032\GIZCRYF0-7AM0-FICB-2068-1AA77C09F582.thor
  • c:\Python27\include\compile.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-8B33-478888601529.thor
  • c:\Python27\include\pydebug.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-3212-2FDCB0888453.thor
  • c:\Python27\include\pygetopt.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-2B33-6926DAB885AE.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-F70D-66BB0EBED6B1.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYF0-7AM0-FICB-3971-09C275C584A4.thor
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1046\GIZCRYF0-7AM0-FICB-FCC3-0232742E1A1B.thor
  • c:\Python27\include\boolobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-F7C6-BBDF34584A80.thor
  • c:\Python27\include\dictobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-4B49-658A59863721.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-3F71-5116DE8BF38F.thor
  • c:\Python27\include\pycapsule.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-9047-FC2AA2A9916F.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-A04F-7FD8609BB6A7.thor
  • c:\Python27\Lib\test\ssl_cert.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-3047-1CBD82352CEC.thor
  • c:\Python27\Lib\idlelib\idle.bat -> c:\Python27\Lib\idlelib\GIZCRYF0-7AM0-FICB-1A15-5D45D7C6200D.thor
  • c:\Python27\include\grammar.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-2553-D8F5EFC52E65.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYF0-7AM0-FICB-611B-F8D5B44F08F2.thor
  • c:\Python27\include\fileobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-395B-29861DF78A42.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-F995-35201996B2AE.thor
  • c:\Python27\include\funcobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-8B11-22ADE023FF93.thor
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1040\GIZCRYF0-7AM0-FICB-5B66-F0EAD2580282.thor
  • c:\Python27\Lib\test\badkey.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-32B2-A1C28DAFB40D.thor
  • c:\Python27\include\intrcheck.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-FB84-21A369FC6AE8.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-7625-CAA69D856443.thor
  • c:\Python27\include\sliceobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-017E-6C51A8F493C8.thor
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1033\GIZCRYF0-7AM0-FICB-10E1-F3C397758250.thor
  • c:\Python27\include\symtable.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-9C26-DBD7AEA21E12.thor
  • c:\Python27\include\asdl.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-ACAE-24C027F91348.thor
  • c:\Python27\include\bytes_methods.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-0D3A-1E372384C158.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-E0D8-7B1DB7959BF5.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\XokzyeXpaoqs.doc -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYF0-7AM0-FICB-B492-27BF24D08292.thor
  • c:\Python27\include\cobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-C623-53CCEBC54BC3.thor
  • c:\Python27\include\bytesobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-29EC-3B979A4C8CE6.thor
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1030\GIZCRYF0-7AM0-FICB-5C6D-128F7B89EAA1.thor
  • c:\Python27\include\pymactoolbox.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-4FD5-BABFEDC99048.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-4853-56FFC738DF22.thor
  • c:\Python27\include\node.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-1F4C-30AF0E1839FF.thor
  • c:\Python27\include\complexobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-DF34-827A5A56CDBB.thor
  • c:\Python27\include\classobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-B3F8-8F024656D76F.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\GIZCRYF0-7AM0-FICB-D6D8-366DCE69157C.thor
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1035\GIZCRYF0-7AM0-FICB-E2B1-F83C072ADB41.thor
  • c:\Python27\include\descrobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-C1B1-EF89418A0248.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-90B8-95EE057E0E8E.thor
  • c:\Python27\include\floatobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-4EB6-9F65D26AB044.thor
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf -> c:\6cdeacda242012e0e5b593e657\3082\GIZCRYF0-7AM0-FICB-E2CB-8B348FCD9C80.thor
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf -> c:\6cdeacda242012e0e5b593e657\2052\GIZCRYF0-7AM0-FICB-F235-FE0EBC6D5165.thor
  • c:\Python27\Lib\test\keycert2.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-A87A-FDB1814675E6.thor
  • c:\Python27\include\intobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-8B19-48CA084055B5.thor
  • c:\Python27\include\weakrefobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-121E-91F32010488E.thor
  • c:\Python27\include\import.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-A840-84A7D2E35E13.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\vZsxMkvyIdOYhmjR.ppt -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYF0-7AM0-FICB-EB18-F3C59D882A12.thor
  • c:\Python27\include\eval.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-5BF4-E4F2724919C2.thor
  • c:\Python27\include\opcode.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-D735-3AC4AA468623.thor
  • c:\Python27\include\pythonrun.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-1373-E20FF60D97A4.thor
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1037\GIZCRYF0-7AM0-FICB-4CFC-664B46454AFE.thor
  • c:\Python27\include\object.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-BD74-1D2DC79E5AD0.thor
  • c:\Python27\include\bufferobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-2D93-C067A0E2FEA4.thor
  • c:\Python27\Lib\test\ssl_key.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-DD7C-CF989F75C111.thor
  • c:\Python27\include\genobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-D23B-8E4DA56A40C6.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-8D74-EAAA0D8CD3F3.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-69B1-A8338BD2ED1F.thor
  • c:\Python27\include\pystrcmp.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-E238-41D3652D0C38.thor
  • c:\Python27\include\ceval.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-73F6-8FDBBCD09A34.thor
  • c:\Python27\include\methodobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-ED37-E01CFE043319.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-4C5A-3CF3D7779939.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYF0-7AM0-FICB-BD5A-741EA1B313A6.thor
  • c:\Python27\include\pyconfig.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-994D-51612A7A82BC.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYF0-7AM0-FICB-1E84-A7481A5C2A45.thor
  • c:\Python27\include\rangeobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-0AB3-74D59145A71E.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\nPdhIeLMnBYElZYVU.docm -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYF0-7AM0-FICB-82E5-5612647E744B.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-7A0C-F8F8CF51534A.thor
