'
metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2016-11-08 14:19:15.042613 2016-11-08 14:22:31.718289 196 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo win7 Clone 1 VirtualBox 2016-11-08 14:19:15 2016-11-08 14:22:30

File Details

File name e43f9dcaa853ff85c65d7acbaab8a2cdfdc29961.zip
File size 1109 bytes
File type Zip archive data, at least v2.0 to extract
CRC32 E84FACA8
MD5 e5724817a02dedd7c655df3820eafd58
SHA1 e43f9dcaa853ff85c65d7acbaab8a2cdfdc29961
SHA256 92dd8a8cc79be60523dcedfe3419c8224b8831a863359b05207244aafee501eb
SHA512 043c6b72e133a680b843b579b117b86a4b1bd0d127899678c2c25de00dc6aca1d0fb0ce26c8a439b69a8b06479680b105409c0e11aae388c03afe5f2e8397f57
Ssdeep 24:9xXFdt4f7txME0ivcHyp4lWlQO1fN2BMn0pOr//M:9xVz4f72AL44v2B5sr/E
PEiD None matched
Yara
  • PM_Zip_with_js ()
VirusTotal Permalink
VirusTotal Scan Date: 2016-11-08 13:17:37
Detection Rate: 8/56 (Expand)

MetaFlows Scores

Metaflows Analysis Results (Signatures=125, Anomalies=0, PEiD=0, Yara=2, VT[1478614991]=100): Snort Events=1, AV Events=2
Total Score=125

SNORT EVENTS:
ET POLICY PE EXE or DLL Windows file download HTTP

CLAMAV DETECTED:
Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND
DROPPED FILE - NRV_548P069I_.js: Sanesecurity.Malware.26447.JsHeur.UNOFFICIAL FOUND

Dropped File/Buffer Yara Signatures:
a983e78132fa6a8a24f7b6033330f735aaae8acd [BUFFER]: Str_Win32_Http_API
6b8e38e56f51c6b9c1f5e5284d8414318c0366e9 [BUFFER]: shellcode

Signatures

antivm_queries_computername details
recon_fingerprint details
antivm_memory_available details
dumped_buffer details
creates_doc details
antivm_network_adapters details
dumped_buffer2 details
antivm_vbox_files details
Windows_Proxy_Tinkering details
network_wscript_downloader details
persistence_ads details
antiav_detectfile details
exploit_heapspray details
malicious_document_urls details
network_document_file details
network_downloader_exe details
antivm_vbox_devices details
antivm_vbox_files details
modifies_files details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

