'
metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2016-11-08 12:39:33.583818 2016-11-08 12:43:01.366432 207 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo win7 Clone 1 VirtualBox 2016-11-08 12:39:34 2016-11-08 12:43:01

File Details

File name dee17605bc3cabd333553c84ccae6a748f4d901c.zip
File size 1104 bytes
File type Zip archive data, at least v2.0 to extract
CRC32 D9790AF6
MD5 db6fab2b0015ea1baeaa0985dee6b1ad
SHA1 dee17605bc3cabd333553c84ccae6a748f4d901c
SHA256 f3a364446442cd0532bb67133bd012a1e1466aaa6a330217f32b8ba86d088675
SHA512 57bae7b4bfdc95674b1b57dd72cfe2770c98c6720423c7cc5281288090bfb4af084f53c0b240ca6c2e56e916efcdb3c18d9062a340baa38b6bb06ceb5b461955
Ssdeep 24:9yRCNrKbnpLV8gmOe7reCN8z7ept6WWJLmWMjV1VCDDRyB:9yRC5E77mTreLtJ65jV1wRS
PEiD None matched
Yara
  • PM_Zip_with_js ()
VirusTotal Permalink
VirusTotal Scan Date: 2016-11-08 12:12:56
Detection Rate: 8/55 (Expand)

MetaFlows Scores

Metaflows Analysis Results (Signatures=125, Anomalies=0, PEiD=0, Yara=2, VT[1478609003]=100): Snort Events=3, AV Events=2
Total Score=125

SNORT EVENTS:
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
ET POLICY PE EXE or DLL Windows file download HTTP
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

CLAMAV DETECTED:
Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND
DROPPED FILE - NRV_NI001_.js: Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND

Dropped File/Buffer Yara Signatures:
7220f1a13ec0865c040fcdef3960162ba58aa34e [BUFFER]: Str_Win32_Http_API

Signatures

antivm_queries_computername details
recon_fingerprint details
antivm_memory_available details
dumped_buffer details
creates_doc details
antivm_network_adapters details
dumped_buffer2 details
antivm_vbox_files details
Windows_Proxy_Tinkering details
network_wscript_downloader details
persistence_ads details
antiav_detectfile details
exploit_heapspray details
malicious_document_urls details
network_document_file details
network_downloader_exe details
antivm_vbox_devices details
antivm_vbox_files details
modifies_files details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