  • c:\Python27\Lib\test\dh1024.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-F6EB-95A1945EEC48.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-5851-937FD928C8CA.thor
  • c:\Python27\include\pystrtod.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-C651-167F81EBF945.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\xuhoFeErWKhqN.pptx -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYF0-7AM0-FICB-AEB6-0B8B012A32A7.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\GIZCRYF0-7AM0-FICB-AC27-01E6F659FC80.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-315E-1E206EE23C58.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYF0-7AM0-FICB-B811-26B14B7568B1.thor
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1055\GIZCRYF0-7AM0-FICB-B664-DE71E597B5B8.thor
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1031\GIZCRYF0-7AM0-FICB-BFF0-3DBA49D172DE.thor
  • c:\Python27\Lib\test\https_svn_python_org_root.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-5308-28865DA19A64.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-2BDF-98D6C1FCD9C1.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-508A-BED7933D0C07.thor
  • c:\Python27\include\iterobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-2D18-25E7C3F74F50.thor
  • c:\Python27\include\structmember.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-BD37-FBA94B91F875.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-6CD1-CF4CBAE50B45.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\GIZCRYF0-7AM0-FICB-CFC3-9348A4B9C002.thor
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYF0-7AM0-FICB-3B05-DC80AE3C986F.thor
  • c:\utskt\bin\cert.p12 -> c:\utskt\bin\GIZCRYF0-7AM0-FICB-2645-67C6047DB950.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Tulips.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYF0-7AM0-FICB-06CF-56916F7D8B07.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-B578-E777E04E3961.thor
  • c:\Python27\include\pyport.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-118D-6B00147BD4E8.thor
  • c:\Python27\Lib\test\wrongcert.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-317D-F626FC47DAFB.thor
  • c:\Python27\Lib\test\badcert.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-FEEF-36C98937701F.thor
  • c:\Python27\include\objimpl.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-62C6-AE9C4232DAA8.thor
  • c:\Python27\include\pyexpat.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-900F-2DBA95C2B32B.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\GIZCRYF0-7AM0-FICB-4172-A52984744343.thor
  • \\KIDSROOM\Users\Harry Dresden\Contacts\Harry Dresden.contact -> \\KIDSROOM\Users\Harry Dresden\Contacts\GIZCRYF0-7AM0-FICB-EE31-AA6B497E6B6A.thor
  • c:\Python27\tcl\tclConfig.sh -> c:\Python27\tcl\GIZCRYF0-7AM0-FICB-3662-376674760EBC.thor
  • c:\Python27\include\unicodeobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-3D0D-5CD616F1D996.thor
  • c:\Python27\include\Python-ast.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-746E-A007E1FBB212.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-C2C5-41AE29E1BD48.thor
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYF0-7AM0-FICB-F330-456F98E23C9E.thor
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1043\GIZCRYF0-7AM0-FICB-D460-6A01E15B1390.thor
  • c:\Python27\Lib\test\nullbytecert.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-91C1-5AD8CF6D9C49.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-3494-9B473822573C.thor
  • c:\Python27\Lib\test\keycert.passwd.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-D212-A950C08A2C0A.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\EhJTJkTGnkBxwNb.rtf -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYF0-7AM0-FICB-E10C-D330CA6F6F61.thor
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1042\GIZCRYF0-7AM0-FICB-7347-5259D60143A5.thor
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYF0-7AM0-FICB-A698-697056CB2D20.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\GIZCRYF0-7AM0-FICB-85CE-EF6D7CA796FF.thor
  • c:\Python27\Lib\test\nullcert.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-A466-EC5C15A54D3D.thor
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php -> c:\ProgramData\WebEx\WebEx\12_1324\GIZCRYF0-7AM0-FICB-AF3E-277C0E3C0B9D.thor
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYF0-7AM0-FICB-73D9-7811865325FF.thor
  • c:\Python27\include\graminit.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-80A1-49BDD5CB81F1.thor
  • c:\Python27\include\pgenheaders.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-9926-292C6B5B79C7.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-2532-941A8FD7D2B8.thor
  • \\KIDSROOM\Users\Harry Dresden\Downloads\cleandesktop.py.txt -> \\KIDSROOM\Users\Harry Dresden\Downloads\GIZCRYF0-7AM0-FICB-A3C0-B2212F10E655.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Desert.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYF0-7AM0-FICB-AF6D-83620468D82B.thor
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYF0-7AM0-FICB-5A2A-262F297E1E6F.thor
  • c:\Python27\include\patchlevel.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-005F-3FE04CBF99B5.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYF0-7AM0-FICB-7008-EC3E5A02FA47.thor
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs -> c:\Python27\tcl\tix8.4.3\pref\GIZCRYF0-7AM0-FICB-5525-4D6636371178.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-81F3-E72F37C04E8D.thor
  • c:\Python27\include\pythread.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-386F-DB02FD169C0A.thor
  • c:\Python27\include\listobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-16C0-BC2793C64751.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Penguins.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYF0-7AM0-FICB-B530-00770CED84D4.thor
  • c:\Python27\include\longobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-2DB2-D387D205F945.thor
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1029\GIZCRYF0-7AM0-FICB-1AEC-D3E909A2FA70.thor
  • c:\Python27\include\traceback.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-46A3-0FC3AC369198.thor
  • c:\Python27\include\codecs.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-080A-476118FBE698.thor
  • \\KIDSROOM\Users\Default\NTUSER.DAT.LOG -> \\KIDSROOM\Users\Default\GIZCRYF0-7AM0-FICB-6214-A692AA452BA9.thor
  • c:\Python27\include\dtoa.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-60E4-0149B761F0FF.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYF0-7AM0-FICB-1D0D-E005B5237966.thor
  • c:\Python27\include\modsupport.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-89BF-2415E98EDA82.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\GIZCRYF0-7AM0-FICB-B224-1B96C856AE94.thor
  • c:\Python27\include\ucnhash.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-CC1F-578434AF770D.thor
