'
metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2016-11-08 21:31:32.423771 2016-11-08 21:34:47.930904 195 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo2 win7 Clone 2 VirtualBox 2016-11-08 21:31:32 2016-11-08 21:34:47

File Details

File name a0c83d759ef3a006df8f16b32dce2fb2b3c37c3d.zip
File size 1110 bytes
File type Zip archive data, at least v2.0 to extract
CRC32 BB859D80
MD5 f53b8b007b279bbc8285b4f3f092cc77
SHA1 a0c83d759ef3a006df8f16b32dce2fb2b3c37c3d
SHA256 46f2d00c870778fdfe5539a34959df4a35216ccc12736b4a569b6c48064f4d27
SHA512 1c5c4ce6fb46701414cb7964861a737659ca228a934906ea158400c0b9507ab4de4886030c6b6c05b75d9712f52fb430185ee8be333eea733bf73c846fba3435
Ssdeep 24:9C0+w86nWcR8mHuUlAlDm0IsxXnCZwXf7bdosvOzP4n7t5NJ65y8q:9znWcREUliD8q9Xf7bdosvOjc7ttcm
PEiD None matched
Yara
  • PM_Zip_with_js ()
VirusTotal Permalink
VirusTotal Scan Date: 2016-11-08 17:51:33
Detection Rate: 11/55 (Expand)

MetaFlows Scores

Metaflows Analysis Results (Signatures=125, Anomalies=0, PEiD=0, Yara=2, VT[1478640931]=100): Snort Events=1, AV Events=2
Total Score=125

SNORT EVENTS:
ET POLICY PE EXE or DLL Windows file download HTTP

CLAMAV DETECTED:
Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND
DROPPED FILE - NRV_6208P0O_.js: Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND

Dropped File/Buffer Yara Signatures:
5a57a3575e28bb0de93533f392c9ab3a2941d9c2 [BUFFER]: Str_Win32_Http_API

Signatures

antivm_queries_computername details
recon_fingerprint details
antivm_memory_available details
dumped_buffer details
creates_doc details
antivm_network_adapters details
dumped_buffer2 details
antivm_vbox_files details
Windows_Proxy_Tinkering details
network_wscript_downloader details
persistence_ads details
antiav_detectfile details
exploit_heapspray details
malicious_document_urls details
network_document_file details
network_downloader_exe details
antivm_vbox_devices details
antivm_vbox_files details
modifies_files details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