5058cf4209391438_076e35c0-5e29-6be8-c810-e0efa7a9d1b5.thor

0b5493d8da08f2da_076e35c0-5e29-6be8-9d93-20eb70b0f7df.thor

c5c775ab9520375a_076e35c0-5e29-6be8-3489-ec745b8367b4.thor

c83acd19bdcdb8ed_076e35c0-5e29-6be8-71b3-db5743248bdf.thor

b668982086399966_076e35c0-5e29-6be8-b991-1fb4233bd2fd.thor

fc81619197a69ceb_076e35c0-5e29-6be8-572b-7bf80e80064f.thor

aadfa3ec7ab368e6_076e35c0-5e29-6be8-afe8-011ec1b06433.thor

3d19acdb2e38480f_076e35c0-5e29-6be8-7a39-69e6758d3608.thor

b80a3507063e5a27_076e35c0-5e29-6be8-c22a-f4811127965a.thor

56d7942d153d7578_076e35c0-5e29-6be8-815c-39a2e4a4ebe8.thor

faf021b3c06abc41_tasks.xml

77797369d744e5e7_076e35c0-5e29-6be8-13e8-00adba3be6be.thor

2471a0c5ee2a7363_076e35c0-5e29-6be8-77b3-3b88363fd99a.thor

e644a0c148a3b255_076e35c0-5e29-6be8-43d2-8ed5da14968d.thor

2d09d0352ee84891_076e35c0-5e29-6be8-20d9-362fc2374234.thor

a0102ca2014d0b49_076e35c0-5e29-6be8-e55b-a225092dcb97.thor

d269fdacc5cd69b7_076e35c0-5e29-6be8-f79e-b1f59cf94fcb.thor

60f76824c6380c2b_076e35c0-5e29-6be8-784f-5d6d856ed42a.thor

8c59d5cfbc256305_076e35c0-5e29-6be8-4ca4-bd3344a09c1a.thor

81b0749ac5e92616_076e35c0-5e29-6be8-299c-386fc2f7834e.thor

d5e77571d8b9087f_076e35c0-5e29-6be8-03bd-be2fbdff8e44.thor

56e27a38b21c5936_076e35c0-5e29-6be8-c047-a87c95317d5d.thor

4df4034e6173aa99_076e35c0-5e29-6be8-9afc-4636767da167.thor

5c19ac097c6409ac_076e35c0-5e29-6be8-ceb3-44b36c349ee9.thor

b913b186a2272a02_076e35c0-5e29-6be8-b697-da5c111045d1.thor

034b4f4f3eb45a66_076e35c0-5e29-6be8-a64c-9015d975684c.thor

7e1bbace87e6b62b_076e35c0-5e29-6be8-3ba0-2fe504feb4c7.thor

12dda9f59f8034a1_076e35c0-5e29-6be8-9177-cd24a7f5cc6a.thor

9e3552f718276888_076e35c0-5e29-6be8-0d38-f0a221a3abb7.thor

fd5f68b59aa2b3e8_resource.xml

7f0a75ec58c006f8_076e35c0-5e29-6be8-8310-65ba45ae2cfb.thor

77d26ff9ac837410_076e35c0-5e29-6be8-b436-c4eaeab8eaa6.thor

76481bc1761e6df5_076e35c0-5e29-6be8-6565-719ff5c0d5eb.thor

ff20432cfd45eabe_076e35c0-5e29-6be8-a263-6669ec355d8c.thor

3284937bc9f4ca2a_076e35c0-5e29-6be8-9ba3-04380061eed2.thor

fff374b5082a473d_076e35c0-5e29-6be8-b41b-32458404c782.thor

a1010557d9454062_076e35c0-5e29-6be8-2a6e-ad21fa680536.thor

d9963679f9ab1983_076e35c0-5e29-6be8-08b7-7816afba20ad.thor

052a8180c5a6dc4e_076e35c0-5e29-6be8-b794-cf84155ddf0f.thor

af7a12135db48bf2_resource.xml

d983ffc1a183bcba_076e35c0-5e29-6be8-2f77-4c6be963d70d.thor

48e75605982c5b2c_076e35c0-5e29-6be8-52a3-f8e5388c1ec8.thor

93169537ed1bdb04_076e35c0-5e29-6be8-be0f-b17b3281cfe5.thor

99d48514243b93cb_076e35c0-5e29-6be8-10da-6890572afc3d.thor

4f2947cb22b95822_076e35c0-5e29-6be8-807a-a6070aab1588.thor

f23016f5e494025a_076e35c0-5e29-6be8-a29f-bf1a152d50ef.thor

5cd50630de7a4cad_076e35c0-5e29-6be8-1764-005fe7fab5c7.thor

ebf32e2695371c52_076e35c0-5e29-6be8-0942-8c925373abe4.thor

697f03f2578e9361_076e35c0-5e29-6be8-927f-b38c7a6eddb6.thor

cb9678c05d9375c6_076e35c0-5e29-6be8-f848-e4e36cc53779.thor

d6227be899998fc9_076e35c0-5e29-6be8-d1fc-2e8209fe232f.thor

e68caed551e59382_076e35c0-5e29-6be8-a8bc-753cd2706d91.thor

0763ab4f8ef42750_076e35c0-5e29-6be8-d9c1-d13bd35ef317.thor

c01f2cf6fc106255_076e35c0-5e29-6be8-922f-13c9b49cb314.thor

05c1dbb87f8fa966_076e35c0-5e29-6be8-f0e8-939f809a0a2d.thor

df78e07bec69c46a_076e35c0-5e29-6be8-6b54-325c854730dc.thor

0597d099838de939_076e35c0-5e29-6be8-576c-9bd149753220.thor

7e56332d1c896df6_076e35c0-5e29-6be8-f799-9a59d6516a4b.thor

207a008d733ac910_076e35c0-5e29-6be8-64ef-6cd6549b986e.thor

f50163824f74d84b_076e35c0-5e29-6be8-0377-b592a4b343a3.thor

18c64012d01c009f_076e35c0-5e29-6be8-d292-84effe9dd12a.thor

fd4c5bba2f29eb4a_076e35c0-5e29-6be8-90fa-5d9bdb7dd065.thor

86c05252eacc2b5d_tasks.xml

33f3ce235c96c6a2_076e35c0-5e29-6be8-3076-093d5c479d18.thor

bc5d7b795a2bad71_076e35c0-5e29-6be8-82ac-2fe4dc201354.thor

2894bc3ddb90fb5b_076e35c0-5e29-6be8-ea3f-ee31e42da607.thor

247139f087cdb58c_076e35c0-5e29-6be8-b403-047a5acc822e.thor

d6f653f76d91083a_076e35c0-5e29-6be8-9f5f-0b66271feccd.thor

65a29cd17b5aaa61_076e35c0-5e29-6be8-6095-dbfb8f32df17.thor

3fbd9129d5a52a0f_076e35c0-5e29-6be8-d19f-6d70e17c9030.thor

b081b49d7059e3fc_076e35c0-5e29-6be8-cf2b-44ade9499af0.thor

cac9d74b72bccb5c_076e35c0-5e29-6be8-7475-15d88a5e662c.thor

a39e3f2d97260c3a_076e35c0-5e29-6be8-0099-d4e2a3920eb3.thor

6638942abd118c95_076e35c0-5e29-6be8-04d9-fd1036991e4d.thor

9ad8a8e4b211c42a_076e35c0-5e29-6be8-b707-2cd35a7c159c.thor

6a6abb9ec9fce584_076e35c0-5e29-6be8-a303-b91ede5c64d4.thor

8a736e0db5b0bc80_u2iokw67olp.dll

a7375b7a80227039_076e35c0-5e29-6be8-121d-e6718164c0a3.thor

4d4f8a1811182cd7_076e35c0-5e29-6be8-f62f-dc560249a2b1.thor

32ae3f8cd394ab52_076e35c0-5e29-6be8-4399-a9d231517474.thor

0506d236325ab552_076e35c0-5e29-6be8-4814-4dc46650ac23.thor

e0b43b60e17389ef_076e35c0-5e29-6be8-7b64-3ad3f694cb52.thor

0017709c6162bf90__3_what_is.html

85992e8d1bbb046e_076e35c0-5e29-6be8-da0d-05bcdb99f5b9.thor

fb3206695c271b31_076e35c0-5e29-6be8-b06c-bf68d1535a86.thor

74bd893a67bb827e_076e35c0-5e29-6be8-a23d-eb65445c7947.thor

d39a5c3918c3e068_076e35c0-5e29-6be8-9a2d-879a039c539d.thor

bef4807a2296311d_076e35c0-5e29-6be8-c088-bdeb86988e09.thor

d56a9627ec3f0938_076e35c0-5e29-6be8-8da4-b3d5507d5ada.thor

d9b595339f6e0d59_076e35c0-5e29-6be8-7bc0-94f8e2dcee21.thor

c3836cc041f7b3b3_076e35c0-5e29-6be8-050b-767da507186e.thor

9dd6983614be0fc5_076e35c0-5e29-6be8-4a00-fb3498476b5b.thor

b8f75d5b871ea8e7_076e35c0-5e29-6be8-e4d8-9dd1c7f5f105.thor

dad4edf72a5e563d_076e35c0-5e29-6be8-95ed-46cbdeece61f.thor

c0cbaa2337b75bb4_076e35c0-5e29-6be8-df58-6b37a6da0376.thor

f37d8e111f677dea_076e35c0-5e29-6be8-0bd7-4dc21e476f6c.thor

d0685d6ea853c242_076e35c0-5e29-6be8-03bb-9588a1f9138b.thor

adbbb76309536cde_076e35c0-5e29-6be8-4334-d31dc3955146.thor

9af1b906e60c8f51_076e35c0-5e29-6be8-53b3-79905dae3916.thor

299014e11b4fa0eb_076e35c0-5e29-6be8-e6d0-1bd94e7f676e.thor

4d0e9a41c58b9884_076e35c0-5e29-6be8-b6bf-be9afa8ea382.thor

d41d1be8265cfb25_076e35c0-5e29-6be8-82da-ae1b50d6b7ce.thor

a85deef8d369b5aa_076e35c0-5e29-6be8-0f40-63eda4c4d499.thor

f7d98a951793b4ac_076e35c0-5e29-6be8-0499-7324862e5e47.thor

73431926a7242b3b_076e35c0-5e29-6be8-88e0-1de0079bc2bb.thor

3885fa6965796bea_076e35c0-5e29-6be8-1844-d504b014d557.thor

904d2bc799ccb33b_076e35c0-5e29-6be8-6e44-2b0c99049615.thor

2da26faf4544b3f9_076e35c0-5e29-6be8-7b14-4c3bbfab365f.thor

3d30831a02e87d88_076e35c0-5e29-6be8-92c4-97e55518dbae.thor

bae5552f5c996c32_076e35c0-5e29-6be8-b561-3ba7f72f699e.thor

8b272d4eab795ad0_076e35c0-5e29-6be8-abb6-61374b375615.thor

f75f1311242ac8f9_076e35c0-5e29-6be8-a8a1-8856e229fb72.thor

6091dd99929c74d0_076e35c0-5e29-6be8-4a69-9ed1dc376e77.thor

5c4053860b47481a_076e35c0-5e29-6be8-8b1c-e6eefc5cf2fd.thor

424c672a40b058b7_076e35c0-5e29-6be8-e7e7-82f0b64de3c3.thor

27c19ba0787d8cc5_076e35c0-5e29-6be8-f45a-e8d41f47e2b1.thor

6e936ace98be4902_076e35c0-5e29-6be8-6761-ac9147c71d37.thor

fc6f50cf3b769e2b_076e35c0-5e29-6be8-3ea9-7c324b00930c.thor

ed3aea742b12e641_076e35c0-5e29-6be8-2441-e112089a1720.thor

ff64299e0140e2d1_076e35c0-5e29-6be8-fc48-53a121e6c7a0.thor

12bf0cddbd6ca101_076e35c0-5e29-6be8-d2c8-17f536191a1d.thor

c2a744f73abde2de_076e35c0-5e29-6be8-4f86-11c9d8bd8d23.thor

22aaaafdc8b687cb_076e35c0-5e29-6be8-2150-3ba3814866ed.thor

95931c9655b03e59_076e35c0-5e29-6be8-72dd-0dbad1905167.thor

8a8ee287b915d354_076e35c0-5e29-6be8-5a2f-ecfc25310a4b.thor

cd4fa6369a96b518_076e35c0-5e29-6be8-a124-def6e59a09a5.thor

feac3703d65f6d2a_076e35c0-5e29-6be8-eb4b-f7c6f2e60d73.thor

05ce79fcec9025bc_076e35c0-5e29-6be8-d804-5902c60c928c.thor

91019288feb39363_076e35c0-5e29-6be8-4354-0c6bc76cedb3.thor

b35aa5aeab0015af_076e35c0-5e29-6be8-4a7f-dab91ec80f79.thor

8690e29018c14a9f_076e35c0-5e29-6be8-096d-c8de7d8626ca.thor

b99d2001ceff6a74_076e35c0-5e29-6be8-a3de-dfd6268e84a1.thor

ae604e1e28433264_076e35c0-5e29-6be8-15eb-e3b3f4e7ee44.thor

e44035b2eb130d27_076e35c0-5e29-6be8-ec92-5144807e97dd.thor

2c171c0885766318_076e35c0-5e29-6be8-4e63-069eb1807743.thor

49168e3aef6b4664_076e35c0-5e29-6be8-179e-e218b4122743.thor

b9e247ead47a1ac1_076e35c0-5e29-6be8-bb2e-363fd043c3a1.thor

4e547bed9d1cadb6_076e35c0-5e29-6be8-7801-a93c0ef597a5.thor

7797afc30a11528d_076e35c0-5e29-6be8-102b-207066f7aa3a.thor

86b178ac02338fe6_076e35c0-5e29-6be8-4910-e89cdbca8f69.thor

5912842649237c3f_076e35c0-5e29-6be8-18e3-0edbeecd81dc.thor

53f2a3cc7fde97b2_076e35c0-5e29-6be8-e179-f698a27c7fb0.thor

7d857ddacc1ead11_076e35c0-5e29-6be8-f52a-9c0e43604d80.thor

1b61765304dbee96_076e35c0-5e29-6be8-d813-024a9799b314.thor

7543664831b8a8d4_076e35c0-5e29-6be8-14ba-4c5480b06668.thor

9f693d36f9b0dc85_076e35c0-5e29-6be8-a35f-0806873a24de.thor

ba9b6a965d19e091_076e35c0-5e29-6be8-b439-99e67400b537.thor

f326901bd0a8d798_076e35c0-5e29-6be8-abb2-d032391b6101.thor

9991aa248517c54c_076e35c0-5e29-6be8-b577-3852c2619e4c.thor

1554801c6a29ec2e_076e35c0-5e29-6be8-87e8-30585f7e9b8d.thor

1bfacf2ede4f064c_076e35c0-5e29-6be8-c347-d22b32bf3da1.thor

69eeb1cd6419b405_076e35c0-5e29-6be8-4c9a-715ea86dddce.thor

d7583e23ec0dd584_076e35c0-5e29-6be8-078e-7b102cef970e.thor

d0e283fc7f6a0f50_076e35c0-5e29-6be8-e835-6ad173fecd94.thor

93ed8f5a6534f08d_076e35c0-5e29-6be8-f205-016e0110d158.thor

3666a611433f89cc_076e35c0-5e29-6be8-bec1-bc618159f4fa.thor

9c80417344cc2dcd_076e35c0-5e29-6be8-5eb4-53398cd99b12.thor

66d8b91344be1b73_076e35c0-5e29-6be8-ad12-9c7cb57826fa.thor

ce706233bbd68e1f_076e35c0-5e29-6be8-d352-d5368cd0853c.thor

169d6ef1aa8819ea_076e35c0-5e29-6be8-7efb-3facd835604b.thor