  • c:\6cdeacda242012e0e5b593e657\1053\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1053\GIZCRYF0-7AM0-FICB-C179-20F99EC5201E.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-D92F-AA9730BF8EA6.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-D535-A65F1B656CBE.thor
  • c:\Python27\Lib\test\sha256.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-4BEC-088EE66891C7.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\GIZCRYF0-7AM0-FICB-E5FB-B2698B3CE681.thor
  • c:\Python27\include\py_curses.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-26C2-7F4FBADAE594.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\GIZCRYF0-7AM0-FICB-DD65-53B473D02BDC.thor
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1044\GIZCRYF0-7AM0-FICB-1959-0AA3F0AD658D.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYF0-7AM0-FICB-18F6-861266D1AAA6.thor
  • c:\Python27\include\moduleobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-988B-37545BFD5D33.thor
  • c:\Python27\include\cellobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-CF9B-0B0FE188A408.thor
  • c:\Python27\include\warnings.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-3D12-C48350CB1EB0.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYF0-7AM0-FICB-9290-7E7FF90A1F89.thor
  • c:\Python27\include\tupleobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-46FE-7A6A29E39D36.thor
  • c:\Python27\include\pystate.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-0D60-6A4C3823FE95.thor
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-151A-65F59966D6D3.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-93EA-C430233FEE56.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYF0-7AM0-FICB-F8BB-F0A86CB0DC96.thor
  • c:\Python27\Lib\test\keycert4.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-2002-38440C8CA287.thor
  • c:\Python27\Lib\test\empty.vbs -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-36AB-3B9E5170C05D.thor
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1025\GIZCRYF0-7AM0-FICB-B32E-939E0BBB2087.thor
  • c:\Python27\include\datetime.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-AFAA-D07240EF6645.thor
  • \\KIDSROOM\Users\Public\Videos\Sample Videos\Wildlife.wmv -> \\KIDSROOM\Users\Public\Videos\Sample Videos\GIZCRYF0-7AM0-FICB-B511-4021E9C03CF3.thor
  • c:\Python27\include\structseq.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-8F58-904AE03B798D.thor
  • c:\Python27\include\metagrammar.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-7F91-F1FDAED82B57.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\GIZCRYF0-7AM0-FICB-DABE-0B95C3132F75.thor
  • c:\Python27\Lib\test\keycert3.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-3EC9-63D378341CA5.thor
  • c:\Python27\include\bytearrayobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-AFA4-0F1F8745D2D8.thor
  • c:\Python27\include\pymem.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-FD01-9DE59BFD0D2A.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\GIZCRYF0-7AM0-FICB-AAAE-6A174806C3EA.thor
  • c:\Python27\include\parsetok.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-04A5-D5AECCD8F66D.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Koala.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYF0-7AM0-FICB-90C4-F3714EDDD074.thor
  • c:\Python27\Lib\test\pycacert.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-4AE1-26F3549F21E0.thor
  • c:\Python27\include\setobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-138F-10F0602A182A.thor
  • c:\Python27\include\memoryobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-46D8-F9AAAEB2343A.thor
  • c:\Python27\include\enumobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-9EB8-5A461FFA94E4.thor
  • c:\Python27\include\code.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-00F6-D62F57976DCB.thor
  • c:\Python27\include\Python.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-888E-EB38F1D104C9.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\GIZCRYF0-7AM0-FICB-DFD2-BA31317B8E17.thor
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1049\GIZCRYF0-7AM0-FICB-BB65-E48BCB614F71.thor
  • c:\Python27\Lib\test\keycert.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-A581-D1C63543B7D5.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-57D8-7BE6B81F39F7.thor
  • \\KIDSROOM\Users\Public\Music\Sample Music\Sleep Away.mp3 -> \\KIDSROOM\Users\Public\Music\Sample Music\GIZCRYF0-7AM0-FICB-1931-7C7CE5968C4F.thor
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf -> c:\6cdeacda242012e0e5b593e657\2070\GIZCRYF0-7AM0-FICB-8884-EF23591991F5.thor
  • c:\Python27\include\frameobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-9F8B-E61EC6232FEF.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-1C74-EFDF209230C4.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-DBEF-10D5E9AEBC3C.thor
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1041\GIZCRYF0-7AM0-FICB-73D2-B2488EE0D92A.thor
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1053\GIZCRYF0-7AM0-FICB-90B6-D7FF6B646A13.thor
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg -> \\KIDSROOM\Users\Public\Pictures\Sample Pictures\GIZCRYF0-7AM0-FICB-101B-745927267300.thor
  • c:\Python27\include\pymath.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-564B-BE014A5C5907.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-6EC6-733194599E28.thor
  • c:\Python27\include\pyctype.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-425B-BF7F1064CD5E.thor
  • c:\Python27\include\cStringIO.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-D771-99688293A59C.thor
  • c:\Python27\include\stringobject.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-E748-3B7C874DDDAA.thor
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1036\GIZCRYF0-7AM0-FICB-579B-EB83321B98CD.thor
  • c:\Python27\include\pgen.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-970F-9132E46DBD2B.thor
  • \\KIDSROOM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3 -> \\KIDSROOM\Users\Public\Music\Sample Music\GIZCRYF0-7AM0-FICB-24F2-5441AC0FC4F4.thor
  • c:\Python27\Lib\test\ssl_key.passwd.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-6C1A-3ED9B1A9871D.thor
  • c:\Python27\include\timefuncs.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-6CEF-7327FD847CA5.thor
  • c:\Python27\Lib\test\nokia.pem -> c:\Python27\Lib\test\GIZCRYF0-7AM0-FICB-9AD4-0E667E2C0F0A.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\GIZCRYF0-7AM0-FICB-D309-01C69DE45C94.thor
  • c:\Python27\include\longintrepr.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-DA35-61E64DD9893C.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\oZDWVpfJrSk.pptx -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYF0-7AM0-FICB-A74B-4399E3A21BE1.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\GIZCRYF0-7AM0-FICB-AFBE-BCBFB5FA6AEB.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-86A4-E9ABC13E6C1F.thor
  • c:\Python27\include\abstract.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-9333-28389158AB35.thor