df0a9be35104ab87_gizcrygc-7am0-f7er-2be8-02ac9a86c991.thor

b34a0e3b893c090d_gizcrygc-7am0-f7er-ad55-84c021f630ae.thor

dbe9e347eb2b46e5_gizcrygc-7am0-f7er-3761-fa1d4ed5bf09.thor

476831c2434c6008_gizcrygc-7am0-f7er-0d91-da8a9edc9cf3.thor

72b0be2ba08272f9_gizcrygc-7am0-f7er-41d2-022c981f39b9.thor

430ab16a424e80a6_gizcrygc-7am0-f7er-2f89-28720103ae35.thor

c1667fa7e4ed119a_gizcrygc-7am0-f7er-109f-1fc435244965.thor

16c25330f7bec7a2_gizcrygc-7am0-f7er-f092-f9c0ea59aeab.thor

0f0e4d628add77fe_gizcrygc-7am0-f7er-371b-6f45b0a6c453.thor

59ddcf498a5b283c_gizcrygc-7am0-f7er-6201-17f5de87ef31.thor

358f59495486f758_gizcrygc-7am0-f7er-9b2b-0f6a54f23f8e.thor

faf021b3c06abc41_tasks.xml

6ed2c3ba68fd75df_gizcrygc-7am0-f7er-76c6-95a962ec61c0.thor

9b73e3119d5330a8_gizcrygc-7am0-f7er-a44c-875e439f72dc.thor

363e34da7aede353_gizcrygc-7am0-f7er-8960-c70ac92377b8.thor

6c3ccafc5d8903ee_gizcrygc-7am0-f7er-642e-a678f400e282.thor

f8831c2c67f0f5af_gizcrygc-7am0-f7er-16d9-e8a2ca23c009.thor

8c6eb2568ff58698_gizcrygc-7am0-f7er-04ac-c0dece8f9abe.thor

2b9d7689ff983286_gizcrygc-7am0-f7er-4af0-de45fd6d6a8a.thor

ecd0f6294ac28101_gizcrygc-7am0-f7er-1445-f03e7e0991ba.thor

7463fe2f1bcfe21c_gizcrygc-7am0-f7er-446b-48668bf84f1a.thor

08411b26e929c933_gizcrygc-7am0-f7er-a176-f5ca551ee0df.thor

b66e14e73ed0d4a3_gizcrygc-7am0-f7er-65c4-8d214c98c4c7.thor

f2588daa1f78798a_gizcrygc-7am0-f7er-611c-bce1af3c3421.thor

6ada1adce4438888_gizcrygc-7am0-f7er-3b4d-570d67bfe527.thor

c11735ac22e4b7db_gizcrygc-7am0-f7er-e183-5aeba59991ae.thor

564bcc6ba7fc2dcc_gizcrygc-7am0-f7er-b26a-62fbf513abbd.thor

14f181a49e60c53f_gizcrygc-7am0-f7er-abde-ad78d2f7ac7d.thor

9a6a10b337c3dd00_gizcrygc-7am0-f7er-54fd-d6c3c5579ec8.thor

80fa79c353a22abc_gizcrygc-7am0-f7er-a141-b7366ccfc4ee.thor

d3d8810615b327ea_gizcrygc-7am0-f7er-f55e-3502e88adc84.thor

8fa87026c0c136bc_gizcrygc-7am0-f7er-f48d-8ae65e52b065.thor

9e46581f7cb448d4_gizcrygc-7am0-f7er-0ace-bfea7d2e0037.thor

49ee91405e9c464f_gizcrygc-7am0-f7er-ac5b-2ecc3fc7bcfe.thor

a25ca35d7eee3b28_gizcrygc-7am0-f7er-ab6e-9d90520eaab5.thor

fd5f68b59aa2b3e8_resource.xml

be9381da661cc4d2_gizcrygc-7am0-f7er-2992-d4805678b35e.thor

3f471fe1f6305169_gizcrygc-7am0-f7er-179a-5056b9e0e2a6.thor

4ab73437fb86051f_gizcrygc-7am0-f7er-14f1-65c4b9e66625.thor

5bc6ab096f33e33d_gizcrygc-7am0-f7er-7850-22a9bf518563.thor

b1ba0e79562a89d5_gizcrygc-7am0-f7er-3f9c-13a8436dba72.thor

e0ccc8a67c9c3766_gizcrygc-7am0-f7er-34bd-7ced8209a0b5.thor

d373e9c5c53fb86b_gizcrygc-7am0-f7er-3dec-ebe288af62a6.thor

2f4eaeee48e8d32a_gizcrygc-7am0-f7er-e163-927df93a0cc4.thor

24b8d4ff3161e26f_gizcrygc-7am0-f7er-afb0-f70aad536195.thor

73c813d735fba499_gizcrygc-7am0-f7er-4851-3d554cf72dee.thor

9a46273200f19e6b_gizcrygc-7am0-f7er-38e9-4af4fa82e284.thor

bb37c06f137f6315_gizcrygc-7am0-f7er-fb84-86f87ffd14ef.thor

0c0e7f6ab26ea315_gizcrygc-7am0-f7er-4a65-cd70a16042ba.thor

4cf471222eff23cb_gizcrygc-7am0-f7er-d564-5ccc437ac98f.thor

d9b1b575f2ae1c11_gizcrygc-7am0-f7er-ee3e-ff1006901f40.thor

08f51a3edbc33648_gizcrygc-7am0-f7er-ae59-03d81a4addbb.thor

af7a12135db48bf2_resource.xml

0d1ee9c00457a53e_gizcrygc-7am0-f7er-1c6d-55c2cdd08190.thor

976cb9a01e010c9e_gizcrygc-7am0-f7er-1733-81e020d66afe.thor

f3cc8fd7ad8d880e_gizcrygc-7am0-f7er-714c-94e207773abd.thor

ea50445e5ed6f6fc_gizcrygc-7am0-f7er-2d68-2483ac60110d.thor

d34be09189a2544e_gizcrygc-7am0-f7er-aeab-5654b3e5c937.thor

2aaeb7e5b1eaac0f_gizcrygc-7am0-f7er-46b8-d4a6b289dd8a.thor

b1fa688592e90e66_gizcrygc-7am0-f7er-1a06-0f8d7b54e4b0.thor

31c04dd9507aaf7f_gizcrygc-7am0-f7er-0480-0def12fa48ba.thor

eaaaad4ab2d2a72f_gizcrygc-7am0-f7er-adb0-42ebd44e6a36.thor

440d5d7cdb74e6ce_gizcrygc-7am0-f7er-f779-267a1221d4c9.thor

28761e23f7d504b7_gizcrygc-7am0-f7er-d3a8-189c74fe9a76.thor

e45c8727b9454ac7_gizcrygc-7am0-f7er-5118-8582926fec2b.thor

e9d3642352b7e28a_gizcrygc-7am0-f7er-25bd-d14989e576f9.thor

44f17af9c7f34a9b_gizcrygc-7am0-f7er-8556-86406b81a94d.thor

5367f446862d596c_gizcrygc-7am0-f7er-e455-a3f1c5d2063b.thor

db857f5e07fa5fca_gizcrygc-7am0-f7er-fe53-e01fa4f84ea8.thor

95a1a2710fc6677c_gizcrygc-7am0-f7er-156a-99c0832844c7.thor

30acd61778c5f6fe_gizcrygc-7am0-f7er-4935-0f71fb8de84c.thor

e2a2cad95640242f_gizcrygc-7am0-f7er-bbc2-95ea4f040b7f.thor

17b85d59eced6f16_gizcrygc-7am0-f7er-426c-529be91eb075.thor

ae1326391225fd81_gizcrygc-7am0-f7er-19e3-81cee48bd3ce.thor

9a04cd7f79465767_gizcrygc-7am0-f7er-3636-9b92f2c9eb34.thor

15df8319d40223d1_gizcrygc-7am0-f7er-8ea9-ca9e2fd58fae.thor

7b807da7158ed9bb_gizcrygc-7am0-f7er-de17-364b8ea45810.thor

069cdab9c003bc94_gizcrygc-7am0-f7er-5813-d29a2c02218d.thor

5f6272360f1b5f11_gizcrygc-7am0-f7er-14a1-54fedf37d01e.thor

bd493bcf817b27b1_gizcrygc-7am0-f7er-45d3-5dfb9bac05c2.thor

b625b1f42cd9a66f_gizcrygc-7am0-f7er-e951-db3f54ed84df.thor

56bb876c7380e665_gizcrygc-7am0-f7er-1770-3a7e8548d152.thor

a25a94b85c8981ac_gizcrygc-7am0-f7er-4dbc-362afc80013a.thor

bd74dd0556f21289_gizcrygc-7am0-f7er-87cd-9d58d61413a7.thor

b853e37cd5fb124f_gizcrygc-7am0-f7er-4557-ea00414cd59f.thor

5c8ca08ef65a1212_gizcrygc-7am0-f7er-7193-091ee1867597.thor

5f880552016230f9_gizcrygc-7am0-f7er-8711-e63741873696.thor

0027c2b1e673ce98_gizcrygc-7am0-f7er-3045-c411b8783edc.thor