1e6f6cdced9ba5b9_076e35c0-5e29-6be8-4036-fd67db195bdb.thor

6f7297d41597121d_076e35c0-5e29-6be8-2777-f7b51735c405.thor

d0ebdf09a8e8cb42_076e35c0-5e29-6be8-1e69-b422a03281ed.thor

d1f18dd3159c475a_076e35c0-5e29-6be8-43d0-fa33c9cbd861.thor

586f0eb9a72e5637_076e35c0-5e29-6be8-3421-8cb5d01686ac.thor

19ab749730dc8571_076e35c0-5e29-6be8-7333-9243de0600be.thor

1d51a3b83c7032ed_076e35c0-5e29-6be8-7d3a-20b544d2ad7d.thor

4c9166360b5d2a31_076e35c0-5e29-6be8-35ba-294116e329f2.thor

6dd3bf01aeecb466_076e35c0-5e29-6be8-4bb8-65b39b2447de.thor

028f4bc229a0b8fe_076e35c0-5e29-6be8-8bd3-6599bdffdefa.thor

aef81c03bd769fca_076e35c0-5e29-6be8-8e1c-ff411a756e48.thor

fa5a7259afd80796_076e35c0-5e29-6be8-31b5-7b86c6073ce7.thor

717e40a6afe43dd3_076e35c0-5e29-6be8-9f47-1a676a90d717.thor

b258faffd620750a_076e35c0-5e29-6be8-19fa-0654b14c1816.thor

e3127d6dfd3d78c3_076e35c0-5e29-6be8-c26e-880a21e42041.thor

d6be4aec2b9dbbe0_076e35c0-5e29-6be8-4dc6-4ae4a12b14bf.thor

f59fcdb7cb4ba734_076e35c0-5e29-6be8-9607-4609f2980252.thor

acef854e1f6109ee_076e35c0-5e29-6be8-71db-c8e05b3e2ffa.thor

c3c30b822d555c85_076e35c0-5e29-6be8-56d0-37d5f8f311c1.thor

7ae74c47f439f3ff_076e35c0-5e29-6be8-8d16-37047b5470df.thor

e261cd442fef56d8_076e35c0-5e29-6be8-c568-b113b8008ca5.thor

433da0335367d79b_076e35c0-5e29-6be8-afd2-8ef7b677d90d.thor

3a0e986128b14690_076e35c0-5e29-6be8-7ba0-5cd688d6abf1.thor

d3631755efd7fc58_076e35c0-5e29-6be8-e8d3-dc1e69a7f603.thor

6f43beda3090a21b_076e35c0-5e29-6be8-f317-c1a5b4fac2d2.thor

62d65758cb9db2c3_076e35c0-5e29-6be8-fe45-724278ea3af5.thor

906afb26bce373e2_076e35c0-5e29-6be8-a96a-bfec2a650d6a.thor

3e2a9969af617e3e_076e35c0-5e29-6be8-0ccf-1bafcae969a2.thor

7740ff588f417424_076e35c0-5e29-6be8-1cf9-bbffef8b0cbb.thor

c790a81a0d8783d9_076e35c0-5e29-6be8-73f5-c2d1641f91b3.thor

9df94b852803d2a1_076e35c0-5e29-6be8-b291-98084c9522d8.thor

868683f5ea4ac075_076e35c0-5e29-6be8-f8ce-d56c326b451e.thor

851686ee3552fc2e_076e35c0-5e29-6be8-0e58-9bfbab1ab5bc.thor

dfcf42101ff22816_076e35c0-5e29-6be8-b56b-3f5d96226c90.thor

0f7f1230d51a0cd8_076e35c0-5e29-6be8-ec64-ef3fada935a9.thor

2e8d3092eedb356f_076e35c0-5e29-6be8-e387-4dfec7ce8030.thor

978e1f818d0dffad_076e35c0-5e29-6be8-3acc-bca5ecd6f546.thor

ca14201cedb7848a_076e35c0-5e29-6be8-ef2f-e61c7a350ba7.thor

d9a68d2ef104dcd1_076e35c0-5e29-6be8-caab-7fda9e82f180.thor

4f4dbcd2df7b44af_076e35c0-5e29-6be8-251a-ad55820872a9.thor

bba2d6c3fce85028_076e35c0-5e29-6be8-80d1-b0bbb4664b2c.thor

23429eda00a8cb67_076e35c0-5e29-6be8-61cb-983c6913d5d1.thor

8c827c5210b6947b_076e35c0-5e29-6be8-2448-d17c85a6e19e.thor

dea3f6f5cac7ddcd_076e35c0-5e29-6be8-7f3c-9fa90a471a5c.thor

dfff2d412a156877_076e35c0-5e29-6be8-6539-d5c44f3aad08.thor

7997e653b5e7059b_076e35c0-5e29-6be8-0bc6-6628e907111b.thor

cacd8f845bc0d05c_076e35c0-5e29-6be8-0e1f-3e1bd626f58a.thor

426da45d7183aea9_076e35c0-5e29-6be8-86ed-044ba794f276.thor

99a24884c6744592_076e35c0-5e29-6be8-01d5-86a77a65ccf1.thor

fd1fdf432baa0663_076e35c0-5e29-6be8-b7ed-0ec4d1bca40a.thor

f7a7a40ca2506c7e_076e35c0-5e29-6be8-f64c-6f65e2793adc.thor

5db64ae6888226e1_076e35c0-5e29-6be8-026d-ca7d11846bc5.thor

0ce7e37d2662cce1_076e35c0-5e29-6be8-ec96-b0d941412c26.thor

8497761cd48e7dcf_076e35c0-5e29-6be8-860c-7a15af0514d0.thor

032f7a59ecc314a9_076e35c0-5e29-6be8-2f30-936d06c50298.thor

00bd289d59cc0262_076e35c0-5e29-6be8-1ee0-c916a018a856.thor

47b5e6c78aa2a461_076e35c0-5e29-6be8-ebb8-d649c2f8d937.thor

13c727cde20a2f2f__3_what_is.html

ae25d6e77127a557_076e35c0-5e29-6be8-16b9-b6d62dbe5598.thor

0e7a3943664176fe_076e35c0-5e29-6be8-6d72-6500959aa6e2.thor

24f81fb0f0a71486_076e35c0-5e29-6be8-145d-3f3327225d50.thor

f5729b1fbc863556_076e35c0-5e29-6be8-e6bb-0c9beb291a74.thor

e7121bc3bed56219_076e35c0-5e29-6be8-faa0-647d56ce8bee.thor

ac284123a246c6f0_076e35c0-5e29-6be8-ed26-ecd7183060f6.thor

13db15eb8e4eb3ec_076e35c0-5e29-6be8-6583-78a8b7b929a7.thor

95d7d370018f8ad6_076e35c0-5e29-6be8-c179-73bfc3715a04.thor

fe96393549608e56_076e35c0-5e29-6be8-0939-b372a45c1a62.thor

e28c330da75df5cf_076e35c0-5e29-6be8-a22f-ca1dae6e220d.thor

77408ec17d90dba4_076e35c0-5e29-6be8-f4e6-11b023136e80.thor

ce35eccb83b45428_076e35c0-5e29-6be8-bcb1-9fb5f0bf8604.thor

9b103af949d55cd1_076e35c0-5e29-6be8-4d78-9cbabcfd40b3.thor

e812e6df1f83d838_076e35c0-5e29-6be8-b29b-dffd3092bd2f.thor

96c045af8fc16ef9_076e35c0-5e29-6be8-42fb-60871a523f9a.thor

3216e53d1c4a738c_076e35c0-5e29-6be8-9581-aeeeaff2b622.thor

940467557228de0d_076e35c0-5e29-6be8-7449-165a5cab1415.thor

78ffa5b988b4fb17_076e35c0-5e29-6be8-201a-be11ba8f190a.thor

6fefacd24fb671b2_076e35c0-5e29-6be8-d697-fa15bf2ad8ed.thor

ffe61306c0222c6f_076e35c0-5e29-6be8-24e5-6ca786f63016.thor

64cdfebe50d97dfc_076e35c0-5e29-6be8-480d-f300c7150d33.thor

062c77015afc5696_076e35c0-5e29-6be8-6574-b380958aed6c.thor

45a4e6dac13d3e1e_076e35c0-5e29-6be8-b848-2f3e30d37f09.thor

274ea9bb144f4bcc_076e35c0-5e29-6be8-0e98-4e41aaa68afd.thor

4a1a54891f82430c_076e35c0-5e29-6be8-6ce6-5bca3880e9c6.thor

cebde2b5f5edc28f_076e35c0-5e29-6be8-ecc3-83cdd503bbfa.thor

556818f4c9dff930_076e35c0-5e29-6be8-f0d7-8060f7fa2682.thor

bbc3269a4ce35911_076e35c0-5e29-6be8-dee4-9fc853e17e19.thor

e5aecac539a2d8ce_076e35c0-5e29-6be8-0e55-0ea97d245dba.thor

69cf3ba634dd666c_076e35c0-5e29-6be8-7e6b-cdd3ab1e1841.thor

293ba1c5ab7a1088_076e35c0-5e29-6be8-1a11-28efc3d6fe1e.thor

9d7325354ae1e241_076e35c0-5e29-6be8-99ea-9d878b554790.thor

387cbaf24950ca3f_076e35c0-5e29-6be8-87d9-5bae90fcf8d6.thor

5d744e68ec441da6_076e35c0-5e29-6be8-6186-2ada807dcc2d.thor

42c4470386ef4aa1_076e35c0-5e29-6be8-c595-19d3c801d674.thor

c06f41793195757b_076e35c0-5e29-6be8-f7be-67f0cf0192e1.thor

f5d408c86d87c483_076e35c0-5e29-6be8-4569-f1cf32dfd694.thor

e7f3f415be60d649_076e35c0-5e29-6be8-3586-d3e43bebbaf0.thor

7d617f5f8fc761a3_076e35c0-5e29-6be8-f80e-b493cc40a89c.thor

4221c46d04660c72_076e35c0-5e29-6be8-1ecc-f42e90e2e414.thor

c6780367cfc9c0da_076e35c0-5e29-6be8-cee8-78390ee931fc.thor

9f307af33528c048_076e35c0-5e29-6be8-38dd-4e88c1317cc8.thor

35a4b2dee98e6fdd_076e35c0-5e29-6be8-56fe-45f870ee5a61.thor

9f71cd5c3757e47f_076e35c0-5e29-6be8-7c30-383346528314.thor

e2e1b2f5a64b6cd3_076e35c0-5e29-6be8-be64-b38ad0dcb066.thor

cc3d44a0dece6ba5_076e35c0-5e29-6be8-f2f2-a0883d2af477.thor

9a3c7415698e8f49_076e35c0-5e29-6be8-8bb9-7efa065f822b.thor

78103195fce946ec_076e35c0-5e29-6be8-b1de-cd7294da4793.thor

715477a7cbc8307c_076e35c0-5e29-6be8-7ac9-03dfd717f56b.thor

15faa67396357a70_076e35c0-5e29-6be8-5def-a2f2794eae7e.thor

d954fa3e4e4515ed_076e35c0-5e29-6be8-115c-3ef3053f331a.thor

6d3026c161818189_076e35c0-5e29-6be8-004a-58f48069476c.thor

2fe7253a17c439e0_076e35c0-5e29-6be8-4aa2-b72503c16f46.thor

9abf88874eb10bc5_076e35c0-5e29-6be8-1b9c-5736107973a5.thor

9daefcb2bf020e9c_076e35c0-5e29-6be8-487e-14ac487d02ae.thor

114b6108d88af005_076e35c0-5e29-6be8-2c8b-d00850cb71da.thor

1e6794df62343f67_076e35c0-5e29-6be8-4267-afcacbdad48b.thor

f508bc94b345f69d_076e35c0-5e29-6be8-eb49-8e9db1ed6625.thor

e7aa3a5b40149ee6_076e35c0-5e29-6be8-ba78-326b8225b6f9.thor

b1042333e1015355_076e35c0-5e29-6be8-7a9f-45b1b817e7ba.thor

787d89ec409808d8_076e35c0-5e29-6be8-4a5d-ff1ba97ea743.thor

7af8d0e4bc6af0e6_076e35c0-5e29-6be8-c40b-ed1fdeb8047a.thor

e68619a297ebcf2a_076e35c0-5e29-6be8-fade-675756f22e08.thor

63bc3c3dd58fdc76_076e35c0-5e29-6be8-f842-1585990bd6d2.thor

60c8c73b0cfd5716_076e35c0-5e29-6be8-b0ab-59064a05ebd7.thor

6ce6c1612dd8d8b0_076e35c0-5e29-6be8-220a-2f281756a461.thor

695ad05f0688e737_076e35c0-5e29-6be8-8133-0fd314fb4d43.thor

40dc9c76960ec889_076e35c0-5e29-6be8-b559-9eb813a529a9.thor

817b7e109b3d6d21_076e35c0-5e29-6be8-f430-f2bdf77a7cdb.thor

0bb50ac25d62319b_076e35c0-5e29-6be8-1113-7c53d142dae0.thor

1542b9f77c457193_076e35c0-5e29-6be8-5fbc-ca43f72c8a55.thor

72ddca12867e2566_076e35c0-5e29-6be8-1efb-4baa6de8ea92.thor

aa8226cbf7d9bd63_076e35c0-5e29-6be8-bc35-8e2cb6954c7c.thor

b5aa58bcb335ffd1_076e35c0-5e29-6be8-3889-a5779385e9bc.thor

1ffb4540c6391744_076e35c0-5e29-6be8-4890-0a21da645a26.thor

8bfbd8c3b3948609_076e35c0-5e29-6be8-6c95-39d20e07dee6.thor

b2a2b7142699017e_076e35c0-5e29-6be8-53b8-1bcf4ce21313.thor

2c179d023ca8b357_076e35c0-5e29-6be8-8ec0-a5464dc1375b.thor

b83db8173a864bf0_076e35c0-5e29-6be8-7c21-7f0be66c9d87.thor

ddac7f9dd642cd58_076e35c0-5e29-6be8-68b4-bc51f52695a3.thor

ea32558c0fd47297_076e35c0-5e29-6be8-dac9-393b089a8d8b.thor

5b3c11068d37bbc1_076e35c0-5e29-6be8-f620-f983cd36d276.thor

573ee6491b0d77db_076e35c0-5e29-6be8-880f-183fc41ccf80.thor

c6b4ccacdfc5a596_076e35c0-5e29-6be8-228e-4ccd7321dd8a.thor

3f68c5d6797cdc68_076e35c0-5e29-6be8-aa1c-e42c8f17c03c.thor

444cb8d53664698c_076e35c0-5e29-6be8-6a14-a8f47057ec2a.thor

d005373a2e2a0282_076e35c0-5e29-6be8-4cca-4460b4bd4b63.thor

449353dee698b8c8_076e35c0-5e29-6be8-c6f2-bb09d74d035f.thor

a53dfbcc1e587888_076e35c0-5e29-6be8-1fbc-a5a5912f5ee7.thor

1dc87d94645e45af_076e35c0-5e29-6be8-a89e-64cbbdbfd6d7.thor

293a382f595430eb_076e35c0-5e29-6be8-067d-bb0d3c7fdc79.thor

5b4c9de008cdcc51_076e35c0-5e29-6be8-c86d-f33ff8e8a7e8.thor

6858a988081e1c21_076e35c0-5e29-6be8-4a66-ff7754b5b09c.thor

f5d28cf5f8a8873a_076e35c0-5e29-6be8-48d6-0ee78c472731.thor

223d3899690c521b_076e35c0-5e29-6be8-7575-66bd2da1889c.thor

46bc03eea2d8382e_076e35c0-5e29-6be8-0756-bf5344d6b95b.thor

5fae7c780560b875_076e35c0-5e29-6be8-387f-d7c138a35447.thor

821ea84bf75bd6fa_076e35c0-5e29-6be8-f384-52124dbdfa37.thor

03a48bac0675ab51_076e35c0-5e29-6be8-e6bc-7f0c1bef346e.thor

891fc525d0ea9661_076e35c0-5e29-6be8-cc04-dfe5f9d65e7e.thor

9f3241f76a635428_076e35c0-5e29-6be8-1f4c-f81f75f309d3.thor

6a99fee15f532049_076e35c0-5e29-6be8-6afb-116861bb1b71.thor

d7a62003bb8238bb_076e35c0-5e29-6be8-1bc5-60f00c161d15.thor

e421b280b9ff6e85_076e35c0-5e29-6be8-a701-240b339ea9a3.thor

2a8bb6d5969b0d27_076e35c0-5e29-6be8-4987-115d934a9c9a.thor

367365e39d78ae4f_076e35c0-5e29-6be8-8e2f-1ce22751efdb.thor

f12b728af6684dde_076e35c0-5e29-6be8-e24e-61af23d5797f.thor

020fc2e2cebbf420_076e35c0-5e29-6be8-d083-ba2032f3f092.thor

d9a52d724540ed97_076e35c0-5e29-6be8-f003-29d6c0ad0c70.thor

9c36b8e2aaffde3c_076e35c0-5e29-6be8-fd28-f132f2bec729.thor

b221d8a14ca13e9e_076e35c0-5e29-6be8-baec-573840f98cef.thor

f17772827fe750b8_076e35c0-5e29-6be8-6181-9cda6091005d.thor

7718f82aeab77abe_076e35c0-5e29-6be8-5edd-11b468342b05.thor

9924db2a1fc6759e_076e35c0-5e29-6be8-5e8b-72b70be7569e.thor

af68a9f397471bb7_076e35c0-5e29-6be8-c6dd-1fd4dcc5e844.thor

9d1e580200fc378d_yesabshxf11x.dll

2194a00ef03b36a8_076e35c0-5e29-6be8-e21b-672f918705b5.thor

87b2090578edb8e8_076e35c0-5e29-6be8-8181-d7b8222622b3.thor

cc85d6cad4624ad4_076e35c0-5e29-6be8-a011-594bb4ed32e5.thor

8d27ced12fd3c0f7_076e35c0-5e29-6be8-cd9d-335adbe79b82.thor

7c4ffa9795cc1fc8_076e35c0-5e29-6be8-d7c7-3ced982e938e.thor

a6a86067938b54a0_076e35c0-5e29-6be8-2905-d07e60525102.thor

65850bffa7d2d649_076e35c0-5e29-6be8-3dc4-858ea4680082.thor

493e9b14dca6f152_076e35c0-5e29-6be8-16a5-1ae5a288e67d.thor

6b4c4e921fee4b0b_076e35c0-5e29-6be8-e562-110bf9016e5e.thor

cc5c088cadab4161_076e35c0-5e29-6be8-2422-7a7ae2e59bca.thor

NRV_548P069I_.js

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

Behavior Summary

File-Read
  • C:\Users\Harry Dresden\Desktop\desktop.ini
  • C:\Windows\System32\wshom.ocx
  • C:\Users\Harry Dresden\AppData\Local\Temp\NRV_548P069I_.js
  • C:\Windows\System32\wscript.exe
  • C:\Windows\System32\msxml3.dll
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\Python27\include\pyexpat.h
  • c:\Python27\include\methodobject.h
  • c:\Python27\include\object.h
  • c:\Python27\include\errcode.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\Lib\test\keycert3.pem
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\Python27\include\intrcheck.h
  • c:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\tupleobject.h
  • c:\Python27\include\pyconfig.h
  • c:\Python27\include\warnings.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\include\pyerrors.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\cobject.h
  • c:\Python27\include\floatobject.h
  • c:\Python27\include\Python-ast.h
  • c:\Python27\include\osdefs.h
  • c:\Python27\Lib\test\empty.vbs
  • c:\Python27\Lib\email\test\data\msg_34.txt
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • c:\Python27\include\pymacconfig.h
  • c:\6cdeacda242012e0e5b593e657\1055\LocalizedData.xml
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Python27\include\ceval.h
  • c:\Python27\include\grammar.h
  • c:\Python27\include\import.h
  • \\?\PIPE\browser
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\structmember.h
  • c:\Python27\Lib\email\test\data\msg_39.txt
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\UYNyjHStpye.doc
  • c:\Python27\include\pyarena.h
  • c:\Python27\include\pygetopt.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • c:\Python27\Lib\email\test\data\msg_30.txt
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\Python27\Lib\email\test\data\msg_33.txt
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\include\ast.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\Python27\include\rangeobject.h
  • c:\Python27\include\pgenheaders.h
  • c:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml
  • c:\Python27\include\pythread.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\Python27\include\patchlevel.h
  • c:\6cdeacda242012e0e5b593e657\3082\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\include\iterobject.h
  • c:\Python27\include\pymem.h
  • UNC\SHARDREALM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx40_IIS_schema_update.xml
  • c:\6cdeacda242012e0e5b593e657\UiInfo.xml
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\Python27\include\structseq.h
  • c:\Python27\include\listobject.h
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • c:\Python27\include\frameobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\JHOYfmcmMF.ppt
  • c:\Python27\include\longintrepr.h
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\NetFx40_IIS_schema_update.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Python27\include\opcode.h
  • c:\Python27\include\parsetok.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • c:\Python27\Lib\test\badcert.pem
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1043\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1046\LocalizedData.xml
  • c:\Python27\include\pydebug.h
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\include\sliceobject.h
  • c:\Python27\Lib\email\test\data\msg_31.txt
  • c:\Python27\include\pgen.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\Python27\Lib\test\wrongcert.pem
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\DsoWNFsAkn.doc
  • c:\Python27\include\moduleobject.h
  • c:\Python27\include\memoryobject.h
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • c:\Python27\include\objimpl.h
  • c:\Python27\include\Python.h
  • c:\Python27\include\fileobject.h
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\include\stringobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\ojSoVPfzdlxDA.doc
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\Python27\include\bitset.h
  • c:\Python27\include\intobject.h
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\include\dictobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\Python27\include\abstract.h
  • c:\Python27\include\pystate.h
  • c:\Python27\Lib\test\keycert.passwd.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\XeeLFqLentIohZxS.pptx
  • c:\Python27\Lib\email\test\data\msg_35.txt
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • c:\Python27\include\descrobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • \\?\PIPE\wkssvc
  • c:\6cdeacda242012e0e5b593e657\1044\LocalizedData.xml
  • c:\Python27\include\pymath.h
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\timefuncs.h
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\Python27\tcl\tclConfig.sh
  • c:\Python27\Lib\email\test\data\msg_32.txt
  • c:\Python27\Lib\test\185test.db
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1045\LocalizedData.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\Python27\include\ucnhash.h
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\test\keycert2.pem
  • c:\Python27\include\py_curses.h
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\include\pyport.h
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\Strings.xml
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\symtable.h
  • c:\Python27\include\setobject.h
  • c:\Python27\include\boolobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\LocalizedData.xml
  • c:\Python27\Lib\test\pycacert.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\Python27\include\code.h
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml
  • c:\Python27\include\dtoa.h
  • c:\Python27\include\graminit.h
  • c:\Python27\include\eval.h
  • c:\Python27\include\asdl.h
  • c:\Python27\include\funcobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • c:\Python27\Lib\idlelib\idle.bat
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\Python27\include\complexobject.h
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx45_IIS_schema_update.xml
  • c:\Python27\include\token.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\Python27\include\bytearrayobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • UNC\SHARDREALM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\Python27\include\node.h
  • c:\Python27\Lib\test\badkey.pem
  • c:\Python27\include\cStringIO.h
  • c:\Python27\Lib\email\test\data\msg_36.txt
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\pyctype.h
  • c:\6cdeacda242012e0e5b593e657\1049\LocalizedData.xml
  • c:\Python27\include\unicodeobject.h
  • c:\yvqjybpr\bin\cert.p12
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • c:\Python27\include\marshal.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\6cdeacda242012e0e5b593e657\2070\LocalizedData.xml
  • c:\Python27\Lib\test\nokia.pem
  • UNC\SHARDREALM\Users\Default\NTUSER.DAT.LOG
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • \\?\PIPE\lsarpc
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\JjeAMQAxnRdP.rtf
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\Python27\Lib\email\test\data\msg_38.txt
  • c:\6cdeacda242012e0e5b593e657\2052\LocalizedData.xml
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\Python27\Lib\email\test\data\msg_41.txt
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\Python27\Lib\test\dh1024.pem
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\test\sha256.pem