  • c:\Python27\include\pymacconfig.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-1F40-7298775930B2.thor
  • c:\Python27\include\pyfpe.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-65B8-9A3FEC874C31.thor
  • \\KIDSROOM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg -> \\KIDSROOM\Users\Harry Dresden\Downloads\GIZCRYF0-7AM0-FICB-60CB-F22DACE061F7.thor
  • c:\Python27\include\pyerrors.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-3E0C-0A47DB799E35.thor
  • c:\Python27\include\token.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-C4D9-B87F2B445DB7.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-37FC-6437B591C07F.thor
  • \\KIDSROOM\Users\Harry Dresden\Desktop\BuHwupzpMAmbiNHl.ppt -> \\KIDSROOM\Users\Harry Dresden\Desktop\GIZCRYF0-7AM0-FICB-9212-DD5D68BA82C9.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-D851-23F67EA83E56.thor
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml -> \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\GIZCRYF0-7AM0-FICB-46F2-A83B87BF3DF6.thor
  • c:\Python27\include\marshal.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-30FF-910E92713348.thor
  • c:\Python27\include\pyarena.h -> c:\Python27\include\GIZCRYF0-7AM0-FICB-D5B9-29F6FE3EE0AD.thor
Network-Connects Host
  • odinmanto.com
Directory-Created
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YLC2QM2Y
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Caches
Directory-Enumerated
  • c:\Python27\Lib\site-packages\pip\*
  • c:\Python27\tcl\tcl8\8.5\*
  • c:\ProgramData\Sun\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\*
  • \\KIDSROOM\Users\Default\Saved Games\*
  • c:\Python27\tcl\tk8.5\demos\images\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\*
  • c:\Users\ruiner\*
  • c:\Recovery\015e7760-d44b-11e0-8947-954f09601788\*
  • c:\PerfLogs\*
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\*
  • \\KIDSROOM\Users\Harry Dresden\Links\*
  • c:\ProgramData\Passmark\*
  • \\KIDSROOM\Users\Harry Dresden\Pictures\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\*
  • c:\Python27\Tools\pynche\X\*
  • c:\Users\Public\Music\Sample Music\*
  • c:\Python27\Lib\importlib\*
  • c:\Python27\tcl\tcl8.5\http1.0\*
  • c:\Python27\Lib\bsddb\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\*
  • c:\utskt\lib\common\*
  • c:\inetpub\wwwroot\aspnet_client\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog\*
  • c:\Python27\tcl\tk8.5\ttk\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\chardet\*
  • c:\Users\Default\Saved Games\*
  • c:\Python27\tcl\tcl8.5\tzdata\Africa\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\*
  • c:\Python27\Tools\i18n\*
  • c:\ProgramData\Microsoft\ClickToRun\*
  • c:\Python27\Lib\site-packages\pip\_vendor\lockfile\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F\en-us.16\*
  • c:\ProgramData\*
  • c:\6cdeacda242012e0e5b593e657\Graphics\*
  • c:\6cdeacda242012e0e5b593e657\1033\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders\*
  • c:\Python27\Lib\compiler\*
  • \\KIDSROOM\Users\Default\Desktop\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\*
  • c:\Python27\Lib\unittest\*
  • c:\utskt\lib\core\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\35\*
  • c:\Python27\Lib\test\capath\*
  • c:\Users\Harry Dresden\Music\*
  • \\KIDSROOM\Users\Default\Downloads\*
  • c:\Users\Harry Dresden\OneDrive\*
  • c:\Python27\tcl\tcl8.5\msgs\*
  • c:\ProgramData\Adobe\Acrobat\11.0\*
  • c:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\*
  • c:\Python27\tcl\tcl8.5\*
  • c:\Python27\Lib\unittest\test\*
  • c:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319\*
  • c:\ProgramData\Microsoft\Network\Connections\*
  • c:\Users\Public\Recorded TV\*
  • c:\Users\Harry Dresden\Contacts\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\42\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F\x-none.16\*
  • c:\Python27\tcl\tk8.5\msgs\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\*
  • c:\Python27\tcl\tcl8.5\tzdata\Atlantic\*
  • c:\Python27\tcl\tcl8.5\tzdata\Europe\*
  • c:\ProgramData\WebEx\WebEx\*
  • \\KIDSROOM\Users\Default\Pictures\*
  • c:\Python27\tcl\tk8.5\demos\*
  • c:\ProgramData\Microsoft\Windows Defender\*
  • c:\ProgramData\Microsoft\PlayReady\Cache\*
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\_backport\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\*
  • c:\ProgramData\NovaTech Network\NovaBench\*
  • c:\Python27\tcl\tix8.4.3\demos\samples\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\SentItems\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers\*
  • c:\ProgramData\Microsoft\PlayReady\Cache\S-1-5-21-3416602863-1947377224-293699093-1001\*
  • c:\6cdeacda242012e0e5b593e657\1037\*
  • c:\Python27\Lib\lib-tk\test\*
  • c:\Users\Default\Pictures\*
  • \\KIDSROOM\Users\Harry Dresden\Searches\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\*
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\tests\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\serializer\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\*
  • c:\inetpub\custerr\*
  • \\KIDSROOM\Users\Harry Dresden\Contacts\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\*
  • c:\Python27\Scripts\*
  • c:\Users\Public\Desktop\*
  • c:\ProgramData\Microsoft\Network\Downloader\*
  • c:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\*
  • c:\Python27\Tools\pynche\*
  • c:\Python27\Lib\email\test\*
  • c:\ProgramData\Mozilla\logs\*
  • \\KIDSROOM\Users\Default\*
  • c:\ProgramData\Microsoft\IdentityCRL\*
  • c:\ProgramData\Microsoft\WPD\*
  • c:\ProgramData\Microsoft\Diagnosis\LocalTraceStore\*
  • c:\ProgramData\Microsoft\Event Viewer\*
  • c:\Users\Harry Dresden\Favorites\Links for United States\*
  • c:\Users\Default\*
  • c:\ProgramData\Sun\Java\Java Update\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\*
  • \\KIDSROOM\Users\Harry Dresden\Favorites\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\*
  • c:\Python27\tcl\dde1.3\*
  • c:\Python27\Lib\ensurepip\_bundled\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\x-none.16\*
  • \\KIDSROOM\Users\Harry Dresden\Music\*
  • c:\PerfLogs\Admin\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters\*
  • \\KIDSROOM\Users\Public\Recorded TV\Sample Media\*
  • c:\Python27\Lib\site-packages\pip\models\*
  • c:\inetpub\*
  • c:\Users\Harry Dresden\Saved Games\*
  • c:\inetpub\wwwroot\msmq\*
  • c:\ProgramData\Microsoft\DRM\*
  • c:\ProgramData\Microsoft\Crypto\RSA\*
  • c:\6cdeacda242012e0e5b593e657\1025\*
  • c:\Python27\Lib\test\crashers\*
  • c:\ProgramData\Microsoft\Search\Data\Applications\*
  • c:\Python27\Lib\ctypes\test\*
  • c:\Users\Public\Libraries\*
  • c:\ProgramData\Microsoft\Device Stage\*
  • c:\ProgramData\Microsoft\Device Stage\Device\*
  • c:\ProgramData\Microsoft\Windows NT\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\*
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\*
  • c:\Python27\Lib\xml\etree\*
  • c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\*
  • c:\Python27\Lib\test\*