5936162a77d1fe7a_gizcrygc-7am0-f7er-9d56-e8963d88d035.thor

b80a513148d0daa8_gizcrygc-7am0-f7er-bbd7-6b25b7f5b19a.thor

7d77c83794c630e6_gizcrygc-7am0-f7er-3faa-dbcb634144dc.thor

0615a5a03a931aba_gizcrygc-7am0-f7er-b1bf-a082b74d1af7.thor

6404d238db870bc8_gizcrygc-7am0-f7er-39a1-30892985772d.thor

be0488e98af03b46_gizcrygc-7am0-f7er-0bd8-9779635a4dc1.thor

16861832010af538_gizcrygc-7am0-f7er-a038-37e1f553674e.thor

a7fc2802e81669fd_gizcrygc-7am0-f7er-fd46-dffe41b8ea02.thor

a4868c1fa4044de7_gizcrygc-7am0-f7er-3166-a9aab316b0df.thor

d9aeaa186a2f7468_gizcrygc-7am0-f7er-7b4f-8bc680ed978e.thor

86c05252eacc2b5d_tasks.xml

eac019c9db0dabf9_gizcrygc-7am0-f7er-23a4-aee985cd1dd3.thor

e5351ce35a8d9fbb_gizcrygc-7am0-f7er-6f99-7f938f2cd8c7.thor

e5beb49b5b24fc83_gizcrygc-7am0-f7er-dcca-e23f29fa2c21.thor

5f0c643cd4082c7f_gizcrygc-7am0-f7er-1a5d-d561e3c77147.thor

124223f8e85b4493_gizcrygc-7am0-f7er-e8cc-1d8f4284e13a.thor

35869cba8b3cf32c_gizcrygc-7am0-f7er-3a4c-594d97094c12.thor

62d41868740ba746_gizcrygc-7am0-f7er-ef03-ed065e12288f.thor

d6900c790fe3cef5_gizcrygc-7am0-f7er-df6e-0d36cedc7c46.thor

1b1e89c7aa91788b_gizcrygc-7am0-f7er-3a42-672ca37ec2b3.thor

edce9420f0f942d5_gizcrygc-7am0-f7er-a88d-36be8ee6384d.thor

2924b6f9b183a7a5_gizcrygc-7am0-f7er-fd31-b9da41221e2b.thor

9366578a87751557_gizcrygc-7am0-f7er-6b75-678157f4cd8f.thor

5aeca0f4a019bb8d_gizcrygc-7am0-f7er-3a1f-99cb3d719b32.thor

7ccce48f68955acc_gizcrygc-7am0-f7er-820a-3cd9b3feed5f.thor

244c54c4b59c6269_gizcrygc-7am0-f7er-69e8-d51ffdc233e8.thor

ee342893576d0e9e_gizcrygc-7am0-f7er-1542-722b9725e8a7.thor

c84a9cc79b6e4de1_gizcrygc-7am0-f7er-5699-513a06a3c72a.thor

b34db9aa560747f5_gizcrygc-7am0-f7er-6c4d-82ac1c29a6bd.thor

1fac136d25547467_gizcrygc-7am0-f7er-8e8d-c15afa08606a.thor

476bb17ebcbbaa29_gizcrygc-7am0-f7er-ecf9-c25053018df0.thor

b0a9b80efd094e2c_gizcrygc-7am0-f7er-a7b1-c29fff9474a2.thor

6d3a2913cd4e1a54_gizcrygc-7am0-f7er-8af9-3954f2eaf24a.thor

db8f6e9940d52ce4_gizcrygc-7am0-f7er-0760-0b3609701935.thor

db787db18e28e42c_gizcrygc-7am0-f7er-b940-dfc3f7b10ebd.thor

2d1d6f44bb4c68f9_gizcrygc-7am0-f7er-4a73-8567c5283cf7.thor

b4b1436ccee1d243_gizcrygc-7am0-f7er-e84a-afb44da637ae.thor

d05a92aa996b2105_gizcrygc-7am0-f7er-f836-06a667e3002f.thor

742e88ef28caa310_gizcrygc-7am0-f7er-a9bf-fee48f743a77.thor

4b098a8ce6e91945_gizcrygc-7am0-f7er-7164-058805d2f14e.thor

760a25fa18129229_gizcrygc-7am0-f7er-ea0e-83a51117f968.thor

0c2be55e799378ca_gizcrygc-7am0-f7er-8ca1-7c6c1227e645.thor

17fa26c0c4e89f5d_gizcrygc-7am0-f7er-3db6-0b98b3a70e45.thor

0696e2eeb28a0870_gizcrygc-7am0-f7er-906d-7f9485e50f06.thor

00f65c7e4f10783e_gizcrygc-7am0-f7er-5792-28eb9f19c04a.thor

52c3a48f3b6fd57d_gizcrygc-7am0-f7er-6a79-9d2680f848bf.thor

773e480161c1f7c1_gizcrygc-7am0-f7er-3d8a-43687c815270.thor

8b86b5262e15e067_gizcrygc-7am0-f7er-1dd7-c1403463e5aa.thor

0c9c183c0fd5798f_gizcrygc-7am0-f7er-888b-207f984cb041.thor

63dc5886e5975940_gizcrygc-7am0-f7er-c1f2-adeee2a884bf.thor

c661951401f31557_gizcrygc-7am0-f7er-181e-28f598d7087e.thor

2b65ac2f9d747ba2_gizcrygc-7am0-f7er-0aa7-eaf5de168448.thor

2e74843fd9ae5a52_gizcrygc-7am0-f7er-c2af-7fc282a28b87.thor

3531716887f32427_gizcrygc-7am0-f7er-d954-a9b3d4a8f113.thor

60b63699307684d6_gizcrygc-7am0-f7er-da50-6669e85870ce.thor

89f2db96d0e34efe_gizcrygc-7am0-f7er-1e12-2b256b403fdd.thor

c7ba755074c1db84_gizcrygc-7am0-f7er-ed55-8d72890e8588.thor

6723bd5b5b4da88c_gizcrygc-7am0-f7er-2caa-b1c4906089e9.thor

ab94a64ea00cc493_gizcrygc-7am0-f7er-5579-490eedb1a1e1.thor

b92c33eb58511370_gizcrygc-7am0-f7er-7ff2-6972c39a5b74.thor

97f7ce1713423a17_gizcrygc-7am0-f7er-9ccb-1bb2fde34483.thor

52aa767dea48a856_gizcrygc-7am0-f7er-888b-00c7fd76ed35.thor

37a735391ceb1133_gizcrygc-7am0-f7er-6410-1bd1685428d7.thor

8c8add9c5e8251de_gizcrygc-7am0-f7er-931c-693b71dadc79.thor

69b366510b1feeaf_gizcrygc-7am0-f7er-1d32-249e42624a7a.thor

8e70158b9dd90baa_gizcrygc-7am0-f7er-2ad6-f55789de3c28.thor

c90805d78ab5f6c9_gizcrygc-7am0-f7er-a2eb-6938860b35dd.thor

7a48b5f9e06989fc_gizcrygc-7am0-f7er-d5a3-27e57e6737c9.thor

5256e755df533378_gizcrygc-7am0-f7er-1aaa-d1f7cdebbdbe.thor

02f091e50c52e04f_gizcrygc-7am0-f7er-4e60-ae8ee9895d7f.thor

784fc9ea1e4b7ece_gizcrygc-7am0-f7er-d132-842aebcc8d59.thor

9752f3ec403be065_gizcrygc-7am0-f7er-1b3f-147c73097830.thor

4fdecaf067de95d1_gizcrygc-7am0-f7er-0877-240fc2218e55.thor

476c25fe11a63774_gizcrygc-7am0-f7er-944a-03e354b284b7.thor

68d498e056a24365_gizcrygc-7am0-f7er-4e7d-29f76a4f1abf.thor

8567c264c4b5982e_gizcrygc-7am0-f7er-beea-61fcadae8418.thor

54fd94414da6c9f2_gizcrygc-7am0-f7er-291d-8ece20777345.thor

f56c6f0469db3eac_gizcrygc-7am0-f7er-a1f0-bab92da240e8.thor

0df6336a862030e9_gizcrygc-7am0-f7er-355e-f4bb42561a7e.thor

ca8afee1e9c75797_gizcrygc-7am0-f7er-6e9b-a332e0f766ea.thor

f61efc813ecc55ca_gizcrygc-7am0-f7er-d691-4f686a663ec5.thor

fe079e8375baa9c1_gizcrygc-7am0-f7er-6ea0-e0e8fe26146c.thor

08ac24666a6d9c9d_gizcrygc-7am0-f7er-bea7-42e13f32081a.thor

26b34f5f6bf9f199_gizcrygc-7am0-f7er-451f-ba2734e2d2bc.thor

eb90bbe2f4c83544_gizcrygc-7am0-f7er-15d8-f850c5ce71fe.thor

da860b5a1101c9f6_gizcrygc-7am0-f7er-de7e-5171ce715037.thor

69e117186704cde0_gizcrygc-7am0-f7er-a7dd-224bb35e3493.thor

a1de7705dcc3e146_gizcrygc-7am0-f7er-db1e-0f54973a411c.thor