c32bc477f76a75a1_076e35c0-5e29-6be8-29bf-433afe61494a.thor

92daae952584a9b2_076e35c0-5e29-6be8-7055-ca85cca9c31f.thor

0289b9e94835bda4_076e35c0-5e29-6be8-dffd-9d7d7d1a45d2.thor

104bfe8ecdeb69e8_076e35c0-5e29-6be8-385d-b477d4c6e7a1.thor

f1c5c43245de879a_076e35c0-5e29-6be8-a4bd-3ca2b5e4e10b.thor

8882861a1397bbd1_076e35c0-5e29-6be8-e914-b131a329f8f3.thor

66b262c60b817f71_076e35c0-5e29-6be8-5288-927813a11415.thor

eca457f468930091_076e35c0-5e29-6be8-202f-075ff6ba30b6.thor

8f6a072760621c56_076e35c0-5e29-6be8-dd10-10574f6638e7.thor

ec352ca5cd24d659_076e35c0-5e29-6be8-7c67-424334594973.thor

6a12a853a20e13bd_076e35c0-5e29-6be8-000f-4a14586642e3.thor

aab0664432b73622_076e35c0-5e29-6be8-01b3-24ea17d257e4.thor

c588d7d613ed59cb_076e35c0-5e29-6be8-fd17-ce40933d4d1b.thor

786a8d1f081412e1_076e35c0-5e29-6be8-f6b3-d6e5352c331d.thor

3c47311623122f77_076e35c0-5e29-6be8-24e2-2e2e0042245e.thor

e4d13ab53d467f19_076e35c0-5e29-6be8-a9e2-851eafefbe9d.thor

6d62655118b58c99_076e35c0-5e29-6be8-cff5-8a67b5944794.thor

a038b424409079fd_076e35c0-5e29-6be8-34d5-155eb0814f97.thor

553af03cbfce0d9c_076e35c0-5e29-6be8-fbbd-24083b7f1126.thor

8931d34acc2d60b8_behavior.xml

dea1e444ca3925c0_076e35c0-5e29-6be8-3681-8480cf420ddf.thor

29bd8a0773936c43_076e35c0-5e29-6be8-e531-a07daa11b5f5.thor

8e754978d171380d_076e35c0-5e29-6be8-7e5e-f792fad03822.thor

e5860ab4efa40cac_076e35c0-5e29-6be8-0c5b-1614b98d830a.thor

6e8104d2f9b47756_076e35c0-5e29-6be8-e032-7afbcf1e1058.thor

9d815b61c667aeec_076e35c0-5e29-6be8-2c6c-4655dfe88480.thor

efb2306d64085f0a_076e35c0-5e29-6be8-7550-769f18c8c5f8.thor

5a64f5631d6f15ca_076e35c0-5e29-6be8-280c-4cecf6f6ef3d.thor

daf15c55e7d9615a_076e35c0-5e29-6be8-fc84-efc658b5a390.thor

cc3d0aa76b3503e9_076e35c0-5e29-6be8-7d09-16304783e12c.thor

7c8910c124691e18_076e35c0-5e29-6be8-805d-f4695bb76c83.thor

33cd663cce94a08d_076e35c0-5e29-6be8-0af1-f2b378cd4d33.thor

4bf9a6c560673024_076e35c0-5e29-6be8-cc0d-16a0073090e6.thor

0f42f0dd4f923b2a_076e35c0-5e29-6be8-c554-753b2620dd67.thor

be2ee7c8dac9bc31_076e35c0-5e29-6be8-c4c9-a5b901798aa8.thor

c4a6e4175562af2b_076e35c0-5e29-6be8-7882-662148fdef51.thor

0b7c1a4ff8c1b7c6_076e35c0-5e29-6be8-6efd-117573186b24.thor

5cdd0ea8935de73f_076e35c0-5e29-6be8-cc68-4fce0ec4e187.thor

358eaef5c2e27b3a_076e35c0-5e29-6be8-8a0d-7c7f796d4bda.thor

c41a77a7181f5dad_076e35c0-5e29-6be8-81c1-438758376d52.thor

564cba855052995b_076e35c0-5e29-6be8-920c-3a9400423c6f.thor

c0a1e09c7137f842_076e35c0-5e29-6be8-a9b2-3ca4044b57c0.thor

7573e6639fd50083_076e35c0-5e29-6be8-a985-836c95711278.thor

fba40ff518b69bb7_076e35c0-5e29-6be8-343a-482b4b005625.thor

9694b04f94eae4a0_076e35c0-5e29-6be8-20ed-69ad2a0d4f30.thor

b74a68aec3d7659c_076e35c0-5e29-6be8-87d3-af27349c0a9a.thor

925d53e86193b8ac_076e35c0-5e29-6be8-963d-458e490f6dee.thor

5ddc3e84706944bd_076e35c0-5e29-6be8-4169-c6bf2764bb98.thor

4893c2049f22eaa9_076e35c0-5e29-6be8-46c0-81d7552b291f.thor

ab40cfaf2c115e88_076e35c0-5e29-6be8-ea19-8a15ec03f8bf.thor

ee42123fee2ff2e8_076e35c0-5e29-6be8-51f1-0c706b3260d2.thor

222edfbe68954993_076e35c0-5e29-6be8-f225-d47b2da39b91.thor

af175bf587ab84d7_076e35c0-5e29-6be8-82a8-70e7cd5afd36.thor

73d1d466c7162cfc_076e35c0-5e29-6be8-5de7-6e32f8e4b4e2.thor

768c86834b7a1dcd_076e35c0-5e29-6be8-2a28-a98bd372a879.thor

bed18ea1fe87841e_076e35c0-5e29-6be8-e3d6-94861e361d6f.thor

31b3b37a301d584c_076e35c0-5e29-6be8-5250-1b1a65cc8f8b.thor

067b823e8db627ec_076e35c0-5e29-6be8-335e-3be996c7c8e4.thor

2a606baef8de7975_076e35c0-5e29-6be8-c569-0c543ccf3166.thor

c58c2bd7ee8ad320_076e35c0-5e29-6be8-8666-f761eb1dd671.thor

f0572b5708c83015_behavior.xml

704d195f8efc744d_076e35c0-5e29-6be8-96cb-d186ad56c188.thor

f8832bf45c258180_076e35c0-5e29-6be8-47c0-5f19a3ef962a.thor

d7b81d074f3903ac_076e35c0-5e29-6be8-2cdb-03ea2a4a2977.thor

e70ebf36df284f45_076e35c0-5e29-6be8-5e51-14c1bd0a6b5a.thor

c2ef1efa3b17b73a_076e35c0-5e29-6be8-5288-7aad2cd425a1.thor

3df257ac9871f132_076e35c0-5e29-6be8-8dba-b168132e9770.thor

bdbff1fe2e5824aa_076e35c0-5e29-6be8-d300-ceb14c0c48df.thor

b94f1e13b3bd7373_076e35c0-5e29-6be8-f6b3-fc37b2e08762.thor

6ddb526465978512_076e35c0-5e29-6be8-568d-97aa77b9be50.thor

6ab245322059e767_076e35c0-5e29-6be8-a2bc-940dc8bad2d0.thor

2b79af9b538cdeb9_076e35c0-5e29-6be8-c6f6-9b1d8fe8fc51.thor

e5c7b926d52dc39f_076e35c0-5e29-6be8-8261-3bf5a39dc43e.thor

4a879dcc2b46fcdd_076e35c0-5e29-6be8-004c-830dec2e157e.thor

66f91af3ead2a3ba_076e35c0-5e29-6be8-0e2b-6cf6adebbaf2.thor

fa086bc5ce1db871_076e35c0-5e29-6be8-b019-98a9f3a86726.thor

7bdf76bd141e0980_076e35c0-5e29-6be8-d747-e5aa0febbbda.thor

35c393cc0364d579_076e35c0-5e29-6be8-6353-860797c1dedd.thor

11b953c5ae0987d5_076e35c0-5e29-6be8-9705-1c941889e69e.thor

7856618e77167c1b_076e35c0-5e29-6be8-e720-400948e1155e.thor

dde82902eb0afa50_076e35c0-5e29-6be8-85c6-160480dec168.thor

f750a1609869df01_076e35c0-5e29-6be8-b54c-19aaf16dd521.thor

ef55b9feab47d7ea_076e35c0-5e29-6be8-97ad-d0a775b5ddba.thor

f050dc32b763a75b_076e35c0-5e29-6be8-5d66-2319a489619e.thor

c2c0e4ca2028c249_076e35c0-5e29-6be8-b92a-e0de89857cc0.thor

1e76fa750bc3a415_076e35c0-5e29-6be8-3755-9103c2166f6d.thor

80e54838c8230f0b_076e35c0-5e29-6be8-91dc-2fe8fb9ff7fd.thor

c3848c4f93853328_076e35c0-5e29-6be8-3c11-454fdc5e2cb9.thor

c92885c734e41c29_076e35c0-5e29-6be8-f12a-5164c379dd69.thor

23ddf118fc9ec2d1_076e35c0-5e29-6be8-93b7-c293a29a04cd.thor

bd7a1a82e933bb62_076e35c0-5e29-6be8-39d1-8c3438146094.thor

4ac5f5e6ca400a8a_076e35c0-5e29-6be8-7249-f0c1e5778935.thor

790a541b1a178c65_076e35c0-5e29-6be8-2d07-de7890f731ec.thor

bfd9308ee91bfa6e_076e35c0-5e29-6be8-e51d-58a849e67651.thor

c47ade645b5ae1ea_076e35c0-5e29-6be8-b7a9-1984095c15af.thor

2d8d1c00e73b4e9f_076e35c0-5e29-6be8-e956-c2ab64526dce.thor

b550c04a869cd135_076e35c0-5e29-6be8-3615-6084dcf7a7bd.thor

bde59c19e9ab5387_076e35c0-5e29-6be8-9211-db2270996870.thor

bca7cc931013693c_076e35c0-5e29-6be8-6cab-703ace76385f.thor

81d01734dbe0e736_076e35c0-5e29-6be8-2247-3bc5446c0a2c.thor

7b33c60ede2f4e21_076e35c0-5e29-6be8-4297-8d13fdf908bb.thor

5cbd1d3f832b4153_076e35c0-5e29-6be8-2566-1b689fbfa72f.thor

897b08412a85f356_076e35c0-5e29-6be8-413b-9d3aa4f25c29.thor

d4ff3dfebe620bee_076e35c0-5e29-6be8-7165-b94640f8f15f.thor

8b3364a1f84c100d_076e35c0-5e29-6be8-729c-b9f6fea29536.thor

3ea2cadb960bc288_076e35c0-5e29-6be8-1841-5b10dd47b635.thor

61d845bef55e300a_076e35c0-5e29-6be8-a303-ec8c010e39d1.thor

3a8d3f7067d22bbb_076e35c0-5e29-6be8-0c08-43762d05daff.thor

6bfda870ac1e31d8_076e35c0-5e29-6be8-4d12-f0e62b9282ea.thor

6ec42d94be7a251d_076e35c0-5e29-6be8-b7b7-8417ef53d7a2.thor

a1677669a6c139c1_076e35c0-5e29-6be8-9b4f-06c991b3362d.thor

8fcc79770be5b43c_076e35c0-5e29-6be8-e393-5267dd3a959d.thor

7e0b489e88df76c0_076e35c0-5e29-6be8-9492-cdb449961979.thor

654a629046a25be3_076e35c0-5e29-6be8-6225-93a53fcd74e5.thor

6b190deae3843c62_076e35c0-5e29-6be8-8e9d-1908791c953f.thor

e5dd3c7e82ad5390_076e35c0-5e29-6be8-b66b-045e89720092.thor

2e35646dab5b71b4_076e35c0-5e29-6be8-0c30-e215418b8a6a.thor

0e971be4d204455b_076e35c0-5e29-6be8-77c3-a0c385d6ba18.thor

bbbbb6c716a173c0_076e35c0-5e29-6be8-99fd-09ad87fa0789.thor

NRV_NI001_.js

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

Behavior Summary

File-Read
  • C:\Users\Harry Dresden\Desktop\desktop.ini
  • C:\Windows\System32\wshom.ocx
  • C:\Users\Harry Dresden\AppData\Local\Temp\NRV_NI001_.js
  • C:\Windows\System32\wscript.exe
  • C:\Windows\System32\msxml3.dll
  • c:\Python27\Lib\email\test\data\msg_02.txt
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml
  • c:\Python27\include\pyexpat.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.en-us.xml
  • c:\Python27\include\errcode.h
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info\top_level.txt
  • c:\Python27\Lib\test\keycert3.pem
  • c:\Python27\include\ast.h
  • c:\Users\Harry Dresden\Desktop\ZpMpzwMDOgVRQtHk.rtf
  • c:\Python27\Lib\test\cjkencodings\big5hkscs.txt
  • c:\Python27\Lib\email\test\data\msg_28.txt
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\tupleobject.h
  • c:\Python27\include\parsetok.h
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml
  • c:\6cdeacda242012e0e5b593e657\1045\LocalizedData.xml
  • c:\Python27\include\pyerrors.h
  • c:\Python27\Lib\email\test\data\msg_19.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml
  • c:\Python27\include\descrobject.h
  • c:\Python27\include\Python-ast.h
  • c:\ndkhbmpia\bin\cert.p12
  • c:\Python27\Lib\email\test\data\msg_01.txt
  • c:\6cdeacda242012e0e5b593e657\1029\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1025\LocalizedData.xml
  • c:\Python27\include\pymacconfig.h
  • c:\6cdeacda242012e0e5b593e657\1055\LocalizedData.xml
  • c:\ProgramData\Microsoft\IlsCache\ilrcache.xml
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Python27\include\ceval.h
  • c:\Python27\Lib\lib2to3\PatternGrammar.txt
  • c:\Python27\include\grammar.h
  • c:\6cdeacda242012e0e5b593e657\1044\LocalizedData.xml
  • c:\Python27\include\import.h
  • c:\Python27\Lib\email\test\data\msg_07.txt
  • \\?\PIPE\browser
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\pymem.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\Python27\Lib\idlelib\README.txt
  • c:\Python27\include\pyarena.h
  • c:\Python27\include\pygetopt.h
  • c:\Python27\Lib\email\test\data\msg_30.txt
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\6cdeacda242012e0e5b593e657\1032\LocalizedData.xml
  • c:\Python27\Lib\email\test\data\msg_22.txt
  • c:\Python27\Lib\email\test\data\msg_10.txt