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\Security\*
  • c:\Python27\Lib\ctypes\macholib\*
  • c:\Python27\Lib\msilib\*
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\*
  • c:\6cdeacda242012e0e5b593e657\1035\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\DD\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\*
  • c:\Users\Default\Videos\*
  • c:\ProgramData\McAfee\MCLOGS\Common\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\*
  • c:\Users\Default\Documents\*
  • c:\6cdeacda242012e0e5b593e657\1031\*
  • c:\Python27\tcl\tcl8.5\tzdata\Pacific\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\North_Dakota\*
  • \\KIDSROOM\Users\Harry Dresden\Downloads\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\*
  • c:\Python27\tcl\tcl8.5\tzdata\Etc\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\DD\*
  • c:\ProgramData\Adobe\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\*
  • c:\inetpub\history\CFGHISTORY_0000000001\*
  • \\KIDSROOM\Users\Harry Dresden\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A6\*
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\*
  • c:\Python27\Tools\webchecker\*
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\*
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\*
  • c:\inetpub\history\CFGHISTORY_0000000005\*
  • c:\Users\Harry Dresden\Favorites\Links\*
  • c:\ProgramData\Microsoft\Assistance\*
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\*
  • c:\inetpub\wwwroot\*
  • c:\Users\Harry Dresden\*
  • c:\Python27\tcl\tcl8.5\tzdata\Antarctica\*
  • c:\Python27\Lib\site-packages\pip\_vendor\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\*
  • \\KIDSROOM\Users\Public\Downloads\*
  • c:\Users\Public\Downloads\*
  • c:\6cdeacda242012e0e5b593e657\2070\*
  • c:\Python27\Lib\test\cjkencodings\*
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\*
  • \\KIDSROOM\Users\Default\Videos\*
  • c:\ProgramData\Microsoft\Windows Defender\Support\*
  • c:\Python27\Lib\site-packages\pip\operations\*
  • c:\ProgramData\Microsoft\MF\*
  • c:\6cdeacda242012e0e5b593e657\1029\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\*
  • c:\Python27\Lib\distutils\tests\*
  • c:\ProgramData\Microsoft\Office\*
  • c:\Users\Public\Music\*
  • c:\Python27\tcl\tcl8.5\tzdata\SystemV\*
  • c:\6cdeacda242012e0e5b593e657\1045\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\*
  • c:\Users\Harry Dresden\Desktop\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\*
  • c:\ProgramData\Microsoft\Crypto\*
  • \\KIDSROOM\Users\Public\Foxit Software\*
  • c:\Users\Public\Pictures\*
  • c:\ProgramData\Mozilla\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\*
  • c:\Python27\include\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\*
  • c:\Python27\Lib\lib2to3\tests\data\fixers\*
  • c:\Python27\Lib\encodings\*
  • c:\Python27\Lib\site-packages\setuptools\*
  • c:\Python27\Lib\test\tracedmodules\*
  • c:\ProgramData\Microsoft\Diagnosis\AsimovUploader\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\*
  • c:\6cdeacda242012e0e5b593e657\1049\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\*
  • c:\Python27\Lib\idlelib\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\*
  • c:\Python27\tcl\tcl8.5\tzdata\Mexico\*
  • \\KIDSROOM\Users\Harry Dresden\Favorites\Links\*
  • c:\ProgramData\Microsoft\RAC\*
  • \\KIDSROOM\Users\Public\Pictures\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\*
  • \\KIDSROOM\Users\Public\Music\*
  • c:\Python27\tcl\tcl8.5\tzdata\Arctic\*
  • c:\ProgramData\Oracle\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\*
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\media\*
  • c:\ProgramData\Microsoft\Windows Defender\Quarantine\*
  • c:\Python27\tcl\tcl8\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Queue\*
  • c:\ProgramData\Microsoft\RAC\Outbound\*
  • c:\ProgramData\WebEx\*
  • c:\inetpub\history\CFGHISTORY_0000000003\*
  • c:\Python27\Lib\site-packages\setuptools\command\*
  • c:\Python27\tcl\tcl8.5\tzdata\Indian\*
  • c:\ProgramData\Microsoft\Event Viewer\Views\*
  • c:\Users\Default\Favorites\*
  • c:\*
  • c:\Users\Default\Desktop\*
  • \\KIDSROOM\Users\Public\Pictures\Sample Pictures\*
  • c:\ProgramData\Microsoft\eHome\logs\*
  • c:\ProgramData\Microsoft\Network\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Kentucky\*
  • c:\Python27\Lib\lib-tk\test\test_ttk\*
  • c:\Python27\tcl\tcl8.5\tzdata\US\*
  • c:\ProgramData\Microsoft\ClickToRun\UserData\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\*
  • c:\Users\Public\Pictures\Sample Pictures\*
  • c:\6cdeacda242012e0e5b593e657\1041\*
  • c:\Users\Default\Downloads\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\ssl_match_hostname\*
  • c:\Users\Harry Dresden\Links\*
  • c:\Python27\DLLs\*
  • c:\ProgramData\Microsoft\User Account Pictures\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\contrib\*
  • \\KIDSROOM\Users\Harry Dresden\OneDrive\*
  • c:\utskt\modules\auxiliary\*
  • c:\Python27\tcl\tcl8.5\tzdata\Asia\*
  • c:\Users\Harry Dresden\Downloads\*
  • c:\Python27\tcl\tcl8.5\opt0.4\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\42\*
  • c:\Users\Public\Videos\*
  • c:\utskt\modules\*
  • c:\Python27\tcl\tcl8\8.4\*
  • c:\6cdeacda242012e0e5b593e657\1055\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\*
  • c:\Python27\Tools\versioncheck\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F7\*
  • c:\Python27\Lib\xml\dom\*
  • c:\Python27\Lib\lib2to3\tests\data\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\*
  • \\KIDSROOM\Users\Harry Dresden\Desktop\*
  • c:\Python27\tcl\tcl8.5\encoding\*
  • c:\ProgramData\McAfee\*
  • c:\ProgramData\Microsoft\DRM\Server\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\*
  • c:\ProgramData\Microsoft\User Account Pictures\Default Pictures\*
  • \\KIDSROOM\Users\Public\Favorites\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\*
  • \\KIDSROOM\Users\Public\Documents\*
  • c:\utskt\*
  • c:\Python27\Lib\xml\parsers\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\*
  • c:\6cdeacda242012e0e5b593e657\1038\*
  • c:\Python27\tcl\tix8.4.3\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\trie\*
  • c:\Python27\tcl\tcl8.5\tzdata\Canada\*
  • c:\ProgramData\NovaTech Network\*
  • c:\ProgramData\Microsoft\WwanSvc\*
  • \\KIDSROOM\Users\*
  • c:\6cdeacda242012e0e5b593e657\1053\*
  • c:\Users\Default\Music\*
  • c:\Python27\Lib\test\decimaltestdata\*
  • c:\Python27\Lib\test\xmltestdata\*
  • c:\ProgramData\Passmark\PerformanceTest\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\*
  • c:\Python27\tcl\reg1.2\*
  • \\KIDSROOM\Users\Public\*
  • \\KIDSROOM\Users\Harry Dresden\Documents\*
  • \\KIDSROOM\Users\Public\Music\Sample Music\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\*
  • c:\6cdeacda242012e0e5b593e657\2052\*
  • c:\Python27\Lib\logging\*
  • c:\ProgramData\Microsoft\eHome\*
  • c:\Users\Public\*
  • c:\6cdeacda242012e0e5b593e657\1043\*
  • c:\Python27\Lib\site-packages\*
  • c:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\*