749ccd2299cbca77_gizcrygc-7am0-f7er-7698-13d5672a3004.thor

afa79c6d2f85994d_gizcrygc-7am0-f7er-8f5b-4533a5770eca.thor

73f3335df775eeab_gizcrygc-7am0-f7er-b21b-3127de0fbab7.thor

7c31f38186dc39fa_gizcrygc-7am0-f7er-ab77-2fad07ce9d5c.thor

7e2030b1bdb3ea9f_gizcrygc-7am0-f7er-ef74-001d7eb9983a.thor

b9603324e1e9c634_gizcrygc-7am0-f7er-1ca6-52df2fe97467.thor

fedf2d0254479d2d_gizcrygc-7am0-f7er-79ca-eb148bb931dc.thor

4e0e4d113448ad79_gizcrygc-7am0-f7er-115a-ed8701ff6624.thor

1aa0c2014c848b84_gizcrygc-7am0-f7er-1888-c1748ff10b33.thor

68f260e807ef9816_gizcrygc-7am0-f7er-2057-d872d31a03ca.thor

f083a0e1bd9f20cf_gizcrygc-7am0-f7er-eca3-3f5180aecca7.thor

e371ed23da1ba3c3_gizcrygc-7am0-f7er-e538-9b61ce96c645.thor

b02adab1913cc2e4_gizcrygc-7am0-f7er-3128-4c4f8dc88a5b.thor

b480a27ed1aee2c0_gizcrygc-7am0-f7er-c4de-0bd99c87aefc.thor

890f23e49f4856ef_gizcrygc-7am0-f7er-e01c-722ab7c025a2.thor

f310e277d37d9f75_gizcrygc-7am0-f7er-747a-8cf7afda55ec.thor

80ad402885e6ccd0_gizcrygc-7am0-f7er-edb7-0337bc3bcfe4.thor

fdb0fca0c72a7838_gizcrygc-7am0-f7er-5cdd-628aedf5fb1d.thor

3f7d1d812dba9593__52_what_is.html

14145fe30f1d40f2_gizcrygc-7am0-f7er-2e38-0dce8d0fdf7e.thor

1aa7df88ef1a5bae_gizcrygc-7am0-f7er-c9d4-ec217e42ff75.thor

8931d34acc2d60b8_behavior.xml

714cd9a3aa4ce5c8_gizcrygc-7am0-f7er-cc12-cede4c02bedd.thor

c47e4dde015b63ca_gizcrygc-7am0-f7er-6b5b-96491dca3d7e.thor

23d96c589ae561e7_gizcrygc-7am0-f7er-9458-8f60800dfcf4.thor

1e4bdab9776af756_gizcrygc-7am0-f7er-2d74-03ed06c82da1.thor

098c2dbf6692b2fb_gizcrygc-7am0-f7er-1f42-0ac2d1f6a0d1.thor

04c24aae2787235a_gizcrygc-7am0-f7er-f1d2-851b66f50ffc.thor

fdb9c42e0166b5d5_gizcrygc-7am0-f7er-eff3-c992a30e72e4.thor

2082bd5b21e664a4_gizcrygc-7am0-f7er-d1c1-4cd8defba38a.thor

917fd5efbdeb1fe1_gizcrygc-7am0-f7er-c8db-c7efc541ab70.thor

47c193194fcd8bc1_gizcrygc-7am0-f7er-d85d-361ec7d41f17.thor

2b6531807cb126c6_gizcrygc-7am0-f7er-7110-c21d8b3b9664.thor

5fb95cf516220c2e_gizcrygc-7am0-f7er-75fc-b66de331d3c7.thor

48e04e6b88d8869e_gizcrygc-7am0-f7er-81ee-2995c3208ba2.thor

2f26f795fac82a5f_gizcrygc-7am0-f7er-deaa-cc10f8d0f9d0.thor

da0b8a16114de0e4_gizcrygc-7am0-f7er-e181-0ef51f4a1c1e.thor

3cb473d69ebd1b59_gizcrygc-7am0-f7er-3ae2-e54ead238de1.thor

6b687f4d3d40d020_gizcrygc-7am0-f7er-33d2-c109befc4b05.thor

50658c8d7fbc7682_gizcrygc-7am0-f7er-c9c3-ceaa92c7a72f.thor

b42875806f08303b_gizcrygc-7am0-f7er-4672-39a13ed11593.thor

1b6b4362d7488db4_gizcrygc-7am0-f7er-e9a5-4c065d7004e3.thor

00125feeea1e7f20_gizcrygc-7am0-f7er-8207-eb6e2e871cba.thor

625be98dc8e61f1b_gizcrygc-7am0-f7er-fbc3-44df147e5faa.thor

52858cfa20500ca2_gizcrygc-7am0-f7er-369c-527984992fea.thor

16a4d2b654609af8_gizcrygc-7am0-f7er-5257-eefbbe749a04.thor

fe7e391fd68cbfd4_gizcrygc-7am0-f7er-c9b9-dfdea049924d.thor

d71c1225ed964c4a_gizcrygc-7am0-f7er-9b2f-5cc2f2636aff.thor

b9a93209a351048d_gizcrygc-7am0-f7er-f0d8-73866dbc8a51.thor

7c1737759e60849a_gizcrygc-7am0-f7er-c005-c963dcbf18e9.thor

6e9514a7077102c7_gizcrygc-7am0-f7er-fd12-1bef3ff8c2c4.thor

ee2923d4e6be9b11_gizcrygc-7am0-f7er-0cf5-c01f8378d06c.thor

698a7fe3e75e8add_gizcrygc-7am0-f7er-ab0c-d1a7d5ae6aa3.thor

74504cd958dc8ffa_gizcrygc-7am0-f7er-bf48-779f18521f90.thor

c3975a4329d10a76_gizcrygc-7am0-f7er-15d1-e697f58ff4ac.thor

d1f92905e0852388_gizcrygc-7am0-f7er-fb1e-aaf04b8b8b16.thor

c3cc839469890096_gizcrygc-7am0-f7er-3ced-e4c85a12552d.thor

a2f17120a1526745_gizcrygc-7am0-f7er-fe2d-cf42a4ff03b1.thor

e879f3ff1f4a7a5b_gizcrygc-7am0-f7er-aab6-00727ca4d69f.thor

3c6906e7f8ddf85d_gizcrygc-7am0-f7er-8b18-6ecd0ffc71b7.thor

9a7020d621286591_gizcrygc-7am0-f7er-d1e0-671fa88e152f.thor

0ae35b5429a4aa2b_gizcrygc-7am0-f7er-62af-c67bd92cb38a.thor

3672fb776590eb9c_gizcrygc-7am0-f7er-2378-4950ef93bf17.thor

36fc33a8d01db6eb_gizcrygc-7am0-f7er-023c-19fd09504db2.thor

5b0b7d7d38624a06_gizcrygc-7am0-f7er-8b96-63335e9e4ba8.thor

9ebedd94177ef01a_gizcrygc-7am0-f7er-2ca1-e95eae7dca6b.thor

c201d543394c3567_gizcrygc-7am0-f7er-b075-11e000f0f019.thor

729cad085000f6d2_gizcrygc-7am0-f7er-feb1-6398c337ab6b.thor

0e69b91e4c88ce58_gizcrygc-7am0-f7er-7432-89daa1121f54.thor

656616dfd42a6948_gizcrygc-7am0-f7er-3e1d-e2fa55593d94.thor

7f4b0c16b3e5de90_gizcrygc-7am0-f7er-4faa-1fda212cb880.thor

39675a0e48feb1bd_gizcrygc-7am0-f7er-bd9c-8c29644405a2.thor

f5bad2c5e93d9621_gizcrygc-7am0-f7er-4594-f5764624a7f1.thor

1a7ae3f7edf46ada_gizcrygc-7am0-f7er-0dcb-28fdea6397cd.thor

d9220b4c682675e9_gizcrygc-7am0-f7er-8ced-294d41324e99.thor

051b45c6a172e5d1_gizcrygc-7am0-f7er-0aaf-505d02fe5d21.thor

06e48f8234a4296a_gizcrygc-7am0-f7er-cfce-00b054fe5e35.thor

f213274086917033_gizcrygc-7am0-f7er-51d2-f7ea4d0b5c49.thor

cf8c93e4eee9e4fb_gizcrygc-7am0-f7er-8534-61740811d942.thor

f0572b5708c83015_behavior.xml

82639e28a792a8de_gizcrygc-7am0-f7er-1115-774efc0f6183.thor

84863718ee65d6e2_gizcrygc-7am0-f7er-3b67-f56b0e1123c2.thor

fa90792c3038fd53_gizcrygc-7am0-f7er-8578-a921a90d6c04.thor

1aff978884913fc3_gizcrygc-7am0-f7er-81fe-967e93140ab0.thor

ae53e6140dedf6b5_gizcrygc-7am0-f7er-e683-8b04becbcf48.thor

7cf36e1961dd1ff2_gizcrygc-7am0-f7er-8723-219b6695bf40.thor

63a67345ed172388_gizcrygc-7am0-f7er-3a31-35539a98be43.thor

39e79c5f9ade88e9_gizcrygc-7am0-f7er-9712-d54572e115c8.thor