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • c:\Python27\include\pycapsule.h
  • c:\Python27\include\modsupport.h
  • c:\Python27\include\enumobject.h
  • c:\Python27\include\classobject.h
  • c:\Python27\include\weakrefobject.h
  • c:\Python27\include\bufferobject.h
  • c:\Python27\include\datetime.h
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\NetFx45_IIS_schema_update.xml
  • c:\Python27\Lib\email\test\data\msg_40.txt
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\Python27\include\cellobject.h
  • c:\Python27\include\metagrammar.h
  • c:\Python27\include\pyfpe.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • c:\Python27\include\compile.h
  • c:\Python27\include\genobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • c:\Python27\include\codecs.h
File-Written
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YLC2QM2Y\7wi66hp[1]
  • C:\Users\Harry Dresden\AppData\Local\Temp\yESaBSHXF11x.dll
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • UNC\SHARDREALM\Users\Harry Dresden\Contacts\_11_WHAT_is.html
  • c:\Python27\include\pyexpat.h
  • c:\Python27\include\methodobject.h
  • c:\Python27\include\object.h
  • UNC\SHARDREALM\Users\Public\Videos\Sample Videos\_10_WHAT_is.html
  • c:\Python27\include\errcode.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\Lib\test\keycert3.pem
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\Python27\include\intrcheck.h
  • c:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\_34_WHAT_is.html
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Python27\include\tupleobject.h
  • c:\Python27\include\pyconfig.h
  • c:\Python27\Lib\idlelib\_30_WHAT_is.html
  • c:\Python27\include\warnings.h
  • c:\Python27\Lib\email\test\data\msg_30.txt
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\include\pyerrors.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\cobject.h
  • c:\Python27\include\floatobject.h
  • c:\Python27\include\Python-ast.h
  • c:\Python27\include\osdefs.h
  • c:\Python27\Lib\test\empty.vbs
  • c:\Python27\Lib\email\test\data\msg_34.txt
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • c:\6cdeacda242012e0e5b593e657\1032\_27_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1037\_6_WHAT_is.html
  • c:\Python27\include\pymacconfig.h
  • c:\6cdeacda242012e0e5b593e657\1055\LocalizedData.xml
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\NetFx40_IIS_schema_update.xml
  • c:\Python27\include\ceval.h
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\_2_WHAT_is.html
  • c:\Python27\include\grammar.h
  • c:\6cdeacda242012e0e5b593e657\1044\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1055\_17_WHAT_is.html
  • c:\Python27\include\import.h
  • \\?\PIPE\browser
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\structmember.h
  • c:\Python27\Lib\email\test\data\msg_39.txt
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\UYNyjHStpye.doc
  • c:\Python27\include\pyarena.h
  • c:\Python27\include\pygetopt.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • UNC\SHARDREALM\Users\Default\_13_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\Python27\Lib\test\nullcert.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\_12_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\_8_WHAT_is.html
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • c:\6cdeacda242012e0e5b593e657\3082\_20_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\6cdeacda242012e0e5b593e657\1038\_7_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • c:\ProgramData\WebEx\WebEx\12_1324\_21_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\Python27\include\pgenheaders.h
  • c:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml
  • c:\Python27\include\pythread.h
  • c:\6cdeacda242012e0e5b593e657\2070\_19_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\Python27\include\patchlevel.h
  • c:\Python27\include\bytearrayobject.h
  • c:\6cdeacda242012e0e5b593e657\3082\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • c:\Python27\include\iterobject.h
  • c:\Python27\include\pymem.h
  • UNC\SHARDREALM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • c:\Python27\Lib\test\_1_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx40_IIS_schema_update.xml
  • c:\6cdeacda242012e0e5b593e657\UiInfo.xml
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\Python27\include\structseq.h
  • c:\6cdeacda242012e0e5b593e657\2052\_18_WHAT_is.html
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • c:\Python27\include\rangeobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1041\_9_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1036\_5_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\_1_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\JHOYfmcmMF.ppt
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml
  • c:\Python27\include\longintrepr.h
  • c:\6cdeacda242012e0e5b593e657\1046\LocalizedData.xml
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\_7_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Python27\include\opcode.h
  • c:\Python27\include\parsetok.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • c:\Python27\Lib\test\badcert.pem
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\_9_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1043\LocalizedData.xml
  • c:\Python27\include\frameobject.h
  • c:\Python27\include\pydebug.h
  • c:\6cdeacda242012e0e5b593e657\1053\_16_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • c:\Python27\include\sliceobject.h
  • c:\Python27\Lib\email\test\data\msg_31.txt
  • c:\Python27\include\pgen.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\Python27\Lib\test\wrongcert.pem
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\DsoWNFsAkn.doc
  • c:\Python27\include\moduleobject.h
  • c:\Python27\include\memoryobject.h
  • c:\yvqjybpr\bin\_2_WHAT_is.html
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • c:\Python27\include\objimpl.h
  • c:\Python27\include\Python.h
  • c:\Python27\include\fileobject.h
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\_0_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\include\stringobject.h
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\ojSoVPfzdlxDA.doc
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\Python27\include\bitset.h
  • c:\Python27\include\intobject.h
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\include\dictobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\Python27\include\abstract.h
  • c:\Python27\include\pystate.h
  • c:\Python27\Lib\test\keycert.passwd.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • c:\6cdeacda242012e0e5b593e657\1025\_22_WHAT_is.html
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\XeeLFqLentIohZxS.pptx
  • c:\Python27\Lib\email\test\data\msg_35.txt
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • c:\6cdeacda242012e0e5b593e657\1042\_10_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • \\?\PIPE\wkssvc
  • c:\6cdeacda242012e0e5b593e657\1029\_24_WHAT_is.html
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\include\pymath.h
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • c:\6cdeacda242012e0e5b593e657\1031\_26_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\modsupport.h
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\6cdeacda242012e0e5b593e657\1030\_25_WHAT_is.html
  • c:\Python27\tcl\tclConfig.sh
  • c:\6cdeacda242012e0e5b593e657\_33_WHAT_is.html
  • c:\Python27\Lib\email\test\data\msg_32.txt
  • c:\6cdeacda242012e0e5b593e657\1046\_14_WHAT_is.html
  • c:\Python27\Lib\test\185test.db
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1045\LocalizedData.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1035\_4_WHAT_is.html
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\_35_WHAT_is.html
  • c:\Python27\include\ucnhash.h
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\test\keycert2.pem
  • c:\Python27\include\py_curses.h
  • c:\Python27\Lib\test\keycert4.pem
  • c:\Python27\include\pyport.h
  • c:\6cdeacda242012e0e5b593e657\1028\_23_WHAT_is.html
  • c:\Python27\Lib\email\test\data\msg_33.txt
  • c:\Python27\include\listobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\Strings.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\symtable.h
  • c:\Python27\include\setobject.h
  • c:\6cdeacda242012e0e5b593e657\1040\_8_WHAT_is.html
  • c:\Python27\include\boolobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\_3_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1053\LocalizedData.xml
  • c:\Python27\Lib\test\pycacert.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\Python27\include\code.h
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml
  • c:\Python27\include\dtoa.h
  • c:\Python27\include\graminit.h
  • c:\Python27\include\eval.h
  • c:\Python27\include\asdl.h
  • c:\Python27\include\funcobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • c:\Python27\Lib\idlelib\idle.bat
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\_0_WHAT_is.html
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • c:\Python27\include\_3_WHAT_is.html
  • c:\ProgramData\Microsoft\ClickToRun\_36_WHAT_is.html
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx45_IIS_schema_update.xml
  • c:\Python27\include\token.h
  • c:\Python27\include\timefuncs.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • c:\6cdeacda242012e0e5b593e657\1043\_11_WHAT_is.html
  • c:\Python27\Lib\email\test\data\_32_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\_5_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\_6_WHAT_is.html
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • UNC\SHARDREALM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\Python27\include\node.h
  • c:\Python27\Lib\test\badkey.pem
  • c:\Python27\include\cStringIO.h
  • c:\Python27\Lib\email\test\data\msg_36.txt
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\pyctype.h
  • c:\6cdeacda242012e0e5b593e657\1049\LocalizedData.xml
  • c:\Python27\include\unicodeobject.h
  • c:\Python27\tcl\tix8.4.3\pref\_29_WHAT_is.html
  • c:\yvqjybpr\bin\cert.p12
  • c:\Python27\include\sysmodule.h
  • c:\Python27\include\pymactoolbox.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • c:\Python27\include\marshal.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • c:\6cdeacda242012e0e5b593e657\2070\LocalizedData.xml
  • c:\Python27\Lib\test\nokia.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\_4_WHAT_is.html
  • UNC\SHARDREALM\Users\Default\NTUSER.DAT.LOG
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • \\?\PIPE\lsarpc
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\6cdeacda242012e0e5b593e657\1044\_12_WHAT_is.html
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\JjeAMQAxnRdP.rtf
  • c:\6cdeacda242012e0e5b593e657\1045\_13_WHAT_is.html
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\Python27\Lib\email\test\data\msg_38.txt
  • c:\6cdeacda242012e0e5b593e657\2052\LocalizedData.xml
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\Python27\Lib\email\test\data\msg_41.txt
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\Python27\Lib\test\dh1024.pem
  • c:\Python27\tcl\_31_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\test\sha256.pem
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • c:\Python27\include\complexobject.h
  • c:\Python27\include\pycapsule.h
  • c:\Python27\include\pyfpe.h
  • c:\Python27\include\enumobject.h
  • c:\Python27\include\descrobject.h
  • c:\Python27\include\classobject.h
  • c:\6cdeacda242012e0e5b593e657\1033\_28_WHAT_is.html
  • c:\Python27\include\weakrefobject.h
  • c:\Python27\include\bufferobject.h
  • c:\Python27\include\datetime.h
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\NetFx45_IIS_schema_update.xml
  • c:\Python27\Lib\email\test\data\msg_40.txt
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\Python27\include\cellobject.h
  • c:\Python27\include\ast.h
  • c:\Python27\include\metagrammar.h
  • c:\6cdeacda242012e0e5b593e657\1049\_15_WHAT_is.html
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • c:\Python27\include\compile.h
  • c:\Python27\include\genobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • c:\Python27\include\codecs.h
File-Deleted
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000000.db
File-Opened
  • C:\Windows\System32\wshqos.dll
  • C:\Users\Harry Dresden\Desktop\desktop.ini
  • C:\Windows\System32\wshom.ocx
  • C:\
  • C:\Windows\Globalization\Sorting\sortdefault.nls
  • C:\Users\
  • C:\Users\Harry Dresden\
  • C:\Users\Harry Dresden\AppData\
  • C:\Users\Harry Dresden\AppData\Local\
  • C:\Windows\SysWOW64\rundll32.exe
  • C:\Windows\System32\en-US\wshqos.dll.mui
  • C:\Users\Harry Dresden\AppData\Local\Temp\NRV_548P069I_.js
  • C:\Windows\System32\en-US\wshtcpip.dll.mui
  • C:\Windows\System32\rsaenh.dll
  • C:\Windows\System32\msxml3.dll
  • C:\Windows\System32\en-US\wship6.dll.mui
  • C:\Windows\System32\wscript.exe
  • C:\Windows\
  • C:\Windows\SysWOW64\
  • c:\Python27\include\frameobject.h
  • c:\Python27\include\pyexpat.h
  • c:\Python27\Lib\ctypes
  • UNC\SHARDREALM\Users\Harry Dresden\Documents
  • c:\Users\Default\Links
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages
  • c:\Python27\include\pymacconfig.h
  • c:\Python27\include\ast.h
  • c:\Python27\include\memoryobject.h
  • c:\Python27\Lib\site-packages\pip\_vendor\colorama
  • c:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources
  • c:\Python27\DLLs
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol
  • c:\Python27\include\tupleobject.h
  • UNC\SHARDREALM\Users\Harry Dresden\Favorites\Links for United States
  • c:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp
  • c:\ProgramData\Adobe\Setup
  • c:\Python27\Lib\test\empty.vbs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\en-US
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages
  • UNC\SHARDREALM\Users\Harry Dresden\OneDrive
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs
  • c:\Users\Harry Dresden\OneDrive
  • c:\Python27\include\grammar.h
  • c:\ProgramData\Microsoft\PlayReady\Cache\S-1-5-21-3416602863-1947377224-293699093-1001
  • c:\Python27\include\import.h
  • c:\Users\Public\Libraries
  • \\?\PIPE\browser
  • c:\Python27\Lib\test\tracedmodules
  • c:\ProgramData\Adobe\ARM
  • c:\Python27\tcl\tcl8.5\tzdata\Indian
  • c:\Users\Public
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Queue
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource
  • c:\Python27\Lib
  • \??\VBoxMiniRdrDN
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp
  • c:\ProgramData
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  • c:\Python27\Lib\site-packages\pip
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A6
  • c:\Python27\Lib\email\test\data\msg_36.txt
  • c:\Python27\Lib\ctypes\macholib
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\Security
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\UiInfo.xml
  • c:\inetpub\history\CFGHISTORY_0000000004\schema
  • c:\Python27\Lib\unittest\test
  • c:\ProgramData\Microsoft\PlayReady
  • c:\Python27\Lib\xml\dom
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00
  • c:\Python27\Lib\site-packages\pip\models
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt
  • c:\Python27\include\marshal.h
  • UNC\SHARDREALM\Users\Public\Foxit Software
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate
  • c:\Python27\Tools\i18n
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp
  • c:\Python27\tcl\tcl8\8.4
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog
  • c:\ProgramData\Microsoft\Crypto\Keys
  • UNC\SHARDREALM\Users\Public\Music\Sample Music
  • c:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319
  • c:\Python27\Lib\ctypes\test
  • c:\Users\Harry Dresden\Searches
  • c:\Python27\Lib\test\badcert.pem
  • c:\ProgramData\Adobe\ARM\S
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css
  • c:\Python27\Lib\ensurepip
  • c:\Python27\include\pgen.h
  • UNC\SHARDREALM\Users
  • c:\Python27\tcl\tcl8.5\tzdata\Canada
  • c:\Python27\Lib\test\wrongcert.pem
  • c:\Users\Harry Dresden\Downloads
  • c:\Python27\include\objimpl.h
  • c:\ProgramData\Microsoft\eHome
  • c:\Python27\tcl\tk8.5\demos\images
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images
  • c:\Python27\Lib\test\cjkencodings
  • c:\inetpub\wwwroot\aspnet_client\system_web
  • UNC\SHARDREALM\Users\Public\Music
  • c:\Python27\tcl\tcl8.5\tzdata\America\Kentucky
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US
  • c:\Python27\include\abstract.h
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php
  • c:\Python27\Lib\test\keycert.passwd.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\XeeLFqLentIohZxS.pptx
  • c:\Python27\include\object.h
  • c:\Python27\tcl\tix8.4.3
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1044\LocalizedData.xml
  • c:\ProgramData\Microsoft\RAC\PublishedData
  • UNC\SHARDREALM\Users\Harry Dresden\Links
  • c:\inetpub\history\CFGHISTORY_0000000005
  • c:\inetpub\history\CFGHISTORY_0000000004
  • c:\inetpub\history\CFGHISTORY_0000000001
  • c:\Python27\include\pydebug.h
  • c:\inetpub\history\CFGHISTORY_0000000003
  • c:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204
  • c:\Users\Harry Dresden\Favorites\Links for United States
  • c:\Python27\Lib\lib2to3\tests\data\fixers
  • c:\Python27\tcl\tcl8.5\tzdata\US
  • c:\Python27\tcl\tcl8.5\tzdata
  • UNC\SHARDREALM\Users\Public\Videos
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css
  • c:\Python27\include\pyport.h
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf
  • UNC\SHARDREALM\Users\Public\Documents
  • c:\Python27\Lib\email
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Kalimba.mp3
  • c:\Python27\tcl\tix8.4.3\demos\samples
  • c:\Python27\Lib\lib-tk\test\test_tkinter
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf
  • UNC\SHARDREALM\Users\Harry Dresden\Music
  • c:\Python27\Tools\webchecker
  • c:\Python27\tcl\tcl8.5\tzdata\America\North_Dakota
  • c:\Python27\Lib\test\crashers
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml
  • c:\ProgramData\Microsoft\Windows Defender\LocalCopy
  • c:\Python27\include\dtoa.h
  • c:\6cdeacda242012e0e5b593e657\1055\LocalizedData.xml
  • c:\Python27\include\asdl.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml
  • c:\Users\Harry Dresden\Contacts
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0
  • c:\PerfLogs
  • UNC\SHARDREALM\Users\Public\Libraries
  • c:\
  • c:\Python27\include\complexobject.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders
  • c:\Python27\tcl\tcl8\8.5
  • UNC\SHARDREALM\Users\Default\Desktop
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf
  • c:\Python27\libs
  • c:\ProgramData\Microsoft\ClickToRun\MachineData
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp
  • c:\Python27\include\pystrtod.h
  • c:\Python27\include\longobject.h
  • UNC\SHARDREALM\Users\Harry Dresden\Contacts\Harry Dresden.contact
  • c:\ProgramData\Microsoft\Assistance
  • c:\Python27\include\bytesobject.h
  • c:\Python27\include\pyctype.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results
  • c:\Users\Harry Dresden\Videos
  • c:\Python27\Lib\pydoc_data
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html
  • UNC\SHARDREALM\Users\Default\Music
  • c:\ProgramData\Microsoft\Crypto\DSS
  • c:\ProgramData\Adobe\Acrobat
  • c:\Python27\tcl\tcl8.5\tzdata\Atlantic
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0
  • c:\ProgramData\Microsoft\Network
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger
  • c:\Users\Default\Downloads
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png
  • c:\Python27\Lib\xml
  • c:\Python27\tcl\tcl8.5\tzdata\Australia
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17
  • c:\Python27\include\fileobject.h
  • c:\Python27\tcl\tk8.5
  • c:\ProgramData\Microsoft\PlayReady\Cache
  • c:\6cdeacda242012e0e5b593e657\3082
  • c:\Python27\Lib\site-packages\pip\compat
  • c:\Python27\Lib\test\leakers
  • c:\Python27\tcl\tcl8\8.4\platform
  • c:\Python27\include\modsupport.h
  • c:\ProgramData\regid.1991-06.com.microsoft
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\filters
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\x-none.16
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\DD
  • c:\Python27\Tools\pynche\X
  • c:\Python27\include\bufferobject.h
  • c:\Python27\Tools\Scripts
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp
  • c:\Python27\Lib\email\test\data\msg_30.txt
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\35
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore
  • c:\Python27\Lib\test\nokia.pem
  • c:\Python27\include\compile.h
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf
  • C:\Users\Harry Dresden\AppData\Local\Temp
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg
  • c:\Python27\tcl\tk8.5\images
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css
  • c:\ProgramData\Microsoft\DRM
  • UNC\SHARDREALM\Users\Harry Dresden\Videos
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US
  • c:\Python27\Lib\idlelib\idle_test
  • c:\Python27\Lib\test\https_svn_python_org_root.pem
  • c:\Python27\include
  • c:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml
  • c:\Python27\Lib\test\nullcert.pem
  • c:\Python27\Lib\site-packages\setuptools
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp
  • c:\Python27\include\cobject.h
  • c:\6cdeacda242012e0e5b593e657\1029
  • c:\6cdeacda242012e0e5b593e657\1028
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}
  • c:\Python27\Lib\site-packages\pip\commands
  • c:\Python27\Lib\lib2to3\tests\data\fixers\myfixes
  • c:\6cdeacda242012e0e5b593e657\1025
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us
  • c:\ProgramData\Adobe\ARM\S\5521
  • c:\Python27\Lib\email\test\data
  • c:\ProgramData\Microsoft\Windows Defender\Support
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\UYNyjHStpye.doc
  • c:\ProgramData\WebEx\WebEx
  • c:\yvqjybpr\bin
  • c:\6cdeacda242012e0e5b593e657\2052
  • c:\yvqjybpr\lib\api
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css
  • UNC\SHARDREALM\Users\Default\Saved Games
  • c:\Python27\tcl\tcl8.5\opt0.4
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases
  • c:\Python27\include\pgenheaders.h
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US
  • c:\Python27\tcl\tcl8.5\encoding
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs
  • c:\Python27\Lib\email\test\data\msg_31.txt
  • c:\Python27\Lib\msilib
  • c:\ProgramData\Microsoft\WwanSvc\Profiles
  • UNC\SHARDREALM\Users\Harry Dresden\Contacts
  • c:\Python27\Lib\encodings
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\_backport
  • c:\ProgramData\Microsoft\Assistance\Client
  • UNC\SHARDREALM\Users\Default\Pictures
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\95
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf
  • c:\Python27\Lib\site-packages\_markerlib
  • c:\Python27\Lib\email\test\data\msg_39.txt
  • c:\ProgramData\Microsoft\Diagnosis\LocalTraceStore
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html
  • c:\inetpub\custerr
  • c:\Python27\include\longintrepr.h
  • c:\inetpub\custerr\en-US
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches
  • c:\Python27\Lib\test\185test.db
  • c:\Python27\include\opcode.h
  • c:\ProgramData\Microsoft\Crypto\RSA
  • c:\6cdeacda242012e0e5b593e657\1046\LocalizedData.xml
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf
  • c:\Python27\tcl\tk8.5\ttk
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\01
  • c:\Users\Default\Favorites
  • c:\inetpub\history
  • c:\Python27\include\moduleobject.h
  • c:\ProgramData\Microsoft\Windows NT
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\chardet
  • c:\yvqjybpr\lib
  • c:\ProgramData\Microsoft\Vault
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData
  • UNC\SHARDREALM\Users\Harry Dresden\Pictures
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf
  • c:\Python27\include\boolobject.h
  • C:\Windows\SysWOW64\en-US\VssTrace.DLL.mui
  • c:\Python27\include\token.h
  • UNC\SHARDREALM\Users\Default\Videos
  • c:\Python27\include\bitset.h
  • c:\Python27\include\warnings.h
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages
  • UNC\SHARDREALM\Users\Harry Dresden
  • c:\ProgramData\Mozilla\logs
  • UNC\SHARDREALM\Users\Public\Recorded TV
  • c:\Python27\include\pycapsule.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\70
  • c:\Python27\tcl\tcl8.5\tzdata\Mexico
  • c:\Python27\Lib\importlib
  • c:\ProgramData\Microsoft\Crypto
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\media
  • c:\Python27\tcl\tcl8.5
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Koala.jpg
  • c:\Python27\tcl\tcl8.5\tzdata\Africa
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs
  • c:\ProgramData\McAfee
  • c:\Python27\include\enumobject.h
  • c:\Python27\Lib\site-packages\pip\vcs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp
  • c:\Python27\Lib\bsddb\test
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43
  • c:\Python27\Lib\test\keycert2.pem
  • c:\ProgramData\Microsoft\Search\Data\Applications
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F7
  • c:\Python27\include\ucnhash.h
  • c:\Python27\include\py_curses.h
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3
  • c:\Python27\Lib\xml\parsers
  • c:\Python27\Lib\test\check_soundcard.vbs
  • c:\Python27\Lib\test\keycert4.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp
  • c:\Python27\tcl\tcl8.5\msgs
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Inbox
  • c:\Users\Harry Dresden
  • UNC\SHARDREALM\Users\Public\Recorded TV\Sample Media
  • c:\Python27\include\node.h
  • c:\ProgramData\McAfee\MCLOGS\Common\jxpiinstall
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\NetFx40_IIS_schema_update.xml
  • c:\ProgramData\Microsoft\Windows Defender\Quarantine
  • c:\Users\Public\Favorites
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  • c:\ProgramData\Microsoft\Office
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg
  • UNC\SHARDREALM\Users\Public
  • c:\ProgramData\NovaTech Network\NovaBench
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  • c:\Python27\Lib\site-packages\pip\_vendor\_markerlib
  • c:\Python27\tcl\reg1.2
  • c:\Users\ruiner
  • c:\Python27\Lib\xml\etree
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp
  • c:\ProgramData\Microsoft\Media Player
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl
  • c:\Users\Public\Videos\Sample Videos
  • UNC\SHARDREALM\Users\Harry Dresden\Favorites
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01
  • c:\Python27\include\symtable.h
  • c:\Python27\Lib\email\test\data\msg_41.txt
  • c:\Python27\include\cStringIO.h
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp
  • c:\Python27\tcl\tcl8.5\tzdata\Antarctica
  • c:\Python27\Lib\xml\sax
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\trie
  • c:\Users\Harry Dresden\Desktop
  • c:\Users\Public\Recorded TV
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css
  • c:\ProgramData\Microsoft\Office\Heartbeat
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\42
  • c:\Python27\tcl\tcl8.5\tzdata\Etc
  • c:\Python27\Lib\bsddb
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\47
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\JjeAMQAxnRdP.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95
  • c:\6cdeacda242012e0e5b593e657\2052\LocalizedData.xml
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups
  • c:\6cdeacda242012e0e5b593e657\1053\LocalizedData.xml
  • c:\Python27\Lib\wsgiref
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\contrib
  • c:\Python27\include\pyfpe.h
  • c:\ProgramData\Microsoft\User Account Pictures
  • c:\ProgramData\Sun\Java\Java Update
  • c:\yvqjybpr
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png
  • c:\Users
  • c:\Users\Default\Saved Games
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources
  • c:\inetpub\history\CFGHISTORY_0000000005\schema
  • c:\Python27\include\datetime.h
  • c:\inetpub
  • c:\Users\Default
  • c:\Python27\tcl\tcl8.5\tzdata\Pacific
  • c:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog
  • c:\Python27\tcl\tk8.5\msgs
  • c:\Python27\tcl\tcl8.5\tzdata\America
  • c:\ProgramData\Microsoft\Diagnosis\DownloadedSettings
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\{98101498-C465-4F51-8751-D1919E97D29D}
  • c:\inetpub\wwwroot
  • c:\Python27\Lib\multiprocessing\dummy
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}
  • c:\ProgramData\Microsoft\MF
  • c:\Python27\include\errcode.h
  • c:\Python27\Lib\test
  • c:\Python27\Lib\test\keycert3.pem
  • c:\Users\Public\Downloads
  • c:\Python27\Lib\site-packages
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage
  • c:\ProgramData\Microsoft\Device Stage\Task
  • c:\6cdeacda242012e0e5b593e657\1045\LocalizedData.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp
  • c:\Python27\include\pyerrors.h
  • c:\Python27\Lib\unittest
  • c:\6cdeacda242012e0e5b593e657\Graphics
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}
  • c:\Python27\Lib\test\capath
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif
  • c:\Recovery
  • c:\ProgramData\Microsoft\Device Stage
  • c:\Python27\tcl\tk8.5\demos
  • c:\Python27\include\ceval.h
  • c:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18
  • UNC\SHARDREALM\Users\Public\Desktop
  • c:\ProgramData\Microsoft\Assistance\Client\1.0
  • c:\Python27\include\pythonrun.h
  • c:\Python27\include\structmember.h
  • c:\ProgramData\Oracle
  • c:\Python27\include\pygetopt.h
  • c:\Python27\Lib\distutils\tests
  • c:\Python27\include\codecs.h
  • c:\Python27\Lib\logging
  • c:\ProgramData\Microsoft\RAC
  • c:\Python27\Lib\site-packages\pip\req
  • c:\Users\Harry Dresden\Links
  • c:\ProgramData\Microsoft\DeviceSync
  • c:\Python27\Doc
  • c:\Python27\Lib\email\test\data\msg_33.txt
  • c:\Users\Public\Pictures
  • c:\Python27\tcl\tix8.4.3\demos\bitmaps
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml
  • c:\Python27\Lib\site-packages\pip\_vendor\requests
  • c:\Python27\include\patchlevel.h
  • c:\yvqjybpr\lib\core
  • c:\Python27\include\bytes_methods.h
  • c:\Python27\Lib\compiler
  • c:\Python27\Scripts
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\42
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\17
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx40_IIS_schema_update.xml
  • c:\Users\Public\Recorded TV\Sample Media
  • c:\Python27\include\structseq.h
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf
  • c:\Python27\Lib\test\keycert.pem
  • c:\Python27\include\traceback.h
  • c:\Python27\tcl\dde1.3
  • c:\Python27\tcl\tcl8.5\tzdata\SystemV
  • c:\ProgramData\NovaTech Network
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf
  • \\?\PIPE\lsarpc
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp
  • c:\yvqjybpr\modules\packages
  • UNC\SHARDREALM\Users\ruiner
  • c:\ProgramData\Sun\Java
  • c:\Python27\Lib\test\ssl_cert.pem
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js
  • c:\ProgramData\Microsoft\Diagnosis\AsimovUploader
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml
  • c:\Python27\tcl\tcl8.5\tzdata\Chile
  • c:\ProgramData\Microsoft\ClickToRun\UserData
  • c:\Python27\Lib\test\xmltestdata
  • c:\ProgramData\Microsoft\WPD
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp
  • c:\Python27\Lib\site-packages\pip\_vendor
  • c:\ProgramData\Sun
  • c:\Python27\include\Python.h
  • UNC\SHARDREALM\Users\Default\Documents
  • c:\Python27\Lib\email\test\data\msg_34.txt
  • c:\Python27\tcl\tclConfig.sh
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp
  • c:\Python27\include\metagrammar.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp
  • c:\yvqjybpr\modules\auxiliary
  • c:\Python27\include\pystate.h
  • c:\Users\Default\Desktop
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
  • c:\ProgramData\Microsoft\WwanSvc
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png
  • \\?\PIPE\wkssvc
  • c:\ProgramData\Microsoft\Event Viewer\Views
  • c:\Python27\Lib\json\tests
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\serializer
  • c:\Python27\include\osdefs.h
  • c:\Python27\Tools
  • c:\Python27\include\timefuncs.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css
  • c:\ProgramData\Microsoft\IlsCache
  • c:\Python27\Lib\lib-tk
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Store
  • c:\ProgramData\Microsoft\Windows NT\MSFax\SentItems
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx45_IIS_schema_update.xml
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\en-us.16
  • c:\Python27\Lib\site-packages\pip\operations
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox
  • c:\Python27\Lib\site-packages\pip\_vendor\lockfile
  • c:\Python27\Lib\curses
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures
  • c:\Python27\include\pystrcmp.h
  • c:\Python27\include\floatobject.h
  • UNC\SHARDREALM\Users\Default\NTUSER.DAT.LOG
  • c:\yvqjybpr\lib\common
  • c:\Python27\Lib\test\pycacert.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg
  • c:\Python27\include\pymactoolbox.h
  • c:\Python27\Lib\test\badkey.pem
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp
  • c:\Users\Default\Music
  • c:\Python27\Lib\email\mime
  • c:\Users\Harry Dresden\Music
  • c:\6cdeacda242012e0e5b593e657\1053
  • c:\6cdeacda242012e0e5b593e657\1055
  • UNC\SHARDREALM\Users\Public\Favorites
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3
  • c:\Python27\tcl\tcl8.5\tzdata\Asia
  • UNC\SHARDREALM\Users\Public\Downloads
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css
  • c:\Python27\Lib\multiprocessing
  • c:\Users\Default\Documents
  • UNC\SHARDREALM\Users\Public\Videos\Sample Videos\Wildlife.wmv
  • c:\Python27\Tools\pynche
  • c:\Users\Public\Desktop
  • c:\ProgramData\Microsoft\User Account Pictures\Default Pictures
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js
  • c:\Python27\Lib\lib-tk\test\test_ttk
  • c:\Users\Harry Dresden\Documents
  • c:\6cdeacda242012e0e5b593e657\1049\LocalizedData.xml
  • c:\Python27\include\sysmodule.h
  • c:\ProgramData\McAfee\MCLOGS\Common
  • c:\Python27\Lib\email\test\data\msg_35.txt
  • UNC\SHARDREALM\Users\Harry Dresden\Favorites\Links
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp
  • c:\ProgramData\Microsoft\IdentityCRL
  • c:\ProgramData\WebEx\WebEx\12_1324
  • c:\Python27\Lib\site-packages\pip\utils
  • c:\Python27\Lib\distutils\command
  • c:\Users\Harry Dresden\Saved Games
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp
  • UNC\SHARDREALM\Users\Default
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml
  • c:\Python27\include\pyarena.h
  • c:\ProgramData\Microsoft\Windows Defender
  • c:\Python27\include\eval.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg
  • c:\6cdeacda242012e0e5b593e657\2070\LocalizedData.xml
  • c:\Python27
  • c:\Python27\Lib\hotshot
  • UNC\SHARDREALM\Users\Public\Music\Sample Music\Sleep Away.mp3
  • c:\Python27\include\genobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader
  • UNC\SHARDREALM\Users\Harry Dresden\Downloads\cleandesktop.py.txt
  • c:\Python27\Tools\versioncheck
  • c:\Python27\tcl\tcl8.5\tzdata\Arctic
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F7
  • c:\Users\Public\Music
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3
  • c:\Python27\Lib\test\audiodata
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Desert.jpg
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters
  • c:\Python27\include\intrcheck.h
  • c:\ProgramData\Microsoft\Network\Connections
  • c:\Python27\Lib\sqlite3
  • c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
  • UNC\SHARDREALM\Users\Public\Pictures
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\43
  • c:\Python27\Lib\test\sha256.pem
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js
  • UNC\SHARDREALM\Users\Default\Downloads
  • UNC\SHARDREALM\Users\Default\Links
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  • c:\ProgramData\Microsoft\Diagnosis
  • c:\Python27\Lib\distutils
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\tests
  • c:\Python27\Lib\idlelib\Icons
  • c:\ProgramData\Microsoft\Device Stage\Device
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib
  • c:\Python27\Lib\test\subprocessdata
  • c:\yvqjybpr\modules
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\35
  • c:\Python27\include\pymem.h
  • c:\inetpub\wwwroot\aspnet_client
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem
  • c:\ProgramData\Microsoft\Network\Downloader
  • c:\Users\Public\Foxit Software
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Quick
  • c:\ProgramData\Microsoft\Windows NT\MSScan
  • c:\Python27\Lib\lib2to3\tests
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem
  • c:\ProgramData\Microsoft OneDrive\setup
  • c:\ProgramData\Microsoft\Crypto\DSS\MachineKeys
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf
  • c:\Python27\Lib\site-packages\pkg_resources
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info
  • c:\Python27\include\Python-ast.h
  • c:\Python27\include\rangeobject.h
  • c:\Python27\tcl\tcl8.5\tzdata\Brazil
  • c:\Users\Harry Dresden\Favorites\Links
  • c:\Python27\Lib\test\imghdrdata
  • c:\Python27\include\iterobject.h
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates
  • UNC\SHARDREALM\Users\Harry Dresden\Saved Games
  • c:\ProgramData\Microsoft\RAC\Outbound
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp
  • c:\inetpub\history\CFGHISTORY_0000000002
  • c:\Python27\include\funcobject.h
  • c:\Python27\include\listobject.h
  • c:\ProgramData\Microsoft\NetFramework
  • c:\ProgramData\Adobe\ARM\Reader_11.0.10
  • c:\ProgramData\Microsoft
  • c:\Users\Public\Pictures\Sample Pictures
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Service
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png
  • c:\Users\Default\Videos
  • c:\ProgramData\Microsoft\Search\Data
  • c:\Python27\tcl
  • c:\Python27\Lib\json
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\JHOYfmcmMF.ppt
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US
  • c:\Python27\include\pythread.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement
  • c:\Python27\Lib\lib2to3\fixes
  • c:\Python27\tcl\tix8.4.3\bitmaps
  • c:\Python27\Lib\site-packages\setuptools\command
  • c:\6cdeacda242012e0e5b593e657
  • c:\6cdeacda242012e0e5b593e657\1043\LocalizedData.xml
  • c:\Python27\tcl\tcl8.5\tzdata\America\Indiana
  • c:\6cdeacda242012e0e5b593e657\2070
  • c:\Python27\include\sliceobject.h
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\DsoWNFsAkn.doc
  • c:\Users\Public\Videos
  • c:\Python27\Lib\test\decimaltestdata
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\DD
  • c:\Python27\include\descrobject.h
  • c:\ProgramData\Microsoft\Diagnosis\UIF
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A6
  • c:\Python27\tcl\tcl8.5\tzdata\Europe
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5
  • c:\Python27\include\stringobject.h
  • c:\Python27\Lib\lib2to3
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default
  • UNC\SHARDREALM\Users\Harry Dresden\Desktop\ojSoVPfzdlxDA.doc
  • c:\Python27\include\intobject.h
  • c:\ProgramData\Microsoft\Event Viewer
  • c:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs
  • c:\Python27\Lib\test\ssl_key.pem
  • c:\ProgramData\Microsoft\ClickToRun
  • c:\Python27\tcl\tix8.4.3\pref
  • c:\Python27\include\methodobject.h
  • c:\Python27\include\pyconfig.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp
  • UNC\SHARDREALM\Users\Default\Favorites
  • c:\Python27\tcl\tcl8.5\http1.0
  • c:\Python27\include\pymath.h
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf
  • c:\Python27\include\parsetok.h
  • c:\ProgramData\Adobe\Acrobat\11.0
  • c:\Python27\Lib\email\test\data\msg_32.txt
  • c:\Python27\Lib\ensurepip\_bundled
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg
  • c:\Python27\include\classobject.h
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us
  • c:\Python27\Lib\test\ssl_key.passwd.pem
  • c:\Users\Public\Music\Sample Music
  • c:\Python27\tcl\tcl8
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager
  • c:\Python27\Lib\lib2to3\tests\data
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70
  • c:\ProgramData\Microsoft OneDrive
  • UNC\SHARDREALM\Users\Harry Dresden\Searches
  • c:\Python27\tcl\tcl8.5\tzdata\America\Argentina
  • c:\Python27\include\setobject.h
  • c:\Recovery\015e7760-d44b-11e0-8947-954f09601788
  • c:\Python27\Lib\idlelib
  • c:\PerfLogs\Admin
  • c:\Python27\include\graminit.h
  • c:\Python27\Lib\site-packages\pip\_vendor\progress
  • c:\Users\Harry Dresden\Pictures
  • c:\ProgramData\Microsoft\Diagnosis\Sideload
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\ssl_match_hostname
  • c:\Users\Harry Dresden\Favorites
  • c:\ProgramData\Passmark
  • c:\Python27\Lib\lib-tk\test
  • c:\6cdeacda242012e0e5b593e657\Strings.xml
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf
  • c:\ProgramData\Adobe
  • c:\Users\Public\Foxit Software\Foxit Reader
  • c:\ProgramData\Microsoft\Search
  • c:\ProgramData\Passmark\PerformanceTest
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs
  • UNC\SHARDREALM\Users\Public\Videos\Sample Videos
  • c:\Python27\include\bytearrayobject.h
  • c:\ProgramData\Microsoft\NetFramework\BreadcrumbStore
  • c:\Python27\Lib\email\test
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}
  • c:\ProgramData\WebEx
  • c:\inetpub\wwwroot\msmq
  • c:\Python27\tcl\tix8.4.3\demos
  • c:\6cdeacda242012e0e5b593e657\3082\LocalizedData.xml
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp
  • c:\Python27\include\dictobject.h
  • c:\Python27\include\unicodeobject.h
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\packaging
  • c:\yvqjybpr\bin\cert.p12
  • c:\ProgramData\McAfee\MCLOGS
  • c:\Users\Default\Pictures
  • c:\6cdeacda242012e0e5b593e657\1049
  • c:\Users\Public\Documents
  • c:\6cdeacda242012e0e5b593e657\1046
  • c:\6cdeacda242012e0e5b593e657\1045
  • c:\6cdeacda242012e0e5b593e657\1044
  • c:\6cdeacda242012e0e5b593e657\1043
  • c:\6cdeacda242012e0e5b593e657\1042
  • c:\6cdeacda242012e0e5b593e657\1041
  • c:\6cdeacda242012e0e5b593e657\1040
  • c:\Python27\Lib\site-packages\pip\_vendor\packaging
  • c:\ProgramData\Microsoft\eHome\logs
  • c:\ProgramData\Microsoft\Windows Defender\Scans
  • c:\ProgramData\Microsoft\Windows NT\MSFax
  • c:\Python27\Lib\email\test\data\msg_38.txt
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg
  • c:\Python27\Lib\test\nullbytecert.pem
  • c:\Python27\Lib\sqlite3\test
  • c:\Python27\Lib\test\dh1024.pem
  • c:\ProgramData\Mozilla
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf
  • UNC\SHARDREALM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0
  • UNC\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates
  • c:\Python27\include\weakrefobject.h
  • c:\Python27\Lib\lib2to3\pgen2
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History
  • c:\Python27\Lib\idlelib\idle.bat
  • c:\Python27\include\code.h
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\NetFx45_IIS_schema_update.xml
  • c:\Python27\Lib\email\test\data\msg_40.txt
  • c:\Python27\include\cellobject.h
  • c:\ProgramData\Microsoft\RAC\StateData
  • c:\6cdeacda242012e0e5b593e657\1038
  • c:\ProgramData\Microsoft\DRM\Server
  • c:\6cdeacda242012e0e5b593e657\1032
  • c:\6cdeacda242012e0e5b593e657\1033
  • c:\6cdeacda242012e0e5b593e657\1030
  • c:\6cdeacda242012e0e5b593e657\1031
  • c:\6cdeacda242012e0e5b593e657\1036
  • c:\6cdeacda242012e0e5b593e657\1037
  • c:\6cdeacda242012e0e5b593e657\1035
File-Moved
  • c:\Python27\include\pgenheaders.h -> c:\Python27\include\076E35C0-5E29-6BE8-1FBC-A5A5912F5EE7.thor
  • c:\Python27\include\pyctype.h -> c:\Python27\include\076E35C0-5E29-6BE8-8EC0-A5464DC1375B.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\line.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-56D7-B88D3651830B.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\nor.js -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\076E35C0-5E29-6BE8-A218-DB31D932F7BE.thor
  • c:\Python27\include\pystrtod.h -> c:\Python27\include\076E35C0-5E29-6BE8-4987-115D934A9C9A.thor
  • c:\6cdeacda242012e0e5b593e657\1025\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1025\076E35C0-5E29-6BE8-6C95-39D20E07DEE6.thor
  • c:\Python27\include\intrcheck.h -> c:\Python27\include\076E35C0-5E29-6BE8-9607-4609F2980252.thor
  • c:\6cdeacda242012e0e5b593e657\1044\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1044\076E35C0-5E29-6BE8-F4E6-11B023136E80.thor
  • c:\6cdeacda242012e0e5b593e657\1049\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1049\076E35C0-5E29-6BE8-4DC6-4AE4A12B14BF.thor
  • c:\Python27\tcl\tix8.4.3\pref\WmDefault.cs -> c:\Python27\tcl\tix8.4.3\pref\076E35C0-5E29-6BE8-C86D-F33FF8E8A7E8.thor
  • c:\Python27\include\pyarena.h -> c:\Python27\include\076E35C0-5E29-6BE8-71DB-C8E05B3E2FFA.thor
  • c:\6cdeacda242012e0e5b593e657\1043\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1043\076E35C0-5E29-6BE8-480D-F300C7150D33.thor
  • c:\Python27\Lib\email\test\data\msg_40.txt -> c:\Python27\Lib\email\test\data\076E35C0-5E29-6BE8-6A14-A8F47057EC2A.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Desert.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\076E35C0-5E29-6BE8-8E59-D209829AD1A3.thor
  • c:\Python27\tcl\tix8.4.3\pref\Blue.cs -> c:\Python27\tcl\tix8.4.3\pref\076E35C0-5E29-6BE8-228E-4CCD7321DD8A.thor
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\NetFx45_IIS_schema_update.xml -> c:\inetpub\history\CFGHISTORY_0000000004\schema\076E35C0-5E29-6BE8-3586-D3E43BEBBAF0.thor
  • c:\6cdeacda242012e0e5b593e657\1028\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1028\076E35C0-5E29-6BE8-E387-4DFEC7CE8030.thor
  • c:\6cdeacda242012e0e5b593e657\1030\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1030\076E35C0-5E29-6BE8-D7C7-3CED982E938E.thor
  • c:\Python27\Lib\email\test\data\msg_30.txt -> c:\Python27\Lib\email\test\data\076E35C0-5E29-6BE8-0E98-4E41AAA68AFD.thor
  • c:\Python27\include\pgen.h -> c:\Python27\include\076E35C0-5E29-6BE8-61CB-983C6913D5D1.thor
  • c:\Python27\include\intobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-C40B-ED1FDEB8047A.thor
  • c:\6cdeacda242012e0e5b593e657\3082\eula.rtf -> c:\6cdeacda242012e0e5b593e657\3082\076E35C0-5E29-6BE8-1CF9-BBFFEF8B0CBB.thor
  • c:\Python27\include\Python-ast.h -> c:\Python27\include\076E35C0-5E29-6BE8-0BC6-6628E907111B.thor
  • c:\Python27\include\abstract.h -> c:\Python27\include\076E35C0-5E29-6BE8-1E69-B422A03281ED.thor
  • c:\Python27\include\longintrepr.h -> c:\Python27\include\076E35C0-5E29-6BE8-F8CE-D56C326B451E.thor
  • c:\Python27\Lib\email\test\data\msg_33.txt -> c:\Python27\Lib\email\test\data\076E35C0-5E29-6BE8-5FBC-CA43F72C8A55.thor
  • c:\6cdeacda242012e0e5b593e657\1040\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1040\076E35C0-5E29-6BE8-31B5-7B86C6073CE7.thor
  • c:\Python27\Lib\test\badkey.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-16B9-B6D62DBE5598.thor
  • c:\Python27\Lib\email\test\data\msg_31.txt -> c:\Python27\Lib\email\test\data\076E35C0-5E29-6BE8-FADE-675756F22E08.thor
  • \\SHARDREALM\Users\Public\Music\Sample Music\Kalimba.mp3 -> \\SHARDREALM\Users\Public\Music\Sample Music\076E35C0-5E29-6BE8-1067-330B45C67C67.thor
  • c:\Python27\tcl\tix8.4.3\pref\TixGray.cs -> c:\Python27\tcl\tix8.4.3\pref\076E35C0-5E29-6BE8-2905-D07E60525102.thor
  • c:\Python27\include\opcode.h -> c:\Python27\include\076E35C0-5E29-6BE8-1F4C-F81F75F309D3.thor
  • c:\Python27\include\moduleobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-7C21-7F0BE66C9D87.thor
  • \\SHARDREALM\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3 -> \\SHARDREALM\Users\Public\Music\Sample Music\076E35C0-5E29-6BE8-9EC5-DD01F381D216.thor
  • c:\Python27\include\warnings.h -> c:\Python27\include\076E35C0-5E29-6BE8-4BB8-65B39B2447DE.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Tulips.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\076E35C0-5E29-6BE8-F04D-AC8A521267D1.thor
  • c:\Python27\include\grammar.h -> c:\Python27\include\076E35C0-5E29-6BE8-EC64-EF3FADA935A9.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Enterprise PDF Reader.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-2475-541C880E4E61.thor
  • c:\Python27\include\listobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-251A-AD55820872A9.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect your PDF files with AD RMS.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-4A7A-DC81D342D0CE.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Edit and reflow paragraphs in PDF files.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-6E7B-CEFA1D2CDA92.thor
  • c:\Python27\include\longobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-0E1F-3E1BD626F58A.thor
  • c:\Python27\include\timefuncs.h -> c:\Python27\include\076E35C0-5E29-6BE8-53B8-1BCF4CE21313.thor
  • c:\Python27\include\dictobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-99EA-9D878B554790.thor
  • c:\Python27\include\ucnhash.h -> c:\Python27\include\076E35C0-5E29-6BE8-F003-29D6C0AD0C70.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\index.html -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\076E35C0-5E29-6BE8-46EA-279017082FB5.thor
  • c:\Python27\include\pymacconfig.h -> c:\Python27\include\076E35C0-5E29-6BE8-2F30-936D06C50298.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\076E35C0-5E29-6BE8-FE43-312D1F7A0379.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\076E35C0-5E29-6BE8-3C7F-3746B9844262.thor
  • c:\Python27\include\compile.h -> c:\Python27\include\076E35C0-5E29-6BE8-80D1-B0BBB4664B2C.thor
  • c:\Python27\include\pythread.h -> c:\Python27\include\076E35C0-5E29-6BE8-1EFB-4BAA6DE8EA92.thor
  • c:\Python27\tcl\tix8.4.3\pref\SGIGray.cs -> c:\Python27\tcl\tix8.4.3\pref\076E35C0-5E29-6BE8-4890-0A21DA645A26.thor
  • c:\Python27\Lib\email\test\data\msg_36.txt -> c:\Python27\Lib\email\test\data\076E35C0-5E29-6BE8-C6DD-1FD4DCC5E844.thor
  • c:\Python27\Lib\test\nokia.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-7AC9-03DFD717F56B.thor
  • c:\Python27\include\genobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-F842-1585990BD6D2.thor
  • \\SHARDREALM\Users\Public\Videos\Sample Videos\Wildlife.wmv -> \\SHARDREALM\Users\Public\Videos\Sample Videos\076E35C0-5E29-6BE8-5DD4-D30E49EB04B9.thor
  • c:\Python27\include\pymem.h -> c:\Python27\include\076E35C0-5E29-6BE8-6583-78A8B7B929A7.thor
  • c:\Python27\Lib\test\ssl_cert.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-4A66-FF7754B5B09C.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\076E35C0-5E29-6BE8-AC00-01103837F573.thor
  • c:\Python27\Lib\test\badcert.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-3ACC-BCA5ECD6F546.thor
  • c:\6cdeacda242012e0e5b593e657\2052\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\2052\076E35C0-5E29-6BE8-E6BB-0C9BEB291A74.thor
  • c:\Python27\tcl\tclConfig.sh -> c:\Python27\tcl\076E35C0-5E29-6BE8-BAEC-573840F98CEF.thor
  • c:\6cdeacda242012e0e5b593e657\1037\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1037\076E35C0-5E29-6BE8-7BA0-5CD688D6ABF1.thor
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\NetFx40_IIS_schema_update.xml -> c:\inetpub\history\CFGHISTORY_0000000004\schema\076E35C0-5E29-6BE8-1B9C-5736107973A5.thor
  • c:\6cdeacda242012e0e5b593e657\1044\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1044\076E35C0-5E29-6BE8-F317-C1A5B4FAC2D2.thor
  • c:\Python27\Lib\email\test\data\msg_35.txt -> c:\Python27\Lib\email\test\data\076E35C0-5E29-6BE8-1EE0-C916A018A856.thor
  • c:\Python27\Lib\test\nullbytecert.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-F384-52124DBDFA37.thor
  • c:\Python27\include\pymactoolbox.h -> c:\Python27\include\076E35C0-5E29-6BE8-BE64-B38AD0DCB066.thor
  • c:\Python27\Lib\test\ssl_key.passwd.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-ECC3-83CDD503BBFA.thor
  • c:\6cdeacda242012e0e5b593e657\1043\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1043\076E35C0-5E29-6BE8-ED26-ECD7183060F6.thor
  • c:\6cdeacda242012e0e5b593e657\1045\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1045\076E35C0-5E29-6BE8-7A9F-45B1B817E7BA.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\076E35C0-5E29-6BE8-600E-219E8FB3131C.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Protect Sensitive PDF Documents.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-8C1D-6E9ECC1CEB8E.thor
  • c:\Python27\include\weakrefobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-FD28-F132F2BEC729.thor
  • c:\Python27\include\fileobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-7E6B-CDD3AB1E1841.thor
  • c:\6cdeacda242012e0e5b593e657\1040\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1040\076E35C0-5E29-6BE8-6D72-6500959AA6E2.thor
  • c:\Python27\include\frameobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-4A5D-FF1BA97EA743.thor
  • c:\Python27\tcl\tix8.4.3\pref\TkWin.cs -> c:\Python27\tcl\tix8.4.3\pref\076E35C0-5E29-6BE8-4CCA-4460B4BD4B63.thor
  • c:\6cdeacda242012e0e5b593e657\1049\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1049\076E35C0-5E29-6BE8-5DEF-A2F2794EAE7E.thor
  • c:\6cdeacda242012e0e5b593e657\2070\eula.rtf -> c:\6cdeacda242012e0e5b593e657\2070\076E35C0-5E29-6BE8-2777-F7B51735C405.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your application.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-D3E6-85F407E03179.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_over_bg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-8360-8D2C3442E2A2.thor
  • c:\6cdeacda242012e0e5b593e657\1035\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1035\076E35C0-5E29-6BE8-6539-D5C44F3AAD08.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\076E35C0-5E29-6BE8-ACF1-B38519F0C0B8.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\body_bg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-8E22-7C074C63F4F9.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Edit and reflow paragraphs in PDF files.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-6C6A-A40214A473D4.thor
  • c:\Python27\Lib\test\pycacert.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-6181-9CDA6091005D.thor
  • c:\6cdeacda242012e0e5b593e657\UiInfo.xml -> c:\6cdeacda242012e0e5b593e657\076E35C0-5E29-6BE8-9F47-1A676A90D717.thor
  • c:\Python27\include\node.h -> c:\Python27\include\076E35C0-5E29-6BE8-2422-7A7AE2E59BCA.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\classic-16-open.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\076E35C0-5E29-6BE8-2AE7-A6E65E25940F.thor
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx40_IIS_schema_update.xml -> c:\inetpub\history\CFGHISTORY_0000000005\schema\076E35C0-5E29-6BE8-38DD-4E88C1317CC8.thor
  • c:\Python27\Lib\test\wrongcert.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-6AFB-116861BB1B71.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View and annotate PDFs.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-985E-260090CD41C4.thor
  • c:\Python27\include\parsetok.h -> c:\Python27\include\076E35C0-5E29-6BE8-F80E-B493CC40A89C.thor
  • c:\Python27\include\symtable.h -> c:\Python27\include\076E35C0-5E29-6BE8-F620-F983CD36D276.thor
  • c:\ProgramData\WebEx\WebEx\12_1324\gpc.php -> c:\ProgramData\WebEx\WebEx\12_1324\076E35C0-5E29-6BE8-0E55-0EA97D245DBA.thor