  • c:\Python27\Lib\email\test\data\msg_33.txt
  • c:\Python27\Lib\email\test\data\msg_12a.txt
  • c:\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\Python27\include\rangeobject.h
  • c:\Python27\include\pgenheaders.h
  • c:\Python27\Lib\email\test\data\msg_34.txt
  • c:\Python27\include\pythread.h
  • c:\6cdeacda242012e0e5b593e657\1038\LocalizedData.xml
  • c:\Python27\Lib\email\test\data\msg_31.txt
  • c:\Python27\include\patchlevel.h
  • c:\Python27\include\setobject.h
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\Lib\email\test\data\msg_24.txt
  • c:\Python27\include\iterobject.h
  • c:\Python27\Lib\test\cjkencodings\big5-utf8.txt
  • c:\Python27\Lib\test\cjkencodings\big5hkscs-utf8.txt
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • c:\Python27\Lib\email\test\data\msg_14.txt
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx40_IIS_schema_update.xml
  • c:\6cdeacda242012e0e5b593e657\UiInfo.xml
  • c:\Python27\include\funcobject.h
  • c:\Python27\include\listobject.h
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • c:\Python27\include\marshal.h
  • c:\Python27\Lib\email\test\data\msg_23.txt
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • c:\Python27\Lib\site-packages\setuptools\command\launcher manifest.xml
  • c:\Users\Harry Dresden\Desktop\KMrMrApicJ.rtf
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml
  • c:\Python27\include\frameobject.h
  • c:\Users\Harry Dresden\Desktop\bjHrgwpPSEDZJbS.pptx
  • c:\Python27\include\longintrepr.h
  • c:\Python27\Lib\email\test\data\msg_09.txt
  • c:\Python27\Lib\idlelib\extend.txt
  • c:\Python27\include\opcode.h
  • c:\Python27\Lib\email\test\data\msg_15.txt
  • c:\Python27\Lib\test\cjkencodings\big5.txt
  • c:\Python27\Lib\test\badcert.pem
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1033\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1043\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1046\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\include\sliceobject.h
  • c:\Python27\include\pgen.h
  • c:\Python27\include\memoryobject.h
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml
  • c:\Python27\include\moduleobject.h
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • c:\Python27\include\objimpl.h
  • c:\Python27\include\Python.h
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • c:\Python27\Lib\email\test\data\msg_04.txt
  • c:\Python27\include\stringobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\dependency_links.txt
  • c:\Python27\Lib\idlelib\idle_test\README.txt
  • c:\Python27\include\token.h
  • c:\Python27\include\bitset.h
  • c:\Python27\include\intobject.h
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\Lib\email\test\data\msg_20.txt
  • c:\Python27\Lib\test\cjkencodings\cp949.txt
  • c:\Python27\include\abstract.h
  • c:\Python27\include\pystate.h
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\Python27\Lib\email\test\data\msg_26.txt
  • c:\Python27\include\pycapsule.h
  • c:\Python27\Lib\email\test\data\msg_05.txt
  • c:\Python27\include\methodobject.h
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • c:\Python27\include\object.h
  • c:\Python27\Lib\email\test\data\msg_11.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml
  • c:\Python27\include\pyconfig.h
  • c:\Python27\include\structseq.h
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • \\?\PIPE\wkssvc
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml
  • c:\Python27\include\pymath.h
  • c:\Python27\Lib\test\cjkencodings\euc_jisx0213.txt
  • c:\Python27\Lib\email\test\data\msg_27.txt
  • c:\Python27\Lib\idlelib\NEWS.txt
  • c:\Python27\include\osdefs.h
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\timefuncs.h
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\Python27\tcl\tclConfig.sh
  • c:\Python27\Lib\email\test\data\msg_25.txt
  • c:\Python27\Lib\idlelib\help.txt
  • c:\Python27\Lib\email\test\data\msg_32.txt
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • c:\Python27\Lib\email\test\data\msg_03.txt
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\Python27\Lib\idlelib\TODO.txt
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\entry_points.txt
  • c:\Python27\include\ucnhash.h
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • c:\Python27\Lib\test\keycert2.pem
  • c:\Python27\include\py_curses.h
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\include\pyport.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml
  • c:\Python27\Lib\test\cjkencodings\cp949-utf8.txt
  • c:\Python27\include\graminit.h
  • c:\Python27\Lib\email\test\data\msg_16.txt
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\Strings.xml
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\symtable.h
  • c:\Python27\include\node.h
  • c:\Python27\include\boolobject.h
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml
  • c:\6cdeacda242012e0e5b593e657\1053\LocalizedData.xml
  • c:\Python27\Lib\test\pycacert.pem
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml
  • c:\Python27\include\code.h
  • c:\Python27\Lib\test\exception_hierarchy.txt
  • c:\6cdeacda242012e0e5b593e657\1037\LocalizedData.xml
  • c:\Python27\include\dtoa.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml
  • c:\Python27\include\asdl.h
  • c:\Python27\include\cStringIO.h
  • c:\Python27\Lib\test\empty.vbs
  • c:\6cdeacda242012e0e5b593e657\1030\LocalizedData.xml
  • c:\Python27\Lib\idlelib\idle.bat
  • c:\Python27\Lib\idlelib\HISTORY.txt
  • c:\ProgramData\WebEx\WebEx\atsdk.xml
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.proofing.msi.16.en-us.xml
  • c:\Python27\include\complexobject.h
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • c:\Python27\Lib\email\test\data\msg_21.txt
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • c:\Python27\Lib\email\test\data\msg_13.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.publishermui.msi.16.en-us.xml
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx45_IIS_schema_update.xml
  • c:\6cdeacda242012e0e5b593e657\1036\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1031\LocalizedData.xml
  • c:\Python27\Lib\lib2to3\Grammar.txt
  • c:\6cdeacda242012e0e5b593e657\1035\LocalizedData.xml
  • c:\Python27\include\bufferobject.h
  • c:\Python27\include\bytearrayobject.h
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • c:\Python27\Lib\idlelib\CREDITS.txt
  • c:\Python27\include\floatobject.h
  • c:\Python27\Lib\test\badkey.pem
  • c:\Python27\include\warnings.h
  • c:\Python27\include\cobject.h
  • c:\Python27\Lib\email\test\data\msg_12.txt
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • c:\6cdeacda242012e0e5b593e657\3082\LocalizedData.xml
  • c:\Python27\Lib\test\cjkencodings\euc_jp.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml
  • c:\Python27\include\dictobject.h
  • c:\Python27\include\pyctype.h
  • c:\6cdeacda242012e0e5b593e657\1049\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1028\LocalizedData.xml
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • c:\Users\Harry Dresden\Desktop\qxbaIhtqjDu.rtf
  • c:\Python27\Lib\email\test\data\msg_29.txt
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml
  • c:\6cdeacda242012e0e5b593e657\2070\LocalizedData.xml
  • c:\Python27\Lib\test\nokia.pem
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\NetFx40_IIS_schema_update.xml
  • c:\Python27\include\intrcheck.h
  • c:\Python27\include\pydebug.h
  • \\?\PIPE\lsarpc
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\6cdeacda242012e0e5b593e657\2052\LocalizedData.xml
  • c:\ProgramData\Microsoft\IlsCache\imcrcache.xml
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\Python27\include\structmember.h
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\Python27\Lib\test\dh1024.pem
  • c:\Python27\Lib\test\185test.db
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • c:\Python27\include\fileobject.h
  • c:\Python27\Lib\test\sha256.pem
  • c:\Python27\Lib\email\test\data\msg_35.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml
  • c:\Python27\Lib\test\keycert.passwd.pem
  • c:\Python27\include\modsupport.h
  • c:\Python27\include\enumobject.h
  • c:\Python27\include\classobject.h
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info\entry_points.txt
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\weakrefobject.h
  • c:\Python27\Lib\email\test\data\msg_08.txt
  • c:\Python27\include\eval.h
  • c:\Python27\include\datetime.h
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\email\test\data\msg_18.txt
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\NetFx45_IIS_schema_update.xml
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\Python27\include\unicodeobject.h
  • c:\Python27\include\metagrammar.h
  • c:\Python27\include\pyfpe.h
  • c:\Python27\Lib\email\test\data\msg_17.txt
  • c:\Python27\include\compile.h
  • c:\Python27\Lib\site-packages\README.txt
  • c:\Python27\include\genobject.h
  • c:\Python27\include\cellobject.h
  • c:\Python27\include\codecs.h
File-Written
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YLC2QM2Y\y8giadzn[1].txt
  • C:\Users\Harry Dresden\AppData\Local\Temp\U2ioKw67olp.dll
  • c:\Python27\Lib\email\test\data\msg_02.txt
  • c:\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt
  • c:\Python27\Lib\email\test\data\msg_26.txt
  • c:\Python27\include\pyexpat.h
  • c:\6cdeacda242012e0e5b593e657\1033\_25_WHAT_is.html
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.en-us.xml