01561949c3b80449_gizcrygc-7am0-f7er-f78d-53b203bb81bb.thor

7b758733e57247ab_gizcrygc-7am0-f7er-6941-64c4c3f36e87.thor

73ab732b44d0da07_gizcrygc-7am0-f7er-d418-1cc309d52b54.thor

0e3e4b31c20f4e5d_gizcrygc-7am0-f7er-1141-7f510fcf72de.thor

d0d9ceddd8b737f3_gizcrygc-7am0-f7er-cdb6-33a81b24c547.thor

b275c95376bbb568_gizcrygc-7am0-f7er-1955-50300229d10e.thor

ae250d6a4c74a117_gizcrygc-7am0-f7er-a0f3-5e25ef2db9ef.thor

2d7d6e86f4c72445_gizcrygc-7am0-f7er-3774-d60f28ee90fa.thor

7dcabb751f51c5af_gizcrygc-7am0-f7er-3343-a40f4b979f57.thor

934305d8cd9e6ad4_gizcrygc-7am0-f7er-4af5-6751dfbb5b3f.thor

008d8a3df5668234_gizcrygc-7am0-f7er-0764-87754a8c36a5.thor

d3b2b7f57219ce24_gizcrygc-7am0-f7er-ebff-b8e9ae66bbbb.thor

180aaefafae576b3_gizcrygc-7am0-f7er-2bc7-2ffaeb500739.thor

9fad5a79470faa24_gizcrygc-7am0-f7er-1ca1-2988b11fec05.thor

d745c74a47a65309_gizcrygc-7am0-f7er-9061-933e53a94aec.thor

2e7ab7067cbdec3c_gizcrygc-7am0-f7er-5956-b076d2bb2d32.thor

7bafde9a1f0da088_gizcrygc-7am0-f7er-1736-3e465d2a8602.thor

38006099fa45f1bc_gizcrygc-7am0-f7er-e80c-8277c19a7fff.thor

8172c66509404ffb_gizcrygc-7am0-f7er-f643-238b4406f2b0.thor

05ceb9a1350dc01b_gizcrygc-7am0-f7er-34ff-7f56ed398069.thor

5de095ebabca3041_gizcrygc-7am0-f7er-5398-23a7a7c9b450.thor

b177e7876bcd5dd9_gizcrygc-7am0-f7er-1f4e-2bd51555fa8d.thor

3b9bc68a6c8856d7_gizcrygc-7am0-f7er-0c95-ce168832f328.thor

5f97d20573597cf7_gizcrygc-7am0-f7er-d423-2132ae725bf8.thor

909541bba8caa6cf_gizcrygc-7am0-f7er-689b-4e0e103cc32b.thor

3ac5987ab6dae668_gizcrygc-7am0-f7er-bf2a-629ed05f00a0.thor

ccacac747fb0d71c_gizcrygc-7am0-f7er-7653-e18b8175e55a.thor

2a7ed1b5846fa6bf_gizcrygc-7am0-f7er-bcff-6a154a6833e9.thor

b42bbc81a682b13e_gizcrygc-7am0-f7er-ac5f-1c8aa108b64c.thor

d04f0e8a837a7114_gizcrygc-7am0-f7er-3c7f-451f6a1dd4e0.thor

5b02dc35973ae0f5_gizcrygc-7am0-f7er-a13c-aca9c72455e6.thor

6d3c8d7ea3e0d305_gizcrygc-7am0-f7er-6991-d80c5fabeca4.thor

760bfd071b0abd1f_gizcrygc-7am0-f7er-1f36-be5db4d644de.thor

80639ab4f9a6982b_gizcrygc-7am0-f7er-6be6-f57d3cf89622.thor

42bd090aa2c81222_gizcrygc-7am0-f7er-3b1a-0a5ad1a6a14f.thor

8e5acc5442d19a50_gizcrygc-7am0-f7er-1cb7-70a3f75bffa0.thor

a88345c9c1c8ae76_gizcrygc-7am0-f7er-de22-ae9376137b8f.thor

6c1a67baf5a62d1f_gizcrygc-7am0-f7er-f6dd-d99931f48c14.thor

b264e35e49eb5912_gizcrygc-7am0-f7er-3630-1baea1e3270f.thor

875a3a1cbc9d5f30_gizcrygc-7am0-f7er-7554-e661de66dc8d.thor

75e2e6ab2ff2732f_gizcrygc-7am0-f7er-8f67-92ef87b22bb3.thor

919284d0c95cd43b_gizcrygc-7am0-f7er-1bb8-f3a472a39939.thor

5cc40304fec1bad0_gizcrygc-7am0-f7er-166c-01432d60b857.thor

79d4121c1286129c_w8emvfiw5muw9ce.dll

3c50d9c028b9a7bd_gizcrygc-7am0-f7er-1265-55c95e6b641d.thor

c3f5c4f4a7dc4f3c_gizcrygc-7am0-f7er-3008-dc2b5d63c009.thor

NRV_6208P0O_.js

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

Behavior Summary

File-Read
  • C:\Users\Harry Dresden\Desktop\desktop.ini
  • C:\Windows\System32\wshom.ocx
  • C:\Windows\System32\wscript.exe
  • C:\Windows\System32\msxml3.dll
  • C:\Users\Harry Dresden\AppData\Local\Temp\NRV_6208P0O_.js
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\email\test\data\msg_45.txt
  • c:\Python27\Lib\email\test\data\msg_06.txt
  • c:\Python27\include\ast.h
  • c:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml
  • c:\Python27\include\pyexpat.h
  • c:\Python27\include\tupleobject.h
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml
  • c:\Python27\include\descrobject.h
  • c:\Python27\Lib\test\cjkencodings\iso2022_kr.txt
  • c:\Python27\Lib\test\cjkencodings\gb2312.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Python27\include\grammar.h
  • c:\Python27\include\import.h
  • \\?\PIPE\browser
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\bUzwpeuMLy.docm
  • c:\Python27\Lib\email\test\data\msg_30.txt
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1032\LocalizedData.xml
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\Python27\Lib\email\test\data\msg_36.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\Python27\Lib\test\cjkencodings\johab.txt
  • c:\Python27\Lib\idlelib\TODO.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\Python27\include\marshal.h
  • c:\Python27\Lib\email\test\data\msg_23.txt
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\Python27\Lib\email\test\data\msg_19.txt
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\GZkcgEMrcrSxNJmVuq.doc
  • c:\Python27\Lib\idlelib\extend.txt
  • c:\Python27\Lib\test\badcert.pem
  • c:\Python27\Lib\test\cjkencodings\euc_kr.txt
  • c:\Python27\include\pgen.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • c:\Python27\Lib\test\floating_points.txt
  • c:\Python27\include\memoryobject.h
  • c:\Python27\include\objimpl.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\Python27\Lib\idlelib\idle_test\README.txt
  • c:\Python27\include\abstract.h
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\keycert.passwd.pem
  • c:\Python27\Lib\test\cjkencodings\gb18030-utf8.txt
  • c:\Python27\include\object.h
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • c:\Python27\Lib\test\cjkencodings\shift_jis.txt
  • c:\Python27\Lib\test\cjkencodings\euc_jisx0213.txt
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\VzNBcncYVdxOwMLR.rtf