  • c:\6cdeacda242012e0e5b593e657\1036\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1036\076E35C0-5E29-6BE8-B291-98084C9522D8.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\Profile.xml -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-BC4E-895FF08CD02B.thor
  • c:\Python27\include\pyexpat.h -> c:\Python27\include\076E35C0-5E29-6BE8-1BC5-60F00C161D15.thor
  • c:\6cdeacda242012e0e5b593e657\1053\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1053\076E35C0-5E29-6BE8-AFD2-8EF7B677D90D.thor
  • c:\Python27\Lib\test\keycert.passwd.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-487E-14AC487D02AE.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index.html -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\076E35C0-5E29-6BE8-7F05-FAB228773EE2.thor
  • c:\Python27\include\metagrammar.h -> c:\Python27\include\076E35C0-5E29-6BE8-CD9D-335ADBE79B82.thor
  • c:\Python27\include\descrobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-5E8B-72B70BE7569E.thor
  • c:\Python27\include\ast.h -> c:\Python27\include\076E35C0-5E29-6BE8-B1DE-CD7294DA4793.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Enterprise PDF Reader.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-66B0-F940089BA1FD.thor
  • c:\Python27\include\codecs.h -> c:\Python27\include\076E35C0-5E29-6BE8-A96A-BFEC2A650D6A.thor
  • c:\Python27\tcl\tix8.4.3\pref\Bisque.cs -> c:\Python27\tcl\tix8.4.3\pref\076E35C0-5E29-6BE8-8D16-37047B5470DF.thor
  • c:\Python27\include\methodobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-A89E-64CBBDBFD6D7.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\ojSoVPfzdlxDA.doc -> \\SHARDREALM\Users\Harry Dresden\Desktop\076E35C0-5E29-6BE8-1079-34538F32C08C.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\XeeLFqLentIohZxS.pptx -> \\SHARDREALM\Users\Harry Dresden\Desktop\076E35C0-5E29-6BE8-7CDA-943573F4AA5B.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\076E35C0-5E29-6BE8-C326-11C42B91C3BC.thor
  • c:\Python27\include\Python.h -> c:\Python27\include\076E35C0-5E29-6BE8-7449-165A5CAB1415.thor
  • c:\6cdeacda242012e0e5b593e657\1042\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1042\076E35C0-5E29-6BE8-8E1C-FF411A756E48.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\JHOYfmcmMF.ppt -> \\SHARDREALM\Users\Harry Dresden\Desktop\076E35C0-5E29-6BE8-5C07-223CB38412DF.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\show_con_bg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-F590-6AAE56ECE6F5.thor
  • c:\Python27\include\errcode.h -> c:\Python27\include\076E35C0-5E29-6BE8-6CE6-5BCA3880E9C6.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\base.css -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\076E35C0-5E29-6BE8-877E-36BC4824A357.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\top_tb_bg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-99BB-B5CB8B70E230.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View PDFs on mobile devices.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-142A-27F44826127C.thor
  • c:\Python27\include\import.h -> c:\Python27\include\076E35C0-5E29-6BE8-4267-AFCACBDAD48B.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Koala.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\076E35C0-5E29-6BE8-04C2-7E1FF3389929.thor
  • \\SHARDREALM\Users\Harry Dresden\Downloads\big-hero-6-2.jpg -> \\SHARDREALM\Users\Harry Dresden\Downloads\076E35C0-5E29-6BE8-F4C2-A4C735E2874D.thor
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\NetFx45_IIS_schema_update.xml -> c:\inetpub\history\CFGHISTORY_0000000005\schema\076E35C0-5E29-6BE8-AA1C-E42C8F17C03C.thor
  • c:\Python27\include\funcobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-4569-F1CF32DFD694.thor
  • c:\Python27\Lib\test\https_svn_python_org_root.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-B848-2F3E30D37F09.thor
  • c:\6cdeacda242012e0e5b593e657\1046\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1046\076E35C0-5E29-6BE8-A22F-CA1DAE6E220D.thor
  • c:\6cdeacda242012e0e5b593e657\1029\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1029\076E35C0-5E29-6BE8-35BA-294116E329F2.thor
  • c:\Python27\include\floatobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-DEE4-9FC853E17E19.thor
  • c:\Python27\include\sysmodule.h -> c:\Python27\include\076E35C0-5E29-6BE8-7333-9243DE0600BE.thor
  • c:\Python27\Lib\test\185test.db -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-0756-BF5344D6B95B.thor
  • c:\Python27\Lib\test\dh1024.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-24E5-6CA786F63016.thor
  • c:\Python27\Lib\test\nullcert.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-0E58-9BFBAB1AB5BC.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\tab.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-4FFF-99B07CCDE011.thor
  • c:\Python27\include\datetime.h -> c:\Python27\include\076E35C0-5E29-6BE8-F0D7-8060F7FA2682.thor
  • c:\Python27\include\memoryobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-115C-3EF3053F331A.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\DD_belatedPNG.js -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\076E35C0-5E29-6BE8-5507-430E60964739.thor
  • c:\Python27\Lib\test\keycert3.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-7C30-383346528314.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\version.xml -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\076E35C0-5E29-6BE8-A561-275136C38DC5.thor
  • c:\6cdeacda242012e0e5b593e657\1055\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1055\076E35C0-5E29-6BE8-D083-BA2032F3F092.thor
  • c:\6cdeacda242012e0e5b593e657\1053\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1053\076E35C0-5E29-6BE8-8133-0FD314FB4D43.thor
  • c:\Python27\tcl\tix8.4.3\pref\Gray.cs -> c:\Python27\tcl\tix8.4.3\pref\076E35C0-5E29-6BE8-68B4-BC51F52695A3.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Fastest PDF Search and Index.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-EC59-2336A7A4257D.thor
  • c:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml -> c:\ProgramData\Microsoft\ClickToRun\076E35C0-5E29-6BE8-6186-2ADA807DCC2D.thor
  • c:\Python27\include\bitset.h -> c:\Python27\include\076E35C0-5E29-6BE8-1113-7C53D142DAE0.thor
  • c:\6cdeacda242012e0e5b593e657\1055\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1055\076E35C0-5E29-6BE8-DAC9-393B089A8D8B.thor
  • c:\6cdeacda242012e0e5b593e657\1045\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1045\076E35C0-5E29-6BE8-4D78-9CBABCFD40B3.thor
  • c:\Python27\include\code.h -> c:\Python27\include\076E35C0-5E29-6BE8-BC35-8E2CB6954C7C.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Design form fields easily.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-2295-14C50C6FCB88.thor
  • c:\6cdeacda242012e0e5b593e657\1031\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1031\076E35C0-5E29-6BE8-BA78-326B8225B6F9.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Create PDF from Office-convert PDF to office.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-4DA8-5F649E28298C.thor
  • c:\Python27\include\graminit.h -> c:\Python27\include\076E35C0-5E29-6BE8-56FE-45F870EE5A61.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Create PDF from Office-convert PDF to office.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-12D5-92059343CC30.thor
  • c:\Python27\include\setobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-2448-D17C85A6E19E.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\JjeAMQAxnRdP.rtf -> \\SHARDREALM\Users\Harry Dresden\Desktop\076E35C0-5E29-6BE8-FC65-42D390B2F6E9.thor
  • c:\Python27\include\structseq.h -> c:\Python27\include\076E35C0-5E29-6BE8-3421-8CB5D01686AC.thor
  • c:\yvqjybpr\bin\cert.p12 -> c:\yvqjybpr\bin\076E35C0-5E29-6BE8-B7ED-0EC4D1BCA40A.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_b.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\076E35C0-5E29-6BE8-0E15-1A767F996C97.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs.css -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\076E35C0-5E29-6BE8-EC7F-A8DC0F6162E9.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your mobile apps.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-7525-0B074ED6A719.thor
  • c:\6cdeacda242012e0e5b593e657\Strings.xml -> c:\6cdeacda242012e0e5b593e657\076E35C0-5E29-6BE8-B0AB-59064A05EBD7.thor
  • c:\Python27\include\objimpl.h -> c:\Python27\include\076E35C0-5E29-6BE8-E24E-61AF23D5797F.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\DsoWNFsAkn.doc -> \\SHARDREALM\Users\Harry Dresden\Desktop\076E35C0-5E29-6BE8-2915-E17D3E97EC79.thor
  • c:\Python27\tcl\tix8.4.3\pref\TK.cs -> c:\Python27\tcl\tix8.4.3\pref\076E35C0-5E29-6BE8-CC04-DFE5F9D65E7E.thor
  • c:\Python27\include\patchlevel.h -> c:\Python27\include\076E35C0-5E29-6BE8-73F5-C2D1641F91B3.thor
  • c:\Python27\Lib\test\keycert4.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-5CAB-80E09A274FF3.thor
  • c:\Python27\include\marshal.h -> c:\Python27\include\076E35C0-5E29-6BE8-004A-58F48069476C.thor
  • c:\Python27\include\asdl.h -> c:\Python27\include\076E35C0-5E29-6BE8-1ECC-F42E90E2E414.thor
  • c:\Python27\include\cStringIO.h -> c:\Python27\include\076E35C0-5E29-6BE8-6BC8-291050EC62DE.thor
  • \\SHARDREALM\Users\Public\Music\Sample Music\Sleep Away.mp3 -> \\SHARDREALM\Users\Public\Music\Sample Music\076E35C0-5E29-6BE8-B079-D08D585AEF22.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Integrate PDF into your mobile apps.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-CDC7-491B57472931.thor
  • c:\6cdeacda242012e0e5b593e657\1041\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1041\076E35C0-5E29-6BE8-86ED-044BA794F276.thor
  • c:\Python27\include\stringobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-B29B-DFFD3092BD2F.thor
  • \\SHARDREALM\Users\Harry Dresden\Downloads\cleandesktop.py.txt -> \\SHARDREALM\Users\Harry Dresden\Downloads\076E35C0-5E29-6BE8-6F6D-0B50331D3FE7.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Fastest PDF Search and Index.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-1399-E1728A62A189.thor
  • c:\6cdeacda242012e0e5b593e657\1046\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\1046\076E35C0-5E29-6BE8-01D5-86A77A65CCF1.thor
  • c:\Python27\include\pyconfig.h -> c:\Python27\include\076E35C0-5E29-6BE8-C595-19D3C801D674.thor
  • c:\Python27\include\bufferobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-BCB1-9FB5F0BF8604.thor
  • c:\Python27\include\structmember.h -> c:\Python27\include\076E35C0-5E29-6BE8-B56B-3F5D96226C90.thor
  • c:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml -> c:\ProgramData\Microsoft\ClickToRun\076E35C0-5E29-6BE8-EC96-B0D941412C26.thor
  • c:\Python27\include\object.h -> c:\Python27\include\076E35C0-5E29-6BE8-42FB-60871A523F9A.thor
  • c:\6cdeacda242012e0e5b593e657\2070\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\2070\076E35C0-5E29-6BE8-FE45-724278EA3AF5.thor
  • c:\Python27\include\enumobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-6574-B380958AED6C.thor
  • c:\Python27\Lib\email\test\data\msg_39.txt -> c:\Python27\Lib\email\test\data\076E35C0-5E29-6BE8-A701-240B339EA9A3.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\phantomPDF_s.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\076E35C0-5E29-6BE8-A649-936947764950.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\history_winbg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-9FE4-260BB343404D.thor
  • c:\Python27\include\complexobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-FAA0-647D56CE8BEE.thor
  • c:\Python27\include\pymath.h -> c:\Python27\include\076E35C0-5E29-6BE8-0939-B372A45C1A62.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\blank.gif -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\076E35C0-5E29-6BE8-C3DF-6FE66E1D0849.thor
  • \\SHARDREALM\Users\Harry Dresden\Desktop\UYNyjHStpye.doc -> \\SHARDREALM\Users\Harry Dresden\Desktop\076E35C0-5E29-6BE8-2EDF-740F83FDEEE5.thor
  • c:\Python27\include\bytesobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-E8D3-DC1E69A7F603.thor
  • c:\Python27\include\pyerrors.h -> c:\Python27\include\076E35C0-5E29-6BE8-EBB8-D649C2F8D937.thor
  • c:\Python27\include\boolobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-F7BE-67F0CF0192E1.thor
  • c:\6cdeacda242012e0e5b593e657\1032\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1032\076E35C0-5E29-6BE8-C568-B113B8008CA5.thor
  • c:\Python27\Lib\test\keycert2.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-4036-FD67DB195BDB.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\right_move_bg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-CFAE-B5C9EE89756C.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Powerful Word Processor.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-148E-CD16D2BC027F.thor
  • c:\Python27\include\bytes_methods.h -> c:\Python27\include\076E35C0-5E29-6BE8-E21B-672F918705B5.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\config.css -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-3F5E-B0C17033FB50.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\buy_phantom.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\076E35C0-5E29-6BE8-867D-C5273D03BC06.thor
  • c:\Python27\include\rangeobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-0CCF-1BAFCAE969A2.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon View and annotate PDFs.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-3EB1-E6D8EA7AAD1C.thor
  • c:\Python27\Lib\email\test\data\msg_32.txt -> c:\Python27\Lib\email\test\data\076E35C0-5E29-6BE8-EF2F-E61C7A350BA7.thor
  • c:\Python27\include\unicodeobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-48D6-0EE78C472731.thor
  • c:\Python27\Lib\idlelib\idle.bat -> c:\Python27\Lib\idlelib\076E35C0-5E29-6BE8-4AA2-B72503C16F46.thor
  • c:\Python27\include\modsupport.h -> c:\Python27\include\076E35C0-5E29-6BE8-CEE8-78390EE931FC.thor
  • c:\Python27\include\eval.h -> c:\Python27\include\076E35C0-5E29-6BE8-CAAB-7FDA9E82F180.thor
  • c:\Python27\include\traceback.h -> c:\Python27\include\076E35C0-5E29-6BE8-880F-183FC41CCF80.thor
  • c:\Python27\include\osdefs.h -> c:\Python27\include\076E35C0-5E29-6BE8-A011-594BB4ED32E5.thor
  • c:\Python27\Lib\test\keycert.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-387F-D7C138A35447.thor
  • \\SHARDREALM\Users\Default\NTUSER.DAT.LOG -> \\SHARDREALM\Users\Default\076E35C0-5E29-6BE8-AA5C-E62607816958.thor
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\Penguins.jpg -> \\SHARDREALM\Users\Public\Pictures\Sample Pictures\076E35C0-5E29-6BE8-20EB-3BE5956BCD70.thor
  • c:\Python27\Lib\email\test\data\msg_34.txt -> c:\Python27\Lib\email\test\data\076E35C0-5E29-6BE8-145D-3F3327225D50.thor
  • c:\Python27\include\tupleobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-C6F2-BB09D74D035F.thor
  • c:\Python27\include\pyfpe.h -> c:\Python27\include\076E35C0-5E29-6BE8-C26E-880A21E42041.thor
  • c:\Python27\Lib\test\empty.vbs -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-19FA-0654B14C1816.thor
  • c:\Python27\Lib\test\ssl_key.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-2C8B-D00850CB71DA.thor
  • c:\Python27\include\sliceobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-EB49-8E9DB1ED6625.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect your PDF files with AD RMS.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-D51A-268941B0FB16.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal View PDFs on mobile devices.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-3040-FD09EEB7794D.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\skin.css -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\076E35C0-5E29-6BE8-8FBE-70DEC22E6BCA.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Integrate PDF into your application.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-3290-B62C8375BA09.thor
  • c:\Python27\include\ceval.h -> c:\Python27\include\076E35C0-5E29-6BE8-B559-9EB813A529A9.thor
  • \\SHARDREALM\Users\Harry Dresden\Contacts\Harry Dresden.contact -> \\SHARDREALM\Users\Harry Dresden\Contacts\076E35C0-5E29-6BE8-BD7E-B4510AAAAA99.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal Powerful Word Processor.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-8051-510A8AD67D2C.thor
  • c:\Python27\include\bytearrayobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-201A-BE11BA8F190A.thor
  • c:\Python27\Lib\test\selfsigned_pythontestdotnet.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-220A-2F281756A461.thor
  • c:\Python27\Lib\email\test\data\msg_38.txt -> c:\Python27\Lib\email\test\data\076E35C0-5E29-6BE8-7575-66BD2DA1889C.thor
  • c:\6cdeacda242012e0e5b593e657\1042\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1042\076E35C0-5E29-6BE8-7D3A-20B544D2AD7D.thor
  • c:\Python27\include\pystrcmp.h -> c:\Python27\include\076E35C0-5E29-6BE8-F430-F2BDF77A7CDB.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\tabs-ie.css -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\076E35C0-5E29-6BE8-7A1C-06759D6D2865.thor
  • c:\Python27\include\pyport.h -> c:\Python27\include\076E35C0-5E29-6BE8-860C-7A15AF0514D0.thor
  • c:\Python27\Lib\test\check_soundcard.vbs -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-F2F2-A0883D2AF477.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\normal create pdf from scanner documents.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-7F56-A7CA1E034D05.thor
  • c:\Python27\include\pydebug.h -> c:\Python27\include\076E35C0-5E29-6BE8-56D0-37D5F8F311C1.thor
  • c:\Python27\include\iterobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-9581-AEEEAFF2B622.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\ribbon-16-open.png -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\076E35C0-5E29-6BE8-6375-588259423D70.thor
  • c:\Python27\include\token.h -> c:\Python27\include\076E35C0-5E29-6BE8-16A5-1AE5A288E67D.thor
  • c:\Python27\include\pythonrun.h -> c:\Python27\include\076E35C0-5E29-6BE8-8181-D7B8222622B3.thor
  • c:\Python27\include\cobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-3DC4-858EA4680082.thor
  • c:\6cdeacda242012e0e5b593e657\2052\eula.rtf -> c:\6cdeacda242012e0e5b593e657\2052\076E35C0-5E29-6BE8-8BD3-6599BDFFDEFA.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\index_ori.html -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\076E35C0-5E29-6BE8-280C-89DE8FFF2E8D.thor