  • c:\ProgramData\Microsoft\Diagnosis\UIF\*
  • c:\Users\Harry Dresden\Searches\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\*
  • c:\Python27\tcl\tk8.5\*
  • c:\Python27\Lib\xml\sax\*
  • c:\ProgramData\Microsoft\Vault\*
  • c:\Users\Default\Links\*
  • c:\Python27\Lib\json\tests\*
  • c:\Python27\libs\*
  • c:\6cdeacda242012e0e5b593e657\1028\*
  • c:\Python27\Lib\lib-tk\test\test_tkinter\*
  • c:\Users\Public\Foxit Software\Foxit Reader\*
  • c:\ProgramData\Microsoft OneDrive\*
  • c:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\*
  • c:\Python27\Lib\ctypes\*
  • c:\Users\Public\Recorded TV\Sample Media\*
  • c:\Python27\*
  • c:\ProgramData\Microsoft\Crypto\DSS\*
  • c:\ProgramData\Microsoft\Diagnosis\Sideload\*
  • c:\Python27\Lib\email\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\*
  • c:\ProgramData\Microsoft\Search\Data\*
  • c:\Users\Harry Dresden\Documents\*
  • c:\ProgramData\Adobe\Setup\*
  • c:\Python27\Lib\distutils\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\*
  • c:\ProgramData\Microsoft\Device Stage\Task\*
  • c:\Users\*
  • \\KIDSROOM\Users\Default\Links\*
  • c:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\*
  • c:\Python27\Lib\sqlite3\*
  • c:\ProgramData\Sun\Java\*
  • c:\ProgramData\Microsoft\NetFramework\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\*
  • c:\ProgramData\Microsoft\Crypto\Keys\*
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\*
  • c:\Python27\Lib\bsddb\test\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\{98101498-C465-4F51-8751-D1919E97D29D}\*
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\*
  • c:\Recovery\*
  • c:\Users\Public\Foxit Software\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A6\*
  • c:\inetpub\history\CFGHISTORY_0000000002\*
  • c:\Python27\Lib\site-packages\pip\req\*
  • c:\Users\Harry Dresden\Videos\*
  • \\KIDSROOM\Users\Public\Videos\Sample Videos\*
  • c:\inetpub\wwwroot\aspnet_client\system_web\*
  • c:\Python27\tcl\tcl8.5\tzdata\Australia\*
  • c:\Users\Harry Dresden\Pictures\*
  • c:\ProgramData\Microsoft\DeviceSync\*
  • c:\ProgramData\WebEx\WebEx\12_1324\*
  • c:\ProgramData\Microsoft\Office\Heartbeat\*
  • c:\Python27\Lib\lib2to3\tests\data\fixers\myfixes\*
  • \\KIDSROOM\Users\Public\Libraries\*
  • c:\Python27\Tools\Scripts\*
  • c:\utskt\lib\*
  • c:\Python27\Lib\hotshot\*
  • c:\ProgramData\Microsoft\*
  • c:\ProgramData\Microsoft\PlayReady\*
  • c:\Python27\Lib\site-packages\pip\utils\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\*
  • \\KIDSROOM\Users\Public\Recorded TV\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\*
  • c:\Python27\tcl\tcl8.5\tzdata\Brazil\*
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\packaging\*
  • \\KIDSROOM\Users\Public\Desktop\*
  • c:\Python27\Lib\lib2to3\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Argentina\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\*
  • c:\ProgramData\Microsoft\WwanSvc\Profiles\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\*
  • c:\Python27\Lib\test\subprocessdata\*
  • \\KIDSROOM\Users\Default\Favorites\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Quick\*
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info\*
  • c:\Python27\Lib\site-packages\pip\_vendor\progress\*
  • \\KIDSROOM\Users\Harry Dresden\Saved Games\*
  • c:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Inbox\*
  • c:\Python27\Lib\xml\*
  • c:\ProgramData\Microsoft\Search\*
  • c:\ProgramData\Microsoft\IlsCache\*
  • c:\Python27\tcl\tk8.5\images\*
  • e:\*
  • c:\Python27\Lib\sqlite3\test\*
  • c:\ProgramData\McAfee\MCLOGS\*
  • c:\Python27\Lib\ensurepip\*
  • c:\Python27\Lib\idlelib\Icons\*
  • c:\Python27\Lib\test\imghdrdata\*
  • c:\ProgramData\Microsoft\Diagnosis\*
  • c:\6cdeacda242012e0e5b593e657\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\*
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\*
  • c:\6cdeacda242012e0e5b593e657\1030\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\*
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\*
  • c:\Python27\tcl\tcl8.5\tzdata\*
  • c:\ProgramData\Microsoft\RAC\PublishedData\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\*
  • \\KIDSROOM\Users\Default\Documents\*
  • c:\Python27\Lib\multiprocessing\dummy\*
  • \\KIDSROOM\Users\ruiner\*
  • c:\Python27\Lib\email\mime\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\*
  • c:\Python27\tcl\tix8.4.3\demos\bitmaps\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\en-us.16\*
  • c:\Users\Public\Documents\*
  • c:\6cdeacda242012e0e5b593e657\3082\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\*
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\*
  • c:\Python27\Lib\lib-tk\*
  • c:\Users\Harry Dresden\Favorites\*
  • c:\Python27\Doc\*
  • c:\utskt\bin\*
  • c:\Python27\Lib\curses\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\C0D2A2B7-8AE4-4D06-93E4-F1A7BD5FEC3F\*
  • c:\Python27\Lib\lib2to3\pgen2\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\*
  • c:\ProgramData\Adobe\Acrobat\*
  • c:\Python27\Lib\*
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\*
  • c:\Python27\tcl\tix8.4.3\demos\*
  • c:\utskt\modules\packages\*
  • c:\6cdeacda242012e0e5b593e657\1042\*
  • c:\Python27\Lib\test\audiodata\*
  • c:\inetpub\history\CFGHISTORY_0000000004\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\*
  • c:\Python27\Lib\site-packages\pip\_vendor\_markerlib\*
  • \\KIDSROOM\Users\Harry Dresden\Videos\*
  • c:\Python27\tcl\tcl8\8.4\platform\*
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\*
  • c:\Python27\Lib\site-packages\pip\vcs\*
  • c:\6cdeacda242012e0e5b593e657\1046\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\*
  • c:\Python27\tcl\tix8.4.3\pref\*
  • c:\Python27\Lib\site-packages\pip\compat\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\*
  • \\KIDSROOM\Users\Default\Music\*
  • c:\Python27\Lib\json\*
  • c:\Python27\Lib\lib2to3\fixes\*
  • \\KIDSROOM\Users\Harry Dresden\Favorites\Links for United States\*
  • c:\ProgramData\Microsoft\Windows Defender\LocalCopy\*
  • c:\ProgramData\Microsoft\Assistance\Client\*
  • c:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\*
  • c:\Python27\Lib\test\leakers\*
  • c:\Users\Public\Videos\Sample Videos\*
  • c:\ProgramData\Microsoft\Media Player\*
  • c:\ProgramData\McAfee\MCLOGS\Common\jxpiinstall\*
  • c:\utskt\lib\api\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\filters\*
  • c:\Python27\Tools\*
  • c:\6cdeacda242012e0e5b593e657\1044\*
  • c:\6cdeacda242012e0e5b593e657\1036\*
  • c:\inetpub\history\*
  • c:\6cdeacda242012e0e5b593e657\1032\*
  • c:\Python27\tcl\tcl8.5\tzdata\Chile\*
  • c:\Python27\Lib\site-packages\pip\_vendor\packaging\*
  • c:\ProgramData\Microsoft\Windows NT\MSScan\*
  • c:\Python27\Lib\email\test\data\*
  • c:\Python27\tcl\tix8.4.3\bitmaps\*
  • c:\Python27\Lib\site-packages\pip\_vendor\colorama\*
  • c:\Python27\Lib\lib2to3\tests\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\*
  • \\KIDSROOM\Users\Public\Videos\*