  • c:\Python27\tcl\tclConfig.sh
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\Python27\include\pyport.h
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml
  • c:\Python27\include\code.h
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml
  • c:\Python27\Lib\test\exception_hierarchy.txt
  • c:\Python27\include\dtoa.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\Python27\include\asdl.h
  • c:\Python27\Lib\test\empty.vbs
  • c:\6cdeacda242012e0e5b593e657\1030\LocalizedData.xml
  • c:\ProgramData\Microsoft\IlsCache\ilrcache.xml
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.proofing.msi.16.en-us.xml
  • c:\Python27\include\complexobject.h
  • c:\Python27\Lib\email\test\data\msg_13.txt
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1031\LocalizedData.xml
  • c:\Python27\Lib\lib2to3\Grammar.txt
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • c:\Python27\include\pyctype.h
  • c:\Python27\Lib\email\test\data\msg_02.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • c:\Python27\Lib\test\nokia.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • c:\Python27\include\pydebug.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • c:\Python27\include\fileobject.h
  • c:\Python27\Lib\email\test\data\msg_11.txt
  • c:\Python27\include\enumobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\OrrYnElSfw.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\KIDSROOM\Users\Default\NTUSER.DAT.LOG
  • c:\Python27\include\pyfpe.h
  • c:\Python27\include\compile.h
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.en-us.xml
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml
  • c:\Python27\Lib\test\cjkencodings\shift_jisx0213-utf8.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • c:\Python27\include\cobject.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml
  • c:\Python27\Lib\test\cjkencodings\hz.txt
  • c:\Python27\Lib\email\test\data\msg_22.txt
  • c:\Python27\include\pgenheaders.h
  • c:\Python27\include\pythread.h
  • c:\Python27\Lib\email\test\data\msg_31.txt
  • c:\Python27\Lib\email\test\data\msg_14.txt
  • c:\Python27\Lib\email\test\data\msg_39.txt
  • c:\Python27\Lib\site-packages\setuptools\command\launcher manifest.xml
  • c:\Python27\Lib\email\test\data\msg_40.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\krHeCqiwNBwjB.pptx
  • c:\Python27\include\opcode.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • c:\6cdeacda242012e0e5b593e657\1038\LocalizedData.xml
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\en-us.16\MasterDescriptor.en-us.xml
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\Python27\include\moduleobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml
  • c:\Python27\Lib\email\test\data\msg_04.txt
  • c:\Python27\Lib\email\test\data\msg_25.txt
  • c:\Python27\include\boolobject.h
  • c:\Python27\Lib\email\test\data\msg_12.txt
  • c:\Python27\include\token.h
  • c:\Python27\include\bitset.h
  • c:\Python27\include\warnings.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\Python27\include\pycapsule.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Access.Access.x-none.msi.16.x-none.xml
  • c:\Python27\Lib\email\test\data\msg_27.txt
  • c:\Python27\Lib\idlelib\NEWS.txt
  • c:\Python27\Lib\email\test\data\msg_42.txt
  • c:\Python27\include\modsupport.h
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • c:\Python27\Lib\idlelib\help.txt
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml
  • c:\Python27\include\ucnhash.h
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\Lib\test\cjkencodings\cp949-utf8.txt
  • c:\Python27\Lib\email\test\data\msg_16.txt
  • c:\Python27\include\symtable.h
  • c:\Python27\include\node.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\Lib\idlelib\HISTORY.txt
  • c:\Python27\Lib\test\cjkencodings\iso2022_kr-utf8.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\Python27\Lib\test\cjkencodings\gb2312-utf8.txt
  • UNC\KIDSROOM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\Lib\email\test\data\msg_41.txt
  • c:\Python27\include\cStringIO.h
  • c:\Python27\Lib\test\cjkencodings\euc_jp.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml
  • c:\ProgramData\Sun\Java\Java Update\jaureglist.xml
  • c:\Python27\Lib\email\test\data\msg_29.txt
  • c:\Python27\Lib\email\test\data\msg_01.txt
  • \\?\PIPE\lsarpc
  • c:\Python27\include\metagrammar.h
  • c:\Python27\Lib\test\formatfloat_testcases.txt
  • c:\Python27\Lib\test\sha256.pem
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\PpBiuStYvQ.pptx
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml
  • c:\Python27\include\classobject.h
  • c:\mgqdvhhf\bin\cert.p12
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • c:\Python27\include\datetime.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • c:\6cdeacda242012e0e5b593e657\1028\LocalizedData.xml
  • c:\Python27\Lib\test\cjkencodings\hz-utf8.txt
  • c:\Python27\Lib\email\test\data\msg_18.txt
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml
  • c:\Python27\include\errcode.h
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info\top_level.txt
  • c:\Python27\Lib\test\keycert3.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Python27\Lib\email\test\data\msg_09.txt