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem -> c:\Python27\Lib\site-packages\pip\_vendor\requests\076E35C0-5E29-6BE8-026D-CA7D11846BC5.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Protect Sensitive PDF Documents.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-1260-40A0B5319868.thor
  • c:\6cdeacda242012e0e5b593e657\3082\LocalizedData.xml -> c:\6cdeacda242012e0e5b593e657\3082\076E35C0-5E29-6BE8-1A11-28EFC3D6FE1E.thor
  • c:\Python27\Lib\test\sha256.pem -> c:\Python27\Lib\test\076E35C0-5E29-6BE8-5EDD-11B468342B05.thor
  • c:\Python27\include\dtoa.h -> c:\Python27\include\076E35C0-5E29-6BE8-E562-110BF9016E5E.thor
  • c:\6cdeacda242012e0e5b593e657\1041\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1041\076E35C0-5E29-6BE8-8E2F-1CE22751EFDB.thor
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml -> c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\076E35C0-5E29-6BE8-F64C-6F65E2793ADC.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ProfileRibbon.xml -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-6CDF-E10FE24FB2AE.thor
  • c:\Python27\include\pystate.h -> c:\Python27\include\076E35C0-5E29-6BE8-E6BC-7F0C1BEF346E.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\history.txt -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\076E35C0-5E29-6BE8-AAF0-2B2F682914BE.thor
  • c:\Python27\include\classobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-067D-BB0D3C7FDC79.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\content_showbg.jpg -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\076E35C0-5E29-6BE8-D78B-029D6B5A7F3E.thor
  • c:\Python27\Lib\email\test\data\msg_41.txt -> c:\Python27\Lib\email\test\data\076E35C0-5E29-6BE8-D697-FA15BF2AD8ED.thor
  • c:\6cdeacda242012e0e5b593e657\1038\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1038\076E35C0-5E29-6BE8-43D0-FA33C9CBD861.thor
  • c:\Python27\include\pycapsule.h -> c:\Python27\include\076E35C0-5E29-6BE8-8BB9-7EFA065F822B.thor
  • c:\Python27\include\cellobject.h -> c:\Python27\include\076E35C0-5E29-6BE8-7F3C-9FA90A471A5C.thor
  • c:\Python27\include\py_curses.h -> c:\Python27\include\076E35C0-5E29-6BE8-3889-A5779385E9BC.thor
  • c:\6cdeacda242012e0e5b593e657\1033\eula.rtf -> c:\6cdeacda242012e0e5b593e657\1033\076E35C0-5E29-6BE8-87D9-5BAE90FCF8D6.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon create pdf from scanner documents.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-C044-27576496ED91.thor
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\ribbon Design form fields easily.bmp -> \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\076E35C0-5E29-6BE8-3940-3E135B70EC82.thor
  • c:\Python27\include\pygetopt.h -> c:\Python27\include\076E35C0-5E29-6BE8-C179-73BFC3715A04.thor
Network-Connects Host
  • flurrbinh.net
  • 185.67.0.102
Directory-Created
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YLC2QM2Y
  • C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Caches
Directory-Enumerated
  • c:\Python27\Lib\site-packages\pip\*
  • c:\Python27\tcl\tcl8\8.5\*
  • c:\ProgramData\Sun\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\*
  • c:\Python27\tcl\tk8.5\demos\images\*
  • c:\Users\ruiner\*
  • c:\Recovery\015e7760-d44b-11e0-8947-954f09601788\*
  • c:\PerfLogs\*
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\*
  • c:\ProgramData\Passmark\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\*
  • c:\Python27\Tools\pynche\X\*
  • c:\Users\Public\Music\Sample Music\*
  • c:\Python27\Lib\importlib\*
  • c:\Python27\tcl\tcl8.5\http1.0\*
  • c:\Python27\Lib\bsddb\*
  • \\SHARDREALM\Users\Harry Dresden\Pictures\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\17\*
  • c:\inetpub\wwwroot\aspnet_client\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\43\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog\*
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\tests\*
  • c:\Python27\tcl\tk8.5\ttk\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\*
  • c:\Users\Default\Saved Games\*
  • c:\Python27\tcl\tcl8.5\tzdata\Africa\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\*
  • c:\Python27\Tools\i18n\*
  • c:\ProgramData\Microsoft\ClickToRun\*
  • c:\Python27\Lib\site-packages\pip\_vendor\lockfile\*
  • c:\ProgramData\*
  • c:\6cdeacda242012e0e5b593e657\Graphics\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treebuilders\*
  • c:\Python27\Lib\compiler\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\*
  • c:\Python27\Lib\unittest\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\35\*
  • c:\Python27\Lib\test\capath\*
  • c:\yvqjybpr\*
  • c:\Users\Harry Dresden\OneDrive\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\*
  • c:\ProgramData\Adobe\Acrobat\11.0\*
  • c:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\*
  • c:\Python27\tcl\tcl8.5\*
  • c:\Python27\Lib\unittest\test\*
  • c:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319\*
  • c:\Users\Public\Videos\Sample Videos\*
  • c:\ProgramData\Microsoft\Network\Connections\*
  • c:\Users\Public\Recorded TV\*
  • c:\Users\Harry Dresden\Contacts\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\42\*
  • c:\yvqjybpr\lib\common\*
  • c:\Python27\tcl\tk8.5\msgs\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\*
  • c:\Python27\tcl\tcl8.5\tzdata\Atlantic\*
  • c:\Python27\tcl\tcl8.5\tzdata\Europe\*
  • c:\ProgramData\WebEx\WebEx\*
  • c:\Python27\tcl\tk8.5\demos\*
  • c:\ProgramData\Microsoft\Windows Defender\*
  • c:\ProgramData\Microsoft\PlayReady\Cache\*
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\_backport\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\01\*
  • c:\inetpub\history\CFGHISTORY_0000000005\*
  • c:\Python27\tcl\tix8.4.3\demos\samples\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\SentItems\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treewalkers\*
  • \\SHARDREALM\Users\Harry Dresden\Favorites\*
  • c:\ProgramData\Microsoft\PlayReady\Cache\S-1-5-21-3416602863-1947377224-293699093-1001\*
  • c:\6cdeacda242012e0e5b593e657\1037\*
  • c:\Python27\Lib\pydoc_data\*
  • c:\Users\Default\Pictures\*
  • \\SHARDREALM\Users\Default\Links\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\*
  • \\SHARDREALM\Users\Public\Music\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\serializer\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\95\*
  • c:\inetpub\custerr\*
  • c:\6cdeacda242012e0e5b593e657\1033\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\47\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\*
  • \\SHARDREALM\Users\Harry Dresden\Links\*
  • c:\Python27\Scripts\*
  • c:\Users\Public\Desktop\*
  • \\SHARDREALM\Users\Harry Dresden\Videos\*
  • c:\ProgramData\Microsoft\Network\Downloader\*
  • c:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\*
  • c:\Python27\Tools\pynche\*
  • c:\Python27\Lib\email\test\*
  • c:\yvqjybpr\modules\auxiliary\*
  • c:\ProgramData\Mozilla\logs\*
  • c:\ProgramData\Microsoft\IdentityCRL\*
  • c:\ProgramData\Microsoft\WPD\*
  • c:\ProgramData\Microsoft\Diagnosis\LocalTraceStore\*
  • c:\ProgramData\Microsoft\Event Viewer\*
  • c:\Users\Harry Dresden\Favorites\Links for United States\*
  • c:\Users\Default\*
  • c:\ProgramData\Sun\Java\Java Update\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\17\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\43\*
  • c:\Python27\tcl\dde1.3\*
  • c:\Python27\Lib\ensurepip\_bundled\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\95\*
  • c:\PerfLogs\Admin\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\treeadapters\*
  • c:\Python27\Lib\idlelib\*
  • c:\Python27\Lib\site-packages\pip\models\*
  • c:\inetpub\*
  • \\SHARDREALM\Users\Harry Dresden\Music\*
  • c:\Users\Harry Dresden\Saved Games\*
  • c:\inetpub\wwwroot\msmq\*
  • c:\ProgramData\Microsoft\DRM\*
  • c:\ProgramData\Microsoft\Crypto\RSA\*
  • c:\6cdeacda242012e0e5b593e657\1025\*
  • c:\Python27\Lib\test\crashers\*
  • c:\ProgramData\Microsoft\Search\Data\Applications\*
  • c:\Python27\Lib\ctypes\test\*
  • c:\Users\Public\Libraries\*
  • c:\ProgramData\Microsoft\Device Stage\*
  • \\SHARDREALM\Users\Harry Dresden\Searches\*
  • c:\ProgramData\Microsoft\Windows NT\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\01\*
  • c:\Python27\Lib\site-packages\setuptools-16.0.dist-info\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\*
  • \\SHARDREALM\Users\Public\Videos\Sample Videos\*
  • c:\Python27\Lib\xml\etree\*
  • c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F3\*
  • c:\Python27\Lib\test\*
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\Security\*
  • \\SHARDREALM\Users\Public\Libraries\*
  • c:\Python27\Lib\ctypes\macholib\*
  • c:\Python27\Lib\msilib\*
  • c:\Python27\Lib\site-packages\pip\_vendor\distlib\*
  • \\SHARDREALM\Users\Harry Dresden\Desktop\*
  • c:\6cdeacda242012e0e5b593e657\1035\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\DD\*
  • \\SHARDREALM\Users\Harry Dresden\Contacts\*
  • c:\ProgramData\Adobe\ARM\S\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\70\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\*
  • c:\Users\Default\Videos\*
  • c:\ProgramData\McAfee\MCLOGS\Common\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\js\*
  • c:\Users\Default\Documents\*
  • c:\6cdeacda242012e0e5b593e657\1031\*
  • c:\Python27\tcl\tcl8.5\tzdata\Pacific\*
  • \\SHARDREALM\Users\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\North_Dakota\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\*
  • c:\Python27\tcl\tcl8.5\tzdata\Etc\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\*
  • c:\ProgramData\Adobe\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\*
  • c:\inetpub\history\CFGHISTORY_0000000001\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\chardet\*
  • \\SHARDREALM\Users\Default\Music\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A6\*
  • c:\Python27\Lib\site-packages\pip\_vendor\pkg_resources\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\*
  • \\SHARDREALM\Users\Default\Favorites\*
  • c:\Python27\Tools\webchecker\*
  • c:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A5\*
  • c:\ProgramData\Adobe\Acrobat\11.0\Replicate\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\*
  • c:\ProgramData\NovaTech Network\NovaBench\*
  • \\SHARDREALM\Users\Public\Music\Sample Music\*
  • c:\Users\Harry Dresden\Favorites\Links\*
  • c:\ProgramData\Microsoft\Assistance\*
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\*
  • c:\inetpub\wwwroot\*
  • c:\Users\Harry Dresden\*
  • c:\Python27\tcl\tcl8.5\tzdata\Antarctica\*
  • c:\Python27\Lib\site-packages\pip\_vendor\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\E0\*
  • c:\ProgramData\Adobe\ARM\S\5521\*
  • \\SHARDREALM\Users\Public\Foxit Software\*
  • c:\Users\Public\Downloads\*
  • c:\6cdeacda242012e0e5b593e657\2070\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\x-none.16\*
  • c:\Python27\Lib\test\cjkencodings\*
  • c:\ProgramData\Microsoft\Assistance\Client\1.0\*
  • c:\ProgramData\Microsoft\Windows Defender\Support\*
  • c:\Python27\Lib\site-packages\pip\operations\*
  • \\SHARDREALM\Users\Harry Dresden\*
  • c:\ProgramData\Microsoft\MF\*
  • c:\6cdeacda242012e0e5b593e657\1029\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\1A\*
  • c:\Python27\Lib\distutils\tests\*
  • c:\ProgramData\Microsoft\Office\*
  • c:\Users\Public\Music\*
  • c:\ProgramData\Microsoft\ClickToRun\MachineData\*
  • c:\6cdeacda242012e0e5b593e657\1045\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\*
  • c:\Users\Harry Dresden\Desktop\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\*
  • c:\ProgramData\Microsoft\Crypto\*
  • \\SHARDREALM\Users\Public\Recorded TV\Sample Media\*
  • c:\Users\Public\Pictures\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\42\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\*
  • c:\Python27\include\*
  • c:\Python27\Lib\lib2to3\tests\data\fixers\*
  • c:\Python27\Lib\encodings\*
  • c:\Python27\Lib\site-packages\setuptools\*
  • c:\Python27\Lib\test\tracedmodules\*
  • c:\ProgramData\Microsoft\DRM\Server\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\*
  • c:\Python27\tcl\tcl8.5\tzdata\SystemV\*
  • c:\6cdeacda242012e0e5b593e657\1049\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\*
  • c:\Users\Harry Dresden\Music\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\*
  • c:\Python27\tcl\tcl8.5\tzdata\Mexico\*
  • c:\ProgramData\Microsoft\RAC\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\*
  • c:\ProgramData\Microsoft\WwanSvc\*
  • c:\Python27\tcl\tcl8.5\tzdata\Arctic\*
  • c:\ProgramData\Oracle\*
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\media\*
  • c:\ProgramData\Microsoft\Windows Defender\Quarantine\*
  • \\SHARDREALM\Users\Default\Pictures\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Queue\*
  • c:\ProgramData\Microsoft\RAC\Outbound\*
  • c:\ProgramData\WebEx\*
  • c:\inetpub\history\CFGHISTORY_0000000003\*
  • c:\Python27\Lib\site-packages\setuptools\command\*
  • c:\Python27\tcl\tcl8.5\tzdata\Indian\*
  • c:\ProgramData\Microsoft\Event Viewer\Views\*
  • c:\Users\Default\Favorites\*
  • c:\*
  • c:\Users\Default\Desktop\*
  • \\SHARDREALM\Users\Default\Desktop\*
  • c:\ProgramData\Microsoft\eHome\logs\*
  • c:\ProgramData\Microsoft\Network\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Kentucky\*
  • \\SHARDREALM\Users\Harry Dresden\Favorites\Links\*
  • c:\Python27\Lib\lib-tk\test\test_ttk\*
  • c:\Python27\tcl\tcl8.5\tzdata\US\*
  • c:\ProgramData\Microsoft\ClickToRun\UserData\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\*
  • c:\Users\Public\Pictures\Sample Pictures\*
  • c:\Python27\tcl\tcl8.5\msgs\*
  • c:\6cdeacda242012e0e5b593e657\1041\*
  • c:\Users\Default\Downloads\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\ssl_match_hostname\*
  • c:\Users\Harry Dresden\Links\*
  • \\SHARDREALM\Users\Harry Dresden\Favorites\Links for United States\*
  • c:\Python27\DLLs\*
  • \\SHARDREALM\Users\Default\Documents\*
  • c:\ProgramData\Microsoft\User Account Pictures\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\contrib\*
  • c:\Python27\tcl\tcl8.5\tzdata\Asia\*
  • c:\Users\Harry Dresden\Downloads\*
  • c:\Python27\tcl\tcl8.5\opt0.4\*
  • c:\ProgramData\Mozilla\*
  • c:\Users\Public\Videos\*
  • c:\Python27\tcl\tcl8\8.4\*
  • c:\6cdeacda242012e0e5b593e657\1055\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\70\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\*
  • c:\Python27\Tools\versioncheck\*
  • c:\Python27\tcl\reg1.2\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\F7\*
  • c:\Python27\Lib\xml\dom\*
  • c:\Python27\Lib\lib2to3\tests\data\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\*
  • c:\Python27\tcl\tcl8.5\encoding\*
  • c:\yvqjybpr\lib\api\*
  • c:\ProgramData\McAfee\*
  • c:\ProgramData\Microsoft\Diagnosis\AsimovUploader\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\*
  • c:\ProgramData\Microsoft\User Account Pictures\Default Pictures\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\images\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\47\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\*
  • \\SHARDREALM\Users\Public\Documents\*
  • c:\Python27\Lib\xml\parsers\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\*
  • c:\6cdeacda242012e0e5b593e657\1038\*
  • c:\Python27\tcl\tix8.4.3\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\trie\*
  • c:\Python27\tcl\tcl8.5\tzdata\Canada\*
  • c:\ProgramData\NovaTech Network\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\*
  • c:\Python27\tcl\tcl8\*
  • c:\6cdeacda242012e0e5b593e657\1053\*
  • c:\Users\Default\Music\*
  • c:\Python27\Lib\test\decimaltestdata\*
  • c:\Python27\Lib\test\xmltestdata\*
  • c:\yvqjybpr\lib\*
  • \\SHARDREALM\Users\Public\Desktop\*
  • c:\ProgramData\Passmark\PerformanceTest\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\*
  • \\SHARDREALM\Users\Harry Dresden\OneDrive\*
  • c:\ProgramData\Adobe\ARM\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\*
  • \\SHARDREALM\Users\Harry Dresden\Documents\*
  • c:\6cdeacda242012e0e5b593e657\2052\*
  • c:\Python27\Lib\logging\*
  • c:\ProgramData\Microsoft\eHome\*
  • c:\Users\Public\*
  • c:\6cdeacda242012e0e5b593e657\1043\*
  • c:\Python27\Lib\site-packages\*
  • c:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\*
  • c:\ProgramData\Microsoft\Diagnosis\UIF\*
  • c:\Users\Harry Dresden\Searches\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\advertisement\*
  • c:\Python27\tcl\tk8.5\*
  • \\SHARDREALM\Users\Public\*
  • c:\Python27\Lib\xml\sax\*
  • c:\ProgramData\Microsoft\Device Stage\Device\*
  • c:\ProgramData\Microsoft\Vault\*
  • c:\Users\Default\Links\*
  • c:\Python27\Lib\json\tests\*
  • c:\Python27\libs\*
  • c:\6cdeacda242012e0e5b593e657\1028\*
  • c:\Python27\Lib\lib-tk\test\test_tkinter\*
  • c:\ProgramData\Microsoft OneDrive\*
  • c:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\*
  • c:\Python27\Lib\ctypes\*
  • c:\Users\Public\Recorded TV\Sample Media\*
  • \\SHARDREALM\Users\Harry Dresden\Downloads\*
  • c:\Python27\*
  • c:\ProgramData\Microsoft\Crypto\DSS\*
  • c:\yvqjybpr\bin\*
  • c:\ProgramData\Microsoft\Diagnosis\Sideload\*
  • c:\Python27\Lib\email\*
  • c:\ProgramData\Microsoft\Search\Data\*
  • c:\Users\Harry Dresden\Documents\*
  • c:\ProgramData\Adobe\Setup\*
  • c:\Python27\Lib\distutils\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\*
  • c:\ProgramData\Microsoft\Device Stage\Task\*
  • c:\Users\*
  • \\SHARDREALM\Users\Public\Favorites\*
  • c:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\tpl\*
  • c:\Python27\Lib\sqlite3\*
  • c:\ProgramData\Sun\Java\*
  • c:\ProgramData\Microsoft\NetFramework\*
  • c:\ProgramData\Microsoft\Crypto\Keys\*
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\*
  • c:\Python27\Lib\bsddb\test\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\{98101498-C465-4F51-8751-D1919E97D29D}\*
  • c:\ProgramData\NovaTech Network\NovaBench\3.0.2.0\*
  • \\SHARDREALM\Users\ruiner\*
  • c:\Recovery\*
  • c:\Users\Public\Foxit Software\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\A6\*
  • c:\inetpub\history\CFGHISTORY_0000000002\*
  • c:\Python27\Lib\site-packages\pip\req\*
  • c:\Users\Harry Dresden\Videos\*
  • \\SHARDREALM\Users\Default\Downloads\*
  • c:\inetpub\wwwroot\aspnet_client\system_web\*
  • c:\Python27\tcl\tcl8.5\tzdata\Australia\*
  • c:\Users\Harry Dresden\Pictures\*
  • c:\ProgramData\Microsoft\DeviceSync\*
  • c:\ProgramData\WebEx\WebEx\12_1324\*