  • c:\ProgramData\regid.1991-06.com.microsoft\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F7\*
  • c:\ProgramData\Microsoft OneDrive\setup\*
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\*
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches\*
  • c:\Python27\Lib\distutils\command\*
  • \\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\*
  • c:\Python27\tcl\*
  • c:\Python27\Lib\site-packages\pip\commands\*
  • c:\Python27\Lib\site-packages\pkg_resources\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\*
  • c:\Python27\Lib\multiprocessing\*
  • c:\Python27\Lib\wsgiref\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\35\*
  • c:\Users\Public\Favorites\*
  • c:\Python27\Lib\pydoc_data\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util\*
  • c:\ProgramData\Microsoft\RAC\StateData\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Indiana\*
  • c:\Python27\Lib\site-packages\_markerlib\*
  • c:\Python27\Lib\idlelib\idle_test\*
  • c:\inetpub\custerr\en-US\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\*
  • c:\6cdeacda242012e0e5b593e657\1040\*
Registry Key-Opened
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\control\NetworkProvider\HwOrder
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPNP\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\VssapiPublisher
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MiniNT
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Safeboot\Option
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\NetworkProvider
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider
  • HKEY_CURRENT_USER\Network\E
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions
  • HKEY_LOCAL_MACHINE\system\CurrentControlSet\Control\NetworkProvider\Notifyees
  • HKEY_CURRENT_USER\Network
  • HKEY_PERFORMANCE_DATA\(Default)
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LDAP
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
  • HKEY_LOCAL_MACHINE\system\CurrentControlSet
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\http\
  • HKEY_CURRENT_USER\Software
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610
  • HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CLASSES_ROOT\.js
  • HKEY_LOCAL_MACHINE\Software\Policies
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Pre Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\0a-00-27-00-00-00
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_CERT_WARNINGS_ON_POST_FROM_ISTREAM_KB2894776
  • HKEY_CURRENT_USER\SOFTWARE\Classes\PROTOCOLS\Filter\text/html
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001
  • HKEY_LOCAL_MACHINE\Software
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Pre Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\*\
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_URLMON_IQDA_SIZE
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent
  • HKEY_CURRENT_USER\Software\Policies
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\KindMap
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_URLMON_IQDA_SIZE
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00
  • HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_LOCAL_MACHINE\System\Setup
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION
  • HKEY_CLASSES_ROOT\JSFile\ScriptEngine
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\UrlMon Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SHOW_CERT_WARNINGS_ON_POST_FROM_ISTREAM_KB2894776
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Registry Key-Deleted
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDetectedUrl
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDetectedUrl
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
Registry Key-Read
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\MaxRpcSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseHostnameAsAlias
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\LdapClientIntegrity
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\OOBEInProgress
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseOldHostResolutionOrder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder\ProviderOrder
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\ComputerName
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions\ProductType
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ReceiveTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\wscript.exe
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\NoFileFolderJunction
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cer\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectTimeOut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\DisallowRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InitFolderHandler
  • HKEY_CURRENT_USER\Directory\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PreCreate
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc2740-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\IgnoreUserSettings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\AdminTabProcs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InfoTip
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DevicePath
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\RestrictRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ADODB.Stream\CLSID\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\*
  • HKEY_CURRENT_USER\Directory\NeverShowExt
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\LogFileName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.js\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chm\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\MapNetDriveVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\Timeout
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivKeyCachePurgeIntervalSeconds
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\TabProcGrowth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDhcp
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParsingName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SendTimeOut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\Environment\PROCESSOR_ARCHITECTURE
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SourcePath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseOldHostResolutionOrder
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273c-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsParseDisplayName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\DontShowSuperHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\InprocServer32
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\AllowFileCLSIDJunctions
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\SessionMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bat\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoSetFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\FolderTypeID
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\DisplayLogo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\(Default)
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableUTF8