  • c:\Python27\include\errcode.h
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info\top_level.txt
  • c:\Python27\Lib\test\keycert3.pem
  • c:\Python27\include\ast.h
  • c:\Users\Harry Dresden\Desktop\ZpMpzwMDOgVRQtHk.rtf
  • c:\Python27\Lib\test\cjkencodings\big5hkscs.txt
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\_38_WHAT_is.html
  • c:\Python27\Lib\email\test\data\msg_28.txt
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\tupleobject.h
  • c:\Python27\include\parsetok.h
  • c:\Python27\Lib\test\cjkencodings\big5hkscs-utf8.txt
  • c:\6cdeacda242012e0e5b593e657\1045\LocalizedData.xml
  • c:\Python27\tcl\tix8.4.3\pref\_29_WHAT_is.html
  • c:\Python27\include\pyerrors.h
  • c:\Python27\Lib\email\test\data\msg_19.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml
  • c:\Python27\include\descrobject.h
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\076E35C0-5E29-6BE8-BE0F-B17B3281CFE5.thor
  • c:\Python27\include\Python-ast.h
  • c:\6cdeacda242012e0e5b593e657\1042\_7_WHAT_is.html
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\_40_WHAT_is.html
  • c:\Python27\Lib\email\test\data\msg_34.txt
  • c:\6cdeacda242012e0e5b593e657\1029\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1025\LocalizedData.xml
  • c:\Python27\include\pymacconfig.h
  • c:\6cdeacda242012e0e5b593e657\1055\LocalizedData.xml
  • c:\ProgramData\Microsoft\IlsCache\ilrcache.xml
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\NetFx40_IIS_schema_update.xml
  • c:\Python27\include\ceval.h
  • c:\Python27\Lib\lib2to3\PatternGrammar.txt
  • c:\6cdeacda242012e0e5b593e657\1028\_20_WHAT_is.html
  • c:\Python27\include\grammar.h
  • c:\6cdeacda242012e0e5b593e657\1044\LocalizedData.xml
  • c:\Python27\include\import.h
  • c:\Python27\Lib\email\test\data\msg_07.txt
  • \\?\PIPE\browser
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\pymem.h
  • c:\6cdeacda242012e0e5b593e657\1037\_28_WHAT_is.html
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\Python27\Lib\idlelib\README.txt
  • c:\Python27\include\pyarena.h
  • c:\Python27\include\pygetopt.h
  • c:\Python27\Lib\email\test\data\msg_30.txt
  • c:\Python27\Lib\email\test\data\msg_22.txt
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\Python27\Lib\test\nullcert.pem
  • c:\ProgramData\WebEx\WebEx\12_1324\_18_WHAT_is.html
  • c:\Python27\Lib\email\test\data\msg_33.txt
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\6cdeacda242012e0e5b593e657\1032\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1035\LocalizedData.xml
  • c:\Python27\Lib\email\test\data\msg_10.txt
  • c:\Python27\include\complexobject.h
  • c:\Python27\Lib\email\test\data\msg_12a.txt
  • c:\6cdeacda242012e0e5b593e657\1044\_9_WHAT_is.html
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • c:\Python27\include\rangeobject.h
  • c:\Python27\tcl\_32_WHAT_is.html
  • c:\Python27\include\pgenheaders.h
  • c:\Python27\include\pythread.h
  • c:\Python27\Lib\idlelib\HISTORY.txt
  • c:\Python27\Lib\test\_2_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1038\LocalizedData.xml
  • c:\Python27\Lib\email\test\data\msg_31.txt
  • c:\Python27\include\patchlevel.h
  • c:\Python27\include\setobject.h
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\Lib\email\test\data\msg_24.txt
  • c:\Python27\include\iterobject.h
  • c:\6cdeacda242012e0e5b593e657\1043\_8_WHAT_is.html
  • c:\Python27\Lib\email\test\data\msg_13.txt
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • c:\Users\Harry Dresden\Desktop\_3_WHAT_is.html
  • c:\Python27\Lib\email\test\data\msg_14.txt
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx40_IIS_schema_update.xml
  • c:\6cdeacda242012e0e5b593e657\UiInfo.xml
  • c:\Python27\include\funcobject.h
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\076E35C0-5E29-6BE8-2566-1B689FBFA72F.thor
  • c:\Python27\include\listobject.h
  • c:\Python27\Lib\test\keycert.pem
  • c:\6cdeacda242012e0e5b593e657\2070\_16_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1029\_21_WHAT_is.html
  • c:\Python27\include\traceback.h
  • c:\Python27\Lib\test\cjkencodings\_53_WHAT_is.html
  • c:\ndkhbmpia\bin\_1_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1053\_13_WHAT_is.html
  • c:\Python27\include\marshal.h
  • c:\Python27\Lib\email\test\data\msg_23.txt
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\_44_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • c:\Python27\Lib\site-packages\setuptools\command\launcher manifest.xml
  • c:\Users\Harry Dresden\Desktop\KMrMrApicJ.rtf
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml
  • c:\Python27\include\frameobject.h
  • c:\6cdeacda242012e0e5b593e657\1046\_11_WHAT_is.html
  • c:\Users\Harry Dresden\Desktop\bjHrgwpPSEDZJbS.pptx
  • c:\Python27\include\longintrepr.h
  • c:\6cdeacda242012e0e5b593e657\1046\LocalizedData.xml
  • c:\Python27\Lib\email\test\data\msg_16.txt
  • c:\Python27\Lib\email\test\data\msg_09.txt
  • c:\Python27\Lib\idlelib\extend.txt
  • c:\6cdeacda242012e0e5b593e657\1036\LocalizedData.xml
  • c:\Python27\include\opcode.h
  • c:\Python27\Lib\email\test\data\msg_15.txt
  • c:\Python27\Lib\test\cjkencodings\big5.txt
  • c:\Python27\Lib\test\badcert.pem
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1033\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1043\LocalizedData.xml
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\076E35C0-5E29-6BE8-4399-A9D231517474.thor
  • c:\6cdeacda242012e0e5b593e657\1036\_27_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\include\sliceobject.h
  • c:\Python27\include\pgen.h
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml
  • c:\Python27\Lib\test\cjkencodings\big5-utf8.txt
  • c:\Python27\include\moduleobject.h
  • c:\6cdeacda242012e0e5b593e657\3082\_17_WHAT_is.html
  • c:\Python27\include\memoryobject.h
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • c:\Python27\include\objimpl.h
  • c:\Python27\include\Python.h
  • c:\Python27\include\fileobject.h
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • c:\Python27\include\osdefs.h
  • c:\Python27\include\stringobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1032\_24_WHAT_is.html
  • c:\Python27\Lib\email\test\data\msg_04.txt
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\dependency_links.txt
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\_37_WHAT_is.html
  • c:\Python27\include\token.h
  • c:\Python27\include\bitset.h
  • c:\Python27\include\warnings.h
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\Lib\email\test\data\msg_20.txt
  • c:\6cdeacda242012e0e5b593e657\1040\_5_WHAT_is.html
  • c:\Python27\include\abstract.h
  • c:\Python27\include\pystate.h
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\076E35C0-5E29-6BE8-43D2-8ED5DA14968D.thor
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\_35_WHAT_is.html
  • c:\Python27\include\pycapsule.h
  • c:\Python27\Lib\email\test\data\msg_05.txt
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\_33_WHAT_is.html
  • c:\Python27\include\methodobject.h
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • c:\Python27\include\object.h
  • c:\Python27\Lib\email\test\data\msg_11.txt
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info\_50_WHAT_is.html
  • c:\Python27\Lib\idlelib\_31_WHAT_is.html
  • c:\Python27\include\pyconfig.h
  • c:\Python27\include\structseq.h
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • \\?\PIPE\wkssvc
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\_39_WHAT_is.html
  • c:\Python27\include\pymath.h
  • c:\6cdeacda242012e0e5b593e657\1038\_30_WHAT_is.html
  • c:\Python27\Lib\test\cjkencodings\euc_jisx0213.txt
  • c:\Python27\Lib\email\test\data\msg_27.txt
  • c:\Python27\Lib\idlelib\NEWS.txt
  • c:\ndkhbmpia\bin\cert.p12
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\timefuncs.h
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\Python27\tcl\tclConfig.sh
  • c:\Python27\Lib\email\test\data\msg_25.txt
  • c:\Python27\Lib\idlelib\help.txt
  • c:\Python27\Lib\email\test\data\msg_32.txt
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • c:\Python27\Lib\email\test\data\msg_03.txt
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\Python27\Lib\idlelib\TODO.txt
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\entry_points.txt
  • c:\Python27\include\ucnhash.h
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • c:\6cdeacda242012e0e5b593e657\1049\_12_WHAT_is.html
  • c:\Python27\Lib\test\keycert2.pem
  • c:\Python27\include\py_curses.h
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\include\pyport.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml
  • c:\Python27\Lib\test\cjkencodings\cp949-utf8.txt
  • c:\Python27\include\graminit.h
  • c:\ProgramData\Microsoft\IlsCache\_41_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\Strings.xml
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\_45_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\symtable.h
  • c:\Python27\include\node.h
  • c:\6cdeacda242012e0e5b593e657\1031\_23_WHAT_is.html
  • c:\Python27\include\boolobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\LocalizedData.xml
  • c:\Python27\Lib\site-packages\README.txt
  • c:\Python27\Lib\test\pycacert.pem
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml
  • c:\Python27\include\code.h
  • c:\Python27\Lib\test\cjkencodings\cp949.txt
  • c:\Python27\Lib\email\test\data\msg_08.txt
  • c:\Python27\Lib\test\exception_hierarchy.txt
  • c:\6cdeacda242012e0e5b593e657\1037\LocalizedData.xml