  • c:\ProgramData\Microsoft\Office\Heartbeat\*
  • c:\Python27\Lib\lib2to3\tests\data\fixers\myfixes\*
  • c:\Python27\Tools\Scripts\*
  • c:\Python27\Lib\hotshot\*
  • \\SHARDREALM\Users\Public\Videos\*
  • c:\ProgramData\Microsoft\*
  • c:\ProgramData\Microsoft\PlayReady\*
  • c:\Python27\Lib\site-packages\pip\utils\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\*
  • c:\Python27\tcl\tcl8.5\tzdata\Brazil\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\*
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\packaging\*
  • c:\Python27\Lib\lib2to3\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Argentina\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\E0\*
  • c:\ProgramData\Microsoft\WwanSvc\Profiles\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\*
  • c:\Python27\Lib\test\subprocessdata\*
  • c:\yvqjybpr\modules\packages\*
  • c:\yvqjybpr\lib\core\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Quick\*
  • c:\Python27\Lib\site-packages\pip-7.0.1.dist-info\*
  • c:\Python27\Lib\site-packages\pip\_vendor\progress\*
  • c:\Users\Public\Foxit Software\Foxit Reader\*
  • c:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode\*
  • c:\ProgramData\Microsoft\Windows NT\MSFax\Inbox\*
  • c:\Python27\Lib\xml\*
  • c:\ProgramData\Microsoft\Search\*
  • c:\ProgramData\Microsoft\IlsCache\*
  • c:\Python27\tcl\tk8.5\images\*
  • e:\*
  • c:\Python27\Lib\sqlite3\test\*
  • c:\ProgramData\McAfee\MCLOGS\*
  • c:\Python27\Lib\ensurepip\*
  • c:\Python27\Lib\idlelib\Icons\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\*
  • c:\Python27\Lib\test\imghdrdata\*
  • c:\ProgramData\Microsoft\ClickToRun\ProductReleases\9E1D94D2-471F-4DC3-9EBD-E31E1E099E00\en-us.16\*
  • c:\ProgramData\Microsoft\Diagnosis\*
  • c:\6cdeacda242012e0e5b593e657\*
  • \\SHARDREALM\Users\Default\Saved Games\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\*
  • c:\Python27\Lib\site-packages\pkg_resources\_vendor\*
  • c:\6cdeacda242012e0e5b593e657\1030\*
  • \\SHARDREALM\Users\Default\Videos\*
  • c:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\*
  • \\SHARDREALM\Users\Public\Downloads\*
  • c:\ProgramData\Microsoft\RAC\PublishedData\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\*
  • c:\Python27\Lib\multiprocessing\dummy\*
  • c:\Python27\Lib\email\mime\*
  • c:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\*
  • c:\Python27\tcl\tix8.4.3\demos\bitmaps\*
  • c:\Users\Public\Documents\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\35\*
  • c:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\*
  • c:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\*
  • c:\Python27\Lib\lib-tk\*
  • c:\Users\Harry Dresden\Favorites\*
  • c:\Python27\Doc\*
  • c:\Python27\Lib\curses\*
  • c:\Python27\Lib\lib2to3\pgen2\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\1A\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\A5\*
  • c:\ProgramData\Adobe\Acrobat\*
  • c:\Python27\Lib\*
  • c:\inetpub\history\CFGHISTORY_0000000004\schema\*
  • c:\Python27\tcl\tix8.4.3\demos\*
  • \\SHARDREALM\Users\Public\Pictures\Sample Pictures\*
  • c:\6cdeacda242012e0e5b593e657\1042\*
  • c:\Python27\Lib\test\audiodata\*
  • c:\inetpub\history\CFGHISTORY_0000000004\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\*
  • c:\Python27\tcl\tcl8.5\tzdata\*
  • c:\Python27\Lib\site-packages\pip\_vendor\_markerlib\*
  • c:\Python27\tcl\tcl8\8.4\platform\*
  • c:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\*
  • \\SHARDREALM\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\css\*
  • c:\Python27\Lib\site-packages\pip\vcs\*
  • c:\6cdeacda242012e0e5b593e657\1046\*
  • c:\Users\Public\Foxit Software\Foxit Reader\StartPage\start\en_us\Default\*
  • c:\Python27\tcl\tix8.4.3\pref\*
  • c:\Python27\Lib\site-packages\pip\compat\*
  • c:\yvqjybpr\modules\*
  • \\SHARDREALM\Users\Public\Pictures\*
  • c:\Python27\Lib\json\*
  • c:\Python27\Lib\lib2to3\fixes\*
  • c:\ProgramData\Microsoft\Windows Defender\LocalCopy\*
  • c:\ProgramData\Microsoft\Assistance\Client\*
  • c:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\*
  • \\SHARDREALM\Users\Default\*
  • c:\Python27\Lib\test\leakers\*
  • \\SHARDREALM\Users\Harry Dresden\Saved Games\*
  • c:\ProgramData\Microsoft\Media Player\*
  • c:\ProgramData\McAfee\MCLOGS\Common\jxpiinstall\*
  • c:\Python27\Lib\site-packages\pip\_vendor\html5lib\filters\*
  • c:\Python27\Tools\*
  • c:\6cdeacda242012e0e5b593e657\1044\*
  • c:\6cdeacda242012e0e5b593e657\1036\*
  • c:\inetpub\history\*
  • c:\6cdeacda242012e0e5b593e657\1032\*
  • c:\Python27\tcl\tcl8.5\tzdata\Chile\*
  • c:\Python27\Lib\site-packages\pip\_vendor\packaging\*
  • \\SHARDREALM\Users\Public\Recorded TV\*
  • c:\ProgramData\Microsoft\Windows NT\MSScan\*
  • c:\Python27\Lib\email\test\data\*
  • c:\Python27\tcl\tix8.4.3\bitmaps\*
  • c:\Python27\Lib\site-packages\pip\_vendor\colorama\*
  • c:\Python27\Lib\lib2to3\tests\*
  • c:\ProgramData\regid.1991-06.com.microsoft\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F7\*
  • c:\ProgramData\Microsoft OneDrive\setup\*
  • c:\inetpub\history\CFGHISTORY_0000000005\schema\*
  • c:\Python27\Lib\site-packages\pip\_vendor\cachecontrol\caches\*
  • c:\Python27\Lib\distutils\command\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\*
  • c:\Python27\tcl\*
  • c:\Python27\Lib\site-packages\pip\commands\*
  • c:\Python27\Lib\site-packages\pkg_resources\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\F3\*
  • c:\Python27\Lib\multiprocessing\*
  • c:\Python27\Lib\wsgiref\*
  • c:\6cdeacda242012e0e5b593e657\3082\*
  • c:\Users\Public\Favorites\*
  • c:\Python27\Lib\lib-tk\test\*
  • c:\Python27\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util\*
  • c:\ProgramData\Microsoft\RAC\StateData\*
  • c:\Python27\tcl\tcl8.5\tzdata\America\Indiana\*
  • c:\Python27\Lib\site-packages\_markerlib\*
  • c:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\DD\*
  • c:\Python27\Lib\idlelib\idle_test\*
  • c:\ProgramData\Adobe\ARM\Reader_11.0.10\*
  • c:\inetpub\custerr\en-US\*
  • c:\ProgramData\Microsoft\Windows Defender\Definition Updates\*
  • c:\6cdeacda242012e0e5b593e657\1040\*
Registry Key-Opened
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\http\
  • HKEY_CURRENT_USER\Software
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610
  • HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CLASSES_ROOT\.js
  • HKEY_LOCAL_MACHINE\Software\Policies
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Pre Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\0a-00-27-00-00-00
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_CERT_WARNINGS_ON_POST_FROM_ISTREAM_KB2894776
  • HKEY_CURRENT_USER\SOFTWARE\Classes\PROTOCOLS\Filter\text/html
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001
  • HKEY_LOCAL_MACHINE\Software
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Pre Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\*\
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_URLMON_IQDA_SIZE
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent
  • HKEY_CURRENT_USER\Software\Policies
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\KindMap
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_URLMON_IQDA_SIZE
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00
  • HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_LOCAL_MACHINE\System\Setup
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
  • HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION
  • HKEY_CLASSES_ROOT\JSFile\ScriptEngine
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\UrlMon Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SHOW_CERT_WARNINGS_ON_POST_FROM_ISTREAM_KB2894776
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\control\NetworkProvider\HwOrder
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPNP\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\VssapiPublisher
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MiniNT
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Safeboot\Option
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\NetworkProvider
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider
  • HKEY_CURRENT_USER\Network\E
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions
  • HKEY_LOCAL_MACHINE\system\CurrentControlSet\Control\NetworkProvider\Notifyees
  • HKEY_CURRENT_USER\Network
  • HKEY_PERFORMANCE_DATA\(Default)
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LDAP
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
  • HKEY_LOCAL_MACHINE\system\CurrentControlSet
Registry Key-Deleted
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDetectedUrl
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDetectedUrl
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
Registry Key-Read
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ReceiveTimeOut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\InheritConsoleHandles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\wscript.exe
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Platform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\NoFileFolderJunction
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cer\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InitFolderHandler
  • HKEY_CURRENT_USER\Directory\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PreCreate
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc2740-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\IgnoreUserSettings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\wscript.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\AdminTabProcs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InfoTip
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DevicePath
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ADODB.Stream\CLSID\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\*
  • HKEY_CURRENT_USER\Directory\NeverShowExt
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\LogFileName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.js\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chm\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\MapNetDriveVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\Timeout
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivKeyCachePurgeIntervalSeconds
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\TabProcGrowth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDhcp
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParsingName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SendTimeOut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\Environment\PROCESSOR_ARCHITECTURE
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SourcePath
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1806
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273c-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsParseDisplayName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\InprocServer32
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\SessionMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bat\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\FolderTypeID
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\DisplayLogo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.crt\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32\(Default)
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableUTF8
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\COM+Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.com\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForInfoTip
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FrameTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\ProgID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\*
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Srp\GP\RuleCount
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HasNavigationEnum
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1A10
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Description
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Roamable
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PreCreate
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\PolicyScope
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273d-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\Safety Warning Level
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ade\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation\AllowedReservedCharacters
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\SessionMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORPARSING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\BrowseInPlace
  • HKEY_CURRENT_USER\Directory\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForOverlay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\UseDropHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsAliasedNotifications
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugHeapFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FrameTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\DefaultLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JScript\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSXML2.XMLHTTP\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideOnDesktopPerUser
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SendTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WScript.Shell\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bas\(Default)
  • HKEY_CURRENT_USER\Directory\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Name
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\wscript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORDISPLAY
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Image Path
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Platform
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\TabProcGrowth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\DelegateExecute
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\PinToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\Levels
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpl\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273d-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\InheritConsoleHandles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\UseWINSAFER
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivKeyCacheMaxItems
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\DocObject
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ReceiveTimeOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Security
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\SaferFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResource
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\AdminTabProcs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\TrustPolicy
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Compatible
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\DA0C75D6
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsUniversalDelegate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.adp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\command
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\NoWorkingDirectory
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\ScriptEngine\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecision
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cmd\(Default)
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1806
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\LogSecuritySuccesses
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc2740-d442-11e0-8ee6-806e6f6e6963}\Generation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
  • HKEY_CURRENT_USER\Directory\IsShortcut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\PrivateKeyLifetimeSeconds
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\*
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideInWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FrameMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\DisplayLogo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\Timeout
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Compatible
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win64\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b9fc273c-d442-11e0-8ee6-806e6f6e6963}\Data
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FrameMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\SetWorkingDirectoryFromTarget
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDns
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionTime
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideFolderVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Flags
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadExpirationDays
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\NeverShowExt
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDetectedUrl
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\MaxRpcSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseHostnameAsAlias
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\LdapClientIntegrity
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\OOBEInProgress
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseOldHostResolutionOrder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder\ProviderOrder
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\ComputerName
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions\ProductType
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxSF\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\NetworkProvider\Class
Registry Key-Written
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionReason
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecision
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadDecisionTime
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F058833-0652-4B15-B7EA-02DD7798ACE8}\WpadNetworkName
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
Mutex-Accessed
  • Local\ZonesCacheCounterMutex
  • Local\ZonesLockedCacheCounterMutex

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 456, Parent PID: 352

"C:\Windows\System32\wscript.exe" C:\Users\HARRYD~1\AppData\Local\Temp\NRV_548P069I_.js PID: 5000, Parent PID: 2944

"C:\Windows\SysWOW64\rundll32.exe" C:\Users\HARRYD~1\AppData\Local\Temp\YESABS~1.DLL,boobs PID: 4936, Parent PID: 5000

Volatility

Nothing to display.