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\COM+Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.com\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForInfoTip
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FrameTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\*
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Srp\GP\RuleCount
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HasNavigationEnum
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1A10
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Description
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\PolicyScope
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoCommonGroups
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273d-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoSimpleStartMenu
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\Safety Warning Level
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ade\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation\AllowedReservedCharacters
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoControlPanel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\SessionMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORPARSING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\BrowseInPlace
  • HKEY_CURRENT_USER\Directory\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForOverlay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\UseDropHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.crt\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsAliasedNotifications
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\ClassicShell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugHeapFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FrameTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\DefaultLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JScript\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSXML2.XMLHTTP\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideOnDesktopPerUser
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SendTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoPropertiesMyComputer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WScript.Shell\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bas\(Default)
  • HKEY_CURRENT_USER\Directory\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Name
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoPropertiesRecycleBin
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORDISPLAY
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Image Path
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Platform
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\TabProcGrowth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\DelegateExecute
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\PinToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\Levels
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpl\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoInternetIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273d-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\InheritConsoleHandles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\UseWINSAFER
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivKeyCacheMaxItems
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1806
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\DocObject
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ReceiveTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Security
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\SaferFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResource
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\AdminTabProcs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\TrustPolicy
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Compatible
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\DA0C75D6
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsUniversalDelegate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.adp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\command
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseHostnameAsAlias
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InitFolderHandler
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\NoWorkingDirectory
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\ScriptEngine\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecision
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cmd\(Default)
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1806
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\LogSecuritySuccesses
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc2740-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
  • HKEY_CURRENT_USER\Directory\IsShortcut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivateKeyLifetimeSeconds
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\*
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\LdapClientIntegrity
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideInWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FrameMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\DisplayLogo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\NoWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\Timeout
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Compatible
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\POLICIES\EXPLORER\InheritConsoleHandles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win64\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\InprocServer32
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273c-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FrameMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\SetWorkingDirectoryFromTarget
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDns
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionTime
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideFolderVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Flags
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadExpirationDays
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\NeverShowExt
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDetectedUrl
Registry Key-Written
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionReason
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecision
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionTime
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadNetworkName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
Mutex-Accessed
  • Local\ZonesCacheCounterMutex
  • Local\ZonesLockedCacheCounterMutex

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 460, Parent PID: 364

"C:\Windows\System32\wscript.exe" C:\Users\HARRYD~1\AppData\Local\Temp\NRV_F9DF5220_.js PID: 4252, Parent PID: 3224

"C:\Windows\SysWOW64\rundll32.exe" C:\Users\HARRYD~1\AppData\Local\Temp\UQK1LO~1.DLL,boobs PID: 2120, Parent PID: 4252

Volatility

Nothing to display.