  • c:\Python27\include\dtoa.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml
  • c:\Python27\include\asdl.h
  • c:\Python27\include\cStringIO.h
  • c:\Python27\Lib\test\empty.vbs
  • c:\6cdeacda242012e0e5b593e657\1030\LocalizedData.xml
  • c:\Python27\Lib\idlelib\idle.bat
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\076E35C0-5E29-6BE8-2D07-DE7890F731EC.thor
  • c:\ProgramData\WebEx\WebEx\atsdk.xml
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.proofing.msi.16.en-us.xml
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\_0_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • c:\Python27\Lib\idlelib\CREDITS.txt
  • c:\Python27\Lib\email\test\data\_47_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\2052\_15_WHAT_is.html
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\_42_WHAT_is.html
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.publishermui.msi.16.en-us.xml
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx45_IIS_schema_update.xml
  • c:\6cdeacda242012e0e5b593e657\1025\_19_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1031\LocalizedData.xml
  • c:\Python27\Lib\lib2to3\Grammar.txt
  • c:\6cdeacda242012e0e5b593e657\1030\_22_WHAT_is.html
  • c:\Python27\include\bufferobject.h
  • c:\Python27\include\bytearrayobject.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\_34_WHAT_is.html
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • c:\6cdeacda242012e0e5b593e657\1035\_26_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1055\_14_WHAT_is.html
  • c:\Python27\include\floatobject.h
  • c:\Python27\Lib\test\badkey.pem
  • c:\Python27\include\intobject.h
  • c:\Python27\include\cobject.h
  • c:\Python27\Lib\email\test\data\msg_12.txt
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • c:\6cdeacda242012e0e5b593e657\3082\LocalizedData.xml
  • c:\Python27\Lib\test\cjkencodings\euc_jp.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml
  • c:\Python27\include\dictobject.h
  • c:\ProgramData\WebEx\WebEx\_51_WHAT_is.html
  • c:\Python27\include\pyctype.h
  • c:\6cdeacda242012e0e5b593e657\1049\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1028\LocalizedData.xml
  • c:\Python27\Lib\idlelib\idle_test\README.txt
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • c:\Users\Harry Dresden\Desktop\qxbaIhtqjDu.rtf
  • c:\Python27\Lib\email\test\data\msg_29.txt
  • c:\Python27\Lib\email\test\data\msg_01.txt
  • c:\6cdeacda242012e0e5b593e657\2070\LocalizedData.xml
  • c:\Python27\Lib\test\nokia.pem
  • c:\Python27\Lib\site-packages\setuptools\command\_43_WHAT_is.html
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\076E35C0-5E29-6BE8-A4BD-3CA2B5E4E10B.thor
  • c:\Python27\include\intrcheck.h
  • c:\Python27\include\pydebug.h
  • \\?\PIPE\lsarpc
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\6cdeacda242012e0e5b593e657\2052\LocalizedData.xml
  • c:\ProgramData\Microsoft\IlsCache\imcrcache.xml
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\Python27\Lib\email\test\data\msg_21.txt
  • c:\Python27\include\structmember.h
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\Python27\Lib\test\dh1024.pem
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\_46_WHAT_is.html
  • c:\Python27\Lib\test\185test.db
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • c:\Python27\Lib\lib2to3\_48_WHAT_is.html
  • c:\Python27\include\_4_WHAT_is.html
  • c:\Python27\Lib\test\sha256.pem
  • c:\Python27\Lib\email\test\data\msg_35.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml
  • c:\Python27\Lib\test\keycert.passwd.pem
  • c:\Python27\include\modsupport.h
  • c:\Python27\include\enumobject.h
  • c:\Python27\include\classobject.h
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info\entry_points.txt
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\weakrefobject.h
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\_36_WHAT_is.html
  • c:\Python27\include\eval.h
  • c:\Python27\include\datetime.h
  • c:\6cdeacda242012e0e5b593e657\1045\_10_WHAT_is.html
  • c:\Python27\Lib\site-packages\_49_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\email\test\data\msg_18.txt
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\NetFx45_IIS_schema_update.xml
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\6cdeacda242012e0e5b593e657\1041\_6_WHAT_is.html
  • c:\Python27\include\unicodeobject.h
  • c:\Python27\include\metagrammar.h
  • c:\Python27\include\pyfpe.h
  • c:\Python27\Lib\email\test\data\msg_17.txt
  • c:\Python27\include\compile.h
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\076E35C0-5E29-6BE8-807A-A6070AAB1588.thor
  • c:\Python27\include\genobject.h
  • c:\Python27\include\cellobject.h
  • c:\Python27\Lib\idlelib\idle_test\_52_WHAT_is.html
  • c:\Python27\include\codecs.h
File-Deleted
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000000.db
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml
File-Opened
  • C:\Windows\System32\wshqos.dll
  • C:\Windows\System32\wshom.ocx
  • C:\
  • C:\Windows\Globalization\Sorting\sortdefault.nls
  • C:\Users\
  • C:\Users\Harry Dresden\
  • C:\Users\Harry Dresden\AppData\Local\Temp\NRV_NI001_.js
  • C:\Users\Harry Dresden\AppData\Local\
  • C:\Windows\
  • C:\Windows\System32\en-US\wshqos.dll.mui
  • C:\Users\Harry Dresden\Desktop\desktop.ini
  • C:\Windows\System32\en-US\wshtcpip.dll.mui
  • C:\Windows\SysWOW64\rundll32.exe
  • C:\Windows\System32\rsaenh.dll
  • C:\Windows\System32\msxml3.dll
  • C:\Windows\System32\en-US\wship6.dll.mui
  • C:\Windows\System32\wscript.exe
  • C:\Users\Harry Dresden\AppData\
  • C:\Windows\SysWOW64\
  • c:\Python27\Lib\email\test\data\msg_02.txt
  • c:\Python27\include\frameobject.h
  • c:\Python27\include\pyexpat.h
  • c:\Python27\Lib\ctypes
  • c:\Users\Default\Links
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages
  • c:\Python27\include\ast.h
  • c:\Python27\include\memoryobject.h
  • c:\ndkhbmpia\modules\auxiliary
  • c:\Python27\Lib\site-packages\pip\_vendor\colorama
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources
  • c:\Python27\DLLs
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol
  • c:\Python27\include\tupleobject.h
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml
  • c:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode
  • c:\ProgramData\Adobe\Setup
  • c:\6cdeacda242012e0e5b593e657\1030\LocalizedData.xml
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\en-US
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Users\Harry Dresden\OneDrive
  • c:\Python27\include\grammar.h
  • c:\ProgramData\Microsoft\PlayReady\Cache\S-1-5-21-3416602863-1947377224-293699093-1001
  • c:\Python27\include\import.h
  • c:\Users\Public\Libraries
  • \\?\PIPE\browser
  • c:\Python27\Lib\test\tracedmodules
  • c:\ProgramData\Adobe\ARM
  • c:\Python27\tcl\tcl8.5\tzdata\Indian
  • c:\Users\Public
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Queue
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource
  • c:\Python27\Lib
  • \??\VBoxMiniRdrDN
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.proofing.msi.16.en-us.xml
  • c:\6cdeacda242012e0e5b593e657\1032\LocalizedData.xml
  • c:\ProgramData
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}
  • c:\Python27\Lib\site-packages\pip
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\chardet
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A6
  • c:\Python27\Lib\ctypes\macholib
  • c:\Python27\Lib\test\cjkencodings\big5-utf8.txt
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\Security
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\UiInfo.xml
  • c:\6cdeacda242012e0e5b593e657\1055
  • c:\Python27\Lib\unittest\test
  • c:\ProgramData\Microsoft\PlayReady
  • c:\Python27\Lib\xml\dom
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00
  • c:\Python27\Lib\site-packages\pip\models
  • c:\Python27\include\marshal.h
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate
  • c:\Python27\Tools\i18n
  • c:\Python27\tcl\tcl8\8.4
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog
  • c:\ProgramData\Microsoft\Crypto\Keys
  • c:\Users\Harry Dresden\Desktop\KMrMrApicJ.rtf
  • c:\Python27\Lib\test
  • c:\Python27\Lib\email\test\data\msg_19.txt
  • c:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319
  • c:\Python27\Lib\ctypes\test
  • c:\Python27\Lib\idlelib\extend.txt
  • c:\Users\Harry Dresden\Searches
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml
  • c:\Python27\Lib\test\badcert.pem
  • c:\ProgramData\Adobe\ARM\S
  • c:\Python27\Lib\ensurepip
  • c:\Python27\include\pgen.h
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\Users\Harry Dresden\Downloads
  • c:\Python27\include\objimpl.h
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml
  • c:\ProgramData\Microsoft\eHome
  • c:\Python27\tcl\tk8.5\demos\images
  • c:\Python27\Lib\test\cjkencodings
  • c:\inetpub\wwwroot\aspnet_client\system_web
  • c:\Python27\tcl\tcl8.5\tzdata\America\Kentucky
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US
  • c:\Python27\include\abstract.h
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\keycert.passwd.pem
  • c:\Python27\include\object.h
  • c:\Python27\tcl\tix8.4.3
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\LocalizedData.xml
  • c:\ProgramData\Microsoft\RAC\PublishedData
  • c:\Python27\include\Python-ast.h
  • c:\inetpub\history\CFGHISTORY_0000000005
  • c:\inetpub\history\CFGHISTORY_0000000004
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml
  • c:\inetpub\history\CFGHISTORY_0000000001
  • c:\Python27\include\pydebug.h
  • c:\inetpub\history\CFGHISTORY_0000000003
  • c:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204
  • c:\Users\Harry Dresden\Favorites\Links for United States
  • c:\Python27\Lib\lib2to3\tests\data\fixers
  • c:\Python27\Lib\email\test\data\msg_14.txt
  • c:\Python27\tcl\tcl8.5\tzdata\US
  • c:\Python27\tcl\tcl8.5\tzdata
  • c:\Python27\include\pyport.h
  • c:\Python27\Lib\email
  • c:\Python27\tcl\tix8.4.3\demos\samples
  • c:\Python27\Lib\email\test\data\msg_15.txt
  • c:\Python27\Lib\email\test\data\msg_25.txt
  • c:\Python27\Lib\lib-tk\test\test_tkinter
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\Python27\Tools\webchecker
  • c:\Python27\tcl\tcl8.5\tzdata\America\North_Dakota
  • c:\Python27\Lib\test\crashers
  • c:\ProgramData\Microsoft\Windows Defender\LocalCopy
  • c:\Python27\include\dtoa.h
  • c:\Python27\include\asdl.h
  • c:\ProgramData\Microsoft\Diagnosis\Sideload
  • c:\Python27\Lib\test\empty.vbs
  • c:\Users\Harry Dresden\Contacts
  • c:\ProgramData\Microsoft\IlsCache\ilrcache.xml
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0
  • c:\PerfLogs
  • c:\
  • c:\Python27\include\complexobject.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries
  • c:\Python27\Lib\email\test\data\msg_13.txt
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders
  • c:\Python27\tcl\tcl8\8.5
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • c:\Python27\libs
  • c:\ProgramData\Microsoft\ClickToRun\MachineData
  • c:\Python27\Lib\lib2to3\Grammar.txt
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • c:\Python27\Lib\email\test\data\msg_35.txt
  • c:\Python27\Lib\email\test\data\msg_12.txt
  • c:\ProgramData\Microsoft\Assistance
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\pyctype.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results
  • c:\Users\Harry Dresden\Videos
  • c:\Python27\Lib\pydoc_data
  • c:\Python27\Lib\test\nokia.pem
  • c:\ProgramData\Microsoft\Crypto\DSS
  • c:\ProgramData\Adobe\Acrobat
  • c:\Python27\tcl\tcl8.5\tzdata\Atlantic
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0
  • c:\ProgramData\Microsoft\Network
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger
  • c:\Users\Default\Downloads
  • c:\Python27\Lib\xml
  • c:\Python27\tcl\tcl8.5\tzdata\Australia
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17
  • c:\Python27\include\fileobject.h
  • c:\Python27\tcl\tk8.5
  • c:\ProgramData\Microsoft\PlayReady\Cache
  • c:\6cdeacda242012e0e5b593e657\3082
  • c:\Python27\Lib\site-packages\pip\compat
  • c:\Python27\Lib\test\leakers
  • c:\Python27\tcl\tcl8\8.4\platform
  • c:\Python27\include\modsupport.h
  • c:\ProgramData\regid.1991-06.com.microsoft
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\filters
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\x-none.16
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\DD
  • c:\Python27\Tools\pynche\X
  • c:\Python27\include\bufferobject.h
  • c:\Python27\Tools\Scripts
  • c:\Python27\include\cellobject.h
  • c:\Python27\Lib\test\exception_hierarchy.txt
  • c:\Python27\Lib\email\test\data\msg_30.txt
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\35
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore
  • c:\Python27\include\pyfpe.h
  • c:\Python27\include\compile.h
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • C:\Users\Harry Dresden\AppData\Local\Temp
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.en-us.xml
  • c:\Python27\tcl\tk8.5\images
  • c:\Users\Harry Dresden\Desktop\ZpMpzwMDOgVRQtHk.rtf
  • c:\ProgramData\Microsoft\DRM
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US
  • c:\Python27\Lib\idlelib\idle_test
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\include
  • c:\Python27\Lib\test\nullcert.pem
  • c:\Python27\Lib\site-packages\setuptools
  • c:\Python27\include\cobject.h
  • c:\Python27\Lib\site-packages\README.txt
  • c:\6cdeacda242012e0e5b593e657\1029
  • c:\6cdeacda242012e0e5b593e657\1028
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}
  • c:\Python27\Lib\site-packages\pip\commands
  • c:\Python27\Lib\lib2to3\tests\data\fixers\myfixes
  • c:\6cdeacda242012e0e5b593e657\1025
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us
  • c:\Python27\tcl\tclConfig.sh
  • c:\Python27\Lib\email\test\data
  • c:\ProgramData\Microsoft\Windows Defender\Support
  • c:\ProgramData\WebEx\WebEx
  • c:\ndkhbmpia\lib\core
  • c:\6cdeacda242012e0e5b593e657\2052
  • c:\Python27\Lib\email\test\data\msg_22.txt
  • c:\Python27\Lib\email\test\data\msg_12a.txt
  • c:\Python27\tcl\tcl8.5\opt0.4
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases
  • c:\Python27\include\pgenheaders.h
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US
  • c:\Python27\tcl\tcl8.5\encoding
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs
  • c:\Python27\Lib\email\test\data\msg_31.txt
  • c:\Python27\Lib\msilib
  • c:\ProgramData\Microsoft\WwanSvc\Profiles
  • c:\Python27\Lib\encodings
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\_backport
  • c:\ProgramData\Microsoft\Assistance\Client
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\95
  • c:\Python27\Lib\site-packages\_markerlib
  • c:\ProgramData\Microsoft\Diagnosis\LocalTraceStore
  • c:\Python27\Lib\site-packages\setuptools\command\launcher manifest.xml
  • c:\inetpub\custerr
  • c:\Python27\include\longintrepr.h
  • c:\inetpub\custerr\en-US
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches
  • c:\Python27\Lib\test\185test.db
  • c:\Python27\include\opcode.h
  • c:\ndkhbmpia\lib
  • c:\ProgramData\Microsoft\Crypto\RSA
  • c:\6cdeacda242012e0e5b593e657\1046\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tk8.5\ttk
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\01
  • c:\Users\Default\Favorites
  • c:\inetpub\history
  • c:\Python27\include\moduleobject.h
  • c:\ProgramData\Microsoft\Windows NT
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5
  • c:\Python27\Lib\email\test\data\msg_17.txt
  • c:\ProgramData\Microsoft\Vault
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • c:\Python27\Lib\email\test\data\msg_04.txt
  • c:\Python27\Lib\idlelib\idle_test\README.txt
  • c:\Python27\include\boolobject.h
  • C:\Windows\SysWOW64\en-US\VssTrace.DLL.mui
  • c:\Python27\include\token.h
  • c:\Python27\include\bitset.h
  • c:\Python27\include\warnings.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages
  • c:\Python27\tcl\tk8.5\demos
  • c:\ProgramData\Mozilla\logs
  • c:\6cdeacda242012e0e5b593e657\1037\LocalizedData.xml
  • c:\Python27\include\pycapsule.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\70
  • c:\Python27\tcl\tcl8.5\tzdata\Mexico
  • c:\Python27\Lib\importlib
  • c:\ProgramData\Microsoft\Crypto
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\media
  • c:\Python27\Lib\email\test\data\msg_27.txt
  • c:\Python27\tcl\tcl8.5
  • c:\Python27\tcl\tcl8.5\tzdata\Africa
  • c:\Python27\Lib\email\test\data\msg_11.txt
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\ProgramData\McAfee
  • c:\Python27\include\enumobject.h
  • c:\Python27\Lib\idlelib\help.txt
  • c:\Python27\Lib\site-packages\pip\vcs
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • c:\Python27\Lib\bsddb\test
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\Python27\Lib\test\keycert2.pem
  • c:\ProgramData\Microsoft\Search\Data\Applications
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F7
  • c:\Python27\include\ucnhash.h
  • c:\Python27\include\py_curses.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3
  • c:\Python27\Lib\xml\parsers
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\tcl\tcl8.5\msgs
  • c:\Python27\Lib\email\test\data\msg_16.txt
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Inbox
  • c:\Users\Harry Dresden
  • c:\Python27\include\symtable.h
  • c:\Python27\include\node.h
  • c:\ProgramData\McAfee\MCLOGS\Common\jxpiinstall
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\NetFx40_IIS_schema_update.xml
  • c:\ProgramData\Microsoft\Windows Defender\Quarantine
  • c:\Users\Public\Favorites
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70
  • c:\Python27\Lib\idlelib\HISTORY.txt
  • c:\ProgramData\Microsoft\Office
  • c:\Users\Public\Pictures
  • c:\Python27\Lib\site-packages\pip\_vendor\requests
  • c:\Python27\Lib\idlelib\TODO.txt
  • c:\Python27\Lib\site-packages\pip\_vendor\_markerlib
  • c:\Python27\tcl\reg1.2
  • c:\Users\ruiner
  • c:\Python27\Lib\xml\etree
  • c:\Python27\include\pymacconfig.h
  • c:\Users\Public\Videos\Sample Videos
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01
  • c:\Python27\include\cStringIO.h
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages
  • c:\Python27\Lib\test\cjkencodings\euc_jp.txt
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform
  • c:\Python27\tcl\tcl8.5\tzdata\Antarctica
  • c:\Python27\Lib\email\test\data\msg_29.txt
  • c:\Python27\Lib\email\test\data\msg_01.txt
  • c:\Python27\Lib\xml\sax
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\trie
  • c:\Users\Harry Dresden\Desktop
  • c:\Users\Public\Recorded TV
  • c:\ProgramData\Microsoft\Office\Heartbeat
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\42
  • c:\Python27\tcl\tcl8.5\tzdata\Etc
  • c:\Python27\Lib\bsddb
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\47
  • c:\Python27\Lib\email\test\data\msg_23.txt