  • c:\Python27\include\pyerrors.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml
  • c:\Python27\include\Python-ast.h
  • c:\Python27\Lib\email\test\data\msg_21.txt
  • c:\Python27\include\ceval.h
  • c:\Python27\Lib\lib2to3\PatternGrammar.txt
  • c:\Python27\Lib\email\test\data\msg_07.txt
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\structmember.h
  • c:\Python27\Lib\idlelib\README.txt
  • c:\Python27\include\pygetopt.h
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\Python27\include\codecs.h
  • c:\Python27\Lib\email\test\data\msg_10.txt
  • c:\Python27\Lib\email\test\data\msg_33.txt
  • c:\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • c:\Python27\include\patchlevel.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\Python27\include\bytes_methods.h
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • c:\Python27\Lib\test\cjkencodings\cp949.txt
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\longintrepr.h
  • c:\Python27\Lib\email\test\data\msg_17.txt
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml
  • c:\Python27\Lib\test\cjkencodings\shift_jis-utf8.txt
  • c:\Python27\include\Python.h
  • c:\Python27\Lib\email\test\data\msg_34.txt
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\entry_points.txt
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\Python27\Lib\test\cjkencodings\iso2022_jp-utf8.txt
  • c:\Python27\include\pystate.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\Lib\test\ieee754.txt
  • c:\Python27\Lib\test\cjkencodings\shift_jisx0213.txt
  • c:\Python27\include\pyconfig.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • c:\Python27\include\pymacconfig.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\ywNEqBZqwLoNlJ.docx
  • c:\Python27\include\bufferobject.h
  • c:\Python27\include\timefuncs.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\zCZxIAYaZFk.pptx
  • c:\Python27\Lib\email\test\data\msg_37.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\floatobject.h
  • c:\Python27\Lib\email\test\data\msg_26.txt
  • c:\Python27\Lib\test\pycacert.pem
  • c:\Python27\Lib\test\badkey.pem
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • c:\Python27\Lib\test\cjkencodings\big5.txt
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\top_level.txt
  • c:\6cdeacda242012e0e5b593e657\1036\LocalizedData.xml
  • c:\Python27\Lib\test\cjkencodings\euc_jp-utf8.txt
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.publishermui.msi.16.en-us.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • c:\Python27\Lib\email\test\data\msg_35.txt
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmui.msi.16.en-us.xml
  • c:\6cdeacda242012e0e5b593e657\1033\LocalizedData.xml
  • c:\Python27\Lib\test\185test.db
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • UNC\KIDSROOM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\Lib\email\test\data\msg_05.txt
  • c:\Python27\Lib\email\test\data\msg_08.txt
  • c:\Python27\include\eval.h
  • c:\Python27\Lib\email\test\data\msg_15.txt
  • c:\Python27\Lib\site-packages\README.txt
  • c:\Python27\include\genobject.h
  • c:\6cdeacda242012e0e5b593e657\1029\LocalizedData.xml
  • c:\Python27\Lib\test\cjkencodings\big5hkscs.txt
  • c:\Python27\Lib\email\test\data\msg_28.txt
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\parsetok.h
  • c:\Python27\include\osdefs.h
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\lbgPTTIlNqwb.pptx
  • c:\6cdeacda242012e0e5b593e657\1025\LocalizedData.xml
  • \\?\PIPE\wkssvc
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\Python27\include\pymem.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\Python27\include\pyarena.h
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\Python27\Lib\email\test\data\msg_46.txt
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\Python27\include\rangeobject.h
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\include\iterobject.h
  • c:\Python27\include\funcobject.h
  • c:\Python27\include\listobject.h
  • c:\Python27\Lib\email\test\data\msg_44.txt
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\Python27\include\frameobject.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64ww.msi.16.x-none.xml
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\Python27\include\sliceobject.h
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\Lib\email\test\data\msg_43.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml
  • c:\Python27\include\stringobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\Python27\include\intobject.h
  • c:\Python27\Lib\email\test\data\msg_20.txt
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\Python27\Lib\test\cjkencodings\johab-utf8.txt
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemuiset.msi.16.en-us.xml
  • c:\Python27\include\methodobject.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\include\structseq.h
  • c:\Python27\Lib\test\cmath_testcases.txt
  • c:\Python27\Lib\test\cjkencodings\gb18030.txt
  • c:\Python27\include\pymath.h
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\Lib\email\test\data\msg_32.txt
  • c:\Python27\Lib\email\test\data\msg_24.txt
  • c:\6cdeacda242012e0e5b593e657\1037\LocalizedData.xml
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • c:\Python27\Lib\test\keycert2.pem
  • c:\Python27\include\py_curses.h
  • c:\ProgramData\WebEx\WebEx\atsdk.xml
  • c:\Python27\Lib\test\cjkencodings\gbk-utf8.txt
  • c:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml
  • c:\Python27\include\setobject.h
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml
  • c:\Python27\Lib\test\cjkencodings\big5-utf8.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\Lib\test\cjkencodings\gbk.txt
  • c:\Python27\include\graminit.h
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\dependency_links.txt
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • c:\6cdeacda242012e0e5b593e657\1035\LocalizedData.xml
  • c:\Python27\include\bytearrayobject.h
  • c:\Python27\Lib\email\test\data\msg_12a.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml
  • UNC\KIDSROOM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\Python27\Lib\idlelib\CREDITS.txt
  • c:\Python27\include\dictobject.h
  • c:\Python27\Lib\test\cjkencodings\big5hkscs-utf8.txt
  • c:\Python27\include\intrcheck.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml
  • c:\Python27\Lib\email\test\data\msg_38.txt
  • c:\Python27\Lib\test\cjkencodings\euc_kr-utf8.txt
  • c:\ProgramData\Microsoft\IlsCache\imcrcache.xml
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64mui.msi.16.en-us.xml
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\53955D98-F46F-4906-AE49-9B6F52BA18A9\x-none.16\MasterDescriptor.x-none.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • c:\Python27\Lib\test\dh1024.pem
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64muiset.msi.16.en-us.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\nfKljNpPmwf.pptx
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmuiset.msi.16.en-us.xml
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info\entry_points.txt
  • c:\Python27\include\weakrefobject.h
  • c:\Python27\Lib\idlelib\idle.bat
  • c:\Python27\include\unicodeobject.h
  • c:\Python27\include\cellobject.h
  • c:\Python27\Lib\test\cjkencodings\iso2022_jp.txt
File-Written
  • C:\Users\Harry Dresden\AppData\Local\Temp\W8EmvFIw5muw9ce.dll
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YLC2QM2Y\6sbdh[1]
  • c:\Python27\Lib\email\test\data\msg_02.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • c:\6cdeacda242012e0e5b593e657\1033\_25_WHAT_is.html
  • c:\Python27\Lib\email\test\data\msg_45.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64ww.msi.16.x-none.xml
  • c:\Python27\include\ast.h
  • c:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml
  • c:\Python27\include\pyexpat.h
  • c:\Python27\include\tupleobject.h
  • c:\Python27\tcl\tix8.4.3\pref\_29_WHAT_is.html
  • c:\Python27\include\descrobject.h
  • c:\Python27\Lib\test\cjkencodings\iso2022_kr.txt
  • c:\ProgramData\WebEx\WebEx\12_1324\_19_WHAT_is.html
  • c:\Python27\Lib\test\cjkencodings\gb2312.txt
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\GIZCRYGC-7AM0-F7ER-33D2-C109BEFC4B05.thor
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Python27\include\grammar.h
  • c:\Python27\include\import.h
  • \\?\PIPE\browser
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\bUzwpeuMLy.docm
  • c:\Python27\Lib\email\test\data\msg_30.txt
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\Python27\Lib\test\nullcert.pem
  • c:\6cdeacda242012e0e5b593e657\1032\LocalizedData.xml
  • c:\Python27\include\complexobject.h
  • c:\6cdeacda242012e0e5b593e657\1044\_9_WHAT_is.html
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\Python27\Lib\email\test\data\msg_36.txt
  • c:\Python27\include\_3_WHAT_is.html
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\_42_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\Python27\Lib\test\cjkencodings\johab.txt
  • c:\Python27\Lib\idlelib\TODO.txt
  • c:\6cdeacda242012e0e5b593e657\2070\_16_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\_5_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1055\_14_WHAT_is.html
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\Python27\include\marshal.h
  • c:\Python27\Lib\email\test\data\msg_23.txt
  • UNC\KIDSROOM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\6cdeacda242012e0e5b593e657\1046\_11_WHAT_is.html
  • c:\Python27\Lib\email\test\data\msg_19.txt
  • UNC\KIDSROOM\Users\Harry Dresden\Desktop\GZkcgEMrcrSxNJmVuq.doc
  • c:\Python27\Lib\idlelib\extend.txt
  • c:\Python27\Lib\test\badcert.pem
  • c:\Python27\Lib\test\cjkencodings\euc_kr.txt
  • c:\Python27\include\pgen.h
  • UNC\KIDSROOM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • c:\Python27\Lib\test\floating_points.txt
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\Python27\include\objimpl.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml
  • UNC\KIDSROOM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\6cdeacda242012e0e5b593e657\1032\_24_WHAT_is.html
  • c:\Python27\Lib\idlelib\idle_test\README.txt
  • c:\6cdeacda242012e0e5b593e657\1040\_5_WHAT_is.html
  • c:\Python27\include\abstract.h
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\keycert.passwd.pem
  • c:\Python27\Lib\test\cjkencodings\gb18030-utf8.txt
  • c:\Python27\include\object.h
  • c:\Python27\Lib\idlelib\_31_