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95
  • c:\6cdeacda242012e0e5b593e657\2052\LocalizedData.xml
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups
  • c:\6cdeacda242012e0e5b593e657\1053\LocalizedData.xml
  • c:\Python27\Lib\wsgiref
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\contrib
  • c:\ProgramData\Microsoft\User Account Pictures
  • c:\ProgramData\Sun\Java\Java Update
  • c:\Python27\Lib\test\sha256.pem
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml
  • c:\Users
  • c:\Users\Default\Saved Games
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources
  • c:\inetpub\history\CFGHISTORY_0000000005\schema
  • c:\Python27\include\datetime.h
  • c:\inetpub
  • c:\Users\Default
  • c:\6cdeacda242012e0e5b593e657\1028\LocalizedData.xml
  • c:\Python27\tcl\tcl8.5\tzdata\Pacific
  • c:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog
  • c:\Python27\tcl\tk8.5\msgs
  • c:\Python27\tcl\tcl8.5\tzdata\America
  • c:\ProgramData\Microsoft\Diagnosis\DownloadedSettings
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\{98101498-C465-4F51-8751-D1919E97D29D}
  • c:\Python27\Lib\multiprocessing\dummy
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml
  • c:\ProgramData\Microsoft\MF
  • c:\Python27\include\errcode.h
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info\top_level.txt
  • c:\Python27\Lib\test\keycert3.pem
  • c:\Users\Public\Downloads
  • c:\Python27\Lib\site-packages
  • c:\Python27\Lib\idlelib\NEWS.txt
  • c:\ProgramData\Microsoft\Device Stage\Task
  • c:\Python27\Lib\email\test\data\msg_09.txt
  • c:\6cdeacda242012e0e5b593e657\1045\LocalizedData.xml
  • c:\Python27\include\pyerrors.h
  • c:\Python27\Lib\unittest
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml
  • c:\6cdeacda242012e0e5b593e657\Graphics
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default
  • c:\Recovery
  • c:\ProgramData\Microsoft\Device Stage
  • c:\6cdeacda242012e0e5b593e657\1055\LocalizedData.xml
  • c:\Python27\Lib\email\test\data\msg_21.txt
  • c:\Python27\include\ceval.h
  • c:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18
  • c:\ProgramData\Microsoft\Assistance\Client\1.0
  • c:\Python27\Lib\email\test\data\msg_07.txt
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\structmember.h
  • c:\ProgramData\Oracle
  • c:\Python27\Lib\idlelib\README.txt
  • c:\Python27\include\pygetopt.h
  • c:\Python27\Lib\distutils\tests
  • c:\Python27\include\codecs.h
  • c:\Python27\Lib\logging
  • c:\ProgramData\Microsoft\RAC
  • c:\Python27\include\osdefs.h
  • c:\Python27\Lib\site-packages\pip\req
  • c:\Users\Harry Dresden\Links
  • c:\ProgramData\Microsoft\DeviceSync
  • c:\Python27\Doc
  • c:\Python27\Lib\email\test\data\msg_10.txt
  • c:\Python27\Lib\email\test\data\msg_33.txt
  • c:\Python27\Lib\test\cjkencodings\euc_jisx0213-utf8.txt
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • c:\Python27\tcl\tix8.4.3\demos\bitmaps
  • c:\ProgramData\NovaTech Network\NovaBench
  • c:\ndkhbmpia\modules
  • c:\6cdeacda242012e0e5b593e657\1038\LocalizedData.xml
  • c:\Python27\include\patchlevel.h
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\Lib\compiler
  • c:\Python27\Scripts
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\42
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\17
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx40_IIS_schema_update.xml
  • c:\Python27\Lib\test\cjkencodings\cp949.txt
  • c:\Users\Public\Recorded TV\Sample Media
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • c:\Python27\tcl\dde1.3
  • c:\Python27\tcl\tcl8.5\tzdata\SystemV
  • c:\ndkhbmpia\modules\packages
  • c:\ProgramData\NovaTech Network
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • c:\ProgramData\Sun\Java
  • c:\Users\Harry Dresden\Desktop\bjHrgwpPSEDZJbS.pptx
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js
  • c:\ProgramData\Microsoft\Diagnosis\AsimovUploader
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml
  • c:\Python27\tcl\tcl8.5\tzdata\Chile
  • c:\ProgramData\Microsoft\ClickToRun\UserData
  • c:\Python27\Lib\test\xmltestdata
  • c:\ProgramData\Microsoft\WPD
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml
  • c:\Python27\Lib\site-packages\pip\_vendor
  • c:\ProgramData\Sun
  • c:\Python27\include\Python.h
  • c:\Python27\Lib\email\test\data\msg_34.txt
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\entry_points.txt
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml
  • c:\6cdeacda242012e0e5b593e657\1029\LocalizedData.xml
  • c:\Python27\include\metagrammar.h
  • c:\Python27\include\pystate.h
  • c:\Users\Default\Desktop
  • c:\Python27\Lib\email\test\data\msg_05.txt
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
  • c:\ProgramData\Microsoft\WwanSvc
  • c:\Python27\include\pyconfig.h
  • c:\Python27\Lib\lib2to3\PatternGrammar.txt
  • \\?\PIPE\wkssvc
  • c:\ProgramData\Microsoft\Event Viewer\Views
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml
  • c:\ndkhbmpia\lib\common
  • c:\Python27\Lib\json\tests
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\serializer
  • c:\ndkhbmpia\bin\cert.p12
  • c:\Python27\Tools
  • c:\Python27\include\timefuncs.h
  • c:\ProgramData\Microsoft\IlsCache
  • c:\Python27\Lib\lib-tk
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Store
  • c:\ProgramData\Microsoft\Windows NT\MSFax\SentItems
  • c:\Users\Public\Foxit Software\Foxit Reader
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\en-us.16
  • c:\Python27\Lib\site-packages\pip\operations
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox
  • c:\Python27\Lib\site-packages\pip\_vendor\lockfile
  • c:\Python27\Lib\curses
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\floatobject.h
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx45_IIS_schema_update.xml
  • c:\Python27\Lib\email\test\data\msg_26.txt
  • c:\Python27\Lib\test\pycacert.pem
  • c:\Python27\include\pymactoolbox.h
  • c:\Python27\Lib\test\badkey.pem
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration
  • c:\Users\Default\Music
  • c:\Python27\Lib\email\mime
  • c:\Python27\Lib\test\cjkencodings\big5.txt
  • c:\Users\Harry Dresden\Music
  • c:\6cdeacda242012e0e5b593e657\1053
  • c:\inetpub\history\CFGHISTORY_0000000004\schema
  • c:\6cdeacda242012e0e5b593e657\1036\LocalizedData.xml
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3
  • c:\Python27\tcl\tcl8.5\tzdata\Asia
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css
  • c:\Python27\Lib\multiprocessing
  • c:\Users\Default\Documents
  • c:\Python27\Tools\pynche
  • c:\Users\Public\Desktop
  • c:\ProgramData\Microsoft\User Account Pictures\Default Pictures
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.publishermui.msi.16.en-us.xml
  • c:\Python27\Lib\lib-tk\test\test_ttk
  • c:\Users\Harry Dresden\Documents
  • c:\6cdeacda242012e0e5b593e657\1049\LocalizedData.xml
  • c:\Python27\include\sysmodule.h
  • c:\ProgramData\McAfee\MCLOGS\Common
  • c:\Users\Harry Dresden\Desktop\qxbaIhtqjDu.rtf
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml
  • c:\ProgramData\Microsoft\IdentityCRL
  • c:\ProgramData\WebEx\WebEx\12_1324
  • c:\Python27\Lib\email\test\data\msg_24.txt
  • c:\6cdeacda242012e0e5b593e657\1031\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1033\LocalizedData.xml
  • c:\Python27\Lib\test\cjkencodings\big5hkscs-utf8.txt
  • c:\Python27\Lib\site-packages\pip\utils
  • c:\Python27\Lib\distutils\command
  • c:\Users\Harry Dresden\Saved Games
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml
  • c:\Python27\include\pyarena.h
  • c:\ProgramData\Microsoft\Windows Defender
  • c:\Python27\Lib\email\test\data\msg_08.txt
  • c:\Python27\include\eval.h
  • c:\6cdeacda242012e0e5b593e657\2070\LocalizedData.xml
  • c:\Python27
  • c:\Python27\Lib\hotshot
  • c:\Python27\include\genobject.h
  • c:\inetpub\wwwroot
  • c:\Python27\tcl\tcl8.5\tzdata\Canada
  • c:\Python27\Tools\versioncheck
  • c:\Python27\tcl\tcl8.5\tzdata\Arctic
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F7
  • c:\Users\Public\Music
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3
  • c:\Python27\Lib\test\audiodata
  • c:\Python27\Lib\test\cjkencodings\big5hkscs.txt
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters
  • c:\Python27\include\intrcheck.h
  • c:\ProgramData\Microsoft\Network\Connections
  • c:\Python27\Lib\email\test\data\msg_28.txt
  • c:\6cdeacda242012e0e5b593e657\1040
  • c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\43
  • c:\ndkhbmpia\bin
  • \\?\PIPE\lsarpc
  • c:\ProgramData\Microsoft\Diagnosis
  • c:\Python27\Lib\distutils
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\6cdeacda242012e0e5b593e657\1025\LocalizedData.xml
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\tests
  • c:\Python27\Lib\idlelib\Icons
  • c:\ProgramData\Microsoft\Device Stage\Device
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib
  • c:\Python27\Lib\test\subprocessdata
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\35
  • c:\Python27\include\pymem.h
  • c:\inetpub\wwwroot\aspnet_client
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\ProgramData\Microsoft\Network\Downloader
  • c:\Users\Public\Foxit Software
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Quick
  • c:\ProgramData\Microsoft\Windows NT\MSScan
  • c:\Python27\Lib\lib2to3\tests
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\ProgramData\Microsoft OneDrive\setup
  • c:\ProgramData\Microsoft\Crypto\DSS\MachineKeys